Real-time malicious behavior detection method and device

Abstract

The invention provides a real-time malicious behavior detection method and device which are applied to an SDN system, and relates to the technical field of cloud computing. The real-time malicious behavior detection method comprises the steps that a malicious behavior attack feature library in a cloud computing environment is built on the basis of a malicious behavior attack model containing possible attack schemes on a cloud platform; whether or not a malicious behavior exists in a current data flow in a network is detected in real time on the basis of the malicious behavior attack feature library; and if yes, it represents that a network attack exists at present, and the current data flow is intercepted. According to the real-time malicious behavior detection method and device, for solving the problem that an existing malicious behavior detection model cannot effectively deal with the processing efficiency bottleneck brought by the large-scale network traffic and the traffic controldifficulty brought by the network topology complexity, an SDN-based real-time malicious behavior detection model is designed by combining a flexible SDN architecture with a big data processing framework to solve the low detection efficiency problem which exists in research at present and is caused by handling the bottleneck and network traffic control problems.

Description

technical field [0001] The invention relates to the technical field of cloud computing, in particular to a method and device for real-time detection of malicious behavior. Background technique [0002] With the development and maturity of various network technologies, the new service model of cloud computing based on the Internet has achieved unprecedented development. "Computing" has been rated as a cutting-edge technology for several consecutive years, and it is also an important foundation for new technologies such as artificial intelligence in the 2017 technology report. [0003] Under the cloud computing model, advantages such as super computing power and extremely low cost attract a large amount of data to gather in the cloud platform. On the one hand, it brings convenient application, and on the other hand, it also greatly increases the risk of the cloud platform being attacked. Therefore, how to effectively detect malicious behaviors on the cloud platform and carry ...

AI Technical Summary

Problems solved by technology

[0005] Although the traditional intrusion detection system represented by Snort guarantees the security of the cloud platform to a certain extent, this model has a series of problems such as inflexible configuration of network rules. In addition, the rapid expansion of the scale of the cloud platform makes the network topology complex. and the rapid growth of network traffic, but in the traditional intrusion detection system, the filtering device and the routing device are completely separated, so it is difficult to achieve unified and rapid protection

The rapid growth of network traffic under the cloud platform has brought great challenges to the existing intrusion detection system. Therefore, it is urgent to build an intrusion detection system that can effectively deal with large-scale network traffic.

Images