Intrusion detection method, electronic equipment and computer storage medium

Abstract

The invention provides an intrusion detection method, electronic equipment and a computer storage medium, and belongs to the technical field of computer information security. The intrusion detection method includes the steps that to-be-detected logs are obtained; through a pre-trained intrusion detection model, the to-be-detected logs are subjected to intrusion detection; the intrusion detection model is obtained according to overall characteristics and personal characteristics of log samples. The intrusion detection model is pre-trained according to the overall characteristics and the personal characteristics of the log samples, the to-be-detected logs are subjected to intrusion detection through the intrusion detection model, the false positive rate and the false negative rate when hacker attack detection is carried out can be effectively reduced, and hacker-attack intrusion detection is more accurate.

Description

technical field [0001] The present application relates to the technical field of computer information security, in particular to an intrusion detection method, an electronic device and a computer storage medium. Background technique [0002] Hacking is unauthorized activity accompanied by a malicious attempt to exploit specially crafted code or techniques. Attacks include denial of service, viruses, buffer overflows, malformed requests, malformed network packets, or unauthorized program execution. [0003] Therefore, protecting against malicious intrusion attacks by hackers is very important for website application security and intranet security. [0004] There are two main types of hacker intrusion detection methods: [0005] 1. The host-based intrusion detection system method is to install the detection system on the host to achieve the purpose of detection. HIDS (Host-based Intrusion Detection System, host-based intrusion detection system) is installed as a daemon or m...

AI Technical Summary

Problems solved by technology

The anomaly detection system is good at detecting some peaks that suddenly exceed the standard. If the anomaly detection system knows that your network usually only has 10 session session requests a day, but a thousand session requests suddenly occur, the anomaly detection system is likely to capture suspicious activities.

[0007] Host-based intrusion detection systems can have the ability to monitor hosts and sniff network traffic. This approach is good at monitoring and reporting direct interaction at the application layer, but this approach can only simply track unauthorized file changes, CPU resources occupied Too large for a web server or a large database server to tolerate this consumption

[0008] Anomaly detection systems detect deviations based on normal conditions and work well in static environments, such as on servers that do the same thing every day, or in networks where traffic patterns are consistent throughout the day, so in dynamic systems and networks In , due to the wide range of normal events, false positives may be generated when anomaly detection triggers are in the analysis phase

Images