Network attack detection method and device based on log analysis

Abstract

The invention provides a network attack detection method and device based on log analysis, and relates to the technical field of network information security. The method comprises the following steps:reading a server log file, obtaining a network address, a server port number, an application type and a fault type of a host corresponding to a to-be-detected log, and judging a format type adopted by the server log according to header format information of the server log file; performing matching with a preset scene type according to the format type adopted by the server log, and the network address, the server port number, the application type and the fault type of the to-be-detected hot to determine a scanning scene corresponding to the to-be-detected log; selecting a scanning strategy uniquely corresponding to the scanning scene from a preset strategy library; scanning the to-be-detected log according to the scanning strategy to generate a log security scanning result; and outputtingthe log security scanning result, the scanning scene and the scanning strategy according to a preset file format.

Description

technical field [0001] The invention relates to the technical field of network information security, in particular to a log analysis-based network attack detection method and device. Background technique [0002] At present, with the continuous development of network information technology, network servers, etc. are also facing various types of attacks. In order to ensure the security of a network server, etc., it is generally necessary to perform network attack detection. For example, network attack detection for web servers can be mainly divided into pre-detection and post-event detection. Pre-detection is to identify network access behaviors with malicious behavior characteristics through preset security policies, so as to realize early warning of network intrusion behaviors. and blocking. Pre-testing mainly includes software testing and hardware testing, among which software testing mainly includes various terminal security defense software, special anti-virus software...

AI Technical Summary

Problems solved by technology

Due to the uniqueness of the power information network security design, it is not allowed to change the current network structure during the detection process, so it is impossible to scan with hardware-connected network security devices

In addition, due to the relatively fixed network structure and externally provided service types, the environment for security detection of a single server in the power information network is relatively single

Images