Malicious traffic detection method, system and apparatus, and computer readable storage medium

Abstract

The invention discloses a malicious traffic detection method. The method comprises the following steps: correspondingly establishing malicious and normal data sample libraries by using obtained malicious and normal data traffic samples; executing a data cleaning operation and a preprocessing operation on the data sample libraries in sequence to obtain training data, and constructing a traffic detection model by using the training data and a deep learning algorithm; judging whether to-be-measured data traffic contains malicious data by using the traffic detection model; and if so, sending alarminformation carrying the to-be-measured data traffic belonging to malicious data via a preset oath. Feature learning and training are performed by using the malicious and normal data traffic samplesvia the automatic learning property of the deep learning algorithm, the feature information extraction operation is completed without consuming precious human resources, thereby improving the improving the work efficiency and improving the discrimination of the malicious traffic. Precision. The invention further discloses a malicious traffic detection system and apparatus and a computer readable storage medium, which have the above beneficial effects.

Description

Technical field [0001] This application relates to the technical field of traffic detection, and in particular to a method, system, device and computer-readable storage medium for detecting malicious traffic. Background technique [0002] With the advent of the era of big data, compared to traditional data storage methods, storing it in the form of binary data on a data storage server or the cloud can save costs and effectively improve work efficiency. The question that follows is how to effectively prevent malicious network traffic attacks and data theft in the current network environment. [0003] In the prior art, malicious data traffic is often discriminated through two methods, static feature classification and dynamic signature classification, so as to block malicious traffic from entering itself based on the judgment result. Among them, the method of static feature classification is simply whether it has exactly the same features as the classification standard. It only need...

AI Technical Summary

Problems solved by technology

Among them, the static feature classification method is simply whether it has exactly the same features as the classification standard, and it only needs simple packing or obfuscation to achieve the target effect, which has been gradually eliminated; dynamic signatures use malicious signatures manually extracted by managers. Cluster analysis of traffic characteristics, and aims to use the cluster analysis results to classify the same type of malicious traffic, but due to the heavy reliance on manually extracted features and the low accuracy of cluster analysis, detection and classification The result is very unstable

Images