Collapsed host computer detection method

Abstract

The invention discloses a collapsed host computer detection method. The method comprises: a log upload step: boundary security probe equipment uploads log data including an application access log, a URL access log, a file transmission log and a threat log generated by the traffic between security domains to a security cloud early warning platform; a data extraction step: the security cloud early warning platform aggregates log data reported by the boundary security probe equipment to a cloud big data analysis engine, the cloud big data analysis engine mines the abnormal behaviors of a user whose host deviates from a normal baseline in a network, generates abnormal behavior data, and aggregates the threat log into threat information; and a data matching steps: the security cloud early warning platform performs matching collision on the threat information and the abnormal behaviors of the user whose host deviates from the normal baseline in the network through the cloud big data analysisengine, and predicts a suspected collapsed host computer.

Description

technical field [0001] The invention relates to a method for detecting a lost host in the field of network security. Background technique [0002] In the past, most attackers tended to have an "opportunistic" mentality when choosing attack targets, and would extensively scan targets with known vulnerabilities for infiltration in the form of "blossom everywhere". Theoretically speaking, if the protection strength of an enterprise exceeds the average level, it can obtain relative security. Systems with weak protection measures are often discovered and compromised by attackers before they are. [0003] Therefore, traditional network security focuses on "prevention", always follows the P2DR strategy, and establishes a protection-detection-response model, that is, first conducts a comprehensive assessment of the risks of the information system, and then formulates corresponding protection strategies, including: at key risk points Deploy access control devices, such as firewalls,...

AI Technical Summary

Problems solved by technology

Utilizing the 0-day vulnerability of the system, it is impossible to prevent in advance, the target is clear, and the targeted attack will cause huge and irreparable losses.

Images