Unknown loophole attack detection method, device, equipment and storage medium

Abstract

The invention provides an unknown loophole attack detection method, device, equipment and storage medium. The method comprises the following steps: performing attack detection on traffic readying to enter a main server; acquiring attack source feature information when detection the attack; and then acquiring attacker traffic in the traffic readying to enter the main server according to the attacksource feature information, and distributing the attacker traffic to a honey pot server; monitoring the honey pot server in real time to acquire abnormal behavior information, wherein the abnormal behavior information is used for comparing with the real-time behavior information when the main server is in operation, thereby performing unknown loophole attack detection. Through the method providedby the invention, the attacker cannot or is hard to sense the existence of the safety protection system, the attack difficulty is greatly increased, the attack successful time is delayed, and the attack from unknown loop on the system can be effectively detected, the attacked system can be effectively detected without artificial participation, and the response time is fast.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method, device, equipment and storage medium for detecting an unknown vulnerability attack. Background technique [0002] With the accelerated pace of global informatization and the in-depth development of information technology, network security is becoming more and more important. It is related to national security and development, and is related to the practical interests of the broad masses of the people. It has a profound impact on politics, economy, culture, society, and military affairs. and other areas of security. [0003] The common feature of traditional security protection technologies is matching detection, which is judged by rules or feature matching, and needs to obtain known attacks or Trojan horse virus samples. For traditional security protection technologies, attacks that exploit unknown vulnerabilities are difficult to match. In addition, traditio...

AI Technical Summary

Problems solved by technology

For traditional security protection technologies, attacks using unknown vulnerabilities are difficult to match

In addition, traditional security protection systems usually block attacks in real time.

[0004] Traditional security protection systems can only protect against known security threats, and cannot identify attacks with unknown attack characteristics, and need to manually develop attack signatures through attack characteristics. The response time is slow, and the attacker will immediately perceive the security protection system after the attack is blocked. The existence of the system, and the security protection system is considered in the follow-up attack actions. In addition, there is no effective defense against the system that has been attacked

Images