A method and device for detecting network attacks based on threat intelligence

Abstract

The present application provides a method and device for detecting network attacks based on threat intelligence. In the method, the threat intelligence collision library is a collection of first mapping results calculated by the first mapping algorithm for threat intelligence keyword information. Compared with the existing Technically speaking, when a network security device detects whether network traffic is threatening traffic, it first matches the information to be detected in the network traffic with the threat intelligence collision library, and after determining that the network traffic corresponding to the information to be detected is the threat traffic generated by a network attack , upload the information to be detected to the cloud, and the cloud will query the details of threats corresponding to the information to be detected. The information to be detected is matched with the threat intelligence collision library, that is, it is judged whether the information to be detected matches the first mapping result. Since the keyword information of the threat intelligence is calculated by the first mapping algorithm, the first mapping result is relatively small in size. Compared with the prior art, the matching pressure of network security equipment is reduced.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a method and device for detecting network attacks based on threat intelligence. Background technique [0002] With the increasing complexity and diversification of network attacks, the security of traditional network security devices (such as firewalls, intrusion prevention systems, and anti-virus software, etc.) is constantly being challenged. In order to achieve the purpose of the attack, attackers of network attacks will constantly change the existing network attack methods, while traditional network security devices may not be able to detect the ever-changing network attacks through the detection methods of malicious program signatures or attack technical reports. [0003] In order to detect ever-changing network attacks, existing technologies provide a method for detecting network attacks using threat intelligence. In this method, the cloud collects a larg...

AI Technical Summary

Problems solved by technology

[0005] This application provides a method and device for detecting network attacks based on threat intelligence to solve the problem of excessive consumption of network security equipment performance caused by the large amount of data in the offline threat intelligence database in the existing detection methods

Images