Network attack detection method and device

Abstract

The present invention provides a network attack detection method and device, the method comprising: acquiring multiple target access requests belonging to the same session sent by a target terminal to a target server; determining detection feature items, and determining detection features according to multiple target access requests The access feature value of the item; obtain the target detection rule corresponding to the detection feature item; use the target detection rule to judge the access feature value, and obtain the first attack detection result; the first attack detection result is used to indicate whether there is a network for the same session aggressive behavior. The present invention detects and extracts access feature values ​​by taking multiple target access requests of the same session as a group, and the information carried by the extracted access feature values ​​is more comprehensive, so that the accuracy of attack detection is higher.

Description

technical field [0001] The present invention relates to the technical field of network security, more specifically, a network attack detection method and device. Background technique [0002] On the Internet, the process of interaction between a terminal and a server may be attacked by malicious programs such as hackers. In order to ensure the security of network access, an application firewall is usually deployed on the access path between the terminal and the server, and based on the protection rules of the application firewall, attack detection and attack processing are performed on the access process. [0003] At present, there are two main forms of application firewalls: one is to use the hardware server as the main body of the firewall, which is connected to the network topology in the form of an independent device; the other is to use the cloud application firewall to modify the DNS resolution method of access requests Integrate Cloud Application Firewall into networ...

AI Technical Summary

Problems solved by technology

[0004] The access request of the terminal is detected by some form of application firewall above, but the attack detection accuracy of the above application firewall is low

Images