Method and system for network attack surface detection

Abstract

The present invention provides a network attack surface detection method and system, which can first perform static analysis based on historical network data to find abnormal data segments, and then construct a noise simulation network attack model based on the vectorized abnormal data segments, using real network attack traffic The noise simulation network attack model is trained, and the model itself has the ability to continuously compound and mutate network attacks. After the noise simulation network attack model is trained, it is connected to the machine learning module as the simulated attack source of the machine learning module. The network traffic is detected on the network attack surface to help improve the detection capability of the machine learning module.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a network attack surface detection method and system. Background technique [0002] Nowadays, many attacks come from hidden and fragmented forms. The vulnerability points and attack links of a single network node will constitute multiple attack surfaces, and the existing methods of preventing network attacks may fail. [0003] At the same time, there are still two deficiencies in the existing statistical analysis and machine learning: First, the attack data is insufficient during the training process, which is far less than the normal data. Insufficient and unbalanced data will cause the detection model to be unbalanced, and the attack data cannot be detected correctly Or behavior; second, with the development of technology, the attack methods of attackers are constantly changing. However, these attack data will not be disclosed in advance, and they cannot be u...

AI Technical Summary

Problems solved by technology

[0002] Many attacks now come from hidden and fragmented forms. The vulnerability points and attack links of a single network node will constitute multiple attack surfaces, and the existing methods of preventing network attacks may fail

[0003] At the same time, there are still two deficiencies in the existing statistical analysis and machine learning: First, the attack data is insufficient during the training process, which is far less than the normal data. Insufficient and unbalanced data will cause the detection model to be unbalanced, and the attack data cannot be detected correctly Or behavior; second, with the development of technology, the attacker's attack methods are constantly changing. However, these attack data will not be disclosed in advance, and they cannot be used for model training, resulting in the model being unable to detect unknown attack data.

Images