Internet hosting website detection method and system based on network access behavior analysis and readable storage medium

Abstract

The invention discloses an Internet hosting website detection method and system based on network access behavior analysis and a readable storage medium. According to the method, Internet access behavior characteristics in network traffic are extracted regularly, the probability that each accessed Internet website is an enterprise trusteeship website is calculated by utilizing the extracted characteristics, and website trusteeship detection is realized so as to assist enterprise security technicians in judgment. According to the scheme, the general network topology characteristics of enterprises are deeply combined, the access behavior characteristics of the Internet hosting website are analyzed based on the network traffic, the method does not depend on an enterprise keyword library, keyword matching does not need to be carried out on the load of the network traffic packet, and the operation efficiency and accuracy are high.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method, system and readable storage medium for detecting an Internet hosting website based on network access behavior analysis. Background technique [0002] The enterprise's information system stores sensitive data of the enterprise. If the enterprise information system is deployed on the Internet server, it will not be supervised and protected by the enterprise's network security, and it will be easily attacked by hackers, leading to information leakage or even data tampering. Large enterprises with server equipment and independent operation and maintenance capabilities usually prohibit the Internet hosting of information systems. [0003] At present, the enterprise's monitoring technology for Internet hosting websites is relatively simple, mainly relying on crawling and analyzing data from the Internet. The accuracy of this method largely depends on whether the crawled netwo...

AI Technical Summary

Problems solved by technology

[0003] At present, the enterprise's monitoring technology for Internet hosting websites is relatively simple, mainly relying on crawling data from the Internet and analyzing them

The accuracy of this method largely depends on whether the crawled network data source is rich, and the richer the network data source means the more massive data, the more massive data, the larger the scale of the web crawler cluster and the Network bandwidth is used for data analysis, which is too costly and cost-effective for enterprises

In addition, crawler data analysis mainly relies on text analysis techniques such as keyword matching, and it is difficult to accurately customize the website keyword feature library for enterprises. For example, the hosting website of the State Grid Corporation may not contain keywords such as "electric power" and "grid" in order to conceal itself.

Images