Network attack processing method, device and electronic equipment

Abstract

The present application proposes a network attack processing method and device, wherein the method includes: obtaining network attack information by monitoring network attacks on the network end; wherein, the network attack information includes the response content of the network end to the network attack, and the response status returns value and the number of times of initiation; determine the attack success probability according to whether the response content is abnormal, the response status return value of the network terminal to the network attack and the number of network attack initiations; determine whether to deal with the network attack according to the attack success probability. Thus, the network attack information is obtained through the monitoring of the network side, and then the attack success probability is determined, and whether the network attack is effective is determined according to the attack success probability, which solves the problem of the high false alarm rate in the prior art when detecting network attacks through network traffic and network logs technical problems, improving the efficiency of network attack reporting.

Description

technical field [0001] The present application relates to the technical field of information security, and in particular to a network attack processing method, device and electronic equipment. Background technique [0002] With the rapid development of Internet technology, Web services have taken up an increasingly large proportion of Internet services, so the damage of network attacks against Web services is also increasing. At present, when using network traffic and system logs to identify some common web vulnerabilities, the identified vulnerability results can be shown to security management personnel, or some alarm mechanisms can be used to remind relevant personnel. [0003] However, the web vulnerability alarm scheme based on network traffic and system logs will generate a large number of false positives, causing security managers to waste a lot of time checking whether these false positives have produced real attack effects or whether such vulnerabilities really exis...

AI Technical Summary

Problems solved by technology

[0005] For this reason, the first purpose of this application is to propose a network attack processing method to solve the technical problem of high false positive rate when detecting network attacks through network traffic and network logs in the prior art

Images