Exception detection method, device and equipment in network security defense

Abstract

The invention discloses an exception detection method in network security defense, which comprises the following steps: after a session connection between a client and a server is established, obtaining a traffic data packet generated by the session connection; calling a preset risk application rule base, and carrying out rule matching on the flow data packet, wherein mode rules of flow data packets corresponding to the risk applications are stored in the risk application rule base; and if the matching succeeds, judging that the session connection is established through the risk application, and pushing the communication activity recorded by the traffic data packet to an administrator, so as to enable the administrator to judge whether the session connection is abnormal or not. According to the invention, based on the supervision of the flow data and the recognition of the risk application, the abnormal condition of the network session established by the risk application can be effectively detected, thereby protecting the host from being invaded by hackers, and the network security is guaranteed. The invention further discloses an exception detection device and equipment in networksecurity defense and a computer readable storage medium, which also have the above beneficial effects.

Description

technical field [0001] The present application relates to the technical field of network security defense, and in particular to an anomaly detection method, device, equipment and computer-readable storage medium in network security defense. Background technique [0002] In recent years, with the development of network communication technology, network security incidents have emerged in an endless stream. [0003] Risk applications, that is, risk software, are some applications that do not contain active dissemination behavior, but can be used by criminals to achieve illegal network intrusion purposes. For example, hackers often use some malicious software such as TeamSpy to implant files of risk software such as teamview in the controlled host they have invaded, so as to use the risk software teamview to open the remote control mode, cover up its C&C communication, and remotely any operation on the control host. Since the risky application itself already exists on the host...

AI Technical Summary

Problems solved by technology

However, due to the lack of effective management and control of such risky applications in the existing network security defense technologies, risky applications have become a cover for hackers' intrusions, and hackers have repeatedly succeeded.

Images