Malformed data packet detection method and device

Abstract

The embodiment of the invention provides a malformed data packet detection method and device. According to the malformed data packet detection method, protocol analysis detection, protocol specification constraint detection and field specification constraint detection based on historical legal flow data are carried out on a network data packet; therefore, the problem of low hit efficiency of the specific data packet based on the blacklist can be effectively avoided, so that the detection efficiency of the malformed data packet is improved. What needs to be explained is that when the malformeddata packet is detected, the protocol specification constraint is used for detecting the malformed data packet, and the historical legal flow data of the target network is fully used for carrying outfield specification constraint detection on the malformed data packet, so that the detection efficiency and the detection accuracy of the malformed data packet can be effectively improved. The malformed data packet detection method provided by the embodiment of the invention is especially suitable for an industrial control network with network data packets having strong content periodicity and obvious characteristics.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method and device for detecting malformed data packets. Background technique [0002] With the rapid development of information technology, industrial control network is facing more and more risks. For example, in the industrial control network environment (mainly referring to the operating environment), malformed traffic generated based on Fuzz technology will have unpredictable and serious consequences on industrial control equipment, such as loss of important data, work in an unexpected way, or even cause downtime. Because there is no specific rule for such malformed data packets, the effect of traditional blacklist-based IPS / IDS methods in detecting malformed data packets is poor. [0003] In view of this, how to detect anomalies in the network has become a technical problem that needs to be solved urgently. Contents of the invention [0004] In view of the problems i...

AI Technical Summary

Problems solved by technology

For example, in the industrial control network environment (mainly referring to the operating environment), the malformed traffic generated based on Fuzz technology will have unpredictable and serious consequences on industrial control equipment, such as loss of important data, work in an unexpected way, and even cause downtime

Because there is no specific rule for such malformed data packets, the traditional blacklist-based IPS / IDS method is less effective in detecting malformed data packets.

Images