Breach host detection method, device and equipment and readable storage medium

Abstract

The invention discloses a breach host detection method, device and equipment and a readable storage medium. The method disclosed by the invention comprises the following steps: acquiring target information in network equipment, wherein the target information is a combination of at least two of process information, communication information, file information and login information; judging whether the target information is abnormal or not; and if yes, determining an abnormal behavior index of the network equipment according to the abnormal information, and if the abnormal behavior index is not smaller than a preset threshold, determining the network equipment as a breach host. The abnormal behavior index of the network equipment is analyzed based on the multi-dimensional information, the comprehensiveness and accuracy of the detection result are improved, the network equipment can be detected before becoming a breach host, occurrence of network security events on a larger scale can be avoided, and network security and reliability can be achieved. Correspondingly, the breach host detection device and equipment and the readable storage medium disclosed by the invention also have the above technical effects.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a method, device, equipment and readable storage medium for detecting a compromised host. Background technique [0002] A compromised host refers to a host in the intranet that has been successfully invaded by an attacker and controlled remotely or has malicious behavior. With the development of advanced viruses, it is often difficult to find rules and strong concealment for the compromised hosts to be controlled or initiate malicious behaviors, so that some compromised hosts are difficult to be perceived. [0003] Existing technologies usually determine the compromised host based on known viruses or known malicious traffic, and the entire process only analyzes the single-dimensional data of the compromised host, which is somewhat one-sided, and there are omissions and misreporting events, so the accuracy of the detection results If it is low, it may also lose...

AI Technical Summary

Problems solved by technology

With the development of advanced viruses, it is often difficult to find rules and strong concealment for the compromised hosts to be controlled or initiate malicious behaviors, so that some compromised hosts are difficult to be perceived

[0003] The existing technology usually determines the compromised host based on known viruses or known malicious traffic, and the entire process only analyzes the single-dimensional data of the compromised host, which is somewhat one-sided, and there are missed and false positives, so the accuracy of the detection results low, may also lose the opportunity to detect and solve problems in advance, leading to larger-scale network security incidents

Images