Network traffic analysis method, apparatus, and computer-readable medium

Abstract

It relates to the field of network technologies, and in particular, to a network traffic analysis method, device and computer-readable medium, which are used to effectively determine the correspondence between request messages and response messages in network traffic. In a network traffic analysis method provided by an embodiment of the present invention, at least one first request message and respective first response messages are received; feature information of the protocol structure of each first request message is extracted, and at least one of the response messages is determined. a possible protocol structure and extract feature information; corresponding to the first request message, record the feature information of the protocol structure of the first request message, and each possible protocol structure of the first response message of the first request message characteristic information.

Description

technical field [0001] The present invention relates to the field of network technologies, and in particular, to a method, device and computer-readable medium for analyzing network traffic. Background technique [0002] Today, the problem of network security is becoming more and more prominent. Security solutions such as firewalls, antivirus software, and intrusion detection systems can be used to stop cyberattacks. However, these security solutions can only detect or block some of the known cyber attacks. [0003] Honeypot systems collect information from attackers by imitating vulnerable systems, and record and analyze attackers' attack behaviors. It is helpful to understand the attacker's attack behavior and methods, and then discover the security holes in the unknown network. [0004] In the existing honeypot system, there are physical honeypots and virtual honeypots. Among them, the physical honeypot has high interactivity, but the cost is high; the virtual honeypot...

AI Technical Summary

Problems solved by technology

Among them, the physical honeypot is highly interactive, but the cost is high; the virtual honeypot simulates the real physical honeypot through software, and the cost is low, but because it is created manually, the response mode is relatively fixed, so it is easy to be identified by the attacker , less interactive

Whether it is a physical honeypot or a virtual honeypot, most of them are static, and usually cannot respond dynamically according to changes in request messages, and when new functions need to be added, the honeypot system needs to be redesigned, and the changes are large

Images