Network data detection method and device, computer equipment and storage medium

Abstract

The embodiment of the invention provides a network data detection method and device, computer equipment and a storage medium, and the method comprises the steps: obtaining a tunnel request segment, obtaining at least two character strings contained in the tunnel request segment, and generating a character distribution matrix corresponding to the at least two character strings, wherein the character distribution matrix comprises elements corresponding to characters in the at least two character strings respectively, the elements comprise character distribution frequencies, and the character distribution frequencies are determined based on distribution positions of the characters in the at least two character strings; calculating abnormal request evaluation values respectively correspondingto at least two to-be-detected sub-matrixes in the character distribution matrix according to the character distribution frequencies, and selecting an abnormal request evaluation value meeting a numerical threshold value from the at least two abnormal request evaluation values as a target abnormal request evaluation value; and generating evaluation reference information for evaluating the abnormaltrend of the tunnel request segment according to the target abnormal request evaluation value. By adopting the embodiment of the invention, the accuracy of network data detection can be improved.

Description

technical field [0001] The present application relates to the technical field of the Internet, and in particular to a network data detection method, device, computer equipment and storage medium. Background technique [0002] The domain name system (Domain Name System, DNS) protocol is one of the essential network communication protocols, which can convert domain names and IP (interconnection protocol between networks) addresses. Most firewalls and intrusion detection devices basically do not filter, analyze or shield DNS, so encapsulating data in the DNS protocol for transmission is a covert means, that is, DNS tunnel refers to a covert channel established by using the DNS query process for data transfer. [0003] In the prior art, the DNS tunnel can be detected by counting the length of the domain name requested to be accessed and the frequency of the domain name requested to be accessed. It is determined that the client uses tunnel detection technology, but an attacker ...

AI Technical Summary

Problems solved by technology

[0003] In the prior art, the DNS tunnel can be detected by counting the length of the domain name requested to be accessed and the frequency of the domain name requested to be accessed. It is determined that the client uses tunnel detection technology. However, an attacker can easily bypass DNS tunnel detection by modifying domain name length, request frequency, etc., resulting in low accuracy of DNS tunnel detection.

Images