Rebound type network attack detection method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a rebound type network attack detection method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring a network session message in a link initiated and established by a target host; identifying a suspected attack request message from the network session message; and detecting whether an attack feature existsin the suspected attack request message or not. According to the embodiment of the invention, firstly, the network session message in the link initiated and established by the target host is obtained, due to the fact that the link may be a link initiated and established by the target host to the other host of an attacker in response to the request of one host of the attacker, by continuously identifying the suspected attack request message in the network message of the link, and then detecting whether the attack feature exists in the suspected attack request message, the rebound type networkattack can be detected.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of network security, and in particular to a detection method, device, equipment and storage medium of a rebound network attack. Background technique [0002] With the continuous development of computer technology and the popularization of the Internet, there are endless forms of network attacks, network security issues are becoming more and more prominent, causing social impact and economic losses are increasing, and new requirements and challenges are put forward for network threat detection and defense. [0003] Rebound network attack is a dangerous network attack method. Taking rebound shell (shell) attack as an example, the attack method is: the attacker sends a network command to the target host through a host, and the network command does not contain attack instructions. But instruct the target host to send a network request to another host of the attacker, and the other host ...

AI Technical Summary

Problems solved by technology

[0004] The above-mentioned rebound network attack is a one-way traffic, that is, from one host of the attacker to the target host, and then from the target host to another host of the attacker, which is difficult to detect through traditional detection methods

Images