Network attack processing method and device, computer equipment and storage medium

Abstract

The invention discloses a network attack processing method and device, computer equipment and a storage medium, and belongs to the technical field of computers. According to the method, a first virtual machine and a second virtual machine are operated, and when it is detected that the first terminal performs network attack on the virtual service system operated in the first virtual machine, the second virtual machine establishes connection with the first terminal so as to control the first terminal subsequently; the method comprises the following steps: acquiring network attack behavior data of a first terminal through a first virtual machine and a second virtual machine, and determining the target danger level of the network attack and a target data acquisition category corresponding to the target danger level based on the network attack behavior data; and actively obtaining the data corresponding to the target data acquisition category from the first terminal by applying the connection established between the second virtual machine and the first terminal, so that the information of the intruder is comprehensively and accurately acquired, the network attack can be defended and counterattack based on the information, and the network security maintenance is facilitated.

Description

technical field [0001] The present application relates to the field of computer technology, in particular to a network attack processing method, device, computer equipment and storage medium. Background technique [0002] Various network services are key services for social operations and business operations, and the systems behind them carry a large amount of key business and sensitive data. These key services and data are often coveted by various intruders, and attacks emerge in endlessly. Cyber ​​attacks will lead to the leakage of sensitive information and the destruction of key businesses, which in turn will affect social operations and business operations. [0003] At present, when dealing with network attacks, honeypot technology can be used to simulate the business logic of real applications, that is, a virtual business system can be simulated, and false information can be set in this virtual business system to trick intruders into initiating network attacks on the ...

AI Technical Summary

Problems solved by technology

However, in this process, only some data actively provided by the intruder can be obtained, such as the intruder’s network address, intrusion method, and software used during the intrusion, etc., which are easily modified by the intruder

Images