Abnormal access behavior detection method and system, storage medium and terminal

Abstract

The invention provides an abnormal access behavior detection method. The method comprises the steps of recording an access relationship set of access behaviors of a terminal; inputting the access behavior characteristics of the access relationship set into an access detection model,wherein the access detection model is a model obtained by training access behavior characteristics in historical access data of the terminal; and determining whether the access behavior in the access relationship set is an abnormal access behavior or not according to an output result of the access detection model. The potential safety hazard of the terminal can be greatly improved, and the safety performance of the terminal is improved. The invention further provides an abnormal access behavior detection system,a computer readable storage medium and a terminal, which have the above beneficial effects.

Description

technical field [0001] The present application relates to the field of network security, in particular to a method for detecting abnormal access behavior, a detection system, a computer-readable storage medium and a terminal. Background technique [0002] At present, malicious attackers often need to first obtain a certain terminal in the intranet during the actual penetration test and intrusion process, and use this as a springboard to infiltrate the intranet. Since many security devices are often deployed on the intranet, sensitive behaviors are easily discovered by security devices. Experienced malicious attackers often use some hidden methods to carry out horizontal attacks on the intranet, using some unconventional attack methods, avoiding Killing tools or even unpublished 0day attacks can be used to steal sensitive information, obtain higher privileges, install backdoor Trojan horses, or perform intranet roaming and other operations. At present, the industry generally...

AI Technical Summary

Problems solved by technology

At present, the industry generally uses intrusion detection equipment for intranet security detection, but intranet detection is generally based on traditional security detection rules, and unknown threats such as 0day and anti-virus tools may be bypassed

Secondly, traditional security detection can only detect some network attacks. Malicious attackers often use some normal business traffic to steal data or forge normal access methods when infiltrating the intranet, resulting in the failure of security devices to detect

Images