Attack behavior detection method and device, computer equipment and storage medium
A detection method and attack detection technology, applied in the network field, can solve problems such as being unable to cope with large-scale network environment applications, and achieve the effects of reducing labor costs, improving analysis efficiency, and improving accuracy
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0023] figure 1 It is a flowchart of an attack behavior detection method in Embodiment 1 of the present invention. This embodiment is applicable to detecting whether there is an attack behavior in the network, and the method can be executed by the attack behavior detection device provided in the embodiment of the present invention. The device can be implemented in the form of software and / or hardware, and generally can be integrated with computer equipment, specifically, it can be a node in the target network. Such as figure 1 As shown, the method of this embodiment specifically includes:
[0024] S110. Acquire log information of nodes in a target network, and collect continuous log data from the log information, where the target network includes at least one node.
[0025] The target network may consist of at least one node, where a node may be a physical device. If the number of nodes is at least two, each node performs network communication with at least one other node. ...
Embodiment 2
[0054] figure 2 It is a flow chart of an attack behavior detection method in Embodiment 2 of the present invention. This embodiment is embodied on the basis of the above-mentioned embodiments, and the continuous log data matched by each node will be correlated and analyzed according to the preset attack database. , to determine the attack behavior data, embodied as: select the attack means included in the attack database as the target attack means, and determine the detection conditions matching the target attack means; in the continuous log data matched by each node, query Abnormal log data matching the detection condition; if it is determined that the abnormal log data in each of the continuous log data satisfies the detection condition, the detection condition matches the target attack means as the attack behavior data.
[0055] Such as figure 2 As shown, the method of this embodiment specifically includes:
[0056] S210. Acquire log information of nodes in a target net...
Embodiment 3
[0085] image 3 It is a schematic diagram of an attack behavior detection device in Embodiment 3 of the present invention. Embodiment 3 is a corresponding device for implementing the attack behavior detection method provided by the above embodiments of the present invention. The device can be implemented by software and / or hardware, and can generally be integrated with computer equipment.
[0086] Correspondingly, the device of this embodiment may include:
[0087] A log information acquisition module 310, configured to acquire log information of nodes in a target network, and count continuous log data from the log information, where the target network includes at least one node;
[0088] The attack behavior data acquisition module 320 is used to correlate and analyze the continuous log data matched by each node according to the preset attack database, and determine the attack behavior data;
[0089] The attack detection result generation module 330 is configured to generate...
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More