Abnormal network data detection method, device, computer equipment and storage medium

Abstract

The present application relates to an abnormal network data detection method, device, computer equipment and storage medium. The method includes: acquiring the network data packet to be detected; extracting features of the network data packet to be detected according to the target protocol type corresponding to the network data packet to be detected, and generating a corresponding target data packet fingerprint set; the target data packet fingerprint set includes at least one target data Packet fingerprint; match the target data packet fingerprint with the reference data packet fingerprint in the reference data packet fingerprint library; based on the confidence correlation information corresponding to the successfully matched target data packet fingerprint, calculate the target confidence degree corresponding to the network data packet to be detected ; Obtain the reference confidence degree, and determine the abnormality detection result of the network data packet to be detected based on the reference confidence degree and the target confidence degree. By adopting the method, the detection accuracy and detection efficiency of abnormal network data packets can be improved, and network security can be improved.

Description

technical field [0001] The present application relates to the field of computer technology, in particular to a method, device, computer equipment and storage medium for detecting abnormal network data. Background technique [0002] The rapid development of computer technology has brought great convenience to the dissemination of information, but at the same time, people are also facing huge challenges in information security. As information security issues become increasingly prominent, for example, hackers can launch attacks on the network to steal confidential information on the network. [0003] In the traditional technology, the detection of network attack events is mainly through the collection of public blacklist IPs. If the IP of the current network data packet is detected as the public blacklist IP, it is determined that the network data packet is an abnormal network data packet, and it is determined that there is an IP blacklist. Cyber ​​attack incident. However, ...

AI Technical Summary

Problems solved by technology

However, the number of IPs on the network is very large, and the public blacklist IPs only include some IPs used by hackers, which is prone to missed judgments, resulting in low detection accuracy of abnormal network data packets and low detection efficiency of abnormal network data packets

Images