Network attack tracing method and system, storage medium and electronic equipment

Abstract

The invention discloses a network attack tracing method and system, a storage medium and electronic equipment. The method comprises the following steps: receiving an access data flow message of a network attack sent by a server; extracting feature identification information according to the access data flow message; comparing and querying the feature identification information and the informationstored in the user information database according to a preset priority sequence to determine the identity information of the network attack, so that the technical problem of how to accurately and efficiently find the information of the network attacker in related technologies is solved, and the technical effect of improving the identification accuracy and efficiency is achieved.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a network attack source tracing method and system, a storage medium, and electronic equipment. Background technique [0002] In recent years, with the continuous popularization of the network, the attack techniques and attack methods used by network attackers have also developed new trends. Network security issues also require constant attention from network users and effective security measures. [0003] The existing technology finds the source of the internal attack through the existing alarm information and historical alarm information. After finding the internal source, it judges the external device connected to the internal source, and then obtains the identification IP address of the external device, that is, the IP address of the attacker. address, and then query the local threat intelligence database to obtain relevant information about the attacker base...

AI Technical Summary

Problems solved by technology

However, this method relies on the acquired IP address of the attacker and the local threat intelligence database. There are three problems. First, the current attackers launch attacks through proxies, and the acquired IP addresses of the attackers are basically proxies. IP address; second, the local threat intelligence database relies on external sources, and the validity and authenticity of the data has not been verified, and the data is not necessarily complete. Even if the real IP address of the attacker is obtained, it may not be possible to accurately locate the attacker; third, the local The threat intelligence database relies on data provided by various external places, and requires a lot of financial and material resources to maintain, which is time-consuming and labor-intensive.

[0004] There is no better solution for how to accurately and efficiently find the identity information of network attackers in related technologies

Images