Attack behavior detection method and device and attack detection equipment

Abstract

The invention discloses an attack behavior detection method and device and attack detection equipment, and belongs to the technical field of network safety. The method comprises the following steps: acquiring HTTP message stream data transmitted by a host within a reference time period, determining a plurality of initial probability values through a plurality of behavior detection models, determining a comprehensive probability value according to the plurality of initial probability values, If the comprehensive probability value is greater than a preset probability threshold, determining that an attack behavior of an EK is detected. Since the plurality of behavior detection models are respectively used for describing different stages in the attack behavior trajectory of the EK, the scheme can completely describe the attack behavior trajectory of the EK, and the attack behavior of the EK can be more accurately detected by synthesizing the initial probability values of the stages. Besides, the scheme does not seriously consume resources of the host, and the acquired data only contains conventional data specified by a network protocol, so that compared with a method for acquiring script code analysis, the scheme has the advantage that the risk of invading user privacy is very low.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to an attack behavior detection method, device and attack detection equipment. Background technique [0002] Currently, malicious actors can use exploit kits (exploit kits, EKs) to spread malicious software to achieve the purpose of attacking hosts such as user terminals. EK is a set of tools, which can also be considered as an attack method for distributing malware based on downloading. When the host accesses a malicious website containing EK, EK will use the vulnerability information in the host's Internet environment to select the corresponding malicious software to attack the host. And if the attack behavior of EK can be detected in time, the user can be reminded to take timely measures to deal with the attack of EK, and the loss of users can be minimized. [0003] In a related technology, a host can collect and detect script codes of the website during a pr...

AI Technical Summary

Problems solved by technology

[0004] However, the collected script code usually contains the user's private data, so there is a risk of violating the user's privacy

Moreover, the processor resources and memory resources consumed by parsing the script code are very large, which will cause the performance of the host to degrade

Images