Attack behavior detection method, device and attack detection device

Abstract

The application discloses an attack behavior detection method, device and attack detection device, which belong to the technical field of network security. The method includes: acquiring HTTP message flow data transmitted by a host within a reference time period, determining a plurality of initial probability values ​​through a plurality of behavior detection models, and determining a comprehensive probability value according to the plurality of initial probability values, if the comprehensive probability value is greater than If the probability threshold is preset, it is determined that the attack behavior of the EK is detected. Since the multiple behavior detection models are used to describe different stages of the EK's attack behavior trajectory, this scheme can completely describe the EK's attack behavior trajectory, and integrate the initial probability values ​​of each stage to more accurately detect the EK's attack behavior. . In addition, this solution will not seriously consume the resources of the host itself, and because the acquired data only contains the regular data specified by the network protocol, therefore, compared with the method of obtaining script code parsing, the risk of infringing user privacy in this solution is very high. Low.

Description

technical field [0001] The present application relates to the technical field of network security, and in particular, to an attack behavior detection method, device, and attack detection device. Background technique [0002] Currently, malicious actors can use exploit kits (EKs) to spread malware to attack hosts such as user terminals. EK is a set of tools, which can also be considered as a download-based attack method for spreading malware. When a host accesses a malicious website containing an EK, the EK will use the vulnerability information in the host's online environment to select the corresponding malware to attack the host. If the attack of the EK can be detected in time, the user can be reminded to take measures to deal with the attack of the EK in time to minimize the loss of the user. [0003] In the related art, in the process of visiting a website, the host can collect and detect the script codes of the website, parse the script codes, and generate the signatu...

AI Technical Summary

Problems solved by technology

[0004] However, the collected script code usually contains the user's private data, so there is a risk of violating the user's privacy

Moreover, the processor resources and memory resources consumed by parsing the script code are very large, which will cause the performance of the host to degrade

Images