Method and device for detecting information data and computer readable storage medium

Abstract

The invention provides a method and a device for detecting information data and a computer readable storage medium, and relates to the field of information security. The method for detecting the information data comprises the steps of obtaining target information data of a server subjected to a network attack from a server log; determining the existing duration of the target information data; extracting attack type features, information area features and information association features from the target information data; and inputting the existing duration, the attack type features, the information area features and the information association features into a pre-trained machine learning model to obtain a detection result, wherein the detection result indicates whether the target information data are invalid or not. Various features are extracted from the information data, whether the information data are invalid or not is detected through the machine learning model, and the accuracy of detecting whether the information data are invalid or not and the detection efficiency are improved.

Description

technical field [0001] The present disclosure relates to the field of information security, in particular to a method, device and computer-readable storage medium for detecting intelligence data. Background technique [0002] With the rapid increase of network information, the importance of information security issues is also increasing. [0003] When the server is under security threats such as network attacks, intelligence data will be obtained. Based on the analysis of intelligence data, existing information security problems can be discovered to a certain extent. [0004] However, intelligence data is a collection of information, and all information is time-sensitive. The effective time of intelligence data is usually short, and attackers may constantly replace some attack signature information in order to hide their tracks. For example, an enterprise server has been attacked by a large number of CCs (Challenge Collapsar, challenge black hole). After retrieving the ser...

AI Technical Summary

Problems solved by technology

For example, an enterprise server has been attacked by a large number of CC (Challenge Collapsar, challenge black hole). After retrieving the server logs and successfully tracing the source to the attacker's IP address, the enterprise found that no loss was suffered, so no measures were taken

Wait until the company discovers that the confidential information has been stolen before processing it. It is found that the traced IP address is invalid, and the validity period of the information has been missed.

Images