Network service identification method and device, equipment and medium

Abstract

The invention discloses a network service identification method and device, equipment and a medium. The method comprises the steps: monitoring one or two previous data packets in network traffic after a session is established to obtain a target data packet; matching the target data packet based on a preset rule base, wherein the preset rule base comprises rules corresponding to each network service; if the matching is successful, outputting a corresponding network service identification result; if the matching fails, storing the target data packet; and determining a rule of a corresponding network service based on the stored target data packet to obtain a new rule, and adding the new rule to the preset rule base. Therefore, the identification efficiency of the network service can be improved.

Description

technical field [0001] The present application relates to the technical field of network service identification, in particular to a network service identification method, device, equipment and medium. Background technique [0002] The identification of network services can be used to identify vulnerability information, monitor the corresponding network space environment, etc. Existing vulnerability scanners mainly identify network services through port scanning, and further identify corresponding vulnerabilities through service information. The active scanning mode has certain limitations. , it is necessary for the security personnel to organize the network request that is precisely satisfied with the target service, and the target port will generate a response; [0003] Existing traffic-based intrusion detection systems rely on detecting all traffic and identifying unsafe traffic in the traffic according to the keywords in the signature database to achieve detection results...

AI Technical Summary

Problems solved by technology

[0003] Existing traffic-based intrusion detection systems rely on detecting all traffic and identifying unsafe traffic in the traffic according to the keywords in the signature database to achieve detection results. Not only do all traffic need to be detected during detection, the recognition efficiency is low, and all traffic needs to be saved. All data packets of unidentified services, and if the same unidentified service appears multiple times, the existing intrusion detection system will save the content of each session. Faced with a large number of possible identical session data, subsequent manual identification is inefficient

Images