Abnormal session detection method and device and computer storage medium

Abstract

The embodiment of the invention discloses an abnormal session detection method. The method comprises the following steps: extracting a session in a data stream and equipment interconnection information corresponding to the session; judging whether a corresponding session exists in a preset white list or not according to the equipment interconnection information; classifying sessions which do not exist in a preset white list step by step according to session contents to obtain a session tree; calculating the data type confidence of each leaf node in the session tree according to the equipment interconnection information; determining the session set corresponding to the leaf node of which the data type confidence is greater than a preset confidence threshold as a latest white list; and determining the session which does not exist in the latest white list as the abnormal session. Thus, the accuracy of abnormal session detection is improved.

Description

technical field [0001] The invention relates to the field of information security, in particular to an abnormal session detection method, device and computer storage medium. Background technique [0002] There are many ways to discover network security threats in the current network, such as intrusion detection system (IDS) and network traffic analysis system (NTA). As an emerging technology for network threat detection, NTA has emerged in the network security market. [0003] However, if the current detection system does not understand the legitimate business and management traffic in the deployment environment, or does not perform corresponding configurations, it uses extremely high device configurations to perform feature analysis and matching on all data traffic, mainly legal traffic, which will lead to There are a huge number of false alarms in the system, and it is difficult to respond effectively. In addition, the detection system in the prior art needs to invest a l...

AI Technical Summary

Problems solved by technology

[0005] In order to solve the above problems, the present invention provides an abnormal session detection method, device and computer storage medium, which determines the white list according to the device interconnection information, divides the sessions that do not exist in the white list into session trees, and extracts each session tree. Leaf node feature information, determine the data type confidence of each leaf node according to multiple feature information, and judge whether the session under the leaf node is an abnormal session according to the data type confidence, so as to solve the problem of inaccurate judgment of abnormal traffic

Images