Network abnormal behavior intelligent detection and response method and device and electronic equipment

Abstract

The embodiment of the invention provides a network abnormal behavior intelligent detection and response method and device and electronic equipment, and the method comprises the steps of collecting the mirror traffic of a session layer through a switch, and extracting a traffic feature from the mirror traffic; training verification rules based on the traffic characteristics, the verification rules including an internal and external network verification rule, a survival host verification rule, an existing network service verification rule and an existing operating system network fingerprint generation rule; marking each network request according to the verification rule to form a request log; and making a basic response to each network request according to the request log. According to the embodiment of the invention, a bypass network data detection method is adopted to realize network spoofing defense, network should be realized in a session layer, and the network defense efficiency is improved.

Description

technical field [0001] The disclosure relates to the technical field of computer networks, in particular to an intelligent detection and response method, device and electronic equipment for abnormal network behavior. Background technique [0002] Network spoofing defense technology is a new concept that has emerged in recent years, that is, by forging various false hosts, false services and even false users in the protected network to deceive attackers into thinking that there are a large number of stock hosts, services, and active users in the protected network. As a result, the attacker cannot accurately locate the effective attack target. On the one hand, this technology can delay the attack speed, increase the time cost of the attacker, and reduce the accuracy of the attack; on the other hand, it can effectively capture the attacker's attack behavior and traffic content, and provide important clues for tracking investigation and evidence collection. [0003] At present,...

AI Technical Summary

Problems solved by technology

[0005] However, there are technical problems in the existing schemes. For typical honeypot deployment schemes, it brings great inconvenience to the number and management of honeypots. Since network deception is limited to honeypot entities, this kind of deception is also easy to be exploited. attacker identification

The method based on traffic redirection can effectively reduce the number of honeypot deployments, but the serial deployment method is likely to bring a single point of failure risk to the network, and all access requests must be analyzed by serial devices before they can be forwarded, increasing the normal access delay of the network

Images