A method and device for determining the success of an attack
A judging method and a successful technology, applied in the field of network security, can solve the problems of inability to judge the success of network attacks, threats, and reduce the work efficiency of security operators.
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0062] see figure 1 , figure 1 This embodiment of the present application provides a schematic flowchart of a method for determining the success of an attack. Among them, the attack success determination method includes:
[0063]S101. Acquire network traffic data to be detected.
[0064] In the embodiment of the present application, the method is applied to the detection scenario of network attacks in network traffic.
[0065] In this embodiment of the present application, the execution body of the method may be an attack success determination device.
[0066] In the embodiment of the present application, when the attack successfully determines that the device is a hardware device, it may be a computing device such as a computer and a server, or a smart device such as a smart phone and a tablet computer, which is not limited in this embodiment.
[0067] In the embodiment of the present application, when the attack success determination device is software-based deployment, ...
Embodiment 2
[0094] see figure 2 , figure 2 This is a schematic flowchart of another attack success determination method provided by the embodiment of the present application. like figure 2 As shown, wherein, the attack success determination method includes:
[0095] S201. Acquire network traffic data to be detected.
[0096] S202. Acquire a request data packet in the network traffic data.
[0097] S203. Perform attack feature detection on the request data packet to obtain a detection result.
[0098] As an optional implementation manner, performing attack feature detection on the request data packet to obtain the detection result may include the following steps:
[0099] Perform parsing processing on the request data packet to obtain the parsing data packet;
[0100] Obtain the feature meta information of the parsed data packet;
[0101] Obtain the preset attack feature metabase, and determine whether the feature meta information matches the attack feature metabase;
[0102] If...
example 1
[0153] Example 1: Suppose a threat program is a Web command execution tool, which can implement hackers to attack the Web system, and transmit commands and command execution results through HTTP requests and HTTP responses.
[0154] When attack detection is performed by the method provided in this embodiment, attack features are first detected from the HTTP request, wherein the attack features included in the HTTP request include: URL path shell.jsp, content of the Accept field, HTTP request body, etc. This attack is characterized by full Base64 encoding, which can be judged as attacking HTTP requests. Then determine whether the attack is successful according to the HTTP response data packet, first determine the HTTP response associated with the attacking HTTP request, and then when it is determined that the response code in the HTTP response is 200, and the garbled form of the HTTP response body conforms to the response characteristics of the threat program , it can be determ...
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More