Network attack detection method and device, electronic equipment and readable storage medium

Abstract

The invention discloses a network attack detection method and device, electronic equipment and a readable storage medium. The method comprises the following steps: training blacklist user data and white list user data obtained from a cloud end in advance to obtain network attack parameters of a to-be-detected network system; extracting target function item data from the operation log data of the target user as standardized operation information of the target user; respectively calculating a similar distance value between the standardized operation information of the target user and the standardized operation information of each user in the blacklist; and if the similar distance value is smaller than the network attack parameter, determining that the target user is an attack user, thereby improving the network attack detection accuracy, effectively preventing network attacks, and improving the network security performance.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a network attack detection method, device, electronic equipment and readable storage medium. Background technique [0002] With the rapid development of computer technology, more and more user data is stored in the network. In order to improve network data security, it is imperative to predict and identify attacking users in real time or in advance, and block network attacks in time. However, it is difficult to identify and judge whether the current user is an attacking user from a large amount of network traffic data in a short period of time. Therefore, in the case of limited energy of security audit practitioners, using advanced computer information security technology to review and filter attack users in advance has become an urgent problem to be solved. [0003] In the process of performing network attack detection, related technologies usually detect bas...

AI Technical Summary

Problems solved by technology

This method judges the user's XSS attack attributes by comparing the input data with the static XSS attack signature database. It needs to maintain the static XSS attack signature database, and cannot protect against other attack methods such as SQL injection, CSRF, etc., which also leads to protection. low rate

From the above discussion, it can be seen that because the related technologies are limited by attack characteristics and attack types, the protection rate is low, the dynamics are poor, and network attacks cannot be effectively prevented, and the network security performance is poor.

Images