Threat detection method and device and storage medium

Abstract

The invention provides a threat detection method and device and a storage medium. The threat detection method comprises the steps of obtaining to-be-detected data; determining encrypted data corresponding to the to-be-detected data; judging whether matched encrypted data of the encrypted data corresponding to the to-be-detected data exists in encrypted data stored in a preset cuckoo filter or not, wherein the stored encrypted data is encrypted data corresponding to preset threat data; and if yes, determining that the to-be-detected data is threat data. The method is used for improving the threat detection efficiency.

Description

technical field [0001] The present application relates to the technical field of network security, in particular, to a threat detection method and device, and a storage medium. Background technique [0002] With the rapid development of the Internet, network attacks and frauds are increasing, especially in high-speed network environments, network security products need to quickly identify attacks. [0003] Existing threat detection technology stores some threat features, such as ip (Internet Protocol, Internet Protocol) address, url (Uniform Resource Locator, Uniform Resource Locator), etc., into a Bloom filter or a data table, Then compare the currently detected data with the threat features in the Bloom filter or the data table, so as to realize the identification of threat data. [0004] In this way, the feature matching method is adopted, and the matching efficiency is low, which in turn leads to low detection efficiency. Contents of the invention [0005] The purpos...

AI Technical Summary

Problems solved by technology

[0004] In this way, feature matching is used, and the matching efficiency is low, which in turn leads to low detection efficiency.

Images