Network intrusion detection method and device, equipment and storage medium

Abstract

The invention discloses a network intrusion detection method and device, equipment and a storage medium. The method comprises the steps of: inputting the features of network data into a first misuse detection model, and obtaining normal data or attack data; inputting the features of the attack data into a first anomaly detection model to obtain a clustering class, and calculating a first class distance between the attack data and the class center of the clustering class to which the attack data belongs; in response to the fact that the first class distance is not greater than a predetermined first class distance threshold of the clustering class, inputting the attack data as deterministic attack data into a second misuse detection model to obtain a specific attack type; and in response to the fact that the first class distance is greater than the predetermined first class distance threshold of the clustering class, storing the attack data as to-be-determined attack data in a to-be-determined attack data set, and judging whether a to-be-determined attack data type has occurred or not. According to the method, the specific type of the network data is accurately detected, whether a new attack occurs or not can be detected, and the network security and timeliness are greatly improved.

Description

technical field [0001] The invention relates to the technical field of abnormal network intrusion, in particular to a network intrusion detection method, device, equipment and storage medium. Background technique [0002] With the development of computer network and communication technology, computer network has become popular rapidly and has become an important tool for information sharing and exchange in the whole society. While network applications bring infinite convenience to people, network security issues are becoming increasingly prominent. Computer networks in today's society are facing the following problems: citizens' personal information is leaked, corporate data information is stolen, and important state agencies are attacked. The problem of maintaining network security is fundamentally a problem of protecting the economy. From the perspective of protecting network security and resisting intrusion, many technologies and equipment have emerged as the times requi...

AI Technical Summary

Problems solved by technology

[0004] Technical purpose: Aiming at the defects in the prior art, the present invention discloses a network intrusion detection method, device, equipment and storage medium, which solves the problem of not only being able to identify the specific attack type of attack data but also identifying new attacks at present. Problems that lead to poor detection performance

Images