Attack detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses an attack detection method and device, electronic equipment and a storage medium, and the method comprises the steps: determining an operation log in a storage equipment partition of a terminal and the modification content, relative to the storage equipment partition, in a honeypot partition of a honeypot system when the terminal is started; generating a cracking log according to the operation log or the modified content; receiving a first write-in request or a second write-in request sent by the client; when it is detected that the first write-in request corresponds to the honeypot partition or the second write-in request corresponds to a function configuration structural body in the honeypot system, a client access log is recorded; and carrying out attack detection on the cracking log and the client access log so as to obtain an attack behavior of the client on the corresponding function configuration of the terminal. According to the method, the corresponding function configuration architecture of the easily attacked terminal can be simulated, the process monitoring on the corresponding function configuration attack behavior of the terminal can be dynamically triggered, and the system resource overhead can be reduced to the maximum extent.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to an attack detection method, device, electronic equipment and storage medium. Background technique [0002] At present, terminal multimedia functions are becoming more and more abundant, and the terminal platform architecture has gradually developed to an application processor (AP, Application Processor) plus baseband (modem) architecture. Because the corresponding configuration structure and functions of the terminal are also extremely vulnerable to attacks by hackers and other attackers , most original equipment manufacturers will directly use or slightly modify the terminal configuration structure and function solutions provided by chip manufacturers. [0003] However, using the terminal configuration structure function solution provided by the chip manufacturer, its code and tools are relatively easy to obtain, not only the attack threshold is low, but also ...

AI Technical Summary

Problems solved by technology

[0003] However, using the terminal configuration structure function solution provided by the chip manufacturer, its code and tools are relatively easy to obtain, not only the attack threshold is low, but also the attack surface of the terminal configuration structure function solution with the application processor plus baseband architecture is wide

Images