Network security anomaly detection method and device, storage medium and computing equipment

Abstract

The invention discloses a network security anomaly detection method and device, a storage medium and computing equipment. According to the method, an acquisition probe is adopted to acquire software static fingerprint information and process dynamic behavior information of electric power Internet of Things edge equipment to construct a trusted software base and a behavior baseline; the behavior information of the process is compared with a local behavior baseline model, the behavior deviation degree is calculated, and therefore safety abnormity is found; comparing the changed binary file under the critical path and a process file corresponding to the new process with a trusted software base, and uploading the binary file which is abnormal in comparison to a server for cloud searching and killing; and the user carries out manual study and judgment on the abnormal alarm, and disposes the abnormity or updates the trusted software base and the behavior baseline according to the result. According to the method, the credible software base and the behavior base line are constructed, changes including software static fingerprint information and process dynamic behaviors exceeding the standard are monitored, the abnormal behaviors of the power internet of things edge equipment can be recognized, and the safety of the equipment is guaranteed.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a network security anomaly detection method, device, storage medium and computing equipment. Background technique [0002] The security of the edge devices of the power Internet of Things affects the security of the power system. Facing the diversity and novelty of network attacks, detection is difficult and costly. [0003] At present, the network security protection of IoT devices is mainly to improve the network security of IoT devices by placing IoT devices on an isolated network or enhancing the complexity of passwords. However, these methods will affect the user experience and cannot satisfy User needs. Contents of the invention [0004] The purpose of the present invention is to provide a network security anomaly detection method, device, storage medium and computing equipment for the edge equipment of the electric power Internet of things, which can detect...

AI Technical Summary

Problems solved by technology

[0002] The security of the edge devices of the power Internet of Things affects the security of the power system. Facing the diversity and novelty of network attacks, detection is difficult and costly

[0003] At present, the network security protection of IoT devices is mainly to improve the network security of IoT devices by placing IoT devices on an isolated network or enhancing the complexity of passwords. However, these methods will affect the user experience and cannot satisfy User needs

Images