Network attack detection method and system based on traffic analysis

Abstract

The invention relates to the technical field of network security, and provides a network attack detection method and system based on traffic analysis. The method comprises the following steps: analyzing target traffic based on a traffic analysis engine to obtain an analysis log; matching and analyzing the log according to the black list and the white list; if it is determined that first traffic matched with the blacklist exists in the analysis log, executing a preset protection measure for the first traffic; if it is determined that a third flow exists in the analysis log, adding the third flow to an alarm library; according to the method, the blacklist and the white list are generated through the recommendation model, and the traffic obtained through analysis is matched, so that the attack traffic and the trust traffic are identified more efficiently, and protection measures are conveniently executed for the attack traffic; furthermore, the black list and the white list can be continuously updated and perfected through the recommendation model, and the recognition efficiency of the network attack can be continuously improved along with iteration of the black list and the white list.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network attack detection method and system based on traffic analysis. Background technique [0002] Cyber ​​attack refers to any type of offensive action against computer information systems, infrastructure, computer networks or personal computer equipment. For computers and computer networks, destroying, disclosing, modifying, disabling software or services, stealing or accessing data of any computer without authorization is considered an attack on computers and computer networks . [0003] Abnormal network traffic analysis has become an increasingly important research topic for protecting computer infrastructure from intruders. However, accurately spotting threats is still a challenging task due to the huge network traffic. [0004] Some existing traffic analysis engines can only parse out some content of the traffic, and cannot judge whether the traffic is attack...

AI Technical Summary

Problems solved by technology

[0006] The present invention provides a network attack detection method and system based on traffic analysis, which is used to solve the defects of complex process and low detection efficiency in the prior art, and realize simple and efficient network attack detection

Images