IP classification method, system and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an IP classification method, system and device, electronic equipment and a storage medium, and the method comprises the steps: receiving to-be-classified information sent by a log analysis unit, and calculating a drainage score corresponding to an external attack IP based on the attack behavior information of each external attack IP; based on the attack behavior information of each external attack IP corresponding to each target IP, calculating a drainage score corresponding to the target IP; and for each external attack IP, if the drainage score corresponding to the external attack IP is greater than a first preset score threshold or the drainage score corresponding to a target IP attacked by the external attack IP is greater than a second preset score threshold, determining that the external attack is an abnormal IP. By adopting the method, the problem that the existing analysis method aiming at the network traffic cannot meet the requirements of the current advanced security analysis system is solved, and the accurate selection and control on the storage of the traffic data are realized.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to an IP classification method, system, device, electronic equipment and storage medium. Background technique [0002] In the field of information security, the analysis of network traffic has become an important analysis method in information security analysis. At present, advanced analysis methods such as complex correlation analysis model, AI model, UEBA (User Entity Behavior Analytics, User Entity Behavior Analysis) model are used to directly analyze network traffic and discover network attack events such as APT and 0day. [0003] However, using advanced security analysis methods to analyze network attack events, on the one hand, it does not fully apply the capabilities of traditional security detection equipment and consumes a lot of computing resources. On the other hand, too much positive sample traffic will also lead to a large number of false alarms. At presen...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the embodiments of the present invention is to provide an IP classification method, system, device, electronic equipment and storage medium to solve the problem that the existing analysis methods for network traffic cannot meet the needs of the current advanced security analysis system

Images