Malicious traffic detection method and device, terminal and computer readable storage medium
A technology of malicious traffic and detection methods, applied in the Internet field, can solve problems such as inaccuracy, high false detection rate, and one-sided detection results.
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0056] In order to solve the problems in the prior art that only one detection model is used to detect malicious traffic, resulting in a certain one-sidedness, inaccuracy, and high false detection rate in the detection results, the embodiment of the present application provides a malicious traffic detection method. See figure 1 As shown, the method may include the following steps.
[0057] S11: Obtain characteristic information of the traffic to be detected.
[0058] It should be noted that the traffic to be detected in step S11 may be http traffic or other types of traffic, wherein the characteristic information of the traffic to be detected may be characteristic information corresponding to any characteristic of the traffic to be detected, for example, it may be The feature information of the request header feature, specifically, can be the feature information of the URL character feature in the request header. In this embodiment, the feature information of the URL characte...
Embodiment 2
[0100] The embodiment of this application provides a malicious traffic detection device, please refer to Figure 5 shown, including:
[0101] An acquisition module 501, configured to acquire characteristic information of traffic to be detected;
[0102] A detection module 502, configured to input the characteristic information into a preset malicious traffic detection model library for detection, and the malicious traffic detection model library includes at least two detection models;
[0103] A determining module 503, configured to determine whether the traffic to be detected is malicious traffic according to the detection results of each detection model.
[0104] In an embodiment, the detection models in the malicious traffic detection model library include but are not limited to: at least two of ML detection models, KNN detection models, logistic regression detection models, decision tree detection models, and random forest detection models. In other embodiments, other ty...
Embodiment 3
[0109] Based on the same inventive concept, the embodiment of this application provides a terminal, please refer to Figure 6 As shown, it includes a processor 601 and a memory 602, the memory 602 stores a computer program, and the processor 601 executes the computer program to implement the steps of the method in the first embodiment above, which will not be repeated here.
[0110] It should be noted that the device in this embodiment may be a PC (Personal Computer, personal computer), a mobile phone, a tablet computer, a notebook computer, a virtual host, and the like. It can also be a rack server, a blade server, a tower server, or a cabinet server (including an independent server, or a server cluster composed of multiple servers) and the like.
[0111] understandable, Figure 6 The structure shown is for illustration only, the equipment may also include Figure 6 more or fewer components than shown in, or with Figure 6 Different configurations are shown.
[0112] The ...
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More