Invasion detecting method

Abstract

The invention provides an intrusion detection method. The intrusion detection system detects each event of accessing the protected network or host according to the detection rules, and further includes the following steps: a) judging whether the currently detected event is an intrusion event, if not , return to step a and continue to detect the next event, if so, obtain the intrusion detection rule used to detect the current event; b) determine the target of the currently detected intrusion event according to the preset correspondence between the intrusion detection rule and the vulnerability Vulnerability; c) Retrieve whether the protected network or host has the vulnerability determined in step b in the vulnerability scanning result database obtained by the vulnerability scanning of the protected network or host; and according to the degree of harm of the intrusion event and the vulnerability to be attacked and The risk assessment of intrusion events is carried out based on the matching degree of vulnerability information among the vulnerability scanning result databases. The application of the invention improves the accuracy and practicability of the intrusion detection results.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to an intrusion detection method. Background technique [0002] In the field of computer network security technology, network intrusion detection and network vulnerability scanning are two methods to protect one's own network and data security. [0003] A network vulnerability scan is a program that automatically detects security weaknesses in remote or local target hosts. The principle is to use the form of simulated attacks to check the known security vulnerabilities that may exist in the target host one by one, and collect the vulnerabilities that exist in the target host. For example, by remotely detecting the services of different TCP / IP ports of the target host and recording the answers given by the target host, various information about the target host can be collected, including whether anonymous login is possible, whether there is a writable FTP directory...

AI Technical Summary

Problems solved by technology

Therefore, the current intrusion detection system cannot detect suspicious behaviors in combination with the actual network environment, such as the topology of the internal protected network, the system type and service type of the protected host, and other information.

Unable to assess whether the intrusion will actually cause damage to the protected network or host, and how much damage will be caused

Images