A network behavior detection method and related device based on network security strategy

Abstract

The present application discloses a network behavior detection method based on network security policy and related devices, the method includes: if the network behavior to be detected is in the preset network security policy whitelist, and the network behavior to be detected is not in the preset network behavior feature whitelist, then determine whether the network behavior to be detected is within the window period, if so, then the network behavior to be detected is audited and passed; if the network behavior to be detected exceeds the window period, then determine whether the network behavior to be detected forms a network behavior feature, if so, then perform a manual audit stage, if not, then intercept the network behavior to be detected, the manual audit stage is to determine whether the network behavior to be detected meets the preset audit rules. The present application can solve the technical problem that the existing network security policy cannot cope with attacks of security vulnerabilities that have not yet been disclosed, resulting in poor system security performance.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network behavior detection method and related devices based on network security strategy. Background Art

[0002] The power monitoring system has deployed many network security protection devices and systems, such as WEB application firewalls, intrusion detection systems, network traffic backtracking analysis systems, etc., which can basically accurately identify the behavior and data in the network, identify the threats therein, and adopt corresponding network security strategies.

[0003] However, the existing network security policies are mainly based on two configuration points: one is the network security policy settings made by users based on business needs, and the other is the network security policy settings made based on network security vulnerabilities disclosed by the industry; however, there are conflicts between these two starting points, and usually the user's network security policy is modified to set the network security policy according to the network security vulnerabilities disclosed by the industry. However, this will easily lead to attacks from some security vulnerabilities that have not yet been disclosed being unable to be detected, causing the system to be attacked and reducing the network security performance of the system. Summary of the invention

[0004] The present application provides a network behavior detection method and related devices based on network security policies, which are used to solve the technical problem that existing network security policies are unable to cope with attacks on security vulnerabilities that have not yet been disclosed, resulting in poor system security performance.

[0005] In view of this, the first aspect of the present application provides a network behavior detection method based on network security policy, comprising:

[0006] If the network behavior to be detected is in the preset network security policy whitelist, and the network behavior to be detected is not in the preset network behavior feature whitelist, then determine whether the network behavior to be detected is within the window period. If so, then the network behavior to be detected is approved;

[0007] If the network behavior to be detected exceeds the window period, it is determined whether the network behavior to be detected forms a network behavior feature. If so, a manual review stage is performed. If not, the network behavior to be detected is intercepted. The manual review stage is to determine whether the network behavior to be detected meets the preset review rules.

[0008] Preferably, if the network behavior to be detected is in the preset network security policy whitelist, and the network behavior to be detected is not in the preset network behavior feature whitelist, then it is determined whether the network behavior to be detected is in the window period, and if so, the network behavior to be detected is approved, further comprising:

[0009] If the network behavior to be detected is in the preset network security policy whitelist, and the network behavior to be detected is in the preset network behavior feature whitelist, then the network behavior to be detected is approved.

[0010] Preferably, if the network behavior to be detected exceeds the window period, determining whether the network behavior to be detected forms a network behavior feature, if so, performing a manual review stage, if not, intercepting the network behavior to be detected, including:

[0011] If the network behavior to be detected exceeds the window period, the behavior frequency of the network behavior to be detected is counted based on a preset time weight;

[0012] Determine whether the behavior frequency conforms to the normal distribution. If so, the network behavior to be detected has formed the network behavior characteristics, and the manual review stage is carried out. If not, the network behavior to be detected has not formed the network behavior characteristics, and the network behavior to be detected is intercepted.

[0013] Preferably, the manual review stage is specifically:

[0014] Determine whether the network behavior to be detected meets the preset audit rules. If so, the network behavior to be detected is included in the preset network behavior feature whitelist, and the network behavior to be detected is audited. If not, the network behavior to be detected is intercepted.

[0015] A second aspect of the present application provides a network behavior detection device based on network security policy, comprising:

[0016] The first detection judgment module is used to judge whether the network behavior to be detected is within the window period if the network behavior to be detected is in the preset network security policy whitelist and the network behavior to be detected is not in the preset network behavior feature whitelist. If so, the network behavior to be detected is approved;

[0017] The second detection and judgment module is used to determine whether the network behavior to be detected forms a network behavior feature if the network behavior to be detected exceeds the window period. If so, a manual review stage is performed; if not, the network behavior to be detected is intercepted. The manual review stage is used to determine whether the network behavior to be detected meets the preset review rules.

[0018] Preferably, it also includes:

[0019] The dual-core passing module is used to verify that the network behavior to be detected is passed if the network behavior to be detected is in the preset network security policy whitelist and the network behavior to be detected is in the preset network behavior feature whitelist.

[0020] Preferably, the second detection and judgment module is specifically used to:

[0021] If the network behavior to be detected exceeds the window period, the behavior frequency of the network behavior to be detected is counted based on a preset time weight;

[0022] Determine whether the behavior frequency conforms to the normal distribution. If so, the network behavior to be detected has formed the network behavior characteristics, and the manual review stage is carried out. If not, the network behavior to be detected has not formed the network behavior characteristics, and the network behavior to be detected is intercepted.

[0023] Preferably, the manual review stage is specifically:

[0024] Determine whether the network behavior to be detected meets the preset audit rules. If so, the network behavior to be detected is included in the preset network behavior feature whitelist, and the network behavior to be detected is audited. If not, the network behavior to be detected is intercepted.

[0025] A third aspect of the present application provides a network behavior detection device based on network security policy, the device comprising a processor and a memory;

[0026] The memory is used to store program code and transmit the program code to the processor;

[0027] The processor is used to execute the network behavior detection method based on network security policy described in the first aspect according to the instructions in the program code.

[0028] The fourth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, wherein the program code is used to execute the network behavior detection method based on network security policy described in the first aspect.

[0029] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0030] In the present application, a network behavior detection method based on network security policy is provided, including: if the network behavior to be detected is in the preset network security policy whitelist, and the network behavior to be detected is not in the preset network behavior feature whitelist, then judging whether the network behavior to be detected is within the window period, if so, the network behavior to be detected is reviewed and approved; if the network behavior to be detected exceeds the window period, then judging whether the network behavior to be detected forms a network behavior feature, if so, performing a manual review stage, if not, intercepting the network behavior to be detected, and the manual review stage is to judge whether the network behavior to be detected meets the preset review rules.

[0031] The network behavior detection method based on network security strategy provided by the present application improves the system's defense capability against unknown network security vulnerabilities by judging and analyzing the network behavior to be detected; the network behavior can be constrained to a certain time and behavior content by indiscriminate judgment, thereby improving the defense capability; and the attack behavior of the security vulnerability is compressed into a fixed network behavior, which can enhance the problem location capability and facilitate targeted elimination of vulnerabilities. Therefore, the present application can solve the technical problem that the existing network security strategy cannot cope with the attack of the security vulnerability that has not been disclosed, resulting in poor system security performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A flowchart of a network behavior detection method based on network security policy provided in an embodiment of the present application;

[0033] Figure 2 A schematic diagram of the structure of a network behavior detection device based on network security strategy provided in an embodiment of the present application;

[0034] Figure 3 A schematic diagram of the specific review process of network behavior based on network security policy provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0036] For easier understanding, see Figure 1 , an embodiment of a network behavior detection method based on network security policy provided by the present application includes:

[0037] Step 101: If the network behavior to be detected is in the preset network security policy whitelist and is not in the preset network behavior feature whitelist, determine whether the network behavior to be detected is within the window period. If so, the network behavior to be detected is approved.

[0038] Furthermore, step 101 further includes:

[0039] If the network behavior to be detected is in the preset network security policy whitelist and the network behavior to be detected is in the preset network behavior feature whitelist, the network behavior to be detected is approved.

[0040] The preset network security policy whitelist is a network security policy at the network routing and port level, which generally includes source address, destination address, source port, and destination port. It only limits the subject and object of network behavior, but does not limit the network behavior characteristics at the application level. The preset network behavior characteristic whitelist is supplemented on the basis of the original network security policy. It is a list of network behavior characteristics obtained by the system based on network behavior analysis, and all of them have passed the legality review; the network behavior characteristic whitelist content includes but is not limited to the following: network behavior source address, destination address, source port, destination port, behavior network data packet characteristics, behavior time period, and the maximum number of access times for the behavior time period. The network behavior to be detected is the network behavior currently detected in the system, which can be a login operation, an access behavior, etc. The object characteristics of the network behavior to be detected include source address, destination address, source port, and destination port; the subject and object of the behavior can be clarified based on the object characteristics; the network data packet characteristics of the network behavior are the essence of the behavior, which are obtained by the network security device after analyzing the network behavior data packet. The key fields can be extracted to form the essential characteristics of the behavior, and what the behavior itself is.

[0041] The network behavior to be detected is only allowed to be accessed if it matches the network behavior instance in the network behavior feature whitelist; on the contrary, if the network behavior to be detected is in both the preset network security policy whitelist and the preset network behavior feature whitelist, the review will be passed.

[0042] In the judgment mechanism, if the network behavior to be detected is in the preset network security policy whitelist, but not in the preset network behavior feature whitelist, a deeper judgment analysis is required and it cannot pass the detection and review directly. The window period is used to judge the network behavior features of familiar users. The network behavior to be detected is allowed to pass within the window period. Once the window period is exceeded, it will be judged according to the actual network behavior features. If it is within the window period, the network behavior to be detected will pass the review.

[0043] For example, if Xiao Ming has opened the permission to access a business system at https: / / 10.10.10.10:80 due to business needs, Xiao Ming's client address is 11.11.11.11, and the opening time range is from 8 am to 6 pm. If Xiao Ming has logged into the system during the window period and formed a fixed network behavior feature, then the system will restrict Xiao Ming's network behavior according to the network behavior feature whitelist after the window period ends. If Xiao Ming has never logged into the system during the window period. At this time, there is a record in the network security policy whitelist set by the user, with the source address of the record being 11.11.11.11, port any, the destination address of the access being 10.10.10.10, port 80, and the time period being from 8 am to 6 pm. Because Xiao Ming has never logged into the business system, he has not yet appeared in the network behavior feature whitelist, so he is blocked by default. During the interception period, if Xiao Ming continuously accesses https: / / 10.10.10.10:80 and forms a fixed pattern, the system will discover it and submit it for manual review and confirmation. After passing, Xiao Ming will be able to access https: / / 10.10.10.10:80 normally within the fixed pattern range.

[0044] Step 102: If the network behavior to be detected exceeds the window period, determine whether the network behavior to be detected forms a network behavior feature. If so, perform a manual review stage. If not, intercept the network behavior to be detected. The manual review stage is to determine whether the network behavior to be detected meets the preset review rules.

[0045] Furthermore, step 102 includes:

[0046] If the network behavior to be detected exceeds the window period, the behavior frequency of the network behavior to be detected is counted based on the preset time weight;

[0047] Determine whether the behavior frequency conforms to the normal distribution. If so, the network behavior to be detected has formed the network behavior characteristics, and the manual review stage is carried out. If not, the network behavior to be detected has not formed the network behavior characteristics, and the network behavior to be detected is intercepted.

[0048] Furthermore, the manual review stage is specifically as follows:

[0049] Determine whether the network behavior to be detected meets the preset review rules. If so, the network behavior to be detected is included in the preset network behavior feature whitelist, and the network behavior to be detected is reviewed and approved. If not, the network behavior to be detected is intercepted.

[0050] It should be noted that if the network behavior to be detected exceeds the window period, it is necessary to make a specific judgment on the current network behavior to be detected, that is, whether the network behavior characteristics are formed. For a certain network behavior A to be detected, its source address, destination address, source port, destination port and network data packet characteristics of the behavior are determined, and based on time, multiple such network behaviors to be detected can be obtained, thereby forming a network behavior sample set. It can be understood that the network behavior of the same user at different times can also form different network behaviors to be detected; therefore, the network behavior sample set can be divided into time periods, such as the three time periods of the past three months, three months to six months, and six months ago; then the weight corresponding to the network behavior is set according to the time period, that is, the preset time weight K, for example, the weight value of the past three months is 1, the weight of three months to six months is 0.5, and the weight of six months ago is 0.2; then the frequency of network behavior is counted according to the preset time weight, that is, the behavior frequency; finally, it is determined whether the behavior frequency conforms to the normal distribution, if it conforms, the network behavior characteristics have been formed, otherwise it has not been formed.

[0051] From 0 to 24 hours a day, it is divided into 48 segments, one segment every half an hour. The number of "login account" behaviors that occur in each period is counted considering the weight. For example, "login account" behavior A1 occurred at 2 pm yesterday, and its weight K1 is 1, so 1 login is recorded in the time period from 2 to 2:30; "login account" behavior A2 occurred at 4 pm this afternoon last year, and its weight K2 is 0.2, so 0.2 logins are recorded in the time period from 4 to 4:30; finally, the behavior frequency distribution characteristics of the 48 segments from 0 to 24 hours of the network behavior sample set A are calculated. If any continuous part of the behavior frequency distribution characteristics of the 48 segments conforms to the normal distribution according to the KS test, it is judged that network behavior A has formed network behavior characteristics in the continuous time period, otherwise it is judged that network behavior A has not yet formed network behavior characteristics.

[0052] For example: Xiao Ming's "login account" network behavior sample A conforms to normal distribution according to the KS test in the four consecutive time periods from 9:00 to 11:00, and conforms to normal distribution according to the KS test in the six consecutive time periods from 2:00 to 5:00 in the afternoon, then it is judged that network behavior A has formed network behavior characteristics in the above time periods. If sample A does not conform to normal distribution according to the KS test in any consecutive time period from 0 to 24 hours, it is judged that network behavior A has not yet formed network behavior characteristics. In other words, the judgment period is a continuous time period, because it is necessary to obtain frequency data that can analyze frequency distribution in order to make state distribution judgments.

[0053] The manual review stage can determine whether unknown network behaviors that are not in the whitelist can be included in the reporting list, that is, whether the network behaviors to be detected can be included in the preset network behavior feature whitelist. The preset review rules can be set according to actual conditions. Once set, it is best not to adjust them at will to ensure the objectivity and accuracy of the review. The preset review rules in this embodiment include but are not limited to confirming with the terminal user whether the network behavior to be detected is his own behavior; reviewing whether the terminal user has been hijacked or remotely operated; and confirming with the terminal user based on historical network behaviors that the network behaviors to be detected are all user operations. Other review rules can also be configured, and the specific ones are not limited.

[0054] If all the above detection and judgment processes are integrated, we can get the following Figure 3 The complete judgment process shown is that for any detected network behavior, the first step is to determine whether it is in the network security policy whitelist and whether it is in the network behavior feature whitelist; then determine whether it is in the window period and whether a network feature behavior is formed; finally, a manual review is performed on the network behavior that is not in the network behavior feature whitelist to determine whether it can be included in the network behavior feature whitelist; the conclusion is that if the judgment is successful, the detection review is passed, otherwise the network behavior is intercepted.

[0055] In addition, it should be noted that the inclusion of the network behavior to be detected in the preset network behavior feature whitelist can realize the dynamic update of the network behavior feature whitelist, and the updated network behavior feature whitelist network behavior source address, destination address, source port, destination port, and network data packet characteristics of the behavior are obtained from the network behavior characteristics. For example, Xiao Ming's "login account" network behavior A is recorded in the whitelist as the source address 11.11.11.11, port any, access destination address 10.10.10.10, port 80, and the network data packet characteristics of the behavior are "login account". The behavior time period in the network behavior feature whitelist is inherited from the time period that forms the network behavior characteristics. For example, Xiao Ming's "login account" network behavior A satisfies the KS test in 4 consecutive time periods from 9 am to 11 am and 6 consecutive time periods from 2 pm to 5 pm, and has a normal distribution characteristic. Then the behavior time period in the whitelist is recorded as 9 am to 11 am and 2 pm to 5 pm. Correspondingly, the maximum accessible number of times within the behavior time period is calculated as follows: within the time period that forms the network behavior characteristics, calculate the mean value A of the network behavior occurrence time avg and standard deviation A σ , in [A avg -2A σ , A avg +2A σ ] For data within the range, the maximum number of visits per day is multiplied by the statistical distribution probability of each time period within the behavior time period to obtain the maximum number of visits for each time period within the behavior time period, and the final result is generally rounded up.

[0056] For example, the data of Xiao Ming's "login account" network behavior A in the four consecutive time periods from 9:00 to 11:00 is calculated to get A avg = 10 hours and 10 minutes, standard deviation A σ = 25 minutes, then in [A avg -2A σ , A avg +2A σ ] range, that is, data within the range of 9:20 to 11 a.m., that is, all Xiao Ming's "login account" network behaviors that occurred between 9:20 and 11 a.m. since the beginning of historical records are composed of a set, and the maximum number of visits per day is taken (considering the weight K). For example, Xiao Ming "logged in to his account" 10 times between 9:20 and 11 a.m. last Monday, and "logged in to his account" 22 times between 9:20 and 11 a.m. on Monday four months ago, then the maximum number of visits per day is recorded as 11 times (22×0.5>10×1).

[0057] Breaking it down into four consecutive time periods from 9:00 to 11:00, assuming that Xiao Ming "logged into his account" online behavior 1,000 times from 9:20 to 11:00, 50 times from 9:20 to 9:30, 150 times from 9:30 to 10:00, 600 times from 10:00 to 10:30, and 200 times from 10:30 to 11:00. Then, in the time period from 9:00 to 9:30, the maximum number of visits is 11*50 / 1000=0.55 times (1 time); in the range of 9:30 to 10:00, the maximum number of visits is 11*150 / 1000=1.65 times (2 times); in the range of 10:00 to 10:30, the maximum number of visits is 11*600 / 1000=6.6 times (7 times); in the range of 10:30 to 11:00, the maximum number of visits is 11*200 / 1000=2.2 times (2 times). Finally, a whitelist of network behavior characteristics is formed.

[0058] Taking Xiao Ming's "account login" behavior as an example, the final whitelist format is source address 11.11.11.11, port any, destination address 10.10.10.10, port 80, the network packet feature of the behavior is "account login", the behavior time period is 9:00 to 11:00 in the morning, of which the maximum number of visits from 9:00 to 9:30 is 1, the maximum number of visits from 9:30 to 10:00 is 2, the maximum number of visits from 10:00 to 10:30 is 7, and the maximum number of visits from 10:30 to 11:00 is 2. The same applies from 2:00 to 5:00 in the afternoon.

[0059] The network behavior detection method based on network security strategy provided by the embodiment of the present application improves the system's defense capability against unknown network security vulnerabilities by judging and analyzing the network behavior to be detected; the network behavior can be constrained to a certain time and behavior content by indiscriminate judgment, thereby improving the defense capability; and the attack behavior of the security vulnerability is compressed into a fixed network behavior, which can enhance the problem location capability and facilitate targeted elimination of vulnerabilities. Therefore, the embodiment of the present application can solve the technical problem that the existing network security strategy cannot cope with the attack of the security vulnerability that has not been disclosed, resulting in poor system security performance.

[0060] For easier understanding, see Figure 2 The present application provides an embodiment of a network behavior detection device based on network security policy, including:

[0061] The first detection judgment module 201 is used to judge whether the network behavior to be detected is within the window period if the network behavior to be detected is in the preset network security policy whitelist and is not in the preset network behavior feature whitelist. If so, the network behavior to be detected is approved;

[0062] The second detection and judgment module 202 is used to determine whether the network behavior to be detected forms a network behavior feature if the network behavior to be detected exceeds the window period. If so, a manual review stage is performed. If not, the network behavior to be detected is intercepted. The manual review stage is to determine whether the network behavior to be detected meets the preset review rules.

[0063] Furthermore, it also includes:

[0064] The dual-core passing module 203 is used to approve the network behavior to be detected if it is in the preset network security policy whitelist and the network behavior to be detected is in the preset network behavior feature whitelist.

[0065] Furthermore, the second detection and judgment module 202 is specifically configured to:

[0066] If the network behavior to be detected exceeds the window period, the behavior frequency of the network behavior to be detected is counted based on the preset time weight;

[0067] Determine whether the behavior frequency conforms to the normal distribution. If so, the network behavior to be detected has formed the network behavior characteristics, and the manual review stage is carried out. If not, the network behavior to be detected has not formed the network behavior characteristics, and the network behavior to be detected is intercepted.

[0068] Furthermore, the manual review stage is specifically as follows:

[0069] Determine whether the network behavior to be detected meets the preset review rules. If so, the network behavior to be detected is included in the preset network behavior feature whitelist, and the network behavior to be detected is reviewed and approved. If not, the network behavior to be detected is intercepted.

[0070] The present application also provides a network behavior detection device based on network security policy, the device comprising a processor and a memory;

[0071] The memory is used to store the program code and transmit the program code to the processor;

[0072] The processor is used to execute the network behavior detection method based on network security policy in the above method embodiment according to the instructions in the program code.

[0073] The present application also provides a computer-readable storage medium, which is used to store program codes, and the program codes are used to execute the network behavior detection method based on network security policy in the above method embodiment.

[0074] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0075] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0076] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0077] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for executing all or part of the steps of the method described in each embodiment of the present application through a computer device (which can be a personal computer, a server, or a network device, etc.). The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (full name in English: Read-Only Memory, English abbreviation: ROM), random access memory (full name in English: Random Access Memory, English abbreviation: RAM), disk or optical disk and other media that can store program codes.

[0078] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A network behavior detection method based on network security strategy, characterized in that: include: If the network behavior to be detected is in the preset network security policy whitelist, and the network behavior to be detected is not in the preset network behavior feature whitelist, then determine whether the network behavior to be detected is within the window period. If so, the network behavior to be detected is approved; If the network behavior to be detected exceeds the window period, it is determined whether the network behavior to be detected forms a network behavior feature. If so, a manual review stage is performed. If not, the network behavior to be detected is intercepted. The manual review stage is to determine whether the network behavior to be detected meets the preset review rules. The specific process is as follows: If the network behavior to be detected exceeds the window period, the behavior frequency of the network behavior to be detected is counted based on a preset time weight; Determine whether the behavior frequency conforms to the normal distribution. If so, the network behavior to be detected has formed a network behavior feature, and a manual review stage is performed. If not, the network behavior to be detected has not formed a network behavior feature, and the network behavior to be detected is intercepted; The manual review stage is specifically as follows: Determine whether the network behavior to be detected meets the preset audit rules. If so, the network behavior to be detected is included in the preset network behavior feature whitelist, and the network behavior to be detected is audited. If not, the network behavior to be detected is intercepted.

2. The network behavior detection method based on network security strategy according to claim 1 is characterized in that: If the network behavior to be detected is in the preset network security policy whitelist, and the network behavior to be detected is not in the preset network behavior feature whitelist, then determining whether the network behavior to be detected is in the window period, and if so, the network behavior to be detected is approved, further comprising: If the network behavior to be detected is in the preset network security policy whitelist, and the network behavior to be detected is in the preset network behavior feature whitelist, then the network behavior to be detected is approved.

3. A network behavior detection device based on network security strategy, characterized in that: include: The first detection judgment module is used to judge whether the network behavior to be detected is within the window period if the network behavior to be detected is in the preset network security policy whitelist and the network behavior to be detected is not in the preset network behavior feature whitelist. If so, the network behavior to be detected is approved; The second detection and judgment module is used to determine whether the network behavior to be detected forms a network behavior feature if the network behavior to be detected exceeds the window period. If so, a manual review stage is performed. If not, the network behavior to be detected is intercepted. The manual review stage is to determine whether the network behavior to be detected meets the preset review rules. The second detection and judgment module is specifically used to: If the network behavior to be detected exceeds the window period, the behavior frequency of the network behavior to be detected is counted based on a preset time weight; Determine whether the behavior frequency conforms to the normal distribution. If so, the network behavior to be detected has formed a network behavior feature, and a manual review stage is performed. If not, the network behavior to be detected has not formed a network behavior feature, and the network behavior to be detected is intercepted; The manual review stage is specifically as follows: Determine whether the network behavior to be detected meets the preset audit rules. If so, the network behavior to be detected is included in the preset network behavior feature whitelist, and the network behavior to be detected is audited. If not, the network behavior to be detected is intercepted.

4. The network behavior detection device based on network security strategy according to claim 3 is characterized in that: Also includes: The dual-core passing module is used to verify that the network behavior to be detected is passed if the network behavior to be detected is in the preset network security policy whitelist and the network behavior to be detected is in the preset network behavior feature whitelist.

5. A network behavior detection device based on network security strategy, characterized in that: The device comprises a processor and a memory; The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the network behavior detection method based on network security policy according to any one of claims 1-2 according to the instructions in the program code.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store program codes, and the program codes are used to execute the network behavior detection method based on network security policy according to any one of claims 1-2.

Images