A method and device for detecting behavior recognition

Abstract

The present invention discloses a method and device for detecting behavior identification, which relates to the technical field of detecting behavior identification, in order to solve the problem of data loopholes. The method and device for detecting behavior identification, through the number of transmission control protocol connections, whether the transmission control protocol is successfully connected, and the number of successful transmission control protocol connections are all not within the qualified threshold range, then the data is indicated as detection behavior data, and the accuracy of data loophole detection can be further improved by confirming the detection behavior data. By obtaining log information, the specific IP address of the detection behavior data can be further traced, so that all information sent by the IP address in the future can be better blocked, effectively improving the accuracy of detecting behavior identification.

Description

Technical Field

[0001] The present invention relates to the technical field of detection behavior recognition, and in particular to a method and device for detection behavior recognition. Background Art

[0002] With the popularization of the Internet and the development of technology, various scanners and automated tools have emerged, making network attacks easier and more common. Important assets and critical infrastructure are often attacked and detected by a large number of hackers and cyber criminals. Network security faces threats from all sides.

[0003] The Chinese patent with publication number CN111586005B discloses a scanner scanning behavior recognition method, device, electronic device and computer-readable medium, which mainly obtains the currently accessed data packet from the server front end; disassembles and analyzes the data packet to extract the current fingerprint feature; matches the current fingerprint feature with multiple fingerprint features in the fingerprint feature library; when the current fingerprint feature matches any fingerprint feature of the multiple fingerprint features, determines that the current access includes the scanner scanning behavior, which can greatly reduce the probability of criminals using scanners to discover server vulnerabilities, increase the time cost of criminals discovering server vulnerabilities, and protect the network security of the server. Although the above patent solves the problem of detection behavior recognition, there are still the following problems in actual operation:

[0004] 1. When detecting and identifying data behavior, there is no effective blocking of abnormal detection behavior data, which causes abnormal data to be exchanged, resulting in poor asset security.

[0005] 2. When performing normal data exchange on the data detected without vulnerabilities, no corresponding selection is made for the transmission channel for data exchange and the storage space after the transmission is completed, resulting in too slow efficiency in data exchange. Summary of the invention

[0006] The purpose of the present invention is to provide a method and device for detecting behavior identification. If the number of transmission control protocol connections, whether the transmission control protocol is successfully connected, and the number of successful transmission control protocol connections are all outside the qualified threshold range, it indicates that the data is detection behavior data. By confirming the detection behavior data, the accuracy of data vulnerability detection can be further improved. By acquiring log information, the specific IP address of the detection behavior data can be further traced, so that all information sent by the IP address in the future can be better blocked, thereby effectively improving the accuracy of detection behavior identification and solving the problems in the prior art.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] A method for detecting behavior recognition comprises the following steps;

[0009] S1: Acquire the Hash information table data, identify and filter out data records with the same Hash value, extract the source IP address and destination IP address of the data records with the same Hash value, perform network communication behavior calculation on the extracted source IP address and destination IP address, and store the calculation result in the Hash information table data. At the same time, perform security detection on the source IP address;

[0010] S2: Monitor the behavior of the transmission control protocol in the network communication behavior, and judge the detection behavior according to the monitoring result of the transmission control protocol. When the network communication behavior is judged as the detection behavior, the output result is controlled by configuring the effect threshold, wherein the output result includes the alarm result and the blocking result. When the network communication behavior is normal, no log information is output;

[0011] S3: After the detection behavior judgment processing is completed, the transmission channel and import space of the data detected as having no vulnerabilities are selected. After the transmission channel and the import space are selected, the detection behavior data is marked as safe data.

[0012] Preferably, the operation on the source IP address and the destination IP address in S1 includes:

[0013] When the source IP address and the destination IP address are calculated, if the source IP address and the destination IP address in the network communication behavior are the same as the source IP address and the destination IP address in the Hash information table data, it means that the network communication behavior and the Hash information table data are the same set of source IP address and destination IP address, and the Hash information table data stores a unique combination of source IP address and destination IP address.

[0014] Preferably, the security detection of the source IP address in S1 includes:

[0015] Import the source IP address into the blacklist and whitelist database. When the source IP address is in the whitelist, the network communication behavior is normal; when the source IP address is in the blacklist, the network communication behavior is detection behavior, and no further operation is performed.

[0016] Preferably, the behavior monitoring of the transmission control protocol in the network communication behavior in S2 includes:

[0017] When the number of transmission control protocol connections is less than the first threshold of the standard transmission control protocol, the network communication behavior corresponding to the transmission control protocol is normal behavior;

[0018] Among them, the connection of the Transmission Control Protocol is a unique five-tuple at the same time, where the five-tuple includes the source IP address, source port, destination IP address, destination port and protocol. The number of Transmission Control Protocol connections is the statistics of multiple Transmission Control Protocol connections.

[0019] Preferably, the behavior monitoring of the transmission control protocol in the network communication behavior in S2 further includes:

[0020] When the number of transmission control protocol connections is greater than the first threshold of the standard transmission control protocol, and the number of successful transmission control protocol connections is greater than the second threshold of the standard transmission control protocol, the network communication behavior corresponding to the transmission control protocol is normal behavior;

[0021] Wherein, the successful connection of the transmission control protocol is that the confirmation character of the transmission control protocol is in the same transmission control protocol connection flow. When the confirmation character of the transmission control protocol exists in the network communication behavior, it indicates that the transmission control protocol connection is successful;

[0022] When the number of successful transmission control protocol connections is less than the second threshold of the standard transmission control protocol, and the number of destination ports is less than the third threshold of the standard transmission control protocol, the network communication behavior corresponding to the transmission control protocol is normal behavior;

[0023] The port number is the port data sent by the detection source through the synchronization sequence data packet of the transmission control protocol;

[0024] When the number of destination ports is greater than the third threshold of the standard transmission control protocol, the network communication behavior corresponding to the transmission control protocol is a detection behavior.

[0025] Preferably, the behavior monitoring of the transmission control protocol in the network communication behavior in S2 further includes:

[0026] When the effect threshold is false data or 0, the effect threshold is an alarm result; when the effect threshold is real data or 1, the effect threshold is a blocking result;

[0027] When the effect threshold is false data or 0, a log message is directly output. The log message content includes: time, source IP address, destination IP address, port number and alarm result;

[0028] When the effect threshold is real data or 1, a reset packet of the transmission control protocol will be sent to block the current link, and a log message will be output, including: time, source IP address, destination IP address, port number and blocking result.

[0029] Preferably, the selection of the transmission channel and import space for the data judged to be free of vulnerabilities in S3 includes:

[0030] The data length of the detection data without loopholes is obtained, and after the data length of the detection data without loopholes is obtained, it is marked as length data, and the length data is converted into capacity data;

[0031] The imported space data is obtained, and if there are multiple imported space data, the total capacity information and the remaining capacity information of each imported space are confirmed respectively;

[0032] Then, the detected vulnerability-free data is transmitted to the transmission channel data of the import space for acquisition, wherein the number of transmission channels is consistent with the number of import spaces;

[0033] Confirming channel parameters of the transmission channel, wherein the channel parameters of the transmission channel include transmission channel saturation and transmission channel remaining capacity;

[0034] A corresponding transmission channel is selected according to the capacity data, and then a corresponding import space is selected according to the transmission channel, wherein the capacity of the capacity data is smaller than the remaining capacity of the transmission channel, and the remaining capacity of the transmission channel is smaller than the remaining capacity of the import space.

[0035] Preferably, selecting a corresponding transmission channel according to the capacity data includes:

[0036] extracting the remaining capacity of each transmission channel;

[0037] extracting a rated data throughput per unit time of each transmission channel;

[0038] The first remaining capacity threshold and the second remaining capacity threshold are set by using the remaining capacity and the rated data throughput of each transmission channel; wherein the first remaining capacity threshold and the second remaining capacity threshold are obtained by the following formula:

[0039]

[0040] Among them, C 01 and C 02 Respectively represent the first remaining capacity threshold and the second remaining capacity threshold; C e represents the remaining capacity of the transmission channel; e represents a constant; n represents the total number of transmission channels whose capacity data is less than the remaining capacity of the transmission channel; C i represents the rated data throughput per unit time of the i-th transmission channel; C p represents the average data throughput per unit time of n transmission channels; C z Indicates the occupied capacity of the transmission channel;

[0041] When the capacity of the capacity data does not exceed the first remaining capacity threshold, the transmission channel corresponding to which the capacity of the capacity data does not exceed the first remaining capacity threshold is determined as the target channel;

[0042] When the capacity of the capacity data exceeds the first remaining capacity threshold but does not exceed the second remaining capacity threshold, a transmission channel corresponding to the capacity of the capacity data exceeding the first remaining capacity threshold but not exceeding the second remaining capacity threshold is used as a candidate channel;

[0043] When the capacity of the capacity data exceeds the second remaining capacity threshold, the transmission channel corresponding to the capacity of the capacity data exceeding the second remaining capacity threshold is used as an abandoned channel.

[0044] Preferably, selecting a corresponding import space according to a transmission channel includes:

[0045] Extracting the remaining capacity of each import space;

[0046] Extracting the data import amount per unit time of each import space;

[0047] The remaining capacity of each import space and the amount of data imported per unit time of each import space are used to set the remaining capacity threshold of the space; wherein the remaining capacity threshold of the space is obtained by the following formula:

[0048]

[0049] Among them, C k Indicates the remaining capacity threshold of the space; C zk represents the occupied capacity of the import space; m represents the number of import spaces whose remaining capacity of the transmission channel is less than the remaining capacity of the import space; C ki represents the amount of data imported per unit time of each import space of the i-th import space; C kpi represents the average amount of data imported per unit time of each import space of the i-th import space;

[0050] When the remaining capacity of the transmission channel does not exceed the remaining capacity threshold of the space, the imported space is identified as the target space;

[0051] When the remaining capacity of the transmission channel exceeds the space remaining capacity threshold, the imported space is deemed to be abandoned space.

[0052] The present invention provides another technical solution, a device for detecting a behavior recognition method, comprising:

[0053] Host and host port;

[0054] First, the host is subjected to host vulnerability detection, wherein the host vulnerability detection includes ICMP (integrated circuit board) vulnerability detection and TCP SYN (synchronizer) vulnerability detection;

[0055] After the host vulnerability detection is completed, the host port detection is performed, wherein the host port detection is TCP SYN (synchronizer) port detection.

[0056] Compared with the prior art, the present invention has the following beneficial effects:

[0057] 1. The present invention provides a method and device for detecting behavior identification. If the number of transmission control protocol connections, whether the transmission control protocol is successfully connected, and the number of successful transmission control protocol connections are all outside a qualified threshold range, then the data is indicated as detection behavior data. By confirming the detection behavior data, the accuracy of data vulnerability detection can be further improved.

[0058] 2. The method and device for detecting behavior identification provided by the present invention can further trace back to the specific IP address of the detecting behavior data by acquiring log information, thereby better blocking all information sent from the IP address in the future, effectively improving the accuracy of detecting behavior identification.

[0059] 3. The present invention provides a method and device for detecting behavior identification. According to the capacity of the detected vulnerability-free data, a transmission channel larger than the data capacity is selected. According to this method, the transmission speed during data exchange can be faster. According to the capacity of the transmission channel after the data exchange, an import space larger than the transmission channel capacity is selected. According to this method, the capacity of the storage space for storing the exchanged data can be larger, and the problem of data security risks caused by capacity overflow will not occur. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is a schematic diagram of the overall detection and identification process of the present invention. DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] In order to solve the problem in the prior art that, when detecting and identifying data, abnormal detection behavior data is not effectively blocked, so that abnormal data is exchanged and the asset security situation is poor, please refer to Figure 1 , this embodiment provides the following technical solutions:

[0063] A method for detecting behavior recognition comprises the following steps;

[0064] S1: Acquire the Hash information table data, identify and filter out data records with the same Hash value, extract the source IP address and destination IP address of the data records with the same Hash value, perform network communication behavior calculation on the extracted source IP address and destination IP address, and store the calculation result in the Hash information table data. At the same time, perform security detection on the source IP address;

[0065] S2: Monitor the behavior of the transmission control protocol in the network communication behavior, and judge the detection behavior according to the monitoring result of the transmission control protocol. When the network communication behavior is judged as the detection behavior, the output result is controlled by configuring the effect threshold, wherein the output result includes the alarm result and the blocking result. When the network communication behavior is normal, no log information is output;

[0066] S3: After the detection behavior judgment processing is completed, the transmission channel and import space of the data detected as having no vulnerabilities are selected. After the transmission channel and the import space are selected, the detection behavior data is marked as safe data.

[0067] Specifically, if the number of transmission control protocol connections, whether the transmission control protocol is successfully connected, and the number of successful transmission control protocol connections are all outside the qualified threshold range, it means that the data is detection behavior data. By confirming the detection behavior data, the accuracy of data vulnerability detection can be further improved. By obtaining log information, the specific IP address of the detection behavior data can be further traced back, so that all information sent by the IP address in the future can be better blocked, effectively improving the accuracy of detection behavior identification. According to the capacity of the detected vulnerability-free data, a transmission channel larger than the data capacity is selected. According to this method, the transmission speed can be faster when data is exchanged. According to the capacity of the transmission channel after the data is exchanged, an import space larger than the transmission channel capacity is selected. According to this method, the capacity of the storage space for storing the exchanged data can be larger, and there will be no security risks to the data caused by capacity overflow.

[0068] The operations for the source IP address and destination IP address in S1 include:

[0069] When the source IP address and the destination IP address are calculated, if the source IP address and the destination IP address in the network communication behavior are the same as the source IP address and the destination IP address in the Hash information table data, it means that the network communication behavior and the Hash information table data are the same set of source IP address and destination IP address, and the Hash information table data stores a unique combination of source IP address and destination IP address.

[0070] Specifically, before the behavior data to be detected is identified and detected, the data will be judged, wherein it is judged whether the source IP address and destination IP address in the network communication behavior are the same as the source IP address and destination IP address in the Hash information table data. If the source IP address and destination IP address in the network communication behavior are the same as the source IP address and destination IP address in the Hash information table data, it indicates that the behavior data to be detected is qualified data. When the qualified data is detected as abnormal data, the IP address data can be added to the blacklist by tracing the source IP address and destination IP address of the abnormal data, thereby further improving the authenticity and security of the behavior data to be detected.

[0071] Security checks on source IP addresses in S1 include:

[0072] Import the source IP address into the blacklist and whitelist database. When the source IP address is in the whitelist, the network communication behavior is normal; when the source IP address is in the blacklist, the network communication behavior is detection behavior, and no further operation is performed.

[0073] Specifically, if the IP address is detected in the blacklist of the blacklist and whitelist database, it means that the IP address and the corresponding detection behavior data are abnormal data, and the abnormal data is directly blocked, thereby improving the security of the data when performing detection behavior identification.

[0074] Behavior monitoring of the transmission control protocol in network communication behavior in S2, including:

[0075] When the number of transmission control protocol connections is less than the first threshold of the standard transmission control protocol, the network communication behavior corresponding to the transmission control protocol is normal behavior;

[0076] Among them, the connection of the Transmission Control Protocol is a unique five-tuple at the same time, where the five-tuple includes the source IP address, source port, destination IP address, destination port and protocol. The number of Transmission Control Protocol connections is the statistics of multiple Transmission Control Protocol connections.

[0077] When the number of transmission control protocol connections is greater than the first threshold of the standard transmission control protocol, and the number of successful transmission control protocol connections is greater than the second threshold of the standard transmission control protocol, the network communication behavior corresponding to the transmission control protocol is normal behavior;

[0078] Wherein, the successful connection of the transmission control protocol is that the confirmation character of the transmission control protocol is in the same transmission control protocol connection flow. When the confirmation character of the transmission control protocol exists in the network communication behavior, it indicates that the transmission control protocol connection is successful;

[0079] When the number of successful transmission control protocol connections is less than the second threshold of the standard transmission control protocol, and the number of destination ports is less than the third threshold of the standard transmission control protocol, the network communication behavior corresponding to the transmission control protocol is normal behavior;

[0080] The port number is the port data sent by the detection source through the synchronization sequence data packet of the transmission control protocol;

[0081] When the number of destination ports is greater than the third threshold of the standard transmission control protocol, the network communication behavior corresponding to the transmission control protocol is a detection behavior.

[0082] Specifically, the behavior data to be detected is first judged whether it is real detection data, wherein, first, based on the number of transmission control protocol connections, whether the transmission control protocol is successfully connected, and the number of successful transmission control protocol connections, it is judged whether it is normal network communication behavior. If all are normal behaviors, it means that the data is qualified data that does not need to be detected. The three methods of judgment can effectively improve the accuracy of data detection judgment. If the number of transmission control protocol connections, whether the transmission control protocol is successfully connected, and the number of successful transmission control protocol connections are all outside the qualified threshold range, it means that the data is detection behavior data. By confirming the detection behavior data, the accuracy of data vulnerability detection can be further improved.

[0083] Behavior monitoring of the transmission control protocol in network communication behavior in S2 also includes:

[0084] When the effect threshold is false data or 0, the effect threshold is an alarm result; when the effect threshold is real data or 1, the effect threshold is a blocking result;

[0085] When the effect threshold is false data or 0, a log message is directly output. The log message content includes: time, source IP address, destination IP address, port number and alarm result;

[0086] When the effect threshold is real data or 1, a reset packet of the transmission control protocol will be sent to block the current link, and a log message will be output, including: time, source IP address, destination IP address, port number and blocking result.

[0087] Specifically, after the detection behavior data is determined, the detection behavior data is further judged, wherein the output result can be controlled by configuring the effect threshold. When the effect threshold is false data or 0, the reset data packet of the transmission control protocol is not sent, and only a log message is directly output. By obtaining the log information, the specific IP address of the detection behavior data can be further traced, so that all information sent by the IP address in the future can be better blocked, effectively improving the accuracy of detection behavior identification.

[0088] In order to solve the problem in the prior art that, when exchanging data without vulnerability detection, the transmission channel for data exchange and the storage space after the transmission are not selected accordingly, resulting in the problem that the efficiency of data exchange is too low, please refer to Figure 1 , this embodiment provides the following technical solutions:

[0089] The selection of transmission channels and import spaces for data judged to be free of vulnerabilities in S3 includes:

[0090] The data length of the detection data without loopholes is obtained, and after the data length of the detection data without loopholes is obtained, it is marked as length data, and the length data is converted into capacity data;

[0091] The imported space data is obtained, and if there are multiple imported space data, the total capacity information and the remaining capacity information of each imported space are confirmed respectively;

[0092] Then, the detected vulnerability-free data is transmitted to the transmission channel data of the import space for acquisition, wherein the number of transmission channels is consistent with the number of import spaces;

[0093] Confirming channel parameters of the transmission channel, wherein the channel parameters of the transmission channel include transmission channel saturation and transmission channel remaining capacity;

[0094] A corresponding transmission channel is selected according to the capacity data, and then a corresponding import space is selected according to the transmission channel, wherein the capacity of the capacity data is smaller than the remaining capacity of the transmission channel, and the remaining capacity of the transmission channel is smaller than the remaining capacity of the import space.

[0095] Specifically, selecting a corresponding transmission channel according to the capacity data includes:

[0096] extracting the remaining capacity of each transmission channel;

[0097] extracting a rated data throughput per unit time of each transmission channel;

[0098] The first remaining capacity threshold and the second remaining capacity threshold are set by using the remaining capacity and the rated data throughput of each transmission channel; wherein the first remaining capacity threshold and the second remaining capacity threshold are obtained by the following formula:

[0099]

[0100] Among them, C 01 and C 02 Respectively represent the first remaining capacity threshold and the second remaining capacity threshold; C erepresents the remaining capacity of the transmission channel; e represents a constant; n represents the total number of transmission channels whose capacity data is less than the remaining capacity of the transmission channel; C i represents the rated data throughput per unit time of the i-th transmission channel; C p represents the average data throughput per unit time of n transmission channels; C z Indicates the occupied capacity of the transmission channel;

[0101] When the capacity of the capacity data does not exceed the first remaining capacity threshold, the transmission channel corresponding to which the capacity of the capacity data does not exceed the first remaining capacity threshold is determined as the target channel;

[0102] When the capacity of the capacity data exceeds the first remaining capacity threshold but does not exceed the second remaining capacity threshold, a transmission channel corresponding to the capacity of the capacity data exceeding the first remaining capacity threshold but not exceeding the second remaining capacity threshold is used as a candidate channel;

[0103] When the capacity of the capacity data exceeds the second remaining capacity threshold, the transmission channel corresponding to the capacity of the capacity data exceeding the second remaining capacity threshold is used as an abandoned channel.

[0104] The technical effects of the above technical solution are: Dynamic channel selection: This method uses a dynamic method to select a suitable channel based on the remaining capacity and rated data throughput of each transmission channel. This helps to maximize the use of available channel resources to meet the needs of different applications and data flows.

[0105] Flexible channel allocation: By setting the first remaining capacity threshold and the second remaining capacity threshold, the method can automatically adjust the allocation and usage of channels according to the current network conditions. This helps the network achieve better performance and resource utilization under different load conditions.

[0106] Channel selection and abandonment: According to the size of the capacity data, this method divides the transmission channel into target channel, alternative channel and abandoned channel. This hierarchical method allows fast channel switching as needed to ensure the effectiveness and stability of data transmission.

[0107] Average data throughput consideration: By considering the average data throughput per unit time (C p ), this method can better balance the data transmission between different channels to avoid overloading some channels while underutilizing other channels.

[0108] In general, the main technical effect of this technical solution is to improve the management efficiency of the transmission channel, so that the network can better cope with different load and traffic requirements, thereby providing better performance and resource utilization. This method is applicable to various communication systems and network environments, and helps to improve the quality and reliability of data transmission. However, the specific effect also depends on the parameter settings and the requirements of the actual application scenario.

[0109] Specifically, the corresponding import space is selected according to the transmission channel, including:

[0110] Extracting the remaining capacity of each import space;

[0111] Extracting the data import amount per unit time of each import space;

[0112] The remaining capacity of each import space and the amount of data imported per unit time of each import space are used to set the remaining capacity threshold of the space; wherein the remaining capacity threshold of the space is obtained by the following formula:

[0113]

[0114] Among them, C k Indicates the remaining capacity threshold of the space; C zk represents the occupied capacity of the import space; m represents the number of import spaces whose remaining capacity of the transmission channel is less than the remaining capacity of the import space; C ki represents the amount of data imported per unit time of each import space of the i-th import space; C kpi represents the average amount of data imported per unit time of each import space of the i-th import space;

[0115] When the remaining capacity of the transmission channel does not exceed the remaining capacity threshold of the space, the imported space is identified as the target space;

[0116] When the remaining capacity of the transmission channel exceeds the space remaining capacity threshold, the imported space is deemed to be abandoned space.

[0117] The technical effects of the above technical solution are as follows: Dynamic space selection: This method dynamically selects a suitable import space by considering the remaining capacity of the transmission channel and the remaining capacity of the import space, as well as the amount of data imported per unit time of the import space. This helps to maximize the use of available import space resources to meet different data import requirements.

[0118] Flexible resource allocation: By setting the space remaining capacity threshold, this method can automatically adjust resource allocation according to the current state of the import space and transmission channel. In this way, resources can be allocated according to actual needs, thereby improving resource utilization efficiency.

[0119] Import space classification: Based on the comparison between the remaining capacity of the transmission channel and the space remaining capacity threshold, this method classifies the import space into two categories: target space and abandoned space. This helps to quickly decide whether to use a specific import space to meet the transmission demand.

[0120] Consideration of average data import volume: By considering the average data import volume per unit time of each import space (C kpi ), this method can better balance the data import tasks and avoid overloading some import spaces while underutilizing other import spaces.

[0121] In general, the main technical effect of this technical solution is to improve the management efficiency of the import space, so that the system can better adapt to different data import requirements and resource status. This method is suitable for application scenarios that require effective management and allocation of import space resources, and helps to improve the efficiency and reliability of data import. However, the specific effect still depends on the parameter settings and actual application requirements.

[0122] Specifically, the capacity of the detected data without vulnerabilities is first obtained, then the remaining capacity of the transmission channel during data exchange is obtained, and finally the remaining capacity of the import space for the final detected data without vulnerabilities is obtained. According to the capacity of the detected data without vulnerabilities, a transmission channel larger than the data capacity is selected. According to this method, the transmission speed during data exchange can be faster. According to the capacity of the transmission channel after the data exchange, an import space larger than the transmission channel capacity is selected. According to this method, the capacity of the storage space for storing the exchanged data can be larger, and there will be no security risks to the data due to capacity overflow.

[0123] A device for detecting a behavior recognition method, comprising:

[0124] Host and host port;

[0125] First, the host is subjected to host vulnerability detection, wherein the host vulnerability detection includes ICMP (integrated circuit board) vulnerability detection and TCP SYN (synchronizer) vulnerability detection;

[0126] After the host vulnerability detection is completed, the host port detection is performed, wherein the host port detection is TCP SYN (synchronizer) port detection.

[0127] Specifically, when performing host vulnerability detection, it is possible to determine whether the data is detection data based on the data from ICMP (integrated circuit board) vulnerability detection and TCP SYN (synchronizer) vulnerability detection. When performing host port detection, it is possible to confirm whether the data is detection data based on TCP SYN (synchronizer) port detection, thereby improving the efficiency of judging malicious detection behavior.

[0128] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0129] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for detecting behavior recognition, characterized in that: The method comprises the following steps: S1: Acquire the Hash information table data, identify and filter out data records with the same Hash value, extract the source IP address and destination IP address of the data records with the same Hash value, perform network communication behavior calculation on the extracted source IP address and destination IP address, and store the calculation result in the Hash information table data. At the same time, perform security detection on the source IP address; S2: Monitor the behavior of the transmission control protocol in the network communication behavior, and judge the detection behavior according to the monitoring result of the transmission control protocol. When the network communication behavior is judged as the detection behavior, the output result is controlled by configuring the effect threshold, wherein the output result includes the alarm result and the blocking result. When the network communication behavior is normal, no log information is output; S3: After the detection behavior judgment processing is completed, the transmission channel and import space of the data detected as having no vulnerabilities are selected. After the transmission channel and import space are selected, the detection behavior data is marked as safe data; Behavior monitoring of the transmission control protocol in network communication behavior in S2 also includes: When the effect threshold is false data or 0, the effect threshold is an alarm result; when the effect threshold is real data or 1, the effect threshold is a blocking result; When the effect threshold is false data or 0, a log message is directly output. The log message content includes: time, source IP address, destination IP address, port number and alarm result; When the effect threshold is real data or 1, a reset packet of the transmission control protocol will be sent to block the current link, and a log message will be output, including: time, source IP address, destination IP address, port number and blocking result.

2. The method for detecting behavior recognition according to claim 1, characterized in that: The operations for the source IP address and destination IP address in S1 include: When the source IP address and the destination IP address are calculated, if the source IP address and the destination IP address in the network communication behavior are the same as the source IP address and the destination IP address in the Hash information table data, it means that the network communication behavior and the Hash information table data are the same set of source IP address and destination IP address, and the Hash information table data stores a unique combination of source IP address and destination IP address.

3. The method for detecting behavior recognition according to claim 1, characterized in that: Security checks on source IP addresses in S1 include: Import the source IP address into the blacklist and whitelist database. When the source IP address is in the whitelist, the network communication behavior is normal; when the source IP address is in the blacklist, the network communication behavior is detection behavior, and no further operation is performed.

4. The method for detecting behavior recognition according to claim 1, characterized in that: Behavior monitoring of the transmission control protocol in network communication behavior in S2, including: When the number of transmission control protocol connections is less than the first threshold of the standard transmission control protocol, the network communication behavior corresponding to the transmission control protocol is normal behavior; Among them, the connection of the Transmission Control Protocol is a unique five-tuple at the same time, where the five-tuple includes the source IP address, source port, destination IP address, destination port and protocol. The number of Transmission Control Protocol connections is the statistics of multiple Transmission Control Protocol connections.

5. The method for detecting behavior recognition according to claim 4, characterized in that: Behavior monitoring of the transmission control protocol in network communication behavior in S2 also includes: When the number of transmission control protocol connections is greater than the first threshold of the standard transmission control protocol, and the number of successful transmission control protocol connections is greater than the second threshold of the standard transmission control protocol, the network communication behavior corresponding to the transmission control protocol is normal behavior; Wherein, the successful connection of the transmission control protocol is that the confirmation character of the transmission control protocol is in the same transmission control protocol connection flow. When the confirmation character of the transmission control protocol exists in the network communication behavior, it indicates that the transmission control protocol connection is successful; When the number of successful transmission control protocol connections is less than the second threshold of the standard transmission control protocol, and the number of destination ports is less than the third threshold of the standard transmission control protocol, the network communication behavior corresponding to the transmission control protocol is normal behavior; The port number is the port data sent by the detection source through the synchronization sequence data packet of the transmission control protocol; When the number of destination ports is greater than the third threshold of the standard transmission control protocol, the network communication behavior corresponding to the transmission control protocol is a detection behavior.

6. The method for detecting behavior recognition according to claim 5, characterized in that: The selection of transmission channels and import spaces for data judged to be free of vulnerabilities in S3 includes: The data length of the detection data without loopholes is obtained, and after the data length of the detection data without loopholes is obtained, it is marked as length data, and the length data is converted into capacity data; The imported space data is obtained, and if there are multiple imported space data, the total capacity information and the remaining capacity information of each imported space are confirmed respectively; Then, the detected vulnerability-free data is transmitted to the transmission channel data of the import space for acquisition, wherein the number of transmission channels is consistent with the number of import spaces; Confirming channel parameters of the transmission channel, wherein the channel parameters of the transmission channel include transmission channel saturation and transmission channel remaining capacity; A corresponding transmission channel is selected according to the capacity data, and then a corresponding import space is selected according to the transmission channel, wherein the capacity of the capacity data is smaller than the remaining capacity of the transmission channel, and the remaining capacity of the transmission channel is smaller than the remaining capacity of the import space.

7. The method for detecting behavior recognition according to claim 6, characterized in that: Select the corresponding transmission channel based on the capacity data, including: extracting the remaining capacity of each transmission channel; extracting a rated data throughput per unit time of each transmission channel; The first remaining capacity threshold and the second remaining capacity threshold are set by using the remaining capacity and the rated data throughput of each transmission channel; wherein the first remaining capacity threshold and the second remaining capacity threshold are obtained by the following formula: Among them, C 01 and C 02 Respectively represent the first remaining capacity threshold and the second remaining capacity threshold; C e represents the remaining capacity of the transmission channel; e represents a constant; n represents the total number of transmission channels whose capacity data is less than the remaining capacity of the transmission channel; C i represents the rated data throughput per unit time of the i-th transmission channel; C p represents the average data throughput per unit time of n transmission channels; C z Indicates the occupied capacity of the transmission channel; When the capacity of the capacity data does not exceed the first remaining capacity threshold, the transmission channel corresponding to which the capacity of the capacity data does not exceed the first remaining capacity threshold is determined as the target channel; When the capacity of the capacity data exceeds the first remaining capacity threshold but does not exceed the second remaining capacity threshold, a transmission channel corresponding to the capacity of the capacity data exceeding the first remaining capacity threshold but not exceeding the second remaining capacity threshold is used as a candidate channel; When the capacity of the capacity data exceeds the second remaining capacity threshold, the transmission channel corresponding to the capacity of the capacity data exceeding the second remaining capacity threshold is used as an abandoned channel.

8. The method for detecting behavior recognition according to claim 7, characterized in that: Select the corresponding import space according to the transmission channel, including: Extracting the remaining capacity of each import space; Extracting the data import amount per unit time of each import space; The remaining capacity of each import space and the amount of data imported per unit time of each import space are used to set the remaining capacity threshold of the space; wherein the remaining capacity threshold of the space is obtained by the following formula: Among them, C k Indicates the remaining capacity threshold of the space; C zk represents the occupied capacity of the import space; m represents the number of import spaces whose remaining capacity of the transmission channel is less than the remaining capacity of the import space; C ki represents the amount of data imported per unit time of each import space of the i-th import space; C kpi represents the average amount of data imported per unit time of each import space of the i-th import space; When the remaining capacity of the transmission channel does not exceed the remaining capacity threshold of the space, the imported space is identified as the target space; When the remaining capacity of the transmission channel exceeds the space remaining capacity threshold, the imported space is deemed to be abandoned space.

9. A device for detecting behavior recognition, applied in a method for detecting behavior recognition as claimed in claim 1, characterized in that: include: Host and host port; First, the host is subjected to host vulnerability detection, wherein the host vulnerability detection includes integrated circuit board vulnerability detection and synchronizer vulnerability detection; After the host vulnerability detection is completed, the host port detection is performed, wherein the host port detection is the synchronizer port detection.

Images