Attack detecting method and device

Abstract

The invention provides an attack detecting method and an attack detecting device, relates to the field of information management, and solves the problem that a correlation analysis mode is not applicable to complicated scenes. The attack detecting method comprises the steps of: extracting scene security events conforming to preset association rules; carrying out correlation analysis on the security events; and determining that the attack is detected when correlation analysis results conform to the association rules. The technical scheme provided by the invention is applicable to information security, and the associated multi-event attach detection is realized.

Description

technical field [0001] The invention relates to the field of information management, in particular to an attack detection method and device. Background technique [0002] In order to alleviate the increasingly serious information security problems, more and more enterprises and institutions have deployed network security equipment such as firewalls, intrusion detection systems (Intrusion Detection Systems, IDS), and abnormal traffic detection systems, which effectively reduce the security risks of information systems. These traditional network security devices can capture, flow reassemble, and protocol analyze data packets in the network according to the set detection rules, discover attack events in the network, and respond according to the set method. However, a threatening attack behavior is often composed of a series of related attack events. These attack events will trigger different network security devices to generate several related alarm messages. Traditional networ...

AI Technical Summary

Problems solved by technology

[0006] The invention provides an attack detection method and device, which solves the problem that the correlation analysis method is not suitable for complex scenarios

Images