Network attack analysis method

Abstract

The invention discloses a network attack analysis method. Through the method, the current network attack condition can be evaluated and the attack situation deserving most attention currently can be described according to a huge amount of logs produced by an intrusion detection system. The method comprises the following steps: acquiring the logs of an intrusion detection system, and judging whether there is a large-scale network attack event by calculating the distribution of the source addresses and destination addresses of the logs of the intrusion detection system; merging the logs of the intrusion detection system according to three parameters, namely, source address, destination address and event type, and detecting and reporting abnormal addresses and hot events; making a statistical analysis of and displaying the propagation process of the hot events in a specified period of time; and associating the output results, and presenting a comprehensive evaluation of the current network attack condition. The system comprises an entropy module unit, a triple module unit, a hot event propagation display module unit, and a comprehensive association analysis module unit.

Description

technical field [0001] The invention relates to the field of information security, in particular to a network attack analysis method. Background technique [0002] The rapid development of the Internet has brought great convenience to the dissemination and utilization of information, but at the same time, human society is facing a huge challenge of information security. In order to alleviate the increasingly serious security problems, intrusion detection equipment (IDS: IntrusionDetectionSystem) has been deployed more and more widely. IDS is installed in the protected network segment, and its monitoring network card works in promiscuous mode, analyzes all data packets in the network segment, and performs real-time detection and response to network attack events. At present, IDS generally adopts the misuse detection technology. The detection method is as follows: first, code the identification specific intrusion behavior pattern, establish a misuse pattern library, and then ...

AI Technical Summary

Problems solved by technology

Due to the large number of alarms and many irrelevant alarms, most of the energy of security management personnel is spent on processing useless information, and it is difficult to understand the security threat status of the system

[0005] 2. Most of the existing intrusion detection equipment detects based on a single data packet, which is reflected in the form of expression. The alarm information of the intrusion detection equipment is an isolated intrusion event

In this way, when large-scale network abnormal behavior occurs, it is difficult to intuitively obtain the characteristics of the abnormal behavior from the alarm information, and it is difficult to evaluate the current network attack situation as a whole

Images