Method and system for detecting attacks in events

Abstract

The embodiment of the invention discloses a method and system for detecting attacks in events for effectively detecting the attacks and improving the success rate and accuracy of attack detection. Themethod in the embodiment of the invention comprises the following steps: collecting a request data packet and a response data packet of attack; separately matching the request data packet and the response data packet by a preset packet return feature library; in the case of matching failure, detecting whether the attack has available vulnerability; if the detection result is yes, performing vulnerability correlation analysis on the attack and the target object to determine whether the target object has vulnerability; if the target object has the vulnerability, determining attack success; andif the detection result is undetermined, performing context correlation analysis on the request data packet and the response data packet to determine whether the attack is successful and the influencegenerated by the attack. The embodiment of the invention further discloses a system for detecting attacks in events for improving the success rate and accuracy of attack detection.

Description

technical field [0001] The invention relates to the technical field of computer network defense, in particular to a method and system for detecting incidental attacks. Background technique [0002] Computer network attack means that the network attacker obtains illegal permissions through illegal means (such as deciphering passwords, electronic spoofing, etc.) and uses these illegal permissions to enable the network attacker to perform unauthorized operations on the attacked host. The main ways of network attacks are: deciphering passwords, IP spoofing and DNS spoofing. [0003] At present, the main detection methods for computer network attacks are: performing static rule base matching on attack request data packets, and detecting reply status codes of request data packets. Wherein the static rule base stores the request data packet characteristic of the pre-statistical attack, when the request data packet of the visit matches the request data packet characteristic of the ...

AI Technical Summary

Problems solved by technology

For example, for command injection attacks, it is often necessary to check whether the return packet contains the execution result before judging whether the attack has affected the target object; secondly, the method of judging whether the reply status code is 200 OK is too general, and many servers currently can It is set to return 200 OK regardless of whether the request is valid, including the software firewall on the server can return 200 OK, so the detection method of static rule base matching and reply status code for the attack cannot realize the effective detection of the attack

Images