Alarming method and device for attack on network

Abstract

The embodiment of the invention provides an alarming method and device for an attack on a network. The alarming method for the attack on the network comprises the steps that alarming information needing to conduct alarming on the attack on the network is acquired, wherein the alarming information comprises attack characteristics of the attack on the network; the similarity between the alarming information and alarmed information is determined on the basis of the similarity between the attack characteristics of the alarming information and attack characteristics of the alarmed information; andwhen the similarity between the alarming information and the alarmed information does not meet a preset similarity condition, alarming is conducted with the alarming information.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to an alarm method and device for network attacks. Background technique [0002] As an important means of network security protection, the web intrusion detection system is usually deployed on the web server or on the bypass road, and can monitor and analyze the real-time traffic of web access, discover the attack behavior against the web in time, and effectively solve the problems faced by the web. security issues. [0003] If the system discovers an attack, it should respond as soon as possible. Common response methods include alarm, network disconnection, and policy processing. At present, the alarm method is a common response method. The system can report the threat corresponding to the attack behavior to the administrator in a timely manner by alarming the attack behavior of the Web. The administrator can further deal with the threat by processing the alarm ...

AI Technical Summary

Problems solved by technology

[0008] Due to the simple division of threat information in the alarm information, a large number of high-risk alarms appear in the system, and the same high-risk alarm threat message will be repeatedly alarmed, which increases the redundancy of the message, and the administrator cannot extract the effectiveness of the alarm from a large number of high-risk alarm information. information; or after a preset period of time, a large number of general alarms appear in the system, and the same general alarm threat message will be repeatedly alarmed, which increases the redundancy of the message, and the administrator cannot extract the effective information of the alarm from the general alarm. In short, there are a large number of alarm information in the system, and it is difficult for the administrator to extract the alarm information from the threat information in the alarm information.

Images