Detection method for network abnormality attacks

Abstract

The invention aims at providing a detection method for network abnormality attacks. Efficient detection on the network abnormality attacks is achieved by cooperatively using the steps of data marking,data mark splitting, normalization processing, data modeling, data abnormality attack judging and the like, the problems that a traditional rule-based detection method is high in maintenance cost andthreshold and needs real-time updating are solved, and meanwhile the private protocol attack detection problem which cannot be solved by existing industrial security manufactures generally is solved.

Description

technical field [0001] The invention belongs to the field of network security, in particular to a method for detecting abnormal network attacks. Background technique [0002] Under the existing technical conditions, the traditional network intrusion detection technology intercepts the data accessed by intrusion by manually maintaining the rule set. On the one hand, hard-coded rules are easily bypassed by flexible hackers, and rule sets based on previous knowledge are difficult to deal with 0-day attacks; big. Furthermore, in the industrial network, there are a large number of communication behaviors with fixed modes, such as data collection through the OPC protocol, and industrial process control using the S7 protocol. These behaviors have relatively fixed communication patterns that vary little. At present, the commonly used method in the industry is to use Deep Packet Inspection (Deep Packet Inspection), which can identify various communication behaviors, standardize no...

AI Technical Summary

Problems solved by technology

At the same time, it also solves the problem of attack detection of private protocols that industrial security manufacturers generally cannot solve.

Images