Hacker attack grading detection method and device

Abstract

The invention discloses a hacker attack grading detection method and device. The method comprises the steps of obtaining log information; extracting related fields from the log information according to an aggregation model, and obtaining the aggregation model by fitting the corresponding relation between all the fields in the log information and hacker behaviors and obtaining the related fields having a pointing effect on hacker behavior judgment; obtaining a corresponding attribute value of the related field; performing aggregation calculation on the corresponding attribute values of the related fields to obtain scores corresponding to the log information; and according to the score and a preset hacker behavior grading judgment rule, carrying out grading judgment on a behavior corresponding to the log information. According to the method, the manual workload can be reduced, hierarchical pre-judgment of hacker attack levels can be realized, and new hacker attack skills can be detectedin a fuzzy manner, so that security personnel can further position and analyze the attack skills conveniently, and the purpose of feeding back other strategy protection is achieved.

Description

technical field [0001] The invention relates to the field of hacker detection, in particular to a hacker attack classification detection method and device. Background technique [0002] Hacking is an act of using security loopholes to destroy and harm users' interests, including but not limited to exploiting loopholes to steal user privacy and virtual property, invading business systems, stealing user data, affecting normal business operations, and maliciously spreading loopholes. Feature portrait refers to a tagged user model abstracted based on user behavior information such as hacking behavior, methods, and means. Tags are highly refined feature identifications obtained through the analysis of hacker behavior. Through tagging, some highly generalized and easy-to-understand features can be used to identify hackers, and it is easier to identify hackers' attack behaviors, achieving the purpose of quick abnormal alarm and post-event source analysis. [0003] Such as figure...

AI Technical Summary

Problems solved by technology

[0004] (1) The labor cost is high, and professionals need to use existing rules to judge and extract keywords for analysis

[0005] (2) Lack of grading, unable to judge hacker attack grading

[0006] (3) New attack forms cannot be detected, and the rules are written based on existing attack forms

Images