Host intrusion detection method and device

Abstract

The invention discloses a host intrusion detection method and device, and relates to the technical field of computers. One specific embodiment of the method comprises the following steps: acquiring signal data of a host, wherein the signal data comprises static signal data n and dynamic signal data s; searching a static detection rule rets matched with the static signal data from a preset featurelibrary; obtaining a dynamic prediction result retd according to the dynamic signal data and an SVM model; wherein the training parameters of the SVM model are obtained by adopting a particle swarm optimization algorithm; and judging whether the current process of the host is an attack behavior or not according to the static detection rule rets and the dynamic prediction result retd. According tothe embodiment, the detection rate of unknown attack behaviors can be improved; the detection false alarm rate of normal operation is reduced, and the stability of normal service is ensured; the detection rule is automatically generated and the detection feature library is updated when the attack behavior is detected, the manual intervention cost is reduced, and the response time to the unknown attack behavior is shortened.

Description

Technical field [0001] The invention relates to the field of computer technology, in particular to a method and device for detecting host intrusion. Background technique [0002] With the widespread application of Intentet and the rapid growth of information flow in cyberspace, various fields have benefited from the development of the network, while their data security has also been seriously threatened. As far as data detection is concerned, intrusion detection can be divided into two types, network-based intrusion detection and host-based intrusion detection. Network-based intrusion detection mainly detects the original data packets on the network to determine whether there are attacks in the data packets; host-based intrusion detection mainly analyzes the log, host traffic, process behavior and other information on the host to determine whether the host has suffered attack. [0003] For host-based intrusion detection, currently two methods are mainly used: misuse detection and...

AI Technical Summary

Problems solved by technology

[0005] (1) Misuse detection cannot effectively detect unknown attacks;

[0006] (2) The false alarm rate of abnormal detection is relatively high, which has a certain impact on normal business

Images