Network attack information processing method and device, electronic equipment and storage medium

Abstract

The invention provides a network attack information processing method. The network attack information processing method comprises the following steps: acquiring attack traffic for attacking a target system; in response to the acquired attack traffic, triggering a port multiplexing process to monitor the attack traffic forwarded by the target port; triggering an attack information classification model, and identifying the category of the attack traffic; triggering a port forwarding process based on an identification result of the attack information classification model, and forwarding the attack traffic. The invention further provides a network attack information processing device, electronic equipment and a storage medium. According to the invention, the attack traffic can be forwarded tothe corresponding honeypot systems of different types, the network attack information processing efficiency of the honeypot systems is improved, the number of deployed servers is reduced, the cost ofa user is saved, and the large-scale deployment of the honeypot systems is realized.

Description

technical field [0001] The invention relates to network attack information processing technology, in particular to a network attack information processing method, device, system, equipment and storage medium. Background technique [0002] In related technologies, the honeypot technology is an active security technology for deceiving attackers (also called hackers). In honeypot technology, technicians can deploy a fake system that simulates a real working system as a bait, and lure attackers to attack the fake system, wherein the fake system can usually be called a honeypot system. When the attacker is lured to attack the honeypot system, the honeypot system can capture the attack data of the attacker. By analyzing the captured attack data, it can provide a basis for identifying attack behaviors in actual production work and subsequent security defense measures. During the deployment process of the traditional honeypot system, not only need to deploy a large number of serve...

AI Technical Summary

Problems solved by technology

During the deployment process of the traditional honeypot system, it not only needs to deploy a large number of servers and configure a large number of IP addresses, but also the attack traffic does not match the attack target, resulting in a low processing efficiency of the honeypot system for attack information

Images