Method and device for establishing malicious IP address threat intelligence library and preventing malicious attack

Abstract

The invention provides a method and device for establishing a malicious IP address threat intelligence library and preventing a malicious attack, and the method comprises the steps: screening out IP address information of which the page view meets a preset condition in a continuous first time period according to IP address information accessed by an enterprise business system; according to the banning / unbanning information of the IP addresses, screening out the IP addresses of which the difference between the banning moment of the same IP address and the banning moment of the next time is smaller than a preset difference; according to the attack logs of the network attack protection devices, screening out IP addresses contained in the attack logs of all the network attack protection devices in a continuous second time period; according to the access log information of the enterprise e-commerce platform and the banning / unbanning information of the IP addresses, screening out the IP addresses of which the access amount exceeds a predetermined amount in a continuous third time period and which have banning history; and establishing a malicious IP address threat intelligence library according to the screened IP addresses. According to the invention, passivity can be changed into active, the network attack resisting capability of enterprises is improved, and the risk is reduced.

Description

technical field [0001] This article relates to the field of network security, in particular to a method and device for establishing a malicious IP address threat intelligence database, and a method and device for preventing malicious attacks. Background technique [0002] At present, most enterprises can only passively wait for defense in the face of network attacks, or prevent the same malicious attacks from happening again based on past malicious attacks. [0003] In the prior art, enterprises cannot predict malicious attacks, and have problems of poor resistance to network attacks and high risks. Contents of the invention [0004] In the prior art, enterprises cannot predict malicious attacks, and have problems of poor resistance to network attacks and high risks. [0005] In order to solve the above technical problems, the first aspect of this paper provides a method for establishing a malicious IP address threat intelligence database, including: [0006] Obtain the ...

AI Technical Summary

Problems solved by technology

[0004]In the existing technology, enterprises cannot predict malicious attacks, and have problems of poor resistance to network attacks and high risks

Images