Malicious machine traffic identification method and system

Abstract

The invention designs a malicious machine traffic identification method and system, and aims to solve the problem of malicious traffic identification difficulty caused by great increase of user access times and frequency possibly occurring in Internet side APPs of state grids and the like, a deep learning technology is adopted to dynamically divide suspicious traffic, and a hidden Markov chain is used for traffic to predict user access behaviors, so that the malicious machine traffic identification efficiency is improved. The effects of pertinently analyzing and identifying the malicious machine traffic and providing accurate positioning for the processing of the malicious traffic are achieved.

Description

technical field [0001] The present invention relates to the field of electric power data security, and more particularly relates to a malicious machine traffic identification method and system. Background technique [0002] Malicious machine traffic identification is to monitor business system traffic in real time to accurately find out business requests initiated by malicious crawlers, automata, simulators, etc. that forge real users. These traffic attack the business system at the application layer. API, causing huge economic losses to the enterprise. This application uses an identification method to analyze and identify malicious machine traffic, so that these business requests that are not sent by real users can be restricted, and data security risks in the process of developing electric power financial services can be reduced. The malicious traffic identification method extracts characteristic information from the traffic, and judges whether the traffic is malicious ac...

AI Technical Summary

Problems solved by technology

Among them, the static feature classification method is simply whether it has exactly the same features as the classification standard, and it only needs simple packing or obfuscation to achieve the target effect, which has been gradually eliminated; dynamic signatures use malicious signatures manually extracted by managers. Cluster analysis of traffic characteristics, and aims to use the cluster analysis results to classify the same type of malicious traffic, but due to the heavy reliance on manually extracted features and the low accuracy of cluster analysis, detection and classification The result is very unstable

Moreover, the malicious machine traffic identification method still has the following problems: the identification method is relatively single, and can only be identified from the perspective of the number of prizes and traffic in the operation process; the identification rules rely on expert experience, and finding suitable expert resources is a challenge

Images