Proactive audit system and method

Abstract

The invention provides a content security audit system, which comprises an allocation device, a webpage extracting device, a content analysis and audit device, and a passive content security audit subsystem, wherein the allocation device acquires a URL list appointed to be proactively audited; the webpage extracting device extracts a webpage source code of a webpage pointed by the URL for each URL in the URL list; the content analysis and audit device performs content analysis on the webpage source code to determine whether the webpage source code comprises sensitive content or malicious codes; and the passive content security audit subsystem is used for acquiring data at network essential nodes, and analyzing the data to determine the URL list. The invention also provides a content security audit method used by the system.

Description

technical field [0001] The invention relates to the field of network security, in particular to a network audit system and its method. Background technique [0002] With the rapid development of information technology and the development of network information system applications, more and more government agencies and enterprises realize that the increasingly complex IT business systems and the behavior of business users with different backgrounds have brought potential threats to the network. For example, the internal business data and important sensitive documents of the system can be tampered with, leaked and stolen through e-mail, database access, remote terminal access (TELNET, FTP, etc.), network file sharing (NETBIOS), etc.; netizens access illegal websites, publish illegal Illegal Internet behaviors such as speeches are increasingly rampant; there are also sabotage behaviors such as malicious users on the Internet that severely damage the information system security ...

AI Technical Summary

Problems solved by technology

[0005] However, such traditional content security auditing systems have some inherent limitations

First of all, these systems generally only analyze data packets passing through key nodes of the network, so these systems can only cover the behavior of network users passing through key nodes of the network, that is, these systems can only cover limited areas, and cannot achieve comprehensive security content audit

For example, if an enterprise user releases internal enterprise data to the public network through the wireless network card that comes with the laptop computer, the existing content security audit system will have no way to detect the leaking behavior

In addition, the existing content security audit system can only passively analyze the user data packets passing through the key nodes of the network, and the omission of data content due to various technical reasons is unavoidable

For example, if the website visited by the user adopts an encrypted transmission protocol (such as the HTTPS protocol), it is difficult for the existing content security audit system to analyze the content of the user data packet, so it is difficult to monitor the bad behavior of the user

Images