Method and device for detecting worm virus and gateway equipment

Abstract

The embodiment of the invention relates to a method and a device for detecting a worm virus and gateway equipment. The method comprises the following steps: obtaining scanning connection information initiated by a source IP address host computer, wherein the scanning connection information comprises scanning connection times, a scanning connection failure rate and the connection number of scanning ports; and analyzing the obtained scanning connection information of the source IP address host computer in a preset period and judging whether the source IP address host computer is a host computer infected with the worm virus or not. By analyzing the scanning connection information, the technical scheme of the embodiment of the invention can effectively detect whether the source IP address host computer is the host computer infected with the worm virus or not, and has higher virus detection efficiency and lower virus detection misinformation rate.

Description

technical field [0001] The invention relates to the field of virus detection, in particular to a worm virus detection method, device and gateway equipment. Background technique [0002] With the rapid development of network technology, network security issues have become the focus of attention of users and operators, and worms are one of the most serious threats to network security. [0003] In the prior art, a method based on traffic information is usually used to detect worms, and the detection process is as follows: First, by collecting normal traffic logs and traffic logs when there are worm activities, the characteristics of the detected worms are extracted, and the traffic logs of the calibration category are obtained ; Secondly, use the machine learning algorithm to learn the traffic logs of the calibrated category to obtain a worm detection classifier; finally, deploy the worm detection classifier obtained through network learning to the network to extract the featur...

AI Technical Summary

Problems solved by technology

[0004] In the process of realizing the present invention, the inventor found that when detecting worms in the prior art, it is easy to misjudgment when the normal business traffic in the network changes frequently, resulting in a high false positive rate of the virus; meanwhile, the prior art is based on In the virus detection of traffic, network traffic learning and feature vector extraction require a large amount of network data, a large amount of data processing, occupying a lot of system resources, resulting in slow processing speed and low virus detection efficiency

Images