Network worm detection and characteristic automatic extraction method and system

Abstract

The invention discloses a network worm detection and characteristic automatic extraction method and a network worm detection and characteristic automatic extraction system and belongs to the technical field of network safety. The method comprises the following steps of: 1) performing abnormal detection on captured network data packets, and dividing the data packets into suspicious network flow and normal network flow according to detection results; 2) storing the suspicious network flow in a suspicious flow pool, and storing the normal network flow in a normal flow pool; 3) clustering the network flow in the suspicious flow pool and the normal flow pool, and extracting a characteristic signature; and 4) updating the extracted characteristic signature in a network attack database, and detecting the network worm. The system comprises an abnormal detection subsystem, a characteristic extraction subsystem, a network attack characteristic database, and a misuse detection system. The methodand the system can more accurately and timely discover the network worm, can automatically extract the worm characteristics and update the attack characteristic database of the existing misuse detection system. Therefore, the aim of suppressing worm propagation is really fulfilled.

Description

technical field [0001] The invention relates to a network worm detection and feature automatic extraction method and system, in particular to a behavior-based network worm detection and flow clustering-based automatic feature extraction method and system, belonging to the technical field of network security. Background technique [0002] There are many kinds of network malicious codes, including network worms, webpage Trojan horses and mobile malicious codes, etc. Among them, network worms cause the most serious harm due to their fast spreading speed and wide spreading range. The outbreak of the first network worm, Morris, in 1988 caused an economic loss of more than 10 million U.S. dollars. The network worm Conficker, which appeared at the end of 2008, has infected more than 12 million hosts worldwide. The statistics of network worm outbreaks in recent years are as follows: figure 1 As shown, the chart lists the 10 worms with the greatest harm since 2000. The statistical r...

AI Technical Summary

Problems solved by technology

The statistics of network worm outbreaks in recent years are as follows: figure 1 As shown, the chart lists the 10 worms with the greatest harm since 2000. The statistical results show that network worms often spread by exploiting serious system vulnerabilities. There are even network worms that use 0-day vulnerabilities to spread, which means that the traditional prevention strategy of manually extracting network worm features and then upgrading the features to end-user antivirus software has almost lost its effect on these fast-scanning and actively spreading network worms , which is also the fundamental reason why network worms can spread rapidly and cause great harm

Images