Trojan-embedded website detection method based on hyper text transfer protocol (HTTP) traffic analysis

Abstract

The invention discloses a trojan-embedded website detection method based on hyper text transfer protocol (HTTP) traffic analysis. The method comprises the following steps of: capturing of a user HTTP request in a wide area network or a local area network, recovery of an HTTP Header, extraction of a Referer domain value, rule characteristic matching of HOST attributes and Get paths in the HTTP Header, outputting of Trojan-embedded uniform resource locator (URL) and HTTP accessing behavior full path, and the like. By the Trojan-embedded website detection method provided by the invention, the information of a Trojan-embedded website can be obtained by a known Trojan-embedded website by fully utilizing the autonomous Web accessing behaviors of a client or an ordinary user, and the influence range and conditions of Trojan-embedding attacks can be comprehensively and really mastered, so relatively better detection results still can be obtained under the condition of relatively less investment, and a great number of clues and data can be obtained. The Trojan-embedded website detection method still can be combined with the conventional Trojan-embedded website detection methods. The detection method can be preposed in application, so a detection range can be narrowed down still with relatively higher recall for the conventional Trojan-embedded website detection methods.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method for detecting websites linked to horses based on HTTP traffic analysis. Background technique [0002] The so-called hanging horse is that the hacker obtains the account of the website administrator through various means, then logs in to the background of the website, and obtains a webshell through database backup / restoration or uploading vulnerabilities. Hackers can use the obtained webshell to modify the content of the website page, add malicious redirection code to the page, or directly obtain the server or website FTP through weak passwords, and then directly modify the website page. When someone visits the page added with malicious code, it will automatically visit the redirected address or download Trojan horse virus. If the website is linked to a horse, it will not only lose the credibility of the website and lose a large number of customers, but also make ordin...

AI Technical Summary

Problems solved by technology

However, the traditional detection methods of Trojan websites can only obtain the whole process of Trojan attacks through a top-down approach.

This method continuously detects a large number of websites by simulating the client, so as to discover the source of the attack and the relationship among them, and it will inevitably consume a lot of resources.

Images