Block-based virus detection method in P2P (peer-to-peer) network

Abstract

The invention relates to the technical field of network virus detection and discloses a block-based virus detection method in a P2P (peer-to-peer) network. The method comprises the following steps: a step (1): locally performing network p2p data packet capture through a network card and performing preliminary filtration according to Winpcap (windows packet capture); a step (2): performing pretreatment on P2P network data packet information obtained by capture from the network card in the step (1), and enabling the data packet information to be used for virus detection; and a step (3): detecting whether data information after treatment contains virus or not, and detecting whether the data information in the p2p data packet information of an application layer, which is obtained after treatment in the step (2), contains the virus or not according to virus characteristic codes in a virus library. Compared with the prior art, by adopting the method, the missing detection situation caused by negligence of P2P characteristics and the P2P transmission file mechanism of existing detection software can be avoided.

Description

technical field [0001] The invention relates to the technical field of network virus detection, in particular to a virus detection method in a P2P network environment. Background technique [0002] Compared with the C / S structure in the traditional network, the P2P network is a brand-new change. Today, with the rapid growth of the number of users, P2P is widely used in the fields of Internet TV, distributed computing, network database, and resource sharing. Gradually popularized and applied. The network security issues in P2P have some commonalities with ordinary network security, and also have some characteristics of their own. Only by conducting targeted research on the network security of P2P network structures can we effectively resist attacks against P2P network structures. [0003] However, well-known anti-virus software such as Norton and Kaspersky can successfully detect viruses and worms spreading in the network, but cannot detect viruses spreading in P2P, because ...

AI Technical Summary

Problems solved by technology

The virus detection technology based on the signature code is efficient and accurate, but the disadvantage is that as long as the individual worms are slightly mutated, this method often loses its effectiveness, and the signature database needs to be updated regularly

However, this method still has the following disadvantages: ① Whether the honeypot can deceive network worms depends on a large number of factors, including the naming of the honeypot, the location of the honeypot in the network, and the reliability of the honeypot itself; Network worms with a large number of scanning behaviors (random scanning, sequential scanning, etc.) are found, but the network worms for routing scanning and DNS scanning are not effective; ③ honeypots rarely play a role in the early stages of network worm propagation

The latter two virus detection methods are not well applied when detecting viruses in P2P networks, and are prone to false detections, causing troubles

[0014] Among them, the traffic-based detection method utilizes statistical laws to detect abnormal network traffic in the network, so as to judge that there may be viruses or worms. In the P2P network, traffic surges or sudden drops often occur. Virus outbreak will seriously affect the work of P2P software

Images