Method and system for defending network virus

Abstract

The invention relates to a method and a system for defending a network virus. The network virus is a botnet virus or a target attacking virus with pertinence to a virus attacking object. The method comprises the following steps: analyzing a network flow of a client and capturing a suspicious file sample when an existing suspicious file is confirmed while detecting the flow of the client during a process of obtaining a network communication service by the client; analyzing if the botnet virus or virus action thereof exists; generating an analysis report for the botnet virus action; transmitting the suspicious file sample and the analysis report to an antivirus operator so as to create a virus removing program; and meanwhile, supplying a network antivirus service to an infected client according to the analysis report and searching and killing the virus after receiving the virus removing program which is sent back. According to the method, when the client which is infected by the virus is detected, defending measures can be taken in real time, thereby efficiently preventing virus diffusion, preventing the infected client from automatically connecting to a malicious website for performing virus variation, and efficiently reducing the risk of the client suffering in a virus attack.

Description

technical field

[0001] The present invention relates to a network virus detection and blocking technology, and more specifically, relates to a method for preventing the client from being infected by a targeted attack virus such as a botnet virus (Botnet) or a virus attack object. Virus spread or virus-controlled network virus protection method and system. Background technique

[0002] Botnet is commonly known as botnet (zombie network). Viruses under this botnet usually invade network user terminals along with email, instant messaging software or computer system vulnerabilities, and then hide in any program. see figure 1 , the botnet usually consists of three parts, including a control terminal 11, botnet members (12a, 12b, 12c) and an instruction sending end 13, the instruction sending end 13 is the hacker itself, and it issues instructions to the botnet members (12a , 12b, 12c), the botnet member (12a, 12b, 12c) refers to the victim computer that is controlled by remote ...

Images