Malicious code capturing method and system

Abstract

The invention relates to malicious code capturing method and system. The malicious code capturing method includes acquiring email data from various email data sources; analyzing the email data, recording files, which cannot be eliminated according to set false negative rate, as suspicious files, and storing the suspicious files to suspicious file database; and detecting the suspicious files by malicious code feature database and manual detection; and storing the suspicious files with unusual detection results to malicious code sample database. The malicious code capturing method and system are applicable to a related honeypot and honeynet system, coverage range of captured objects can be increased, and capability of capturing malicious codes is improved.

Description

technical field [0001] The invention relates to the technical field of network information security, in particular to a malicious code capture method and system. Background technique [0002] Malicious codes such as network worms, Trojan horses, and botnets emerge in an endless stream, which has brought great harm to network information security. In order to better analyze and detect malicious codes, defenders should first research ways to obtain a large amount of malicious codes in the Internet, and honeypot and honeynet technologies emerged and gradually emerged. Honeypot technology means that defenders provide virtual or real hosts, servers, and other intelligent terminals, or simulate related services, to be scanned and invaded by attackers, and then achieve the purpose of obtaining relevant malicious codes. A honeynet is a network with a certain topology composed of several interrelated honeypots, which can be regarded as a large-scale distributed honeypot system. Gen...

AI Technical Summary

Problems solved by technology

[0007] However, the existing honeypot and honeynet technologies have not fully considered the malicious codes spread by social engineering based on the Email network, and have not made use of the above-mentioned social network features to capture more types of malicious codes

It can be seen that the existing honeypot and honeynet technology cannot effectively capture the malicious codes spread by social engineering based on the Email network on a large scale

Images