An unknown virus detection method

Abstract

The invention discloses an unknown virus detecting method. Based on the characteristics of file formatted storage and the characteristics of network file transmission, through capturing bi-directional network flows in the same connection, a system extracts file extension names in requests which are transmitted to a server by a client respectively and analyzes file header contents in data which are responded by the server to the client; and whether file types of the file extension names and the file header contents are matched with each other are contrasted, if the file types of the file extension names and the file header contents are matched with each other, it is considered as normality, otherwise, it is considered as abnormality, and alarms can be emitted. With the unknown virus detecting method adopted, approaches of virus transmission by using camouflage can be blocked under the situation that conventional anti-virus software is incapable of effectively dealing with unknown viruses.

Description

technical field [0001] The invention relates to a detection technology for unknown viruses in network data, which is suitable for non-unidirectional traffic networks and discovers specific types of unknown viruses in time under the condition of rapid virus changes. Background technique [0002] Most of the current computer application environment is inseparable from the network, and the majority of netizens spend a lot of time surfing the Internet. Because ordinary computer users do not have professional network security knowledge, they lack protection for themselves and cannot identify threats from the network. [0003] Virus writers and disseminators take advantage of this situation to deceive the computer's resource manager and browser by simply changing the file extension, making it mistakenly think that the virus after changing the file extension is another harmless file, thereby tricking users Download and execute; at the same time, through the rapid release of viruse...

AI Technical Summary

Problems solved by technology

[0004] Through the above means, a large number of computer users are infected with viruses. At the same time, the update speed of the current anti-virus software cannot keep up with the update speed of the current virus, and cannot effectively face such threats.

Images