Security detection method and security detection server for network data

Abstract

The invention provides a security detection method and a security detection server for network data. The security detection method for network data comprises the steps: capturing data packets transmitted in a network; performing packet composing on the data packets so as to restore TCP (Transmission Control Protocol) connection data; recognising an application layer protocol used by the TCP connection data; performing security scanning on the TCP connection data by a security scanning module corresponding to the application layer protocol. According to the technical scheme, after the data packets are captured and subjected to packet composing, security monitoring is performed on the data according to the application layer protocol corresponding to the data packets; protocol analysis is carried out based on the repacked data of the application layer protocol; the pertinence is strong, network attack can be fast and effectively recognised, and the network security is improved.

Description

technical field [0001] The invention relates to the field of Internet security, in particular to a network data security detection method and a security detection server. Background technique [0002] Malicious program is an umbrella term for any software program intentionally created to perform unauthorized and often harmful acts. Computer viruses, backdoor programs, keyloggers, password stealers, Word and Excel macro viruses, boot sector viruses, script viruses (batch, windows shell, java, etc.), Trojan horses, crimeware, spyware and adware, etc., These are examples of what could be called malicious programs. [0003] Traditional anti-malware programs mainly rely on signature database matching or behavior analysis. The identification method of signature database matching is as follows: the antivirus engine reads the local file and matches all the signature code "keywords" in the signature database. If the file program code is found to be hit, it can be determined that th...

AI Technical Summary

Problems solved by technology

[0006] However, the current "cloud scanning and killing technology" can only scan and process the downloaded files, and for those virus or Trojan files that need to consume a lot of network resources to download, it is possible to find and delete them only after the download command is executed.

But for the content that is being transmitted in the network, it is powerless

Images