A method and system for recording transmission path and distribution of local area network files

Abstract

The invention provides a method and system for recording transmission paths and distribution conditions of files in a local area network. According to the method and system, host file monitoring is combined with network-level file transmission monitoring, and monitoring data are aggregated to a server for correlation analysis, and therefore, transmission paths and distribution conditions of the files between hosts in the local area network can be generated. With the method and system adopted, the defect of incapability of performing bidirectional monitoring on file transmission, accurately generating transmission paths and analyzing file distribution in the prior art can be eliminated; a basis can be provided for the backtracking of diffusion conditions of analysis files between the hosts, even if the files are deleted, the historical transmission paths of the files can be still recorded; the distribution conditions of virus files between the hosts can be obtained, and a foundation can be provided for virus elimination, and processing time can be effectively reduced.

Description

technical field [0001] The invention relates to the technical field of network file monitoring, in particular to a method and system for recording transmission paths and distribution of local area network files. Background technique [0002] With the emergence of APT (Advanced Persistent Threat, Advanced Persistent Threat) attacks, network intrusions have become more difficult to defend against. It is increasingly easy for attackers to construct targeted viruses to bypass the detection of host security software and enter the host, and can use normal software or network channels to spread in the local area network. When the security software has updated the virus database to detect virus files, it may have spread to multiple hosts in the LAN. If the transmission path of files between LAN hosts is recorded in advance and the distribution statistics are made, it can provide a basis for analyzing the process of intrusion and subsequent disposal. [0003] At present, the bounda...

AI Technical Summary

Problems solved by technology

Although this method can form the "line" of the file transfer path between hosts, it is only a record of the file transfer behavior, whether the destination host successfully receives the file, and whether the file still exists on the host when an intrusion event needs to be analyzed The above problems cannot be determined by network monitoring

Images