A Method for Discovering Malicious Network Behaviors Based on HTTP Content Consistency

Abstract

The invention relates to a malicious network behavior discovery method based on HTTP content consistency. The method comprises the following steps: 1) analyzing an HTTP message; 2) performing consistency comparison on a type declared by an HTTP message header and an actual load type of the HTTP message; 3) if the comparison result of step 2) is non-consistency, judging a suspicious degree of inconsistent behaviors according to a specific message header and the actual load type; 4) recording the inconsistent behaviors with the suspicious degree being greater than a set threshold; and 5) scanning and analyzing the recorded suspicious inconsistent behaviors to discover malicious behaviors. By adoption of the malicious network behavior discovery method provided by the invention, very good discovery ability of unknown malicious behaviors is provided, and the shortcomings of the traditional mode of detecting the unknown malicious behaviors based on a regular firewall and an intrusion detection system are compensated.

Description

Technical field [0001] The invention belongs to the technical field of information technology, and specifically relates to a method for discovering malicious network behaviors based on HTTP content consistency. Background technique [0002] Nowadays, with the development of the Internet, more and more network application service providers choose to use the HTTP protocol to provide users with websites and mobile application services, and HTTP traffic occupies a large part of the Internet traffic. Due to the huge, complex, and flexible HTTP traffic, many attacks and malware have begun to use HTTP traffic to hide their propagation and control behavior. Some of these malicious behaviors will forge a Content-type type that is different from the actual type of the HTTP payload. Through the firewall (Firewall) and intrusion detection system (IDS) type detection, it has caused serious hidden dangers to the information security of enterprises and users. [0003] Traditional rule-based fire...

AI Technical Summary

Problems solved by technology

On the one hand, this often requires the extraction of known malicious behavior features, and requires the configuration of a large number of feature rules; The ability to detect malicious behaviors, and it is impossible to detect unknown malicious network behaviors that use this phenomenon to spread in time

In addition, about 35% of the packets in the HTTP traffic have inconsistent content declarations, and most of them are caused by misconfigurations. These inconsistent packets are often harmless, and only the HTTP payload content and declarations are detected. Inconsistency has a high false positive rate, which cannot be a good aid in discovering malicious network behaviors

Images