Harmful code detection method and device based on http compressed data stream

Abstract

The invention provides a method and a device for detecting a malicious code of a compressed data stream based on an HTTP. The method comprises the following steps of obtaining a to-be-received gzip compressed data stream of a client, which is sent by an Internet server, and carrying out Huffman decoding on the gzip compressed data stream to obtain a first compressed data stream which is compressed through LZ77; triggering a multimode matching window to slide in order to push an LZ77 decompression sliding window to slide on the first compressed data stream; and only carrying out boundary matching on a long pointer in the first compressed data stream and judging whether a provisional stack has an index position in a reference character string pointed by the pointer, if yes, determining the index position in a target position where the pointer is located and storing the index position into the provisional stack, wherein a distance between the LZ77 decompression sliding window and the multimode matching window is smaller than a preset distance threshold, so that the LZ77 decompression and the jumpy multimode matching detection can be carried out simultaneously, and thus the time for invasion of the compressed data stream or detection of the malicious code is reduced, and the speed for a client user to carry out online experience is increased.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method and device for detecting harmful codes based on HTTP compressed data streams. Background technique [0002] At present, in order to improve the security of network transmission, the gzip compressed data stream based on Hyper Text Transfer Protocol (Hyper Text Transfer Protocol, HTTP) sent by the Internet server (obtained by LZ77 compression and Huffman encoding of the data stream respectively) is located at The firewall and gateway server between the Internet server and the client need to perform intrusion detection and harmful code detection on each TCP compressed segment of the compressed data stream, and send each TCP compressed segment of the compressed data stream to the client after passing the detection . [0003] In the prior art, when firewalls and gateway servers detect compressed data streams, they first need to perform Huffman decoding and LZ77 decomp...

AI Technical Summary

Problems solved by technology

[0004] The present invention provides a harmful code detection method and device based on HTTP compressed data streams, which are used to solve the problem of consuming a lot of time and storage resources in the existing detection process

Images