A method and device for identifying offline malware logs

Abstract

The invention discloses an offline malicious software log recognition method. The method comprises the following steps of: carrying out matching search in an IP and port reverse matching rule set on the basis of a first target IP and a target port included in a plurality of obtained network logs, so as to obtain an alternative network log set and a suspicious malicious software hash value set; grouping network logs in the alternative network log set according to a same source IP to obtain a network log group set; filtering network log groups according to a malicious software recognition rule set and the suspicious malicious software hash value set, so as to obtain a network log sub-group satisfying a first preset condition; and when the fact that a head-tail time interval of two network logs in the network log sub-group is smaller than a preset threshold value is determined, judging that network logs having the same source IP with the two network logs are infected by malicious software corresponding to a hash value corresponding to the two network logs. The invention furthermore discloses an offline malicious software log recognition device.

Description

technical field [0001] The invention relates to network security technology, in particular to a method and device for identifying offline malicious software logs. Background technique [0002] With the rapid development of the Internet, network security issues have gradually become prominent, among which malicious software represented by Trojan horses, viruses, backdoor programs, and adware have developed by leaps and bounds in terms of quantity, update speed, and use of technology. The impact and losses caused to Internet users are also increasing year by year. The above situation makes it increasingly difficult for traditional malware detection methods represented by static analysis methods such as file hashing to meet the requirements. Establishing a system that can effectively identify and control new malware has become one of the most urgent tasks for current network security. one. [0003] Threat intelligence is the inevitable result of the evolution of defense ideas...

AI Technical Summary

Problems solved by technology

[0008] 1) It is necessary to be able to obtain malware samples for analysis, but the number of malware samples and variants is huge and updated rapidly;

[0009] 2) A large amount of manpower is required for sample analysis, which requires a large amount of resources and is inefficient;

[0010] 3) When malware is bound to normal software, the traffic samples contain a large amount of normal traffic, making it difficult to distinguish;

[0011] 4) There are many variants of malware and they are updated quickly. The above solutions cannot meet the timeliness requirements

This method takes advantage of the efficiency and timeliness of threat intelligence through the identification of botnets and malware infrastructure, but at the same time there are the following problems: on the one hand, multiple websites and services may be associated with the same IP at the same time, Part of the traffic of this IP is malicious traffic, while the other part of traffic is normal traffic, which needs to be distinguished and identified. Using only one IP or domain name as the identification standard is likely to cause problems of misidentification and false positives (False Positive); on the other hand, currently Botnets and malware network facilities change rapidly, and the intelligence of a single IP and domain name may fail, which is prone to misidentification and false positives

Images