Network theft behavior detecting method based on HTTP flow analysis

Abstract

The invention relates to a network theft behavior detecting method based on HTTP flow analysis. The method comprises the steps of establishing a C&C server blacklist database, acquiring DNS and HTTP protocol flow in a random time segment and performing analysis restoring, performing abnormal data elimination on HTTP traffic data generated in accessing a normal server, performing statistics, determining a to-be-determined abnormal behavior item and a detecting use threshold, detecting whether an abnormal behavior of a computer device in a network of an organization, if yes, performing alarming, storing a data packet in a database, and performing risk analysis and processing on alarming. According to the network theft behavior detecting method, network behavior characteristic analysis is performed on a tool and malicious software which transmit sensitive data based on an HTTP protocol, thereby determining an abnormal behavior characteristic. A threshold value is determined through performing statistics on the HTTP traffic at the network entrance of the organization, thereby identifying a sensitive data transmission behavior by a trojan horse on the attacked computer device. The network theft behavior detecting method has advantages of low alarm error rate, low alarm omission rate, high accuracy and high feasibility. The network theft behavior detecting method is suitable for organizations, individuals and large-scale high-speed network.

Description

technical field [0001] The present invention relates to the transmission of digital information, such as the technical field of telegram communication, and in particular to a HTTP flow-based method for analyzing the HTTP flow data entering and leaving the unit network to identify the behavior of the Trojan horse virus on the attacked computer equipment to transmit sensitive data Analytical network theft detection method. Background technique [0002] The firewall is an important tool in the network security system. It always checks the data packets entering and leaving the network it protects. The data packets that threaten the protected network will be intercepted by the firewall. [0003] However, firewalls in the prior art are not yet able to fully control malware infection and data leakage. One of the reasons is that commonly used protocols use reserved ports by default, and the firewall must allow traffic to pass through. The traffic sent by the computer to the web ser...

AI Technical Summary

Problems solved by technology

When implementing this detection method, at least the following difficulties exist: 1. The Trojan horse control terminal (that is, the C&C server) may not always be online in order to avoid detection; 2. The communication protocol between the Trojan horse and its control terminal may be designed by the network attacker himself. The non-public protocols used by different Trojan horses may use different communication protocols. The difficulty of identifying these non-public protocols is unpredictable

Images