A method for confirming a WEB backdoor attack event

Abstract

The invention relates to a network security protection technology, aiming at providing a method for confirming a WEB backdoor attack event. The method comprises: parsing a firewall, IDS, IPS and related WEB server log, extracting the log record of WEB backdoor attack type, and judging whether the attack of WEB backdoor is successful or not according to the attack time, attacker IP, attacker port number, attacked IP, attacked domain name, attack request header and attack response header recorded in each alarm log; returning the confirmation result to the appropriate network protection device and marking the confirmed WEB backdoor attack event as a successful attack event to the user. The invention can provide a more scientific confirmation means for the WEB backdoor attack event, improve the recognition rate and accuracy of the network security protection equipment to the WEB backdoor attack, and reduce the alarm false alarm rate of the successful confirmation attack.

Description

technical field [0001] The invention relates to network security protection technology, in particular to a method for confirming WEB backdoor attack events. Background technique [0002] WEB backdoor, called WebShell in English, refers to a webpage Trojan horse implemented by webpage codes for illegal purposes. Specifically, the attacker controls the entire WEB server by implanting a WEB backdoor, uploads and downloads files, and illegally tampers with files. [0003] With the increasing number of network attack incidents, the attack techniques and means of network hackers are becoming more and more sophisticated, and the open source hacking tools circulating on the Internet have reduced the cost of attacks. Therefore, there are countless illegal scanning, backdoor detection and other attack traffic every day. The logs on the firewall, IDS, and IPS devices are also the accumulation of tens of millions of attack data every day. The WEB backdoor attack incident is often the ...

AI Technical Summary

Problems solved by technology

[0005] However, the above means have the following disadvantages: (1) security personnel may not be able to handle all WEB backdoor attack events on the network security protection equipment in time

Because analysts related to information security in actual work often do not have the authority to operate and maintain the server, and cannot log in to the server for troubleshooting in time

(2) Only relying on the analyst's own experience is often unable to accurately judge whether the backdoor attack is successful, and there may be misjudgments

(3) There are too many false alarms on the network security protection equipment, causing security personnel to frequently turn pages when analyzing alarm records, and it is easy to ignore important attack clues

Images