A malicious site access interception method and detection system based on flow analysis

A traffic analysis and malicious technology, which is applied in the field of network information security, can solve the problems of unpublished real-time online detection methods of malicious sites, and achieve the effects of easy promotion, real-time monitoring, and improvement of network security

CN109271790AInactive Publication Date: 2019-01-25STATE GRID HUNAN ELECTRIC POWER +2
3 Cites 6 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Publication Date
2019-01-25
Estimated Expiration
Not applicable · inactive patent

Smart Images

  • Figure 1
    Figure 1
Patent Text Reader

Abstract

The invention discloses a malicious site access interception method and detection system based on flow analysis. The method comprises the following steps: S1, constructing a malicious site detection model based on log characteristic information detection in flow data; wherein, the malicious site model performs access interception according to detected malicious site access; S2, collecting the flowmirror data packet at the network outlet in real time, extracting the log characteristic information in the flow mirror data packet to generate a log data unit, and sending the log data unit to the log buffer queue; S3: The malicious site detection model constructed based on S1 analyzes and detects the log data unit in S2, and updates the detected IP address-domain name mapping temporary file tothe IP address-domain name mapping file of the DNS server. The invention realizes the real-time on-line detection of the malicious site and the real-time interception of the detected visit of the malicious site, thereby improving the security of the network system.
Need to check novelty before this filing date? Find Prior Art

Description

technical field

[0001] The invention belongs to network information security technology, and in particular relates to a flow analysis-based malicious site access interception method and detection system. Background technique

[0002] A malicious site refers to a network site that embeds malicious code in a web page and combines it with a remote control Trojan horse or virus to destroy the user's computer software and steal the user's personal information without the user's permission. Such as the switch domain name site in the ransomware virus that swept the world in 2017. Internet regulators such as the National Internet Emergency Response Center and some provincial communications administrations have also published blacklists of malicious sites. By detecting access to malicious sites, information assets infected with viruses and Trojans can be located, so that emergency measures can be quickly carried out to avoid large-scale infection of viruses and Trojans and prevent n...

Examples

Embodiment Construction

[0026] The present invention will be further described below in conjunction with examples.

[0027] The present invention detects malicious site visits based on flow analysis, and specifically uses the log feature information of "source IP address, syn value of TCP protocol, ack value of TCP protocol, and destination IP address" in the flow data to identify whether the current visit is is a visit to a malicious site. After the present invention collects the traffic packet, it will extract characteristic information therefrom to generate a log data unit, as shown in Figure 1, which is the format of the log data unit:

[0028] Table 1

[0029] Attributes

attribute name

src_ip

source ip address

dst_ip

destination ip address

host

Main site domain name

syn

The syn value of the TCP protocol

message

Raw log information

[0030] In order to realize the monitoring of malicious site visits, the present invention ...