A malicious site access interception method and detection system based on flow analysis

Abstract

The invention discloses a malicious site access interception method and detection system based on flow analysis. The method comprises the following steps: S1, constructing a malicious site detection model based on log characteristic information detection in flow data; wherein, the malicious site model performs access interception according to detected malicious site access; S2, collecting the flowmirror data packet at the network outlet in real time, extracting the log characteristic information in the flow mirror data packet to generate a log data unit, and sending the log data unit to the log buffer queue; S3: The malicious site detection model constructed based on S1 analyzes and detects the log data unit in S2, and updates the detected IP address-domain name mapping temporary file tothe IP address-domain name mapping file of the DNS server. The invention realizes the real-time on-line detection of the malicious site and the real-time interception of the detected visit of the malicious site, thereby improving the security of the network system.

Description

technical field [0001] The invention belongs to network information security technology, and in particular relates to a flow analysis-based malicious site access interception method and detection system. Background technique [0002] A malicious site refers to a network site that embeds malicious code in a web page and combines it with a remote control Trojan horse or virus to destroy the user's computer software and steal the user's personal information without the user's permission. Such as the switch domain name site in the ransomware virus that swept the world in 2017. Internet regulators such as the National Internet Emergency Response Center and some provincial communications administrations have also published blacklists of malicious sites. By detecting access to malicious sites, information assets infected with viruses and Trojans can be located, so that emergency measures can be quickly carried out to avoid large-scale infection of viruses and Trojans and prevent n...

AI Technical Summary

Problems solved by technology

Currently, there is no published literature dealing with real-time online detection methods for malicious sites

Images