Method and system for automatically identifying B/S botnet background, and storage medium

Abstract

The invention discloses a method and a system for automatically identifying a B / S botnet background, and a storage medium. The method comprises the following steps of acquiring a to-be-detected website URL; preprocessing the to-be-detected website URL; extracting a feature from a botnet background feature library, and judging the feature type; if the feature is a file name feature, carrying out crawling test on a to-be-detected website by utilizing the file name feature, if a webpage file corresponding to the file name feature exists, giving an alarm; and if the feature is a file content feature, traversing the to-be-detected website by utilizing the file content feature, and giving an alarm if matching is successful, wherein the file name feature and the file content feature which are extracted from the known botnet background are stored in the botnet background feature library. According to the method and the system for automatically identifying the B / S botnet background, and the storage medium, the botnet background of a B / S framework based on an HTTP can be effectively identified.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method, system and storage medium for automatically identifying the background of a B / S botnet. Background technique [0002] Botnet is a kind of network with great harm at present. It is controlled by botnet to infect other computers by spreading malicious software, and then centrally manages and controls these computers through a C&C server. A one-to-many controllable network is formed between the botnet controller and the infected host. The malicious software used by the botnet controller to infect the victim host can interact with the C&C server to execute the tasks issued by the C&C server. By using this attack platform composed of botnets, attackers can complete large-scale network attacks with low cost and resources, such as launching distributed denial of service attacks (DDOS), sending spam, obtaining sensitive information, distributing Trojan horses and spyw...

AI Technical Summary

Problems solved by technology

Among them, network security researchers have conducted a lot of research on botnets based on the IRC protocol, and there are many corresponding detection methods for them. Emerging botnets based on P2P protocols and HTTP protocols have gradually become popular, especially those based on HTTP protocols Botnets are hidden in massive HTTP communication traffic, making it difficult to detect them effectively

Images