Method and system for monitoring and capturing file server site for online storage of malicious codes based on cluster botnet

Abstract

The invention provides a method and a system for monitoring and capturing a file server site for online storage of malicious codes based on a cluster botnet. The method comprises the following steps of acquiring malicious codes of a botnet of each known malicious code family, analyzing a control node, acquiring a protocol of each malicious code family, and establishing a protocol analysis module;and simulating a controlled end and carrying out information interaction and monitoring with a control end in order to acquire a cross infection instruction, analyzing a malicious code storage address, namely the newly found file server site for online storage of the malicious codes, according to the cross infection instruction, and carrying out package downloading on files in the address. According to the technical scheme, the cluster botnet can be monitored, the situation of cross infection of the malicious codes can be found in time, and the new file server site for online storage of the malicious codes can be found. Meanwhile, the monitoring of the new file server site for online storage of the malicious codes is monitored, the monitoring of the control end in the past is combined, andinteractive monitoring between the botnets can be realized.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and a system for monitoring and capturing horse-discharging sites based on cluster botnets. Background technique [0002] The current technology is only based on the detection and identification of Fangma sites (file server sites that store malicious code online) that have been exposed. However, this does not solve the problem of timely identification of the IP / Domain of some horse-release sites that are hidden relatively deeply, that is, the sites that have not been exposed. According to the currently monitored activities and methods of some hacker organizations, once a hacker realizes the remote code execution authority on an Internet device, he will execute the command to remotely download the url of the site designated to store the malicious code, and implant the relevant malicious code. The device becomes a "broiler" in the botnet controlled by hackers (th...

AI Technical Summary

Problems solved by technology

At present, malicious code capture can only be detected and captured from devices such as intrusion prevention detection systems (IDS), terminal antivirus tools, honeypots, and traffic monitoring systems. the code

Therefore, there will always be some lag in the wanton spread of malicious code

Images