Malware protection method and device

Abstract

The invention provides a malicious software protection method and device. The malicious software protection method is based on a security analysis technology driven by DNS analysis log machine data and internal and external information data. A large number of latest technologies such as data acquisition, data merging, data association, machine learning and the like are comprehensively and crosslyapplied to finish automatic and cross confidence verification of domain name access behavior analysis, detect blacklist domain names accessed by the malicious software, finish DNS analysis linkage ina software definition security mode, and point the blacklist domain names accessed by the malicious software to a self-set IP address, thereby realizing a DNS black hole function. The use of the malicious software protection method is irrelevant to the terminal type and the application, known and unknown malicious software can be detected, definition of a protection strategy can be completed in anautomatic and real-time mode, an attack chain is blocked, protection is achieved, and meanwhile various security value-added services can be provided.

Description

technical field [0001] The present disclosure relates to the technical field of information security, in particular to a malicious software protection method and device. Background technique [0002] With the rapid development of computer technology and Internet applications, information security has become more and more important, and information security has also become an important research field that has attracted much attention. In the face of endless security problems and explosive growth of malware and its variants, it is necessary to continuously improve and improve the automatic discovery, detection and protection capabilities of malware so that malware cannot produce adverse consequences. [0003] Malicious software is a piece of computer instruction, which is implanted by the attacker into the attacked computer through system security holes or other methods, so that the attacked computer can perform tasks according to the attacker's wishes. Any computer that can p...

AI Technical Summary

Problems solved by technology

This method requires a large amount of analysis work on massive network data, and its efficiency is very low, and the input-output ratio is not high; limited by the deployment position of the probes that collect network traffic, it is easy to cause the loss of network data and prevent malware from being found; Traffic to analyze malicious domain names can only realize the detection function, but cannot block the bad behavior of malware in real time, and has no protection function

Images