Recognition method, device and electronic device for remote control back connection behavior
A behavioral and remote control technology, applied in the computer field, can solve problems such as low efficiency and heavy recognition tasks, and achieve the effect of improving efficiency and narrowing the recognition range.
Active Publication Date: 2021-09-28
HANGZHOU ANHENG INFORMATION TECH CO LTD
View PDF7 Cites 0 Cited by
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
With the increase of network asset information, the task of identifying whether the asset is connected by remote control is becoming more and more heavy. The traditional way of manually identifying the behavior of remote control connection is inefficient.
Method used
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View moreImage
Smart Image Click on the blue labels to locate them in the text.
Smart ImageViewing Examples
Examples
Experimental program
Comparison scheme
Effect test
specific Embodiment approach
[0042] Constructing a network graph based on suspicious clients and suspicious servers; determining target clients and target servers in the network graph that have remote control connection back behavior based on machine learning algorithms.
[0043] In a specific implementation, this embodiment provides a specific implementation of building a network graph based on suspicious clients and suspicious servers:
[0044] Take suspicious clients and suspicious servers as network nodes. According to the number of requests for the first domain name and the first domain name and the number of requests for the second domain name and the second domain name, the request access relationship between the suspicious client and the suspicious server is regarded as a network segment between network nodes, based on network nodes and network segments Get a network map. For example, see e.g. figure 2 In the network diagram shown, the suspicious server and the possible client are respectively ...
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More PUM
Login to View More Abstract
The present invention provides an identification method, device and electronic equipment for remote control back-to-connection behavior, and relates to the field of computer technology. The method includes: acquiring the traffic data of the domain name system of the target network; The number of requests for a domain name and the first domain name and the number of requests for the second domain name and the second domain name on the server side; based on traffic data, suspicious clients and suspicious servers that may have remote control connection behaviors are screened out; suspicious customers are identified based on machine learning algorithms The target client (the target client is the client with the behavior of remote control connection back) and the target server (the target server is the server with the behavior of remote control connection back) contained in the client and the suspicious server. The invention improves the efficiency of identifying the remote control connection behavior in the target network.
Description
technical field [0001] The invention relates to the field of computer technology, in particular to a method, device and electronic equipment for identifying remote control back-to-connection behaviors. Background technique [0002] The remote control connection back behavior means that after the client in the network is infected with a Trojan horse or a virus, the server will remotely control the client to make the client perform corresponding operations, such as transmitting data to the server. With the increase of network asset information, the task of identifying whether an asset is remotely controlled or not is becoming more and more arduous, and the traditional way of manually identifying remote control and connecting behavior is inefficient. Contents of the invention [0003] The purpose of the embodiments of the present invention is to provide a method, device, and electronic device for identifying remote control back-to-connection behaviors, and the method improves...
Claims
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More Application Information
Patent Timeline
Login to View More Patent Type & Authority Patents(China)
IPC IPC(8): H04L29/06G06N20/00
CPCG06N20/00H04L63/1425H04L63/145
Inventor 徐丽丽范渊王世晋黄进
Owner HANGZHOU ANHENG INFORMATION TECH CO LTD