A method and system for abnormal UA detection and analysis based on rules

Abstract

The invention provides a rule-based abnormal UA detection and analysis method and system. The method comprises steps of capturing the network flow based on a Spark network flow capturing platform; filtering the HTTP traffic from all network traffic according to the HTTP format. The abnormal UA in the network traffic can be effectively detected and analyzed by extracting the UA field of the HTTP traffic, so that network management and malicious software detection are facilitated.

Description

technical field [0001] The invention belongs to the technical field of network information, and in particular relates to a method and system for detecting and analyzing abnormal UA (User Agent) based on rules. Background technique [0002] Key fields in network traffic play a vital role in network traffic. Key fields in the Domain NameSystem (DNS) can be used to resolve remaining trust in the domain to see the evolution of DNS resolution, and to detect malware behavior in the network. Similarly, key fields in the HyperText Transfer Protocol (HTTP) and Transport Layer Security / Secure Socket Layer (TLS / SSL) protocols, such as UA, cookie, server name indication (SNI), play an important role in network behavior analysis and malicious behavior detection important role. [0003] Since all traffic generated by HTTP accounts for nearly half of all protocol traffic every day, the frequency of users using HTTP is very high and the number of users involved in using HTTP is large, and...

AI Technical Summary

Problems solved by technology

[0004] In a high-speed network environment, in-depth analysis of network protocols and extraction of key field content are the primary prerequisites for network mapping and traffic attribute labeling. However, due to the complexity of network protocols, existing analysis tools are not suitable for high-speed network environments. Protocol analysis often has abnormal characters in key fields. The abnormal characters in these key fields introduce polluted error messages to the effective mapping and labeling of network traffic.

[0005] For the case of abnormal characters in key fields, it is usually ignored in previous research on UA, and these key fields are not directly processed

Images