A fingerprint database establishment method based on the characteristics of web attack tools

Abstract

This application discloses a method for establishing a fingerprint library based on the characteristics of WEB attack tools, including: step 1, building a feature capture environment for WEB attack tools, where the feature capture environment includes a WEB attack tool host and a feature capture target machine , there are attack and / or scanning tools running on the WEB attack tool host, and traffic grabbing tools are running on the feature capture target machine; Step 2, use the WEB attack tool host to perform packet capture analysis on the feature capture target machine, and determine The feature captures the feature information of the target machine, and the feature information includes the name of the tool framework of the attack and / or scanning tool; step 3, associate the feature information with the attack and / or scan tool, and establish a fingerprint database. Through the technical solution in this application, a practical and effective fingerprint database is established to realize the functions of automatic early warning and analysis and evidence collection before network attacks, reduce the work pressure of data analysis and security personnel, reduce the hidden dangers of the network, and improve monitoring and early warning Forensics capabilities.

Description

technical field [0001] This application relates to the technical field of network security, in particular, to a method for establishing a fingerprint library based on the characteristics of WEB attack tools, a fingerprint library system based on the characteristics of WEB attack tools, a network security server, and a computer readable storage media. Background technique [0002] Generally, the handling of network attack behaviors is generally carried out after the attack characteristics, intercepted attacks or attack events have been discovered, and then effective handling is carried out. It is a passive protection and early warning. This processing method cannot be fast, timely and effective As a result, there are still hidden dangers and risks such as being attacked, penetrated, and emergency delays. [0003] At present, practitioners related to network and information security can analyze network behavior through traffic and logs, discover attack behavior and attack eve...

AI Technical Summary

Problems solved by technology

[0002] Generally, the handling of network attack behaviors is generally carried out after the attack characteristics, intercepted attacks or attack events have been discovered, and then effective handling is carried out. It is a passive protection and early warning. This processing method cannot be fast, timely and effective Blocking network attacks, there are still hidden dangers and risks such as being attacked, penetrated, and emergency delays

[0003] At present, practitioners related to network and information security can analyze network behavior through traffic and logs, discover attack behavior and attack events, and check the trigger time and event content of the event through source tracing. The intelligence collection of offensive network behaviors cannot be quickly blocked and disposed of

Images