A traffic-based self-feedback malware monitoring system and method

Abstract

The invention discloses a flow-based self-feedback malicious software monitoring system and method, comprising the following steps: step 1, acquiring HTTP flow, and filtering the HTTP flow of benign domain name; step 2, cleaning and filtering out the HTTP flow originating from the browser The HTTP flow of described; Step 3, compare with the fingerprint feature database, directly identify; Step 4, carry out streaming processing to the described HTTP flow that cannot identify, flow is carried out clustering; Step 5, detection analysis; Step 6, to Verify the detection results, calculate and monitor the false positive rate; step 7, when the false positive rate exceeds the set threshold, perform feedback training and adjustment to the model; step 8, execute the steps 1 to 7 cyclically. The invention can efficiently monitor malicious software, and can adapt to the constantly changing dynamic flow environment, and can cope with the current changing and developing trend of malicious software.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a traffic-based self-feedback malicious software monitoring system and method. Background technique [0002] Internet security has always been an important issue worldwide. With the rapid development of new network attack methods, Internet security threats are becoming more and more intensified. Malware, as one of the major network threats, is likely to cause the entire network system where it is located to be attacked and cause the leakage of sensitive information. This also makes the accurate and timely identification and classification of malware in the network system increasingly important. [0003] For an organization, an insider's negligence and the introduction of malware could end up causing unforeseen damage. How to effectively detect malware in its entire network system environment has become a common topic. However, the current main way of malware detection ...

AI Technical Summary

Problems solved by technology

[0005] The technical problem to be solved by the present invention is that the current detection method for malicious software still has the problems of limited detection range, low accuracy and low adaptability to changes.

Images