Network attack analysis method, network attack analysis device, computing equipment and medium

Abstract

The invention provides a network attack analysis method, a network attack analysis device, computing equipment and a medium. The method comprises the following steps: detecting a first network data flow in response to the received first network data flow to determine whether the first network data flow has a network attack file or not; if it is determined that the network attack file exists in thefirst network data stream, obtaining path information of the network attack file; and in response to receiving the request, performing attack analysis on the request to determine whether the electronic device corresponding to the path information is being attacked by the network, the request including the path information of the network attack file and the request belonging to the second networkdata flow, and the receiving time of the second network data flow being later than the receiving time of the first network data flow.

Description

technical field [0001] The present disclosure relates to the technical field of information security, and more specifically, to a network attack analysis method, a network attack analysis device, computing equipment and a medium. Background technique [0002] With the rapid development of communication and computer technology, Internet information security has become the focus of people's increasing attention. webshell is a script attack tool for network (web) intrusion. To put it simply, webshell is a Trojan horse backdoor. After hackers invade a website, they often place these Trojan horse backdoor files in the web directory of the website server and mix them with normal web page files. Then hackers can use the web to control the website server through the Trojan horse backdoor, including uploading and downloading files, viewing databases, and executing arbitrary program commands. [0003] In the process of realizing the disclosed concept, the inventor found that there a...

AI Technical Summary

Problems solved by technology

[0003] In the process of realizing the disclosed concept, the inventor found that there are at least the following problems in related technologies: the related webshell detection technology can detect that the webshell file is uploaded, if the attacker does not take further actions to trigger the malicious code in the webshell file, then The malicious code will always be stored in the victim's device as a normal file code

Therefore, when the attacker will trigger the webshell file and cause real harm to the attacked system is still unknown

Images