CN111756707A - Back door safety protection device and method applied to global wide area network - Google Patents

Back door safety protection device and method applied to global wide area network Download PDF

Info

Publication number
CN111756707A
CN111756707A CN202010514170.7A CN202010514170A CN111756707A CN 111756707 A CN111756707 A CN 111756707A CN 202010514170 A CN202010514170 A CN 202010514170A CN 111756707 A CN111756707 A CN 111756707A
Authority
CN
China
Prior art keywords
module
backdoor
area network
combination set
rule base
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202010514170.7A
Other languages
Chinese (zh)
Inventor
赵勇
方剑
金剑锋
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Telecom Group Trade Union Shanghai Committee
China Telecom Corp Ltd Shanghai Branch
Original Assignee
China Telecom Group Trade Union Shanghai Committee
China Telecom Corp Ltd Shanghai Branch
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Telecom Group Trade Union Shanghai Committee, China Telecom Corp Ltd Shanghai Branch filed Critical China Telecom Group Trade Union Shanghai Committee
Priority to CN202010514170.7A priority Critical patent/CN111756707A/en
Publication of CN111756707A publication Critical patent/CN111756707A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441Countermeasures against malicious traffic
    • H04L63/145Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416Event detection, e.g. attack signature detection

Abstract

The invention provides a back door safety protection device and a method applied to a global Wide Area Network (WAN). The back door safety protection device is integrated in application safety protection equipment of the WAN; the application safety protection device specifically comprises: the acquisition module is used for acquiring the feature code key words of the script backdoor program of the request website; the calling interface module is connected with the acquisition module and used for calling the feature code keywords acquired by the acquisition module; the pre-defined rule base is used for pre-storing a preset keyword combination set; the rule detection module is respectively connected with the predefined rule base and the calling interface module and is used for detecting whether at least one keyword group formed by keywords is matched with one keyword group in a preset keyword combination set or not, and if the matching is successful, a disconnection source request connection command is generated; and the action module is connected with the rule detection module and used for executing a disconnection source request connection command so as to refuse the access request between the request websites. The method and the system can carry out dynamic access control on the backdoor program of the malicious script implanted into the website, discover hacker behaviors, disconnect in time, protect the server of the existing Trojan horse, realize deeper defense and prevent an attacker from further invading.

Description

Back door safety protection device and method applied to global wide area network
Technical Field
The invention relates to the technical field of network security, in particular to a back door security protection device and a back door security protection method applied to a global wide area network.
Background
The use of the internet is increasingly widespread, programs based on a Web application layer (a global wide area network application layer) are widely popularized, and in the prior art, various protection technologies are adopted for the problem of Web application security, for example, as shown in fig. 1, a database server (14) and a Web server (13) are used as background servers, and security protection devices such as a firewall (10), an IDS/IPS (11), an application firewall (12) and the like are arranged between the client (9) requesting access and the database server and the Web server.
The firewall (10) is a device which helps the computer network construct a relatively isolated protective barrier between the internal and external networks to protect the user data and information security; an Intrusion Detection System (IDS) is a network security device that monitors network transmissions on-the-fly, alerts when suspicious transmissions are found, or takes proactive action. The IPS (Intrusion Prevention System) is a computer network security facility, and is a supplement to Antivirus software (anti Programs) and a firewall (Packet Filter). An Intrusion-prevention system (Intrusion-prevention system) is a computer network security device capable of monitoring network data transmission behaviors of a network or network devices, and can timely interrupt, adjust or isolate abnormal or harmful network data transmission behaviors. Waf (Web application Firewall) is a product that provides protection specifically for Web applications by enforcing a series of security policies against HTTP/HTTPS. The Web application firewall can perform abnormal detection on the HTTP request and reject the HTTP request which does not meet the HTTP standard. And it can only allow partial options of the HTTP protocol to pass through, thereby reducing the scope of attack. Even more, some Web application firewalls may severely limit options in the HTTP protocol that are too loose or not fully formulated.
The existing IDS and IPS can not meet the safety protection requirement of a web application layer, the web application firewall technology can effectively identify and filter various attacks on a web application system, and the attack problems can be basically solved based on real-time monitoring, discovery and interception of common web intrusion attack methods, such as SQL injection, form bypass, XSS script cross-site, directory traversal, remote file inclusion, command execution, application layer CC attack and the like.
However, Web application firewall technologies are all in the interception attack level, and the existing Web attack methods are novel and diverse, and cannot solve all attacks on Web application layer security, for example, effective protection cannot be achieved on some Web application layer bugs belonging to a logic type, or weak passwords exist in some system background configurations, and the like, which may cause the whole Web application system to be successfully invaded by hackers even under the protection of the Web application security firewall, and after the hackers successfully invade, the Web application system can be further operated and controlled by uploading various website script backdoor programs (also called webshell, Web backdoor programs), while in the prior art, the malicious script backdoor programs implanted in websites basically have no protection effect.
Disclosure of Invention
The invention provides a backdoor safety protection device and a backdoor safety protection method applied to a global wide area network (WW AN), and aims to solve the technical problem that a malicious script backdoor program implanted into a website cannot be protected in the prior art.
A backdoor security device for use in a global wide area network, comprising: the back door safety protection device is integrated in the application safety protection equipment of the global wide area network;
the application safety protection device specifically comprises:
the acquisition module is used for acquiring the feature code key words of the script backdoor program of the request website;
the calling interface module is connected with the acquisition module and used for calling the feature code keywords acquired by the acquisition module;
the pre-defined rule base is used for pre-storing a preset keyword combination set;
the rule detection module is respectively connected with the predefined rule base and the calling interface module and is used for detecting whether at least one keyword group formed by keywords is matched with one keyword group in a preset keyword combination set or not, and if the matching is successful, a disconnection source request connection command is generated;
and the action module is connected with the rule detection module and used for executing a disconnection source request connection command so as to refuse the access request between the request websites.
Further, the updating module is connected with the predefined rule base and used for regularly updating the preset keyword combination set in the predefined rule base.
Further, the method also comprises the following steps: and the log module is connected with the rule detection module and used for recording log information related to the operation process of the rule detection module and marking the currently recorded log information when the keyword group is successfully matched with the preset keyword combination set of the predefined rule base.
Further, the feature code key includes a predetermined call function key and/or an illegal authority elevating operation key.
Further, the rule detection module is used for generating a blocking command when the keyword group is successfully matched with the preset keyword combination set of the predefined rule base;
the action module is used for executing a blocking command to perform the operation of blocking the source internet protocol address and/or blocking the account and/or forbidding the access to the uniform resource identifier on the request website.
A back door safety protection method applied to a global area network (WW AN) uses the back door safety protection device applied to the WW AN, and comprises the following steps:
a1, collecting the feature code key words of the script backdoor program of the request website by a collecting module;
step A2, calling an interface module to call the feature code key words collected by the collection module;
step A3, respectively connected to the predefined rule base and the calling interface module, for detecting whether at least one keyword group composed of keywords matches with a certain keyword group in the preset keyword combination set, if matching is successful, generating a disconnection source request connection command;
in step A4, the action module executes a disconnect source request connection command to deny access requests between requesting web sites.
Further, the method also comprises the step A5:
and updating a preset keyword combination set in a predefined rule base.
Further, the method also comprises the step A6: and recording the log information associated with the operation process of the rule detection module, and recording the operation process of the rule detection module when the keyword group is successfully matched with the preset keyword group set of the predefined rule base, and labeling the currently recorded log information.
Further, the feature code key includes a predetermined call function key and/or an illegal authority elevating operation key.
Further, the method also comprises the step A7:
the rule detection module is also used for generating a blocking command when the keyword group is successfully matched with the preset keyword combination set of the predefined rule base;
further comprising step A8: the action module is used for executing a blocking command to perform the operation of blocking the source internet protocol address and/or blocking the account and/or forbidding the access to the uniform resource identifier on the request website.
The beneficial technical effects of the invention are as follows: the method and the system can carry out dynamic access control on the backdoor program of the malicious script implanted into the website, discover hacker behaviors, disconnect in time, protect the server of the existing Trojan horse, realize deeper defense and prevent an attacker from further invading.
Drawings
FIG. 1 is a schematic diagram of a WWAN security system according to the prior art;
FIG. 2 is a block diagram of a rear door security device for use in a WWAN application of the present invention;
FIG. 3 is a flowchart illustrating steps of a security method for a backdoor of a WWAN according to the present invention;
FIG. 4 is a diagram illustrating steps of updating a predefined rule base according to a backdoor security protection method applied to a global wide area network of the present invention;
FIG. 5 is a diagram illustrating a recording operation of a backdoor security method applied to a global wide area network according to the present invention;
fig. 6 is a diagram illustrating a further implementation of the security protection method for the backdoor in the ww an according to the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
It should be noted that the embodiments and features of the embodiments may be combined with each other without conflict.
The invention is further described with reference to the following drawings and specific examples, which are not intended to be limiting.
Referring to fig. 2, the present invention provides a security device for a backdoor applied to a global wide area network, comprising: the back door safety protection device is integrated in application safety protection equipment of a global wide area network;
the acquisition module (5) is used for acquiring the feature code key words of the script backdoor program of the request website;
the global wide area network application safety protection device comprises:
the calling interface module (6) is connected with the acquisition module (5) and is used for calling the feature code keywords acquired by the acquisition module (5);
a predefined rule base (4) for pre-storing a preset keyword combination set;
the rule detection module (2) is respectively connected with the predefined rule base (4) and the calling interface module (6) and is used for detecting whether at least one keyword group formed by the feature code keywords is matched with one keyword group in the preset keyword combination set or not, and if the matching is successful, a disconnection source request connection command is generated;
and the action module (3) is connected with the rule detection module (2) and is used for executing a disconnection source request connection command so as to reject the access request between the request websites.
Preferably, in the present invention, the ww an application security protection device may be an application firewall.
Further, an updating module (8) is connected to the predefined rule base (4) and configured to periodically update the preset keyword combination set in the predefined rule base (4).
Further, a log module (7) connected to the rule detection module (2) is configured to record log information associated with an operation process of the rule detection module (2), and mark the currently recorded log information when the keyword group is successfully matched with a preset keyword combination set of the predefined rule base (4).
Further, the feature code keyword includes a predetermined call function keyword and/or an illegal authority elevating operation keyword.
The feature code keywords may also include some common names such as ocean top, Trojan, special purpose keywords, and combinations thereof.
Further, the rule detection module (2) is further configured to generate a blocking command when the keyword group is successfully matched with a preset keyword group set of the predefined rule base (4);
the action module (3) is used for executing the blocking command to perform the operation of blocking a source internet protocol address and/or blocking an account and/or forbidding access to a uniform resource identifier on the request website.
When the matching is successful, the rule detection module (2) also generates an http command (a source request connection command) for intercepting the http command and disconnecting the http connection; and further blocks the source IP address, blocks the User, or inhibits access to the URI, as the case may be. The action module (3) executes the related command generated by the rule detection module (2).
Referring to fig. 3-6, the present invention further provides a back door security protection method applied to a global wide area network, using the aforementioned back door security protection device applied to the global wide area network, including the following steps:
a1, an acquisition module (5) acquires feature code keywords of a script backdoor program of a request website;
a2, calling an interface module (6) to call the feature code keywords collected by the collection module (5);
step A3, detecting whether at least one keyword group formed by the keywords is matched with one keyword group in the preset keyword combination set, if matching is successful, generating a disconnection source request connection command;
step A4, the action module (3) executes a disconnect source request connection command to deny access requests between the requesting web sites.
Further, the method also comprises the step A5: updating the preset keyword combination set in the predefined rule base (4).
Further, the method also comprises the step A6: and recording log information related to the operation process of the rule detection module (2), and recording the operation process of the rule detection module (2) and marking the currently recorded log information when the keyword group is successfully matched with a preset keyword combination set of a predefined rule base (4).
Further, the feature code keyword includes a predetermined call function keyword and/or an illegal authority elevating operation keyword.
Further, the method also comprises the step A7: the rule detection module (2) is also used for generating a blocking command when the keyword group is successfully matched with a preset keyword group set of a predefined rule base (4);
further comprising step A8: the action module (3) is used for executing the blocking command to perform the operation of blocking a source internet protocol address and/or blocking an account and/or forbidding access to a uniform resource identifier on the request website.
The device and the method can also be arranged in the website security monitoring equipment of the cloud system.
The invention realizes the protection capability through the analysis capability of the web server, and can discover and block all the dynamic access control to the script backdoor programs mentioned in the background technology, so that a hacker can not further check and actually operate the internal data of the global wide area network system to further realize deeper defense and prevent further invasion of the attacker. The invention has wide application range, lower cost, faster realization, stability and reliability, and is particularly suitable for the deployment of telecom mobile operators and the like.
While the invention has been described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention.

Claims (10)

1. A backdoor security device for use in a global wide area network, comprising: the back door safety protection device is integrated in application safety protection equipment of a global wide area network;
the application safety protection device specifically comprises:
the acquisition module is used for acquiring the feature code key words of the script backdoor program of the request website;
the calling interface module is connected with the acquisition module and used for calling the feature code keywords acquired by the acquisition module;
the pre-defined rule base is used for pre-storing a preset keyword combination set;
a rule detection module, connected to the predefined rule base and the calling interface module, respectively, for detecting whether at least one keyword group formed by the feature code keywords matches with a certain keyword group in the preset keyword combination set, and if matching is successful, generating a disconnection source request connection command;
and the action module is connected with the rule detection module and used for executing the disconnection source request connection command so as to reject the access request between the request websites.
2. The security device for backdoor of WWAN application of claim 1,
and the updating module is connected with a predefined rule base and used for periodically updating the preset keyword combination set in the predefined rule base.
3. The device of claim 1, further comprising:
and the log module is connected with the rule detection module and used for recording log information related to the operation process of the rule detection module and marking the currently recorded log information when the keyword group is successfully matched with a preset keyword combination set of a predefined rule base.
4. The security device for backdoor of WWAN application of claim 1,
the feature code keywords include predetermined call function keywords and/or illegal authority elevating operation keywords.
5. The security device for backdoor of WWAN application of claim 1,
the rule detection module is also used for generating a blocking command when the keyword group is successfully matched with a preset keyword combination set of a predefined rule base;
the action module is used for executing the blocking command so as to execute the operation of blocking a source internet protocol address and/or blocking an account and/or forbidding access to a uniform resource identifier on the request website.
6. A security method for a backdoor of a global area network, comprising the steps of using the security device of any one of claims 1-5 for a backdoor of a global area network, comprising:
step A1, the acquisition module acquires feature code keywords of a script backdoor program of a request website;
step A2, calling an interface module to call the feature code keyword collected by the collection module;
step A3, connected to the predefined rule base and the calling interface module, respectively, for detecting whether at least one keyword group formed by the keywords matches with a certain keyword group in the preset keyword combination set, and if matching is successful, generating a disconnection source request connection command;
step A4, the action module executes the disconnect source request connection command to deny access requests between the requesting web sites.
7. The security protection method for the backdoor of the global area network of claim 6, further comprising step a 5:
and updating the preset keyword combination set in the predefined rule base.
8. The security protection method for the backdoor of the global area network of claim 6, further comprising step a 6: and recording the log information related to the operation process of the rule detection module, and recording the operation process of the rule detection module and marking the currently recorded log information when the keyword group is successfully matched with the preset keyword combination set of the predefined rule base.
9. The security protection method for the back door of the global wide area network as claimed in claim 6,
the feature code keywords include predetermined call function keywords and/or illegal authority elevating operation keywords.
10. The security protection method for the backdoor of the global area network of claim 6, further comprising step a 7:
the rule detection module is also used for generating a blocking command when the keyword group is successfully matched with a preset keyword combination set of a predefined rule base;
further comprising step A8: the action module is used for executing the blocking command so as to execute the operation of blocking a source internet protocol address and/or blocking an account and/or forbidding access to a uniform resource identifier on the request website.
CN202010514170.7A 2020-06-08 2020-06-08 Back door safety protection device and method applied to global wide area network Pending CN111756707A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202010514170.7A CN111756707A (en) 2020-06-08 2020-06-08 Back door safety protection device and method applied to global wide area network

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010514170.7A CN111756707A (en) 2020-06-08 2020-06-08 Back door safety protection device and method applied to global wide area network

Publications (1)

Publication Number Publication Date
CN111756707A true CN111756707A (en) 2020-10-09

Family

ID=72675724

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010514170.7A Pending CN111756707A (en) 2020-06-08 2020-06-08 Back door safety protection device and method applied to global wide area network

Country Status (1)

Country Link
CN (1) CN111756707A (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114363386A (en) * 2021-12-31 2022-04-15 中控智网(北京)能源技术有限公司 Industrial control safety management device and oil and gas pipeline control system
WO2022082561A1 (en) * 2020-10-22 2022-04-28 Arris Enterprises Llc Method and system for parental control of broadband devices

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103268442A (en) * 2013-05-14 2013-08-28 北京奇虎科技有限公司 Method and device for achieving safe access of video websites
CN103561012A (en) * 2013-10-28 2014-02-05 中国科学院信息工程研究所 WEB backdoor detection method and system based on relevance tree
CN103905415A (en) * 2013-10-25 2014-07-02 哈尔滨安天科技股份有限公司 Method and system for preventing remote control type Trojan viruses
CN105933268A (en) * 2015-11-27 2016-09-07 中国银联股份有限公司 Webshell detection method and apparatus based on total access log analysis
CN108040036A (en) * 2017-11-22 2018-05-15 江苏翼企云通信科技有限公司 A kind of industry cloud Webshell safety protecting methods
US10397250B1 (en) * 2016-01-21 2019-08-27 F5 Networks, Inc. Methods for detecting remote access trojan malware and devices thereof
CN110943961A (en) * 2018-09-21 2020-03-31 阿里巴巴集团控股有限公司 Data processing method, device and storage medium

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103268442A (en) * 2013-05-14 2013-08-28 北京奇虎科技有限公司 Method and device for achieving safe access of video websites
CN103905415A (en) * 2013-10-25 2014-07-02 哈尔滨安天科技股份有限公司 Method and system for preventing remote control type Trojan viruses
CN103561012A (en) * 2013-10-28 2014-02-05 中国科学院信息工程研究所 WEB backdoor detection method and system based on relevance tree
CN105933268A (en) * 2015-11-27 2016-09-07 中国银联股份有限公司 Webshell detection method and apparatus based on total access log analysis
US10397250B1 (en) * 2016-01-21 2019-08-27 F5 Networks, Inc. Methods for detecting remote access trojan malware and devices thereof
CN108040036A (en) * 2017-11-22 2018-05-15 江苏翼企云通信科技有限公司 A kind of industry cloud Webshell safety protecting methods
CN110943961A (en) * 2018-09-21 2020-03-31 阿里巴巴集团控股有限公司 Data processing method, device and storage medium

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022082561A1 (en) * 2020-10-22 2022-04-28 Arris Enterprises Llc Method and system for parental control of broadband devices
CN114363386A (en) * 2021-12-31 2022-04-15 中控智网(北京)能源技术有限公司 Industrial control safety management device and oil and gas pipeline control system
CN114363386B (en) * 2021-12-31 2024-04-12 中控创新(北京)能源技术有限公司 Industrial control safety management device and oil and gas pipeline control system

Similar Documents

Publication Publication Date Title
EP3462698B1 (en) System and method of cloud detection, investigation and elimination of targeted attacks
US10212134B2 (en) Centralized management and enforcement of online privacy policies
US9917864B2 (en) Security policy deployment and enforcement system for the detection and control of polymorphic and targeted malware
US20190354709A1 (en) Enforcement of same origin policy for sensitive data
Cazorla et al. Cyber stealth attacks in critical information infrastructures
KR101462311B1 (en) Method for preventing malicious code
EP2715522B1 (en) Using dns communications to filter domain names
US7007301B2 (en) Computer architecture for an intrusion detection system
US7134141B2 (en) System and method for host and network based intrusion detection and response
US20060026683A1 (en) Intrusion protection system and method
US10218738B2 (en) Secure notification of networked devices
US20050203921A1 (en) System for protecting database applications from unauthorized activity
US20110214182A1 (en) Methods for proactively securing a web application and apparatuses thereof
US20030191966A1 (en) System and method for detecting an infective element in a network environment
Latha et al. A survey on network attacks and Intrusion detection systems
CN111756707A (en) Back door safety protection device and method applied to global wide area network
CN110087238B (en) Information security protection system of mobile electronic equipment
CN113660222A (en) Situation awareness defense method and system based on mandatory access control
US20180316697A1 (en) Method of aiding the detection of infection of a terminal by malware
KR101910496B1 (en) Network based proxy setting detection system through wide area network internet protocol(IP) validation and method of blocking harmful site access using the same
Kandan et al. Network attacks and prevention techniques-a study
Bhimireddy et al. Web Security and Web Application Security: Attacks and Prevention
KR101153115B1 (en) Method, server and device for detecting hacking tools
Mishra et al. Intrusion detection systems for high performance computing environment
Udaykumar A Study on Network Threats, Attacks & Security Measures

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication
RJ01 Rejection of invention patent application after publication

Application publication date: 20201009