CN103067360A - Method and system for procedure network behavior identification - Google Patents
Method and system for procedure network behavior identification Download PDFInfo
- Publication number
- CN103067360A CN103067360A CN 201210551540 CN201210551540A CN103067360A CN 103067360 A CN103067360 A CN 103067360A CN 201210551540 CN201210551540 CN 201210551540 CN 201210551540 A CN201210551540 A CN 201210551540A CN 103067360 A CN103067360 A CN 103067360A
- Authority
- CN
- China
- Prior art keywords
- network behavior
- program
- application layer
- layer data
- agreement
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Abstract
The invention discloses a method and a system for procedure network behavior identification. The system comprises a client-side and a cloud server. The client-side is used for obtaining a data packet of a procedure in prior network behavior and receiving an identification result returned by the cloud server in the process of accessing network of the procedure. The cloud server is used for receiving the data packet, obtained by the client-side, of the prior network behavior of the procedure and judging whether an unknown treaty is included in application layer data. If the treaties in the application layer data are all known, the prior network behavior of the procedure is marked to be the network behavior capable of being identified of the procedure. If the unknown treaty is included, the network behavior is marked to be the dubious network behavior of the procedure. The identification result is sent to the client-side so that accurate identification of the network behavior of the procedure is achieved.
Description
Technical field
The invention belongs to field of computer technology, relate in particular to a kind of program network behavior recognition methods and system.
Background technology
As everyone knows, in the current internet environment, the network configuration that is most widely used satisfies DoD model (claiming again TCP/IP protocol suite).This DoD model comprises: link layer, internet layer, transport layer and application layer.If a program will send or receive internet data, just need to allow oneself data fit ICP/IP protocol standard, could allow data in the Internet accurately and effectively transmission.And in this four layer protocol: the data structure of link layer, internet layer, transport layer all has the relatively strict standard of a cover, and programmer can not be changed its structure without authorization, so be easy to be monitored critical data and be difficult to camouflage by fail-safe software or safety means.The data structure of application layer has very high customizable characteristic only.Allow the programming personnel according to oneself demand and any definition of idea content and structure wherein.
The detection scheme of existing data structure to application layer, mainly be to rely on condition code to detect---namely: the researcher has found a certain Cyberthreat that has occurred (control far away, wooden horse, worm etc.), by the sample of taking is carried out research and analysis, grasp the network packet of its transmission, then extract its fixation features (a certain specific character appears in the place such as a certain particular offset), as the automatic foundation that detects of program.And the shortcoming that enters such traditional solution maximum is to exist hysteresis quality, must find the sample of novel threat to be analyzed, and just can make effective interception.
Hence one can see that, and traditional program network behavior RM can not accurately be identified for the network behavior of the program of new appearance or new variant.
Summary of the invention
In view of above-mentioned technical problem, the present invention has been proposed in order to a kind of program network behavior recognition methods and system that overcomes above-mentioned technical problem or solve the problems of the technologies described above at least in part is provided.
According to an aspect of the embodiment of the invention, a kind of program network behavior recognition methods is provided, method comprises: in the process of routine access network, obtain the application layer data in the current network behavior of program; Judge and whether comprise unknown agreement in the application layer data; If the agreement in the application layer data all is known agreement, then the current network behavior of program is designated the network behavior of the program that can identify; If comprise unknown agreement in the application layer data, then the current network behavior of program is designated the network behavior of suspicious program; Wherein, after the current network behavior with described program was designated the step of network behavior of the program that can identify, described method also comprises: whether the network behavior of judging the described program that can identify was the network behavior of rogue program; If the network behavior of rogue program then sends indicating risk information, and/or tackle the current network behavior of the described program that can identify; If not the network behavior of rogue program, then the current network behavior with the described program that can identify is designated normal network behavior.
Another aspect according to the embodiment of the invention, a kind of program network behavior recognition system is provided, comprise: client and cloud server, client wherein, be used for the process at the routine access network, obtain the packet in the current network behavior of program, packet comprises: application layer data, and receive the recognition result that cloud server returns; The high in the clouds service end be used for to receive the current network behavior packet of the program that client obtains, and judges the agreement that whether comprises the unknown in the application layer data; If the agreement in the application layer data all is known agreement, then the current network behavior of program is designated the network behavior of the program that can identify; If comprise unknown agreement in the application layer data, then the current network behavior of program is designated the network behavior of suspicious program, send recognition result to client; Cloud server comprises program network behavior recognition device, and this device comprises: acquisition module, be used for the process at the routine access network, and obtain the application layer data in the current network behavior of program; The first judge module is used for judging whether application layer data comprises unknown agreement; Identification module when being used for agreement at application layer data and all being known agreement, is designated the current network behavior of program the network behavior of the program that can identify; And when comprising unknown agreement in the application layer data, the current network behavior of program is designated the network behavior of suspicious program.
According to program network behavior recognition methods and the system of the embodiment of the invention, when the application layer data in the current network behavior of program all is known agreement, the current network behavior of program is designated the network behavior of the program that can identify; When comprising unknown agreement in the application layer data in the current network behavior of program, the current network behavior of program is designated the network behavior of suspicious program, realize thus the accurate identification to the network behavior of program, to comprise that the network behavior of the program of unknown agreement is designated the network behavior of suspicious program, and can send indicating risk information to the user, carry out final selection by the user, solved thus the problem that traditional program network behavior identifying schemes can not accurately be identified for the network behavior of the program of new appearance or new variant, further solve the problem of procotol of the unknown not being tackled in traditional program network behavior identifying schemes, improved user's internet security.
And, after the current network behavior with program is designated the network behavior of the program that can identify, perhaps the current network behavior of program is designated after the network behavior of suspicious program, client can be sent to cloud server with the characteristic information in the application layer data, by cloud server according to the black and white lists in the black and white lists storehouse, whether the network behavior of determining program is the network behavior of rogue program, by data volume is larger, change ratio more frequently some black and white lists is stored on the cloud server, identified the network behavior of rogue program by cloud server, can effectively save the performance cost of client terminal local resource and reduction client terminal local machine, also can accelerate the response speed of recognition network behavior simultaneously.
Above-mentioned explanation only is the general introduction of technical solution of the present invention, for can clearer understanding technological means of the present invention, and can be implemented according to the content of specification, and for above and other objects of the present invention, feature and advantage can be become apparent, below especially exemplified by the specific embodiment of the present invention.
Description of drawings
By reading hereinafter detailed description of the preferred embodiment, various other advantage and benefits will become cheer and bright for those of ordinary skills.Accompanying drawing only is used for the purpose of preferred implementation is shown, and does not think limitation of the present invention.And in whole accompanying drawing, represent identical parts with identical reference symbol.In the accompanying drawings:
Fig. 1 shows the according to an embodiment of the invention flow chart of program network behavior recognition methods 100;
Fig. 2 shows the in accordance with another embodiment of the present invention structured flowchart of program network behavior recognition device 200; And
Fig. 3 shows the structured flowchart of the program network behavior recognition system 300 of another embodiment according to the present invention.
Embodiment
Exemplary embodiment of the present disclosure is described below with reference to accompanying drawings in more detail.Although shown exemplary embodiment of the present disclosure in the accompanying drawing, yet should be appreciated that and to realize the disclosure and the embodiment that should do not set forth limits here with various forms.On the contrary, it is in order to understand the disclosure more thoroughly that these embodiment are provided, and can with the scope of the present disclosure complete convey to those skilled in the art.
Traditional program network behavior identifying schemes is started with by known data mostly, attempts to find which partly is known in the data that is:, finds useful part again from these known data, is used for judging whether these data have threat.In case be unknown but the disadvantage of this thinking is the application layer data of network data, the effective known data that can take so will be seldom, so just be difficult to whether exist threat to make accurate judgement to network behavior, be easy to let slip the unknown network behavior with Cyberthreat.
For this reason, a kind of program network behavior recognition methods that the embodiment of the invention proposes, Apparatus and system, the data structure that its thinking is based on application layer in the ICP/IP protocol system has higher customizable characteristic, in case detect and comprise self-defining data structure in the application layer data, can think that there is risk in current network behavior, the program network behavior recognition methods of the present invention's proposition mainly is thus, whether comprise unknown agreement in the application layer data of the current network behavior by determining program, if all be known agreement, then the current network behavior of program is designated the network behavior of the program that can identify; If comprise unknown agreement, then the current network behavior of program is designated the network behavior of suspicious program.
The flow chart of the program network behavior recognition methods 100 that specifies according to an embodiment of the invention, is suitable for solving the problems of the technologies described above below in conjunction with Fig. 1.As shown in Figure 1, the method 100 of the embodiment of the invention starts from step S101.Subsequently, in step S102, in the process of routine access network, obtain the application layer data of the current network behavior of program.
Need to prove that program is a common file, is the set of a machine code instruction and data, is the concept of a static state.A program implementation on computers is a dynamic concept during process.Same program can run on several data acquisition systems simultaneously, that is to say that same program can corresponding a plurality of processes.Network behavior is to be initiated by active program (also being process).The current network behavior of program that is to say the network behavior of being initiated by the process that belongs to this program.
For the ease of understanding this step, at first simply introduce network behavior.Network behavior can be understood as the various actions that need to be undertaken by network, of a great variety, for example comprise: HTTP(Hypertext Transport Protocol, HTTP) access (common are download file or upload information), SMTP(Simple Mail Transfer Protocol, Simple Mail Transfer protocol) request (sending and receiving e-mail), DNS(Domain Name System, domain name system) request (resolving the information such as IP address corresponding to domain name) etc.
Secondly, introduce again the flow process of application access network: if a common program needs interconnection network, the API(Application Program Interface that needs provide by operating system (such as Windows), application programming interfaces) interface sends the request of interconnection network, after operating system receives this network request of application program, can receive the data that application program will send, and the data that receive are encapsulated, afterwards the data of encapsulation are sent to physical equipment (such as network interface card etc.), last hardware device spreads out of data.
Based on the flow process of above application access network, the information of network behavior is intercepted and captured the purpose of the current network behavior that can realize monitoring program in any one link of this flow process.The execution mode of concrete monitoring can but be not limited to following several mode: by the information that drives in client log-in protocol, is created in the similar filtration drive of operating system, the application programming interface function (such as the hook function) that utilizes operating system to provide is intercepted and captured the current network behavior, take over the request of routine call interface for network programming function (Winsock) or utilize the mode such as registration fire compartment wall readjustment, intercept and capture the information of the current network behavior of program.The below carries out specific description:
In the process of application access network, operating system is when processing related data, can obtain with some protocol-driven and filtration drive the data of network behavior, so can the log-in protocol driving or the similar filtration drive of filtration drive used of establishment and operating system, and then get access to the data of network behavior.Embodiment can be: to NDIS(Network Driver Interface Specification, NDIS) log-in protocol drives, also can be at Afd.sys(Ancillary Function Driver for Winsock, the miscellaneous function of Winsock drives) the driving arrangement stack, Tdi.sys(Transport Dispatch Interface, the transmission distribution interface) driving arrangement stack or Tcpip.sys(Transmission Control Protocol/Internet Protocol, transmission control/network communication protocol) the increase filtration drive similar to operating system on the driving arrangement stack.
In addition, the application layer data that obtains in the current network behavior of program can also be realized in the following manner: utilize the hook function with the Data acquisition of network behavior.Embodiment can be: intercept and capture Windows SSDT(System Services Descriptor Table with the hook function, the system service descriptor table) in kernel provide with device communication interface NtDeviceIoControl function, obtain the data of all application devices communications, filter the request that wherein Afd.sys is sent; Can also be to utilize the hook function to intercept and capture Tcpip.sys to drive interface that the service function that provides or NDIS.sys derive etc., come by the way the network behavior of monitoring program.Can certainly come in the following manner the network behavior of program is monitored: according to the LSP(Layered Service Provider of Windows, layered service provider), can say that LSP mechanism expands, after using oneself dll file to take over the request of all application call Winsock, being forwarded among the mswsock.dll of Windows self again and going, perhaps also can be to drive to Windows system IP device to send IOCTL_IP_SET_FIREWALL_HOOK registration fire compartment wall readjustment etc.In practice, during the network behavior of monitoring program, can select above different mode according to actual conditions, the mode of monitor network behavior also is not limited to above cited mode certainly.
Subsequently, in step S104, judge whether comprise unknown agreement in the application layer data, in certain embodiments, can according to the form of known agreement, judge whether comprise unknown agreement in the application layer data.For example: known agreement comprises at least one in following at least: http protocol, DNS Protocol, smtp protocol, File Transfer Protocol (File Transfer Protocol, file transfer protocol (FTP)), snmp protocol (Simple Network Management Protocol, Simple Network Management Protocol) and POP3 agreement (the 3rd release protocol of post office protocol).
Alternatively, collect in advance the abundant known agreement of quantity on client, this known agreement comprises: three kinds of agreements such as http protocol, DNS Protocol, smtp protocol, also can comprise some cryptographic protocols, such as: File Transfer Protocol etc.Cryptographic protocol mainly is in packet the agreement of the unknown to be carried out unified encryption format to encapsulate, the more additional discernible common protocol in packet the inside, these agreements commonly used can comprise: snmp protocol, POP3 agreement, eMule/eDonkey agreement, perhaps BITTORRENT agreement etc.Because different agreements itself has some set forms, therefore but for form of known agreement detection protocol itself, for example http protocol comprises protocol header, but there is not the agreement tail, the field such as Host, Refer all belongs to the content that comprises in the protocol header, and form common in the protocol header comprises: the field parts such as Host, Refer, User-agent, Url.
If comprise unknown agreement in the application layer data, then can think to have risk.Although application layer data can arbitrarily be specified by the software developer, for the convenience of transfer of data in the Internet, in actual application, formed cover puppy parc (also can be described as a known agreement) standard.Known agreement such as DNS Protocol, http protocol, File Transfer Protocol, smtp protocol, SSL/TLS agreement, SSH agreement, uTorrent agreement, eMule/eDonkey agreement, BitTorrent agreement etc., above-mentioned known agreement has occupied the overwhelming majority in the network data.As long as can effectively identify and analyze the data structure of above-mentioned known agreement, so the agreement of remaining the unknown will be only a few.Because known agreement can satisfy all transfer of data demands substantially, so have reason to think that every custom protocol (i.e. unknown agreement) of needing carries out transfer of data, all should be certain specific demand is arranged and in the specific environment of a certain very low range, to use, and should not be in wide-scale distribution in the middle of the Internet.Classify as suspiciously so will include the application layer data of unknown agreement, be necessary to carry out indicating risk to the user.
In the flow process specific to method 100, can collect in advance the form of known agreement, known agreement includes but not limited to DNS Protocol, http protocol, File Transfer Protocol, smtp protocol, the SSL/TLS agreement, the SSH agreement, the uTorrent agreement, the eMule/eDonkey agreement, BitTorrent agreement etc., then in step S104, form according to the known agreement of collecting in advance, the agreement of using in the layer data is identified, if the agreement in the application layer data can both be identified, then judge in the application layer data it all is known agreement, if there is at least part of agreement not identify in the application layer data, then judge to comprise unknown agreement in the application layer data.
If the agreement of judging in the application layer data all is known agreement, then carry out step S106 in step S104.In step S106, the current network behavior of program is designated the network behavior of the program that can identify.
Namely, when the agreement in the application layer data of network behavior all is known agreement, means and to identify this network behavior, in step S106, this network behavior can be designated the network behavior of the program that can identify this moment.For example by identifier " 1 " network behavior is designated the network behavior of the program that can identify.What certainly can understand is not limit in an embodiment of the present invention the concrete form of identifier.
After step S106, can enter ending step S121.But whether the network behavior of the program that can identify for further judgement is the network behavior of rogue program, can after step S106, enter step S110, in step S110, whether the network behavior of the program that judgement can be identified is the network behavior of rogue program.
Rogue program typically refers to one section program that the operation side with attack intension writes.These threats can be divided into two classifications: need threat and the threat independent of each other of host program.The former is the usability of program fragments that can not be independent of certain actual application program, utility program or system program basically; The latter is the self-contained program that can be operated system call and operation.Rogue program comprises: trapdoor, logic bomb, Trojan Horse, worm, bacterium and virus etc.
In certain embodiments, can adopt following dual mode to judge whether the network behavior of the program that can identify is the network behavior of rogue program, wherein
Mode one is used for the black and white lists in storage black and white lists storehouse in the default module of client, can judge by black and white lists and the characteristic information that obtains whether network behavior is the network behavior of rogue program by client.
Alternatively, the black and white lists that cyber-defence is relevant can carry out different check items for different agreement.For example: (1) general check item comprises: check far-end ip address, local port, remote port, transport layer protocol (being generally one of TCP or UDP).(2) protocol type inspection, some known protocol may be used for the transmission of data by wooden horse control far away, and in a single day this type of known protocol is found to be judged as the data protocol bag that is used by rogue program.(3) protocol details inspection, other known protocols, obtain the object itself that reference value is wherein arranged and can not relate to detection according to the distinctive structure of agreement, the standard of judging as black and white on this basis, this protocol details can be according to the difference of agreement and detailed programs also can be different, as: the field after client detects URL, Host, Referer, User-Agent etc. in the http protocol and encrypts; Field after Name in the Queries information in the detection DNS Protocol and Type etc. encrypt.
Particularly, client is obtained the characteristic information in the application layer data of network behavior of the program that can identify, and this characteristic information can be partial code, the packet in the application layer data or the one piece of data in the packet in the application layer data in the application layer data; According to the black and white lists on the client, and the characteristic information that obtains, whether the network behavior of the program that judgement can be identified is the network behavior of rogue program.
Be that HTTP access behavior is introduced with network behavior, in above-mentioned steps, in step S102, obtain the application layer data of HTTP access behavior.In step S104, judging the agreement that this HTTP access behavior comprises according to the form of known http protocol all is known agreement.Then in step S106, HTTP access behavior is designated the network behavior of the program that can identify.Then in step S110, obtain the characteristic information in the application layer data of HTTP access behavior, such as Host field, Url field, IP address field etc., and judge according to the black and white lists in the black and white lists storehouse whether above-mentioned characteristic information belongs to the characteristic information in the network behavior of rogue program, if belong to, then this network behavior belongs to the network behavior of rogue program, enter into step S112, if do not belong to, then this network behavior belongs to normal network behavior, enters into step S114.
Need to prove that for different agreements, the project of the detection in mode one is different, for example for DNS Protocol, mainly is the domain name mapping for the request bag, judges the character string of the domain name of resolving, and DNS whether return the IP address come etc. unusual.Mainly be to judge whether name field part is unusual, for example detect mail sender, recipient, sender's title and domain name, and whether recipient's title and domain name etc. is unusual for smtp protocol.For File Transfer Protocol and http protocol, mainly be to judge whether domain name and Url field be unusual.If above-mentioned field is consistent with blacklist in cloud server or the client, think that then this agreement is risky, be necessary to carry out indicating risk to the user.For all data that obtain in the smtp protocol all can MD5 etc. cryptographic Hash upload again cloud server after processing, black and white lists only detects the MD5 value of the data in the smtp protocol beyond the clouds in the server, does not relate to Mail Contents itself.
Mode two, preset beyond the clouds a database on the server, this database is used for the black and white lists in storage black and white lists storehouse, client sends to cloud server with the characteristic information that obtains, and judges according to black and white lists and the characteristic information that receives whether network behavior is the network behavior of rogue program by cloud server.
Particularly, at first client is obtained the characteristic information in the application layer data in the network behavior of the program that can identify, and this characteristic information can be partial code (for example Host field or Url field), the packet in the application layer data or the one piece of data in the packet in the application layer data in the application layer data.Generally, except comprising the field for transmission, also have some self-defining data in the application layer data.For example the user with HTTP or FTP to the website or during server up transfer file, except some necessary identifying informations of being uploaded by field designated users such as URL and Host, the file that the user uploads itself will be used as a packet, is attached in HTTP or the File Transfer Protocol and transmits to given server.At this moment, the file content that the user uploads just belongs to the packet (certainly, the words that file is large might be split into a plurality of packets and transmit) in the above-mentioned application layer protocol.This only is a more common example, and for different agreement and different application scenario, this packet can be with multi-form appearance.Certainly, also may not exist this packet or packet for empty under some situation.
Then, client is sent to cloud server with characteristic information, judge according to the black and white lists in the black and white lists storehouse whether above-mentioned characteristic information belongs to the characteristic information in the network behavior of rogue program by cloud server, and return judged result to client, if belong to, then this network behavior belongs to the network behavior of rogue program, enter into step S112, if do not belong to, then this network behavior belongs to normal network behavior, enters into step S114.Because the memory space of cloud server will be far longer than client, so can pre-stored black and white lists as much as possible storehouse on the cloud server, and then can improve the accuracy of network behavior identification.Simultaneously, can in time upgrade processing for after the up-to-date black and white lists storehouse of collecting on the server beyond the clouds.
Get back in the flow process of said method 100, if in step S110, judge it is the network behavior of rogue program, then enter into step S112, in step S112, then the current network behavior of the program that transmission indicating risk information and/or interception can be identified enters ending step S121.For example, if current network behavior that can determine procedures is the network behavior of rogue program, can suspend first the network connection of this program, and send information to the user, inform that this program of user is for unusual, make final selection by the user, if the user selection interception, this network behavior will thoroughly be stoped so.On the contrary, if judge it is not the network behavior of rogue program in step S110, then enter into step S114, the current network behavior of the program that can identify is designated normal network behavior, then enters ending step S121.Normal network behavior does not have risk or has extremely low risk, allows this normal network behavior accesses network.
On the contrary, comprise unknown agreement in the application layer data if in step S104, judge, then carry out step S108.In step S108, the current network behavior of program is designated the network behavior of suspicious program.Namely, the agreement of the application layer data of the network behavior of program and general agreement are compared, when comprising unknown agreement in the application layer data of the network behavior of program, can think that then the network behavior of this program temporarily can't accurately identify, can think that there is risk in this network behavior, can be designated the network behavior of this program the network behavior of suspicious program this moment.For example by identifier " 0 " network behavior is designated the network behavior of suspicious program.What certainly can understand is not limit in an embodiment of the present invention the concrete form of identifier.
After step S108, can enter ending step S121.But in order further to judge whether the network behavior of suspicious program is the network behavior of rogue program, can enter step S116 after step S108.In step S116, judge whether the network behavior of suspicious program is the network behavior of rogue program.
Rogue program typically refers to one section program of writing with attack intension, and these threats can be divided into two classifications: need threat and the threat independent of each other of host program.The former is the usability of program fragments that can not be independent of certain actual application program, utility program or system program basically; The latter is the self-contained program that can be operated system call and operation, and rogue program comprises: trapdoor, logic bomb, Trojan Horse, worm, bacterium and virus etc.
In certain embodiments, can adopt following dual mode to judge whether the network behavior of suspicious program is the network behavior of rogue program, wherein
Mode one is used for the black and white lists in storage black and white lists storehouse in the default module of client, judges by black and white lists and the characteristic information that obtains whether network behavior is the network behavior of rogue program by client.
Particularly, client is obtained the characteristic information in the application layer data of network behavior of suspicious program, and this characteristic information can be partial code, the packet in the application layer data or the one piece of data in the packet in the application layer data in the application layer data; According to the black and white lists on the client, and the characteristic information that obtains, whether the network behavior of judging suspicious program is the network behavior of rogue program, if belong to, then this network behavior belongs to the network behavior of rogue program, enters into step S118, if do not belong to, then this network behavior belongs to risky network behavior, enters into step S120
Need to prove that for different agreements, the project of detection is different, for example for DNS Protocol, mainly is the domain name mapping for the request bag, judges the character string of the domain name of resolving, and DNS whether return the IP address come etc. unusual.Mainly be to judge name field part for smtp protocol, comprise: mail sender, recipient, sender's title and domain name, and whether recipient's title and domain name etc. are unusual.For http protocol, mainly judge Host, URL, whether the fields such as User-Agent, Referer and Method are unusual.The unusual judgement for whether, mainly be two large classes: (1) is coupling precisely: such as having found a wooden horse, find that this wooden horse has connected certain IP address or URL, and this IP address or URL do not find to have other proper purposes, when finding to have program to remove to connect this IP address or URL so again, just think that this program has unusually (more more complex criterion can also be arranged, and such as the particular port that connects certain specific IP, just thinking has unusually); (2) fuzzy matching, long-term monitoring and the analysis of the application program of process server end find that a large amount of wooden horses all are to point to same IP section or same TLD, and seldom occur or do not occur at all normal website on this IP section or the TLD.Can think that so the program that is connected under this IP section or the TLD just all has unusual.This kind situation can have more complicated criterion, for example utilize game456 to carry out the example that wooden horse is propagated: official's domain name of game456 is game456.com and game456.net, and the domain name that a lot of wooden horses connect is all very near official's domain name, such as game456.me, game456.3322.org, game456.com.abcd.org etc.Can think so every game456 of being similar to official domain name to have certain fraudulent these domain names, just all have unusual.
Mode two, a default module is used for storing the black and white lists in black and white lists storehouse on the server beyond the clouds, client sends to cloud server with the characteristic information that obtains, and judges according to black and white lists and the characteristic information that receives whether network behavior is the network behavior of rogue program by cloud server.Client upload can be passed through encryption to the characteristic information of cloud server, for example: the cryptographic Hash that can calculate whole URL, main frame URL, domain name URL, classification domain name URL, query path URL by the MD5 algorithm, this MD5 cryptographic Hash is sent to cloud server, cloud server returns encrypt data to client together with the MD5 cryptographic Hash, and encrypt data comprises the MD5 cryptographic Hash.
Particularly, client is obtained the characteristic information in the application layer data in the network behavior of suspicious program, and this characteristic information can be partial code (for example Host field or Url field), the packet in the application layer data or the one piece of data in the packet in the application layer data in the application layer data; Client is sent to cloud server with characteristic information, judge according to the black and white lists in the black and white lists storehouse whether above-mentioned characteristic information belongs to the characteristic information in the network behavior of rogue program by cloud server, and return judged result to client, if belong to, then this network behavior belongs to the network behavior of rogue program, enters into step S118, if do not belong to, then this network behavior belongs to risky network behavior, enters into step S120.
Because the memory space of cloud server will be far longer than client, so can pre-stored black and white lists as much as possible storehouse on the cloud server, and then can improve the accuracy of network behavior identification.Simultaneously, can in time process for after the up-to-date black and white lists storehouse of collecting.In certain embodiments, for the local resource of saving client and the performance cost that reduces client, simultaneously also in order to improve response speed, can be large data volume, change is saved on the cloud server than some black and white lists more frequently, and a part of black and white lists that some are relatively fixed, hit very precisely, data volume is very little is saved on the client.
If in step S116, judge it is the network behavior of rogue program, then enter into step S118.In step S118, send the current network behavior that indicating risk information and/or interception are designated suspicious program, then enter ending step S121.For example, if current network behavior that can determine procedures is the network behavior of rogue program, can suspend first the network connection of this program, and send information to the user, inform that this program of user is for unusual, make final selection by the user, if the user selection interception, this network behavior will thoroughly be stoped so.
On the contrary, if in step S116, judge it is not the network behavior of rogue program, then enter into step S120.In step S120, send indicating risk information, then enter ending step S121.Namely, although the network behavior of suspicious program is not the network behavior of rogue program, there is risk in the network behavior of the program that this is suspicious, therefore sends indicating risk information by step S120 to the user, makes final selection by the user.
Need to prove, method shown in Figure 1 do not limit by shown in the order of each step carry out, can adjust as required the sequencing of each step, in addition, described step also is not limited to above-mentioned steps and divides, and above-mentioned steps can split into further more that multi-step also can be merged into still less step.
Below in conjunction with Fig. 2 explanation in accordance with another embodiment of the present invention, a kind of program network behavior recognition device 200 of being suitable for addressing the above problem.
As shown in Figure 2, this program network behavior recognition device 200 comprises: acquisition module 202, the first judge module 204 and identification module 206, wherein: acquisition module 202, for the application layer data of the current network behavior of obtaining program; The first judge module 204 is used for judging whether application layer data comprises unknown agreement; Identification module 206 when being used for agreement at application layer data and all being known agreement, is designated the current network behavior of program the network behavior of the program that can identify; And when comprising unknown agreement in the application layer data, the current network behavior of program is designated the network behavior of suspicious program.
In certain embodiments, the first judge module 202 is further used for the form according to known agreement, judges whether comprise unknown agreement in the application layer data.For example, the abundant known agreement of pre-stored quantity on client, this known agreement comprises: three kinds of agreements such as http protocol, DNS Protocol, smtp protocol, also can comprise some cryptographic protocols, such as: File Transfer Protocol etc.Cryptographic protocol mainly is in packet the agreement of the unknown to be carried out unified encryption format to encapsulate, the more additional discernible common protocol in packet the inside, these agreements commonly used can comprise: snmp protocol, POP3 agreement, EDONKEY agreement, perhaps BITTORRENT agreement etc.Because different agreements itself has some set forms, therefore but for form of known agreement detection protocol itself, for example: http protocol detection protocol head and agreement tail, Host, the field parts such as Refer, http protocol comprises protocol header, but does not have the agreement tail, the field such as Host, Refer all belongs to the content that comprises in the protocol header, and form common in the protocol header comprises: the field parts such as Host, Refer, User-agent, Url.Unknown agreement is then thought risky, if unknown agreement in the included scope of discernible agreement, then might not have self-defining agreement inside.
Referring to Fig. 2, in another embodiment of the present invention, device 200 also comprises: the second judge module 208 and the first processing module 210, and wherein the second judge module 208 is used for judging whether the network behavior of the program that can identify is the network behavior of rogue program; The first processing module 210 is used for sending indicating risk information, and/or tackling the current network behavior of the program that can identify when the second judge module 208 judges that the network behavior of the program that can identify is the network behavior of rogue program; Judge that when the second judge module 208 network behavior of the program that can identify is not the network behavior of rogue program, normal network behavior is identified in the current network behavior of the program that can identify.
In certain embodiments, the second judge module 208 comprises: the first acquiring unit and the first judging unit, wherein the first acquiring unit is for the characteristic information in the application layer data of the network behavior that obtains the program that can identify,, characteristic information can be partial code, the packet in the application layer data or the one piece of data in the packet in the application layer data in the application layer data; The first judging unit is used for according to characteristic information, and whether the network behavior of the program that judgement can be identified is the network behavior of rogue program.
In certain embodiments, the second judge module 208 also comprises: second acquisition unit, the first transmitting element and the first receiving element, wherein second acquisition unit is for the characteristic information in the application layer data of the network behavior that obtains the program that can identify, and characteristic information can be partial code, the packet in the application layer data or the one piece of data in the packet in the application layer data in the application layer data; The first transmitting element is used for characteristic information is sent to cloud server, judges according to characteristic information whether the network behavior of the program that can identify is the network behavior of rogue program by cloud server; And first receiving element be used for receiving the judged result that described cloud server returns.
Continuation is referring to Fig. 2, and device 200 also comprises: the 3rd judge module 212 and the second processing module 214, and wherein the 3rd judge module 212 is used for judging whether the network behavior that is designated suspicious program is the network behavior of rogue program; The second processing module 214 is used for send indicating risk information, and/or interception being designated the current network behavior of suspicious program when the 3rd judge module 212 judges that the network behavior of suspicious program is the network behavior of rogue program; Judge that when the 3rd judge module 212 network behavior of suspicious program is not the network behavior of rogue program, send indicating risk information.
In certain embodiments, the 3rd judge module 212 comprises: the 3rd acquiring unit and the second judging unit, wherein the 3rd acquiring unit is for the characteristic information in the application layer data of the network behavior that obtains the program that can identify, and characteristic information can be partial code, the packet in the application layer data or the one piece of data in the packet in the application layer data in the application layer data; The second judging unit is used for according to characteristic information, and whether the network behavior of the program that judgement can be identified is the network behavior of rogue program.
In certain embodiments, the 3rd judge module 212 also comprises: the 4th acquiring unit, the second transmitting element and the second receiving element, wherein the 4th acquiring unit is for the characteristic information in the application layer data that obtains the network behavior that is designated suspicious program, and characteristic information can be partial code, the packet in the application layer data or the one piece of data in the packet in the application layer data in the application layer data; The second transmitting element is used for characteristic information is sent to cloud server, according to characteristic information, judges whether the network behavior that is designated suspicious program is the network behavior of rogue program by cloud server; And second receiving element be used for to receive the judged result that cloud server returns.
Below in conjunction with Fig. 3 a kind of program network behavior recognition system 300 another embodiment, that be suitable for addressing the above problem is described according to the present invention.
As shown in Figure 3, according to this program network behavior recognition system 300 of an aspect of the embodiment of the invention, this system comprises: client 302 and cloud server 304, wherein
In certain embodiments, comprise in the cloud server 304 that one is used for the database in storage black and white lists storehouse, cloud server is according to the black and white lists in the black and white lists storehouse, and whether the network behavior of the network behavior of the program that judgement can be identified or suspicious program is the network behavior of rogue program.
As shown in Figure 3, according to this program network behavior recognition system 300 of another aspect of the invention process, comprising: client 302 and cloud server 304, wherein
High in the clouds service end 304 be used for to receive the current network behavior packet of the program that client 302 obtains, and judges the agreement that whether comprises the unknown in the application layer data; If the agreement in the application layer data all is known agreement, then the current network behavior of program is designated the network behavior of the program that can identify; If comprise unknown agreement in the application layer data, then the current network behavior of program is designated the network behavior of suspicious program, send recognition result to client.
In certain embodiments, cloud server 304 also can obtain the characteristic information of the network behavior of the network behavior of the program that can identify or suspicious program, judge according to characteristic information whether the network behavior of the described program that can identify or the network behavior of described suspicious program are the network behavior of rogue program, and returning judged result to client 304, this characteristic information comprises: the one piece of data in the partial code in the application layer data, the packet in the application layer data or the packet in the application layer data.
In certain embodiments, this client 302 also can comprise memory (it can comprise one or more computer-readable recording mediums), Memory Controller, one or more processing units (CPU), Peripheral Interface, the RF circuit, voicefrequency circuit, loud speaker, microphone, I/O (I/O) subsystem, other inputs can be controlled client, and outside port.Client can comprise one or more optical pickocffs, and these parts can be communicated by letter by one or more communication buss or holding wire.
Should be appreciated that client 302 only is an example of portable multifunction device, and client can have than shown more or less parts, can make up two or more parts, perhaps can have different component configuration or setting.
Memory can comprise high-speed random access memory, and can comprise nonvolatile memory, for example one or more disk memory, flush memory device or other nonvolatile memories.The miscellaneous part such as CPU and Peripheral Interface of client can be controlled by Memory Controller the access of memory.
Peripheral Interface is couple to CPU and memory with the input and output peripheral hardware of client.One or more processor operations or execution are stored in various software programs and/or the instruction set in the memory, to realize various functions and the deal with data of client.
In certain embodiments, Peripheral Interface, CPU and Memory Controller can be realized at the one single chip such as chip.In some other embodiment, they can be realized at discrete chip.
The RF(radio frequency) circuit receives and sends the RF signal.The RF circuit is converted to electromagnetic signal/electromagnetic signal is converted to the signal of telecommunication with the signal of telecommunication, and communicates by this electromagnetic signal and communication network and other communication equipments.The RF circuit can comprise that for the known circuit of carrying out these functions it includes but not limited to antenna system, RF transceiver, one or more amplifier, tuner, one or more oscillator, digital signal processor, CODEC chipset, Subscriber Identity Module (SIM) card, memory etc.
Voicefrequency circuit, loud speaker and microphone provide the audio interface between user and the client.Voicefrequency circuit is converted to the signal of telecommunication from Peripheral Interface audio reception data with this voice data, and this signal of telecommunication is sent to loud speaker.Loud speaker is with the audible sound wave of this signal of telecommunication conversion behaviour.Voicefrequency circuit also receives the signal of telecommunication that microphone comes from the sound wave conversion.Voicefrequency circuit is converted to voice data with the signal of telecommunication, and this voice data is sent to Peripheral Interface in order to process.Can be by Peripheral Interface from memory and/or RF circuit retrieves voice data and/or voice data is sent to memory and/or RF circuit.
The I/O subsystem is couple to Peripheral Interface with the I/O peripheral hardware on the client.The I/O subsystem can comprise display controller and be used for other inputs or one or more input control devices of control client.One or more input control devices from/to other inputs or control client/transmission signal of telecommunication.Other inputs/control client can comprise physical button, dial, slide switch, joystick, click roller etc.In some alternative embodiment, the input control device can be couple to lower any: keyboard, infrared port, USB port and such as the indicating equipment of mouse.
The touch sensitive touch-screen provides input interface and the output interface between client and the user.Display controller from/receive and/or send the signal of telecommunication to touch-screen.Touch-screen with visual output display to the user.Visual output can comprise figure, text, icon, video with and combination in any (being referred to as " figure ").
Touch-screen has for contacting touch sensitive surface, transducer or the transducer group of accepting from user's input based on sense of touch and/or sense of touch.Touch-screen and display controller detect the contact on the touch-screen, and the contact that will detect is converted to and is presented at the mutual of user interface object on the touch-screen.In an example embodiment, touch-screen is corresponding to user's finger with contact point between the user.Also can adopt other Display Techniques in other embodiments.
Intrinsic not relevant with any certain computer, virtual system or miscellaneous equipment with demonstration at this algorithm that provides.Various general-purpose systems also can be with using based on the teaching at this.According to top description, it is apparent constructing the desired structure of this type systematic.In addition, the present invention is not also for any certain programmed language.Should be understood that and to utilize various programming languages to realize content of the present invention described here, and the top description that language-specific is done is in order to disclose preferred forms of the present invention.
In the specification that provides herein, a large amount of details have been described.Yet, can understand, embodiments of the invention can be put into practice in the situation of these details not having.In some instances, be not shown specifically known method, structure and technology, so that not fuzzy understanding of this description.
Similarly, be to be understood that, in order to simplify the disclosure and to help to understand one or more in each inventive aspect, in the description to exemplary embodiment of the present invention, each feature of the present invention is grouped together in single embodiment, figure or the description to it sometimes in the above.Yet the method for the disclosure should be construed to the following intention of reflection: namely the present invention for required protection requires the more feature of feature clearly put down in writing than institute in each claim.Or rather, as following claims reflected, inventive aspect was to be less than all features of the disclosed single embodiment in front.Therefore, follow claims of embodiment and incorporate clearly thus this embodiment into, wherein each claim itself is as independent embodiment of the present invention.
Those skilled in the art are appreciated that and can adaptively change and they are arranged in one or more equipment different from this embodiment the module in the equipment among the embodiment.Can be combined into a module or unit or assembly to the module among the embodiment or unit or assembly, and can be divided into a plurality of submodules or subelement or sub-component to them in addition.In such feature and/or process or unit at least some are mutually repelling, and can adopt any combination to disclosed all features in this specification (comprising claim, summary and the accompanying drawing followed) and so all processes or the unit of disclosed any method or equipment make up.Unless in addition clearly statement, disclosed each feature can be by providing identical, being equal to or similar purpose alternative features replaces in this specification (comprising claim, summary and the accompanying drawing followed).
In addition, those skilled in the art can understand, although embodiment more described herein comprise some feature rather than further feature included among other embodiment, the combination of the feature of different embodiment means and is within the scope of the present invention and forms different embodiment.For example, in the following claims, the one of any of embodiment required for protection can be used with compound mode arbitrarily.
All parts embodiment of the present invention can realize with hardware, perhaps realizes with the software module of moving at one or more processor, and perhaps the combination with them realizes.It will be understood by those of skill in the art that and to use in practice microprocessor or digital signal processor (DSP) to realize according to some or all some or repertoire of parts in the program network behavior recognition system of the embodiment of the invention.The present invention can also be embodied as be used to part or all equipment or the device program (for example, computer program and computer program) of carrying out method as described herein.Such realization program of the present invention can be stored on the computer-readable medium, perhaps can have the form of one or more signal.Such signal can be downloaded from internet website and obtain, and perhaps provides at carrier signal, perhaps provides with any other form.
It should be noted above-described embodiment the present invention will be described rather than limit the invention, and those skilled in the art can design alternative embodiment in the situation of the scope that does not break away from claims.In the claims, any reference symbol between bracket should be configured to limitations on claims.Word " comprises " not to be got rid of existence and is not listed in element or step in the claim.Being positioned at word " " before the element or " one " does not get rid of and has a plurality of such elements.The present invention can realize by means of the hardware that includes some different elements and by means of the computer of suitably programming.In having enumerated the unit claim of some devices, several in these devices can be to come imbody by same hardware branch.The use of word first, second and C grade does not represent any order.Can be title with these word explanations.
Claims (18)
1. program network behavior recognition methods, it comprises:
In the process of routine access network, obtain the application layer data in the current network behavior of program;
Judge and whether comprise unknown agreement in the described application layer data;
If the agreement in the described application layer data all is known agreement, then the current network behavior of described program is designated the network behavior of the program that can identify;
If comprise unknown agreement in the described application layer data, then the current network behavior of described program is designated the network behavior of suspicious program;
Wherein, after the current network behavior with described program was designated the step of network behavior of the program that can identify, described method also comprised:
Whether the network behavior of judging the described program that can identify is the network behavior of rogue program;
If the network behavior of rogue program then sends indicating risk information, and/or tackle the current network behavior of the described program that can identify;
If not the network behavior of rogue program, then the current network behavior with the described program that can identify is designated normal network behavior.
2. method according to claim 1 is characterized in that, describedly judges that the step that whether comprises unknown agreement in the described application layer data is:
Form according to known agreement, judge and whether comprise unknown agreement in the described application layer data, if the agreement in the application layer data can both be identified, judge that then application layer data all is known agreement, if there is at least part of agreement not identify in the application layer data, judge that then application layer data comprises unknown agreement.
3. method according to claim 2, it is characterized in that described known agreement comprises at least one in following at least: HTTP, domain name system agreement, Simple Mail Transfer protocol, file transfer protocol (FTP), Simple Network Management Protocol and pop3 post office protocol version 3 POP3 agreement.
4. arbitrary described method is characterized in that according to claim 1 ~ 3, and whether the described network behavior of judging the described program that can identify is that the step of the network behavior of rogue program comprises:
Obtain the characteristic information in the application layer data in the network behavior of the described program that can identify, described characteristic information comprises: the one piece of data in the partial code in the application layer data, the packet in the application layer data or the packet in the application layer data;
According to described characteristic information, judge whether the network behavior of the described program that can identify is the network behavior of rogue program.
5. method according to claim 4 is characterized in that, whether the described network behavior of judging the described program that can identify is that the step of the network behavior of rogue program comprises:
Obtain the characteristic information in the application layer data in the network behavior of the program that can identify, described characteristic information comprises: the one piece of data in the partial code in the application layer data, the packet in the application layer data or the packet in the application layer data;
Described characteristic information is sent to cloud server, judges according to described characteristic information whether the network behavior of the described program that can identify is the network behavior of rogue program by described cloud server, and return judged result.
6. arbitrary described method is characterized in that according to claim 1 ~ 4, and after the current network behavior with described program was designated the step of network behavior of suspicious program, described method also comprised:
Whether the network behavior of judging described suspicious program is the network behavior of rogue program;
If the network behavior of rogue program then sends indicating risk information, and/or tackle the current network behavior of described suspicious program;
If not the network behavior of rogue program then sends indicating risk information.
7. method according to claim 6 is characterized in that, whether the described network behavior of judging described suspicious program is that the step of the network behavior of rogue program comprises:
Obtain the characteristic information in the application layer data in the network behavior of described suspicious program, described characteristic information comprises: the one piece of data in the partial code in the application layer data, the packet in the application layer data or the packet in the application layer data;
According to described characteristic information, judge whether the network behavior of described suspicious program is the network behavior of rogue program.
8. method according to claim 6 is characterized in that, whether the described network behavior of judging described suspicious program is that the step of the network behavior of rogue program comprises:
Obtain the characteristic information in the application layer data in the network behavior of described suspicious program, described characteristic information comprises: the one piece of data in the partial code in the application layer data, the packet in the application layer data or the packet in the application layer data;
Described characteristic information is sent to cloud server, judges according to described characteristic information whether the network behavior of described suspicious program is the network behavior of rogue program by described cloud server, and return judged result.
9. program network behavior recognition system, it comprises: client and cloud server, wherein,
Described client is used for the process at the routine access network, obtains the packet in the current network behavior of program, and described packet comprises: application layer data, and receive the recognition result that described cloud server returns;
Described high in the clouds service end is used for receiving the current network behavior packet of the program that described client obtains, and judges whether comprise unknown agreement in the described application layer data; If the agreement in the described application layer data all is known agreement, then the current network behavior of described program is designated the network behavior of the program that can identify; If comprise unknown agreement in the described application layer data, then the current network behavior of described program is designated the network behavior of suspicious program, send recognition result to described client;
Described cloud server comprises program network behavior recognition device, and described program network behavior recognition device comprises:
Acquisition module is used for the process at the routine access network, obtains the application layer data in the current network behavior of described program;
The first judge module is used for judging whether described application layer data comprises unknown agreement;
Identification module when being used for agreement at described application layer data and all being known agreement, is designated the current network behavior of described program the network behavior of the program that can identify; And when comprising unknown agreement in the described application layer data, the current network behavior of described program is designated the network behavior of suspicious program.
10. system according to claim 9 is characterized in that, described the first judge module is further used for the form according to known agreement, judges whether comprise unknown agreement in the described application layer data.
11. system according to claim 10, it is characterized in that the described known agreement that can identify comprises at least one in following at least: HTTP, domain name system agreement, Simple Mail Transfer protocol, file transfer protocol (FTP), Simple Network Management Protocol and pop3 post office protocol version 3 POP3 agreement.
12. arbitrary described system is characterized in that according to claim 9 ~ 11, described program network behavior recognition device also comprises:
The second judge module is used for judging whether the network behavior of the described program that can identify is the network behavior of rogue program;
The first processing module is used for sending indicating risk information when described the second judge module judges that the network behavior of the described program that can identify is the network behavior of rogue program, and/or tackles the current network behavior of the described program that can identify; And be used for judging that when described the second judge module the network behavior of the described program that can identify is not the network behavior of rogue program, normal network behavior is identified in the current network behavior of the described program that can identify.
13. system according to claim 12 is characterized in that, described the second judge module comprises:
The first acquiring unit, for the characteristic information in the application layer data of the network behavior that obtains the program that can identify, described characteristic information comprises partial code, the packet in the application layer data or the one piece of data in the packet in the application layer data in the application layer data;
The first judging unit is used for according to described characteristic information, judges whether the network behavior of the described program that can identify is the network behavior of rogue program.
14. system according to claim 12 is characterized in that, described the second judge module comprises:
Second acquisition unit, for the characteristic information in the application layer data of the network behavior that obtains the program that can identify, described characteristic information comprises: the one piece of data in the partial code in the application layer data, the packet in the application layer data or the packet in the application layer data;
The first transmitting element is used for described characteristic information is sent to cloud server, judges according to described characteristic information whether the network behavior of the described program that can identify is the network behavior of rogue program by described cloud server;
The first receiving element is used for receiving the judged result that described cloud server returns.
15. arbitrary described system is characterized in that according to claim 9 ~ 12, described program network behavior recognition device also comprises:
The 3rd judge module is used for judging whether the network behavior of described suspicious program is the network behavior of rogue program;
The second processing module is used for when described the 3rd judge module judges that the network behavior of described suspicious program is the network behavior of rogue program, transmission indicating risk information, and/or tackle the current network behavior of described suspicious program; And be used for when described the 3rd judge module judges that the network behavior of described suspicious program is not the network behavior of rogue program transmission indicating risk information.
16. system according to claim 15 is characterized in that, described the 3rd judge module comprises:
The 3rd acquiring unit, for the characteristic information in the application layer data of the network behavior that obtains the program that can identify, described characteristic information comprises: the one piece of data in the partial code in the application layer data, the packet in the application layer data or the packet in the application layer data;
The second judging unit is used for according to described characteristic information, judges whether the network behavior of the described program that can identify is the network behavior of rogue program.
17. according to claim 15 or described system, it is characterized in that described the 3rd judge module comprises:
The 4th acquiring unit, be used for obtaining the characteristic information in the application layer data of network behavior of described suspicious program, described characteristic information comprises: the one piece of data in the partial code in the application layer data, the packet in the application layer data or the packet in the application layer data;
The second transmitting element is used for described characteristic information is sent to cloud server, according to described characteristic information, judges whether the network behavior of described suspicious program is the network behavior of rogue program by described cloud server;
The second receiving element is used for receiving the judged result that described cloud server returns.
18. each described system in 17 according to claim 9, it is characterized in that, described cloud server obtains the characteristic information of the network behavior of the network behavior of the program that can identify or suspicious program, judge according to described characteristic information whether the network behavior of the described program that can identify or the network behavior of described suspicious program are the network behavior of rogue program, and return judged result to described client;
Described characteristic information comprises: the one piece of data in the partial code in the application layer data, the packet in the application layer data or the packet in the application layer data.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210551540.XA CN103067360B (en) | 2012-12-18 | 2012-12-18 | Program network Activity recognition method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210551540.XA CN103067360B (en) | 2012-12-18 | 2012-12-18 | Program network Activity recognition method and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103067360A true CN103067360A (en) | 2013-04-24 |
| CN103067360B CN103067360B (en) | 2016-12-28 |
Family
ID=48109822
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210551540.XA Active CN103067360B (en) | 2012-12-18 | 2012-12-18 | Program network Activity recognition method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103067360B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103051617A (en) * | 2012-12-18 | 2013-04-17 | 北京奇虎科技有限公司 | Method, device and system for identifying network behaviors of program |
| CN105561580A (en) * | 2015-12-24 | 2016-05-11 | 北京奇虎科技有限公司 | Network protecting method and device based on game platform |
| CN105574146A (en) * | 2015-12-15 | 2016-05-11 | 北京奇虎科技有限公司 | Website intercepting method and device |
| CN110855602A (en) * | 2018-08-21 | 2020-02-28 | 国家计算机网络与信息安全管理中心 | Internet of things cloud platform event identification method and system |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101272380A (en) * | 2008-02-19 | 2008-09-24 | 北大方正集团有限公司 | Method, system and device for network action management |
| CN102136956A (en) * | 2010-01-21 | 2011-07-27 | 宏碁股份有限公司 | Monitoring method and system for detecting network communication behaviors |
| CN102594623B (en) * | 2011-12-31 | 2015-07-29 | 华为数字技术（成都）有限公司 | The data detection method of fire compartment wall and device |
| CN103051617B (en) * | 2012-12-18 | 2015-09-02 | 北京奇虎科技有限公司 | The method of the network behavior of recognizer, Apparatus and system |
-
2012
- 2012-12-18 CN CN201210551540.XA patent/CN103067360B/en active Active
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103051617A (en) * | 2012-12-18 | 2013-04-17 | 北京奇虎科技有限公司 | Method, device and system for identifying network behaviors of program |
| WO2014094470A1 (en) * | 2012-12-18 | 2014-06-26 | 北京奇虎科技有限公司 | Method, device and system for recognizing network behaviour of program |
| CN103051617B (en) * | 2012-12-18 | 2015-09-02 | 北京奇虎科技有限公司 | The method of the network behavior of recognizer, Apparatus and system |
| CN105574146A (en) * | 2015-12-15 | 2016-05-11 | 北京奇虎科技有限公司 | Website intercepting method and device |
| CN105561580A (en) * | 2015-12-24 | 2016-05-11 | 北京奇虎科技有限公司 | Network protecting method and device based on game platform |
| CN110855602A (en) * | 2018-08-21 | 2020-02-28 | 国家计算机网络与信息安全管理中心 | Internet of things cloud platform event identification method and system |
| CN110855602B (en) * | 2018-08-21 | 2022-02-25 | 国家计算机网络与信息安全管理中心 | Internet of things cloud platform event identification method and system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103067360B (en) | 2016-12-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN103051617B (en) | The method of the network behavior of recognizer, Apparatus and system | |
| US10666686B1 (en) | Virtualized exploit detection system | |
| US11271907B2 (en) | Smart proxy for a large scale high-interaction honeypot farm | |
| US10530810B2 (en) | Dynamic selection and generation of a virtual clone for detonation of suspicious content within a honey network | |
| US10122746B1 (en) | Correlation and consolidation of analytic data for holistic view of malware attack | |
| US11265346B2 (en) | Large scale high-interactive honeypot farm | |
| US10567431B2 (en) | Emulating shellcode attacks | |
| US10015198B2 (en) | Synchronizing a honey network configuration to reflect a target network environment | |
| US9594912B1 (en) | Return-oriented programming detection | |
| US9438613B1 (en) | Dynamic content activation for automated analysis of embedded objects | |
| US10242185B1 (en) | Dynamic guest image creation and rollback | |
| US8443439B2 (en) | Method and system for mobile network security, related network and computer program product | |
| US10805340B1 (en) | Infection vector and malware tracking with an interactive user display | |
| US20150156183A1 (en) | System and method for filtering network communications | |
| CN103746956A (en) | Virtual honeypot | |
| US11861008B2 (en) | Using browser context in evasive web-based malware detection | |
| US11489853B2 (en) | Distributed threat sensor data aggregation and data export | |
| CN111556061B (en) | Network disguising method, device, equipment and computer readable storage medium | |
| US20210344690A1 (en) | Distributed threat sensor analysis and correlation | |
| EP3590061B1 (en) | Managing data encrypting application | |
| US20210112093A1 (en) | Measuring address resolution protocol spoofing success | |
| CN111901326B (en) | Multi-device intrusion detection method, device, system and storage medium | |
| CN103067360B (en) | Program network Activity recognition method and system | |
| CN112804263A (en) | Vulnerability scanning method, system and equipment for Internet of things | |
| US20210344726A1 (en) | Threat sensor deployment and management |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CP01 | Change in the name or title of a patent holder |
Address after: 100088 room 112, block D, 28 new street, new street, Xicheng District, Beijing (Desheng Park) Patentee after: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Patentee after: Beijing Qizhi Business Consulting Co.,Ltd. Address before: 100088 room 112, block D, 28 new street, new street, Xicheng District, Beijing (Desheng Park) Patentee before: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Patentee before: Qizhi software (Beijing) Co.,Ltd. |
|
| CP01 | Change in the name or title of a patent holder | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20220402 Address after: 100016 1773, 15 / F, 17 / F, building 3, No.10, Jiuxianqiao Road, Chaoyang District, Beijing Patentee after: Sanliu0 Digital Security Technology Group Co.,Ltd. Address before: 100088 room 112, block D, 28 new street, new street, Xicheng District, Beijing (Desheng Park) Patentee before: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Patentee before: Beijing Qizhi Business Consulting Co.,Ltd. |
|
| TR01 | Transfer of patent right |