TW201502845A - Website antivirus information security system - Google Patents

Abstract

This invention is an Antivirus Information Security Control System. The system includes: (a) A component that allows website administrators to embed in their own websites. This components can detect pages when transmitting information, send transmitted information to the Antivirus Information Security Control System, receive attack identify result, and redirect browser to URL compulsively. (b) Fast eliminate the malware approach. A Black/White Data Bank which identifies the resource is a threat attack or a safe browse. (c) An Attack Identify Module that can identify abnormal transmitting information, send identify result to the embed component, and update the Data Bank identify list basis on identifying result. (d) A recording and notifying module that can write transmitting information to the database. Receive identify result from the Attack Identify Module or Black/White Data Bank, and send antivirus information to the website administrators. (e) A DDOS identify module that used data mining technique to detect force behavior users. Add danger users' information to the Black/White Data Bank to avoid next threat attack.

Description

Website anti-drug security system

The invention relates to an anti-virus information security system, in particular to anti-virus and anti-mite of a website, and provides an analysis attack, recording, blocking, intercepting, website transposition, notification manager and the like to achieve the anti-virus information security effect of the website.

Websites have become an important conduit for corporate branding, business profitability, and media campaigns. However, computer viruses and attacks are no longer just for your personal computer, but are turning to your website. Website virus injection (SQL Injection, XSS) and Violent Traffic Attack (DDOS) mode is the most common and most devastating attack method at present, which can cause the data of your website to be changed, and the personal information of your website members. The leakage of data, even more serious, will result in the entire website being inoperable!

Through the input interface, hackers can insert malicious programs into your website to monitor and steal sensitive information on your website, and even simulate the administrator's login to the background, making shopping frauds endless. The hacker will also use the power of the network to simulate normal web browsing with the sea tactics, and the external bandwidth of the website will be smashed, resulting in the website being unable to operate, and threatening to threaten you to pay a considerable protection fee!

In order to protect the website from virus injection (SQL Injection, XSS), you need to install a WAF (Web Application Firewall) website application firewall device in front of your server to protect the website from malicious. Virus implantation; to be protected from For violent traffic attack (DDOS) threats, an IPS (Intrusion Prevention System) intrusion prevention system device is added to protect websites from violent traffic attacks.

There is no set today, using software to solve the website poisoning threat!

Therefore, the object of the present invention is to provide an anti-virus software for a website that can detect attacks, identify attacks, intercept attacks, block attacks, and notify administrators.

Another object of the present invention is to provide a method for quickly installing and installing a website anti-virus, and reducing the threshold for use.

Another object of the present invention is to provide a system method for blocking, opening, and automatically updating a list of web page viewer IP locations.

Another object of the present invention is to provide a system method for analyzing and identifying attack characteristics through hardware devices of a non-original website system architecture.

Therefore, the present invention has an anti-virus security system mounted on any website, and is applicable to any website. The system includes a detection transmission component, an interception blocking component, a black and white list identification module, and a black and white list data. The library, an attack feature recognition module, an attack feature database, a record notification module, a webpage record record database, and a brute force attack recognition module.

The detection transmission and interception blocking elements are external components of the system for embedding in a protected website. After detecting the information transmitted by the webpage, the information is transmitted to the internal system of the present invention through the Internet; the intercepting blocking component can transmit or block the attacker's webpage through the attack signal transmitted back by the Internet receiving system. The black and white list database contains a list of source IPs that have been attacked in the past, a list of source IPs that managers have added to blockades themselves, and a whitelist of exclusions identified by managers. The attack signature database contains website virus implants (SQL Injection, Attack feature information such as XSS, IDor). The webpage transmission record database contains information for detecting the backhaul of the transmission component and the identification of the attack signature module.

The black and white list identification module is connected with the detection transmission component, the interception blocking component, the black and white list database, the attack feature recognition module, the record notification module, etc., and the black and white list recognition module detects the transmission content of the webpage transmitted back by the transmission component and The black and white list database is compared. The content of the black and white list database is transmitted to the interception blocking component, and the identification result is processed by the record notification module; if the content of the database is not in the black and white list, the transmission information is handed over to the attack feature recognition module.

The attack feature identification module is connected to the whitelist identification module, the black and white list database attack feature database, and the record notification module. The information transmitted by the blacklist identification module is compared with the attack signature database. If the attack is sent, the attack signal is transmitted to the interception blocking component, and the identification result is processed by the record notification module; if not, the attack signature database is not included. The content person transfers the transmission information to the record notification module.

The brute force attack identification module is connected to the webpage transmission record database and the black and white list database record notification module. The brute force attack identification module analyzes the content of the webpage transmission record database to analyze the web browser of the violent traffic attack (DDOS). The location, the identification result is processed by the record notification module, and the black and white list database content is updated.

The record notification module is connected to the black and white list identification module and the attack feature recognition module webpage transmission record database, and has the function of notifying the mobile phone application, the short message sending, the email, the website display by means of the attack record and transmitting through the network. The method informs the website administrator of the security information and updates the network transmission information to the webpage transmission record database.

The anti-virus security system of the website of the present invention comprises the following steps:

(B1) A website is required.

(B2) Embedding the website into the system of the present invention for detecting transmission and intercepting the embedded component. When the website has a viewer, the component transmits the detected webpage transmission information to the system of the present invention.

(B3) The system analyzes the transmitted data.

(B4) The transmission information is judged as an attack feature.

(B5) If there is no attack feature, only the data transmission record is made.

(B6) If there is an attack feature, it will trigger the interception blocking embedded component to block, intercept, and page transpose.

(B7) Record the attack information and notify the website administrator.

(B8) Protection is successful.

A1‧‧‧ website

A2‧‧‧Detection transmission component

A3‧‧‧ interception element

A4‧‧‧Black and white list identification module

A5‧‧‧Black and White List Database

A6‧‧‧ attack feature identification module

A7‧‧‧ Attack signature database

A8‧‧‧record notification module

A9‧‧‧ website anti-drug security system

A10‧‧‧Web transmission record database

A11‧‧‧Violence Attack Identification Module

B1~B8‧‧‧ system process steps

1 is a system architecture diagram illustrating the present invention as a system with website anti-virus, management, and notification mechanisms; and FIG. 2 is a flow chart showing the flow of the system for detecting the success of the invention.

The foregoing and other technical contents, features and effects of the present invention will be apparent from the description with reference to FIG.

As shown in FIG. 1 , the implementation case of the website anti-virus security system A9 of the present invention can be applied to a shopping website, an official image website, a government, a public service, an academic, a medical website, etc., and can be embedded in the detection transmission A2 and interception of the present invention. Block A3 components.

When the viewer enters the website, the detecting transmission component A2 sends the transmission information of the webpage to the black and white list identification module A4, and the module compares the blacklisted database A5 to the viewer who refuses to and from the browser. The interception operation is performed by intercepting the blocking element A3, blocking any action of the viewer, and the comparison result is sent to the record notification module A8.

If the viewer does not belong to the data in the black and white list database A5, the webpage transmission information captured by the detection transmission component A2 is sent to the attack feature recognition module A6, and according to the attack feature database A7 (SQL Injection , XSS, DDOS, IDOR and other network attack techniques feature) use the data feature for comparison, and then send the comparison result to the record notification module A8.

The brute force attack identification module A11 uses the data mining method to find the source of the brute force attack, and sends the comparison attack result to the record notification module A8, and updates the black and white list database A4.

Record notification module A8 is divided into attack behavior and non-attack when processing identification results. behavior. Attack behavior: Record the webpage transmission information to the webpage transmission record database A10, and then send the anti-virus security information to the website administrator through the Internet. The notification method can be received by the mobile application, the newsletter, and the e-mail. Or by web page display, etc. Non-aggressive behavior: Record the webpage transmission information to the webpage transmission record database A10.

In summary, the present invention has an information security mechanism that allows a website to have an anti-virus detection attack, identify an attack, intercept an attack, block an attack, and notify a manager. To add the protection provided by the present invention, the website only needs to embed the detection transmission component (A2) and the interception blocking component (A3) provided by the invention in the website, and does not need to additionally augment the hardware device, thereby reducing the anti-virus threshold of the website; The website administrator can open the browser IP or any new blocked browser IP, and provide the user's own browsing rights for the website viewer. Different from the computer anti-virus software, the identification of the invention is handled by the system, and the original website will not be added. The system burden.

However, the above-mentioned types of websites are exemplified by the discussion of the present invention, and the scope of the invention is not limited thereto, that is, the simple equivalent changes and modifications made by the scope of the invention and the description of the invention are all It is still within the scope of the invention patent.

A1‧‧‧ website

A2‧‧‧Detection transmission component

A3‧‧‧ interception element

A4‧‧‧Black and White List Database

A5‧‧‧Black and white list identification module

A6‧‧‧ Attack signature database

A7‧‧‧ attack feature identification module

A8‧‧‧record notification module

A9‧‧‧ website anti-drug security system

A10‧‧‧Web transmission record database

A11‧‧‧Violence Attack Identification Module

Claims (7)

A website anti-virus security system method, through a system for transmitting information on a website, the system has the functions of analyzing attacks, recording, blocking, intercepting, website transcoding, and notifying the administrator to achieve anti-virus information security of the website, and the system comprises the following steps: (a) The system that can be embedded in the website detects the webpage transmitting information elements, and the detecting component can transmit the webpage transmission information to the system of the present invention through the network. (b) After receiving the test page transmission information, the system will submit the black and white list identification module, and compare the black and white list database to determine whether it is in the list: if it is a white list, record the transmission information separately; if it is a black list, it can be handed over. Blocking blocking elements embedded in the website block, intercept, and URL transposition; the network transmission information is not black-and-white list data, and the inventory content is processed downward by the attack feature recognition module. (c) The attack feature recognition module uses the feature code to compare the network attack features of the SQLInjection, XSS, IDOR, etc. in the attack feature database, and if it is determined that the attack is intercepted by the interception blocking component of the embedding website, blocking, intercepting, The URL is transposed and the identification result is processed by the record notification module. (d) The brute force attack identification module uses data mining for the webpage transmission record database, finds the violent attack list, updates the list to the black and white list database, and passes the identification result to the record notification module for processing. (e) The notification notification module receives the attack identification result, and can notify the administrator of the attack information through the Internet, and the notification method includes the mobile device application, the short message, the email, the web page presentation, and the like to notify the network administrator. According to the website anti-drug security system method described in claim 1, the components of the embeddable website mentioned in (a), (b), and (c) have the function of detecting webpage transmission information, intercepting and blocking viewer transmission. , web page transcoding and other functions, its components can be written in Javascript, PHP, ASP, JSP, Java and other grammar categories. According to the first and second items of the patent application scope, the anti-drug security system method is not limited to the website. The application category, because the components embedded in the website can be written in Javascript, PHP, ASP, JSP, Java and other grammatical categories. According to the website anti-drug security system method described in the first application of the patent scope, (b) the system receives the test page transmission information and then submits it to the black and white list identification module, and compares the black and white list data through data mining. The library, the content of the black and white list database can be updated by the system, and can also increase or decrease the stored content through the administrator. According to the anti-virus security system method of the website mentioned in the first paragraph of the patent application, (c) the contents of the network attack techniques such as SQL Injection, XSS, IDOR, etc. in the feature database can be corrected by the system developer. And adjustment, if a new attack method occurs, the system developer can find the new attack method to update the database load content. According to the website anti-drug security system method described in the first application of the patent scope, (d) the data mining rules of the brute force attack identification module can be corrected and adjusted by the system developer. According to the anti-drug security system method of the website mentioned in the first paragraph of the patent application, wherein the notification module of (d) receives the attack identification result, the attack information can be notified to the administrator through the Internet, and the notification method is through the network. Road transmission notification, not limited to device applications, newsletters, emails, web pages.