TWI640894B - Method of detecting internet information security and its implemented system - Google Patents

Abstract

The invention discloses a network information security detection method and an implementation system thereof, which are installed on a website platform, and mainly have an identification module, a processing module, a recording module, and an alarm module, and an identification module. After detecting a packet request information of a connection request and a connection request end information, a connection request end information, a deformation signature code, and a transmission flow abnormal number can be parsed, and the processing module can be identified according to the identification module. The identification result, the immediate response measures, if the abnormal number of transmission traffic reaches a certain threshold, that is, forging the webpage content provided by the website platform, and driving the alarm module to notify the website administrator, thereby reducing the information security detection system The cost of hardware and software construction, and the possibility that the website server will not be able to provide services due to DDoS attacks.

Description

Network information security detection method and implementation system thereof

A network information security detection method and an implementation system thereof for preventing a website platform from being attacked by information. The present invention particularly relates to a network information security detection method capable of effectively coping with DDoS attacks by forging webpage information and Implement the system.

With the development of information technology, the website has become an important channel for corporate brand management, e-commerce profit, news media promotion and knowledge acquisition. However, today's information attacks are no longer limited to the client's personal computer ( Personal Computer, PC) or mobile device, has turned to attack the server platform on the server (Server), if the website platform is attacked and framed, it may lead to serious consequences such as theft of member information and the inability of the website to provide services. Unpredictable losses, and the most popular website attacks include: Denial of Service Attack (DoS), Distributed Denial of Service attack (DDoS attack), cross-site command Cross-site scripting (commonly known as XSS), hidden code attack (SQL injection), and cross-site request forgery (CSRF), etc., according to which, network information security detection is designed for the website platform. The demand for the measurement system is born, and the conventional network information security detection system mainly sets a web page in front of the server. Application Application Firewall (WAF) and an Intrusion Prevention System (IPS) to compensate for the general network firewall (Firewall) can only detect the Open System Interconnection Reference Model (Open System Interconnection Reference Model) , OSI) Defects in Layer 2 to Layer 4 packet information.

The so-called web application firewall (WAF) detects whether the connection request (such as HTTP/HTTPS Request) belonging to the OSI application layer is abnormal and blocked by comparing the feature code (Feature Code or Signature), and can check And the content of the restricted website form and the field, such as the "Web Security protection method, device and system" of the US Patent Publication No. US20140373125A1 , which discloses a network security protection method and system, mainly using a network security device ( The Web Security Device detects whether a website has a security vulnerability and sends it to a web application firewall according to the detection result. If the web application firewall determines that the detection result is a security vulnerability, it will take a suspicious vulnerability. The feature code is then compared with the complex feature code stored in the local rule library, and then the corresponding security policy is configured for the website, or the suspicious feature code is stored in the local rule base.

Intrusion Prevention System (IPS) uses signature matching and Deep Packet Inspection (DPI) technology to detect whether the contents of OSI packets contain abnormal data and actively filter abnormal packet information. Virus, Worm, Trojan Horses, Spyware, and Intrusion Prevention System can also detect whether the transmission traffic of the connection is abnormal to prevent DDoS attacks, such as Chinese Invention Patent Publication No. CN101034975B "Method and Apparatus for Preventing Small Message Attack" mainly compares the received data transmission amount with a comparison unit and performs correction by a processing unit to effectively control The number of packets sent to the server side, in addition, more website administrators to increase network bandwidth, improve server hardware specifications (such as memory, hard disk space, hard disk type, etc.), and take traffic cleaning, or Traffic offloading is a response to DDoS attacks.

However, because the Intrusion Prevention System (IPS) cannot view encrypted packet information (such as packet information transmitted using the HTTPS protocol), it is also impossible to determine SQL (Structural Query Language) hidden code attacks and XSS (Cross-site scripting) attacks. Website attacks are abnormally connected. Therefore, webmasters usually need to build a web application firewall (WAF). This will inevitably increase the complexity of the network information security detection system architecture, the number of fault points, And the problems of product incompatibility and management interface are different, which may affect the defense capability of the network information security detection system, increase the workload of the website administrator, and the abnormal connection behavior for large traffic. Website administrators mainly improve server hardware specifications, increase network bandwidth, and build a traffic cleaning center (Scrubbing Center) as a solution, so how to propose a way to reduce website administrators to set up network information security detection Measuring the hardware and software costs of the system, and the network information security detection party that blocks various website attacks and can effectively deal with DDoS attacks. The law and its implementation system are issues to be resolved.

In view of the above problems, the inventors have based on years of experience in researching information security, and how to reduce the software and hardware costs of network administrators to set up network information security detection systems, and can effectively block various website attacks and the like. Therefore, the main purpose of the present invention is to provide a network information security detection that can reduce the cost of software and hardware for erecting a network information security detection system, can effectively block various website attacks, and can effectively cope with DDoS attacks. Measurement method and its implementation system".

To achieve the above objective, the network information security detection system of the present invention comprises: an identification module, a processing module, a recording module, an alarm module, an attack signature database, and a black and white list data. The attack feature database is used to store a plurality of signature codes, and the black and white list database is used to store the connection request information of the website that allows and does not allow access to the website platform, and the identification module is configured to parse the connection request. Connect the requester information and a packet information to determine whether the connection request from the connection requester to a website platform is abnormal. The processing module is configured to immediately make contingency measures according to the identification result of the identification module (for example, directly Rejecting the connection request), marking the connection requester information of the abnormal connection request as blacklist information, and driving the alarm module to send an alarm message to notify the website manager holding one of the monitoring device, and if If the attack is a DDoS attack, the processing module will set a threshold and falsify the website content provided by the website platform (for example, a web page with a smaller file) instead of blocking it immediately. Wired requests, so that a web server can be burdened with a small burden, to reach a fraudulent connection request end, and to greatly reduce the possibility that the web server is attacked by DDoS and cannot provide services; accordingly, the present invention can indeed Providing a software and hardware construction cost that can reduce the network information security detection system, promptly responding to various website attacks, promptly notify the website administrator, and simultaneously solve the problem that the website server is attacked by DDoS "Network Information Security Detection Method and Implementation System" for providing service problems.

In order for your review board to have a clear understanding of the purpose, technical features and effects of the present invention, the following description will be used in conjunction with the illustrations, please refer to it.

1‧‧‧Network Information Security Detection System

11‧‧‧ Identification Module

12‧‧‧Processing module

13‧‧‧record module

14‧‧‧Alarm module

15‧‧‧ Attack signature database

16‧‧‧Black and White List Database

2‧‧‧Web server

21‧‧‧ website platform

22‧‧‧Website database

3‧‧‧Monitor device

S1‧‧‧Detection connection request step

S2‧‧‧Determining whether the connection request is abnormal

S21‧‧‧Determination of whether the connection requester information is listed in the blacklist step

S22‧‧‧Determination of whether the connection request contains a signature step

S23‧‧‧Determination of whether the number of abnormal traffic times reaches the first threshold step

S24‧‧‧Provide steps for forging webpage information

S25‧‧‧Determination of whether the second threshold is satisfied

S3‧‧‧Reject connection request step

S4‧‧‧ Warning Steps

S5‧‧‧Update connection requester information and signature steps

S6‧‧‧ Allow connection request steps

S7‧‧‧Record connection request information step

Figure 1 is a diagram showing the system architecture of the present invention.

Fig. 2 is a schematic view showing the composition of the system of the present invention.

Figure 3 is a schematic view (I) of the implementation flow of the present invention.

Figure 4 is a schematic view (2) of the implementation flow of the present invention.

Please refer to "FIG. 1", which is a system architecture diagram of the present invention. As shown in the figure, a website server 2 is provided with a website platform 21 and a website database 22, and the website platform 21 information is linked to the website information. The library 22 stores the website content stored in the website database 22, and the website platform 21 is provided with the network information security detection system 1 of the present invention. A monitoring device 3 can directly link information to the network information security detection. Test system 1 to view the monitoring information of the website platform 21, according to which, if a connection request terminal wants to connect to the website platform 21, it must first pass the filtering mechanism of the network information security detection system 1 in order to smoothly connect The website to the website platform 21 is configured to access the website information provided by the website platform 21, and the monitoring device 3 is used to check whether the network information security detection system 1 reports any abnormal condition.

Please refer to FIG. 2, which is a schematic diagram of the system composition of the present invention. As shown in the figure, the network information security detection system 1 mainly includes: an identification module 11, a processing module 12, and a recording module. 13. An alarm module 14, an attack signature database 15, and a black and white list database 16; the attack signature database 15 and the black and white list database 16 respectively establish information links with the identification module 11 and the processing module 12, and record The module 13 and the alarm module 14 are respectively connected to the processing module 12, and the identification module 11 is configured to determine whether a connection request includes the signature code and the connection request stored in the same or suspected attack signature database 15. Whether the end information is the blacklist information stored in the black and white list database 16 and whether the transmission traffic of the connection request end is abnormal, and the website administrator can edit the black and white list information stored in the black and white list database 16 and the black and white list information. For example, the method includes: storing and allowing access to the IP address of the website platform 21, the packet information, the port number, and the like, and the comparison mechanism of the signature includes: Whether the packet information of the connection request contains malware signature (such as computer virus, worm, or Trojan), whether it contains malicious SQL input string, whether it contains the index value of the file name in the website database 22, whether it contains Encoded URL (Uniform Resource Locator) or attribute value (Attribute), whether the connection requester enters a malicious command that is suspected of XSS attack on the message board, and whether the transmission traffic of the connection request end is abnormal. The processing module 12 can immediately make a contingency measure according to the identification result of the identification module 11 (such as directly blocking the connection request), and then the recording module 13 stores the relevant connection request information of the connection request end, the The related connection request information includes, for example, a connection request time, a connection number, an IP address, a protection record, a file name, a threat type, or a processing measure, and the processing module 12 can update the attack feature database 15 to store the information. The alarm code and the connection requester information stored in the black and white list database 16 can generate an alarm information and report it to the monitoring device 3, and the monitoring device 3 can be a personal computer (PC). Notepad (Notebook Computer, NB), smart phone, or tablet (Tablet), etc., not limited to this, especially first.

Please refer to FIG. 3, which is a schematic diagram (1) of an implementation flow of the present invention. As shown in the figure, the implementation method of the network information security detection system 1 of the present invention includes: (1) detecting a connection request. Step S1: When a connection requesting party wants to access the website information of the website platform 21 in the website server 2, the connection requesting end sends a connection request (for example, HTTP/HTTPs Request), and is installed on the website platform 21 The above-mentioned network information security detection system 1 first receives the connection request, and sends an identification module 11 of the network information security detection system 1 to detect the packet information of the connection request, the packet The information includes: a header (Header) and a bearer data (Payload), and the header includes a connection request end information, and after the identification module 11 completes the detection connection request step S1, it performs to determine whether the connection request is abnormal. Step S2; (2) determining whether the connection request is abnormal. Step S2: The detection connection request step S1, the identification module 11 determines whether the packet information of the connection request includes the signature of the attack signature database 15, and whether it is Blacklists stored in the black and white list database 16 If the identification module 11 determines that the connection request is abnormal, the identification module information is coupled to a processing module 12, and the processing module 12 performs the reject connection request step. S3; if the identification module 11 determines that the connection request is not abnormal, the processing module 12 executes the permission connection request step S5; (3) rejects the connection request step S3: determines whether the connection request is abnormal step S2, if If the module 11 determines that the connection request is abnormal, the processing module 12 can make a contingency measure, for example, immediately reject the connection request and mark the connection request side information as blacklist information, or the traffic of the connection request end is abnormal. Whether the number of times has met a threshold (Threshold value) to determine whether to reject the connection request, mark the connection requester information as blacklist information, or falsify one of the webpage materials provided by the website platform 21; (4) Warning step S4: refusal After the connection requesting step S3, when the identification module 11 determines that the connection request is abnormal, and the processing module 12 responds to the connection request, an alarm module 14 is connected to the monitoring device 3 to Transmitting one of the generated alarm information for the website administrator to know that there is an abnormal connection request to connect to the website platform 21: (5) updating the connection request side information and the signature step S5: the warning step S4, when When the identification module 11 determines that the connection request is abnormal, the processing module 12 can add a deformation signature to the attack signature database 15, and the information of the marker connection request is the blacklist information stored in the blacklist database 16. (6) Allow connection request Step S6: Determine whether the connection request is abnormal Step S2, if the identification module 11 determines that the connection request is not abnormal, the processing module 12 allows the connection request to pass the network information security detection. System 1, according to the connection request, the webpage data provided by the website platform 21 can be smoothly accessed; (7) the record connection request information S7: when the processing module 12 completes the update connection request end information or signature step S5 After the processing module 12 executes the allow connection request step S6, the processing module 12 links the information to a record module 13 to record the relevant connection request information, and the record module 13 completes the record request information step S7, and then identifies Module 11 will continue Execute the connection request detection step S1, and the related connection request information includes: the connection request time, port number, IP address, protection record, file name, type of threat or action and other information.

Please refer to FIG. 4, which is a schematic diagram (2) of the implementation process of the present invention. As shown in the figure, when the identification module 11 of the present invention completes the detection connection request step S1, it is determined whether the connection request is abnormal. The implementation method of step S2 includes: (1) determining whether the information of the connection requesting end is listed in the blacklist step S21: determining whether the connection request is abnormal or not, step S2, and the identification module 11 firstly connects the request request information of the connection request. Comparing with the black and white list database 16 to confirm whether the connection requester information is listed in the blacklist information stored in the black and white list database 16, and if so, the identification module 11 determines that the connection request is abnormal, and The processing module 12 performs the reject connection request step S3; if not, the identification module 11 determines that the connection request end information of the connection request does not belong to the blacklist information, and further performs determining whether the connection request includes the signature code step S22; (2) determining whether the connection request includes the feature code. Step S22: determining whether the connection request end information is listed in the blacklist step S21, and the identification module 11 confirms that the connection request end information of the connection request does not belong to the blacklist information. First, the packet information of the connection request is compared with the attack signature database 15 to confirm whether the packet information of the connection request includes the signature code stored in the same or suspected attack signature database 15, and if so, the identification module 11: The connection request is determined to be abnormal, and the processing module 12 performs the reject connection request step S3; if not, it is determined that the connection request does not include the same or deformed signature, and continues to perform to determine whether the flow abnormality number reaches The first threshold step S23, in addition, the feature code comparison mechanism may be: determining whether the packet information of the connection request contains a malicious program signature (such as a computer virus, a worm, or a Trojan, etc.), and whether the malicious SQL input string is included. Whether it contains the index value of the file name in the website database 22, whether it contains the encoded (Encoding) URL or attribute value (Attribute), whether the connection request end enters the malicious message of the suspected XSS attack on the message board, and the connection Whether the transmission traffic of the requesting end is abnormal or the like; (3) determining whether the abnormal number of traffic abnormalities reaches the first threshold value. Step S23: determining whether the connection request includes the characteristic code step S22, after the identification module 11 confirms that the packet information of the connection request does not include the signature, it starts to detect whether the abnormal transmission traffic of the connection requesting end reaches a first threshold preset by the processing module 12, if any If the first threshold is reached, the processing module 12 performs the step of providing the forged webpage information S24; if the first threshold is not met, the processing module 12 executes the allow connection request step S6, and the identification module 11 determines the abnormal transmission traffic number. The judging mechanism is: if the connection requester sends the same or different normal connection request times within an average time to satisfy the first threshold (for example, the connection request end sends more than 200 times in 30 minutes, the same or different When the connection request is made, it means to browse or access the website data of the website platform 21 in a large amount, and the identification module 11 determines that the transmission traffic of the connection request is abnormal; (4) providing forged webpage information, step S24: judging the traffic If the number of abnormalities reaches the first threshold step S23, if the identification module 11 determines that the number of traffic abnormalities of the connection requesting end has met the first threshold, the processing module 12 first links the information to the website platform 21 The website information provided by the website platform 21 is forged, and then the connection requesting end is allowed to continue to issue the connection request. Thereafter, the processing module 12 continues to perform the determination of whether the second threshold is satisfied, and the step S25 is further performed. The forged webpage data may be: a blank webpage, or a webpage displaying only a small number of digits, thereby allowing the website platform 21 to provide a smaller or minimal webpage file to the connection requester to deceive the DDoS attack. The connection request side can reduce the burden on the website server 2, thereby reducing the possibility that the website server 2 is not D2S attacked and unable to provide the service; (5) determining whether the second threshold is satisfied, step S25: providing the forged webpage In step S24, the identification module 11 continues to determine whether the second threshold value preset by the processing module 12 is satisfied. If the second threshold is satisfied, the processing module 12 performs the reject connection request step S3; If the threshold is not satisfied, the processing module 12 accumulates the second threshold, and executes the allow connection request step S6; (6) again, whether the connection requesting end is listed in the blacklist step S21 After the line is completed, it may be determined whether the number of abnormal traffic times reaches the first threshold step S23. In other words, the processing module 12 determines whether the number of abnormal traffic times reaches the first threshold. If the determination result of the step S23 is “the first threshold is not satisfied”, The processing module 12 does not directly execute the allow connection request step S6, but successively performs a determination of whether the connection request includes the feature code step S22; and relatively, determines whether the flow abnormality number reaches the first threshold value. If the first threshold has been satisfied, the processing module 12 can directly perform the step of providing the forged webpage information S24 and continue to perform the second threshold step S25. Then, if the second threshold is satisfied, the determination result of the step S25 is " The second threshold is not satisfied, and the processing module 12 can continue to determine whether the connection request includes the signature step S22.

As can be seen from the above, the present invention mainly includes: an identification module, a processing module, a recording module, an alarm module, an attack feature database, and a black and white list database; To store a plurality of signature codes, the black and white list database is used to store the information of the connection requester that allows and does not allow access to the website platform, and the identification module uses the connection requester information for parsing a connection request, and a package information. To determine whether the connection request from the connection request end to a website platform is abnormal, the processing module is configured to immediately make a contingency measure according to the identification result of the identification module (for example, directly reject the connection request), and mark the abnormal connection. The connection request side information of the line request is blacklist information, and the alarm module is driven to send an alarm information to notify the website manager holding the monitoring device, and if it is determined that the connection request issued by the connection request end belongs to For DDoS attacks, the processing module will set a threshold and falsify the website content provided by the website platform (for example, a web page with a smaller file) instead of immediately blocking its connection. In order to minimize the burden on the web server, to reach the fraudulent connection request end, and to greatly reduce the possibility that the web server is attacked by DDoS and unable to provide services; accordingly, the present invention can provide a network reduction The cost of hardware and software construction of the road information security detection system, the immediate response to various website attacks, the purpose of notifying the website administrator immediately, and the ability of the website server to be unable to provide services due to DDoS attacks. The problem of "network information security detection method and its implementation system".

The above description is only for the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention; any changes and modifications made by those skilled in the art without departing from the spirit and scope of the invention All should be covered by the patent of the present invention.

In summary, the effects of the present invention are patents such as "industry useability", "novelty" and "progressiveness"; the applicant filed an application for an invention patent to the bureau in accordance with the provisions of the Patent Law.

Claims (17)

A network information security detection method for detecting whether a connection request from a connection requester to a website platform is abnormal, so that a monitoring device information is linked to a network information security detection system Obtaining an alarm information, comprising the steps of: detecting a connection request step: an identification module detecting the connection request, parsing a connection request end information of the connection request, and the One of the connection requesting ends transmits the abnormal number of traffic; a step of determining whether the transmission traffic is abnormal: the identification module determines whether the connection requesting end sends the connection request within an average time, whether it satisfies a processing module Presetting a first threshold; providing a forged webpage information step: when the abnormal number of transmission traffic reaches the first threshold, the processing module information is linked to the website platform, forging a website information provided by the website platform, And allowing the connection requesting end to continue to send the connection request to the website platform, and accumulating a second threshold preset by the processing module; and if the second threshold is full The identification module finds that the connection request terminal is abnormal, that is, the processing module rejects the connection request, as well as marking the end of the connection request information to one of a black and white list blacklist information stored in the database. For example, in the network information security detection method described in claim 1, wherein after the detecting connection request step is performed, performing a judgment on whether the connection request end information is listed in the black and white single step: the identification mode The group determines whether the connection requester information belongs to the blacklist information stored in the black and white list database. The method for detecting a network information security according to claim 1, wherein the processing module allows the connection requesting party to continue to issue the connection request if the abnormal number of transmission traffic does not reach the first threshold. To the website platform. The method for detecting a network information security according to the first aspect of the invention, wherein, if the second threshold is not met, the processing module may first allow the connection requesting party to continue to send the connection request to the Website platform. The method for detecting a network information security according to the second aspect of the patent application, wherein, when the information of the connection request end belongs to the blacklist information, the identification module determines that the connection request is abnormal, and the processing module That is, the connection request is rejected. The network information security detection method of claim 2, wherein when the connection request end information does not belong to the blacklist information, performing the step of determining whether the transmission traffic is abnormal. The network information security detection method of claim 3, wherein if the abnormal number of transmission traffic does not reach the first threshold, first performing a determination of whether the connection request includes a signature step: the identification module Determining whether a packet request information of the connection request contains a signature code stored in the same or suspected attack signature database. The method for detecting a network information security according to claim 7, wherein the processing mode is configured when the packet information of the connection request includes the same or suspected signature of the attack signature database. The group rejects the connection request and marks the connection requester information as one of the blacklist information stored in the black and white list database. The method for detecting a network information security according to claim 7 , wherein the processing of the packet requesting the connection does not include the signature stored in the same or suspected signature database, the processing The module allows the connection requester to issue the connection request to the website platform. The method for detecting a network information security according to claim 8 , wherein when the processing module rejects the connection request, performing an update connection request information or a signature step: the processing module A deformation feature code is added to the attack feature database, and the connection request end information stored in the black and white list database is updated. The method for detecting a network information security according to claim 1, wherein when the processing module rejects the connection request, performing an update connection request information step: the processing module updates the black and white The connection requester information stored in the list database. The method for detecting a network information security according to the first aspect of the patent application, wherein the connection request end information includes: connection request time, port number, IP address, protection record, file name, threat type, And processing information. The method for detecting a network information security according to the first, fifth, or eighth aspect of the patent application, wherein the processing module rejects the connection request, and then performs a warning step: the processing mode The group information is linked to an alarm module, and the alarm module generates the alarm information for the monitoring device to obtain the alarm information. A network information security detection system is installed on a website platform for detecting whether a connection request sent by a connection requesting end to the website platform is abnormal, so that a monitoring device information link is available. Obtaining an alarm information, comprising: an identification module, respectively establishing an information link with an attack feature database and a black and white list database, for receiving the connection request and parsing a package information, and a connection request information. And the one of the connection requesting end transmits the traffic abnormal number, and identifies whether the connection request end information belongs to one of the blacklist information stored in the black and white list database, and whether the abnormal number of the transmission traffic meets a first threshold; a processing module for establishing an information link with the identification module for making a contingency measure based on the identification result of the identification module; a recording module for the processing module information link to record the connection request end a related connection request information; an alarm module for linking the processing module information to generate the alarm information; and the contingency measure is the processing module Creating a website data provided by the website platform, and accumulating a second threshold preset by the processing module, when the second threshold is satisfied, the processing module rejects the connection request, and the information is linked to The black and white list database is used to mark the connection requester information as the blacklist information. The network information security detection system of claim 14, wherein the identification module compares the signature information to the signature information stored in the same or suspected attack signature database, and the processing module The group may add a variant signature to the attack signature database. The network information security detection system of claim 15, wherein the contingency measure further includes the processing module information being linked to the attack signature database to mark the connection requester information as the blacklist. Information, and updating the deformation signature to the attack signature database. For example, the network information security detection system described in claim 14 is characterized in that the website material forged by the processing module is a website page with a minimum file size or a blank website page.