WEB backdoor detection method and system based on relevance tree

Abstract

The invention relates to a WEB backdoor detection method and system based on a relevance tree. The WEB backdoor detection system comprises a link relevance tree generation module and an attack real-time detection module. The detection system does not depend on antivirus software or file feature detection software, instead, initiative crawling and access record collecting are conducted on WEB links first, a link set of all URLs of a WEB is established through analysis and process, and the link and skip relation of the URLs is marked in a computerized algorithm in a tree mode, so that a link relevance tree is formed. If a backdoor URL request does not exist in the link relevance tree, a security monitoring module of the system gives an alarm, and the attack request is stopped. By means of the detection method, the safety of WEB application is improved, the problem of WEB backdoor attack which can not be detected and prevented by security products such as the antivirus software and a firewall is solved, the university is good, there is no need to mount software programs on a WEB server, and the type of the WEB server, WEB programming languages, customer usage and the like are all made to be transparent.

Description

technical field [0001] The invention relates to a WEB backdoor detection method and system, in particular to a WEB backdoor detection method and system based on an association tree, and belongs to the fields of computer network security and information security. Background technique [0002] At present, WEB applications have occupied the main position of network applications. With the vigorous development of WEB applications, there are overwhelming WEB application security problems, and WEB application security is facing a great threat. With the continuous development of WEB technology and the improvement of network attack technology, the attack methods against WEB applications are also changing with each passing day. As WEB business platforms are widely used in all walks of life, attackers also shift their attention from attacks on network servers to attacks on WEB services. At this level, attackers can use security holes to gain control of WEB servers. Steal important int...

AI Technical Summary

Problems solved by technology

Compared with binary-encoded programs, WEBshell is a plain text file, which is easy to transform and flexible to use scripts. It is easy to confuse or hide signatures, which makes it difficult for detection methods based on signature matching to detect quickly and accurately.

Traditional anti-virus, firewall and other methods are powerless against WEB backdoor programs, and new security methods must be adopted to ensure server security

Images