Network data security detection method and security detection server

Abstract

The invention provides a network data safety detection method and a safety detection server. Among them, the security detection method of network data includes: grabbing the data packets transmitted in the network; grouping the data packets to restore the transmission control protocol TCP connection data, identifying the application layer protocol used by the TCP connection data; The security scanning module performs security scanning on TCP connection data. Utilize the technical scheme of the present invention, after grabbing data packets and grouping them, perform data security monitoring according to the application layer protocol corresponding to the data packets, and perform protocol analysis on the basis of the reorganized application layer protocol data, which is highly targeted and can Identify network attacks quickly and efficiently, improving network security.

Description

technical field [0001] The invention relates to the field of Internet security, in particular to a network data security detection method and a security detection server. Background technique [0002] Malicious program is an umbrella term for any software program intentionally created to perform unauthorized and often harmful acts. Computer viruses, backdoor programs, keyloggers, password stealers, Word and Excel macro viruses, boot sector viruses, script viruses (batch, windows shell, java, etc.), Trojan horses, crimeware, spyware and adware, etc., These are examples of what could be called malicious programs. [0003] Traditional anti-malware programs mainly rely on signature database matching or behavior analysis. The identification method of signature database matching is as follows: the antivirus engine reads the local file and matches all the signature code "keywords" in the signature database. If the file program code is found to be hit, it can be determined that th...

AI Technical Summary

Problems solved by technology

[0006] However, the current "cloud scanning and killing technology" can only scan and process the downloaded files, and for those virus or Trojan files that need to consume a lot of network resources to download, it is possible to find and delete them only after the download command is executed.

But for the content that is being transmitted in the network, it is powerless

Images