Automatic generation method and system for HTTP (Hyper Text Transport Protocol) network feature code

Abstract

The invention discloses an automatic generation method for an HTTP (Hyper Text Transport Protocol) network feature code. The method comprises the following steps: a pack feature code generation step, a URI (Uniform Resource Identifier) feature code generation step and an HTTP network feature code total set generation step, wherein the pack feature code generation step comprises the following steps: extracting feature statistics and pack content aiming at a plurality of network samples in a manner of asking and answering interchangeably; generating a coarseness cluster set by secondary clustering so as to generate a fineness cluster set on the basis of the coarseness cluster set by the secondary clustering; generating an asking and answering pack feature code set of the network samples by the fineness cluster set; the URI feature code generation step comprises the following steps: dividing flow of the network samples into single one type of flow and carrying out supplementary extraction of a URI path and parameter feature codes to generate a URI feature code set; finally, combining the asking and answering pack feature code set and the URI feature code set to generate a feature code total set Tall.

Description

technical field [0001] The invention relates to the technology in the field of network security, in particular to a method for generating signatures of unknown HTTP botnets, more specifically, a method for automatically generating HTTP network signatures and a system thereof. Background technique [0002] In recent years, incidents related to network security have occurred frequently, and network security has risen to become a hot topic at the national strategic level. However, due to the general lack of security awareness among netizens and various loopholes in computer operating systems and application software, more and more computers have quietly become "broilers" in botnets, and they have become targets for others to steal privacy and attack network resources. , Illegal profiteering and other illegal and criminal activities. [0003] Botnet (Botnet) is a kind of "universal computing platform constructed by invading several non-cooperative user terminals in cyberspace, ...

AI Technical Summary

Problems solved by technology

[0012] The technical problem to be solved by the present invention is to overcome the problems of long generation time and difficult deployment of existing system signatures, and propose a method and system for automatically generating HTTP network signatures

Images