Reverse-based intrusion detection system and reverse-based intrusion detection method

Abstract

The invention discloses a reverse-based intrusion detection system and a reverse-based intrusion detection method and relates to the field of network encryption protocols. The system comprises a data extraction module, a reverse analysis module, an intrusion rule module, a response module and a data management module. The method comprises the following steps: (1) capturing all network data packages running through an Android phone by the data extraction module, sending to a reverse analysis engine, acquiring network processes and user behaviors by the data extraction module to generate a system log and a weblog, and sending the system log and the weblog to the data management module; (2) identifying intrusion behaviors by the reverse analysis engine through the TCP / IP (transmission control protocol / Internet protocol) analysis technology and the apk decompilation reverse technology by combining the system log and the weblog; (3) performing warning and recording on the intrusion behaviors identified by the reverse analysis engine through the response module; (4) storing all information of a user in the data management module so as to facilitate later evidence collection and lookup. The reverse-based intrusion detection system and the reverse-based intrusion detection method disclosed by the invention have safety, timeliness, expandability and advancement.

Description

technical field [0001] The invention relates to the field of network encryption protocols, in particular to a reverse-based intrusion detection system and its method, which have the advantages of scalability and high timeliness. Background technique [0002] According to the "Mobile Phone Security Industry Analysis Report for the First Half of 2013" released by Security Manager, a professional mobile phone antivirus software company, in the first half of 2013, a total of 33,930 types of mobile phone malware were found, including 26,580 types of malware based on the Android platform. Very fast. Among the 26,580 types of malicious software, 12% of them have the phenomenon of stealing users' private information such as geographic location information, address book, SMS and device information. The intrusion detection system can identify the intrusion behavior and effectively suppress the danger of stealing the user's private information, which has great practical value for main...

AI Technical Summary

Problems solved by technology

Among the 26,580 types of malicious software, 12% of them have the phenomenon of stealing users' private information such as geographic location information, address book, SMS and device information, etc.

The research results show that among the 33 popular Android applications sampled by the team, 58% of the programs have privacy leaks, and 25% of the applications encrypt the user's private information and upload it to the server, which increases the burden of review and authentication. difficulty

Images