P2P (peer to peer) worm detection method and device

Abstract

The invention discloses a P2P (peer to peer) worm detection method which is as follows: analyzing the features of P2P worms, constructing a worm feature library according to the related information of the P2P worms; scanning whether the port of a host in a P2P network is open, if the port of the host in the P2P network is open, sending a corresponding request message to the host according to the related information of a corresponding worm in the worm feature library; and after a response message returned from the host is received, parsing the response message content to determine whether the host is infected with the P2P worm according to the related information in the worm feature library. The invention also discloses a P2P worm detection device. The P2P worm detection method and device adopt the detection mode of active detection, and can effectively avoid the shortcomings that methods in the prior art are based on filtering and state detection of data packets, so that known P2P worms can be effectively defended, and the security of intranet system can be improved.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to a P2P worm detection method and device. Background technique [0002] With the popularity of P2P (Peer to Peer, peer-to-peer computing) software, P2P worms have become one of the main threats to P2P network security. Use the security loopholes in other hosts in the P2P network, P2P network file sharing function, resource sharing, etc. to quickly and covertly spread worms to other hosts. Due to the design of the P2P network, while increasing the speed of resource sharing, it also speeds up the spread of worms. The speed enables P2P worms to infect a large number of hosts in a short period of time and construct a huge botnet at the same time, which poses a great security threat to the existing network. For the harm of P2P worms, the current firewall technology mainly detects whether the hosts in the network are infected with P2P worms by filtering the content of data packets ...

AI Technical Summary

Problems solved by technology

[0003] 1. Since the P2P worm spreads in the internal network, the traffic does not pass through the firewall, so in this case, the firewall is useless;

[0004] 2. Since P2P worms and normal P2P software use the same technology, it is difficult to distinguish P2P worms from normal P2P software;

[0005] 3. P2P worms often use encryption and obfuscation technology for the file itself and communication content, which makes it impossible for the firewall to recognize

Images