Malicious code evidence obtaining method and system on the basis of feature code under Linux

Abstract

The invention provides a malicious code evidence obtaining method and system on the basis of a feature code under the Linux. The method extracts an accurate feature code through known malicious files and non-malicious files, carries out multi-mode matching on an unknown file and a WM (Wu-Manber) feature rule library after the features of the file under a Linux system is subjected to whitelist detection, carries out detection to obtain a detailed and accurate result, and gives a detection evidence obtaining report. The method also utilizes the characteristics that information including a registry, a starting item and the like in the Linux can be stored in a file form to extract starting item information, memory information, process information and the like, and can detect the information so as to detect the malicious files in the system.

Description

technical field [0001] The invention relates to the field of network security, in particular to a malicious code evidence collection method and system based on feature codes under Linux. Background technique [0002] With the rapid development of network and computer technology, Linux system is gradually used by more and more network users. At the same time, the development of malicious codes in the Linux environment is becoming more and more extensive and diverse. However, the corresponding detection methods and detection tools cannot develop so rapidly like those in the Windows system environment, and most of them still rely on malicious code signatures for detection. [0003] The characteristic code of the malicious code is a series of bytes extracted from the sample of the malicious code that does not exceed 64Byte and can accurately represent a certain type of malicious code. Signature-based detection is to first collect many signatures into a database, and then use t...

AI Technical Summary

Problems solved by technology

[0006] Based on the above problems, the present invention proposes a malicious code forensics method and system based on feature codes under Linux, which solves the problem of malicious code forensics under Linux, and at the same time solves the problems of too large a feature library and low detection efficiency

Images