Method and system for detecting zombie, trojan and worm networks

Abstract

The invention discloses a method and system for detecting zombie, trojan and worm networks, and relates to the field of internet security, wherein the method comprises the following steps: message detection equipment obtains control terminal information in a zombie, trojan and worm sample message in a network designated area; the control terminal information in the zombie, trojan and worm sample message is sent to flow detection equipment; the flow detection equipment samples flow in a network according to the control terminal information in the zombie, trojan and worm sample message, so that corresponding zombie, trojan and worm controlled terminal address information is obtained; and the flow detection equipment sends the obtained zombie, trojan and worm controlled terminal address information to a zombie, trojan and worm detection platform, so that the zombie, trojan and worm detection platform constructs a zombie, trojan and worm network topological structure. By means of the method and the system disclosed by the invention, on the basis of distributed measurement nodes in two types including deep package inspection and deep flow detection, the zombie, trojan and worm networks can be tracked more widely; the flow is reduced by adoption of a message sampling method; and thus, measurement on the network flow of a high-speed link and relatively accurate deduction on the topological structure of the zombie, trojan and worm networks can be realized.

Description

technical field [0001] The invention relates to the technical field of Internet security, in particular to a method and a system for detecting zombie and worm networks. Background technique [0002] Zombie worm network refers to a group of botnet (Botnet) computers secretly established by attackers using Internet users' computers that can be remotely and uniformly controlled. Currently, botnet worm networks are mainly controlled by Trojan horses and spread through worms and malicious websites. The Trojan horse is a hacking tool based on remote control, and its essence is a "client / service" network program. The Trojan horse program appears to have some useful functions on the surface, but in fact it can control the entire computer system and open the back door. , a function that endangers system security; a worm is a virus that spreads through the network and infects hosts with vulnerabilities, and replicates automatically, usually without human interaction. The traffic gener...

AI Technical Summary

Problems solved by technology

Therefore, whether it is for the safe operation of the network or the protection of user data security, zombie and worm networks are extremely threatening hidden dangers

Images