Web Trojan detection system and method based on sandbox technology

Abstract

The invention provides a web Trojan detection system and method based on sandbox technology. The system comprises a website malicious code monitoring module, a webpage Trojan carrying detection module, an iframe framework implanting module, an abnormal link skipping detection module, a dynamic engine detection module and a periodic webpage Trojan carrying security monitoring reporting module. The web Trojan scanning engines on the market at present are collected, the web Trojan detection system is a web Trojan detection engine based on browser sandbox technology, a local browser sandbox is constructed to simulate a Web browser behavior so as to identify and detect malicious behaviors, the dynamic detection engine can perform dynamic decryption and identification on malicious codes which are encrypted and are hard to identify, and the detection rate of the unknown web Trojan is improved by detection means based on behaviors. Distributed parallel processing of web Trojan detection tasks is realized by adopting asynchronous task management and distributed task allocation, and the detection efficiency of a large number of web Trojan detection tasks is improved.

Description

technical field [0001] The invention relates to the field of network information security, in particular to a sandbox technology-based nethorse detection system and a detection method thereof. Background technique [0002] The rapid development of the Internet has pushed people into the Web2.0 era, bringing great convenience to people's life, work and study. Since my country proposed the Internet+ action plan in 2015, the use of information technology to promote e-government has also become an important condition for realizing the goal of modernizing the national governance system and governance capabilities. Internet + government affairs is playing an increasingly important role in improving government administrative efficiency and improving government public service capabilities. However, these websites have relatively weak protection measures and are often invaded by hackers, who tamper with the content of the website and bring a bad image to the government. It even pose...

AI Technical Summary

Problems solved by technology

Internet + government affairs is playing an increasingly important role in improving government administrative efficiency and improving government public service capabilities. However, these websites have relatively weak protection measures and are often invaded by hackers, who tamper with the content of the website and bring a bad image to the government. even pose a serious threat to the normal operation of government work and the security and confidentiality of government information or personal information.

Most of the trojan scanning tools currently on the market are based on feature matching. Faced with more complex trojans (such as encrypted codes), they cannot accurately detect trojans. Lots of false negatives and false negatives