Malicious network behavior identification method and device based on network gene technology

Abstract

The invention belongs to the technical field of network communication security of the Internet of Things (IoT), and particularly relates to a malicious network behavior identification method and device based on the software gene technology. The malicious network behavior identification method based on the software gene technology comprises the following steps: constructing a network gene bank forterminals and the cloud; and carrying out malicious network behavior identification based on the network gene bank. The malicious network behavior identification device based on the software gene technology comprises a terminal and cloud network gene bank construction module, and a malicious network behavior identification module, wherein the terminal and cloud network gene bank construction module is used for constructing the network gene bank for the terminals and the cloud; and the malicious network behavior identification module is used for carrying out the malicious network behavior identification based on the network gene bank. The malicious network behavior identification method and device based on the software gene technology provided by the invention has the advantages that the gene detection efficiency is improved, and high IoT security is guaranteed.

Description

technical field [0001] The invention belongs to the technical field of network communication security of the Internet of Things, and in particular relates to a network malicious behavior identification method and device based on network gene technology. Background technique [0002] Today's society has entered the information network era of "everywhere online, everywhere interconnected", and the Internet of Things, as an important part of the communication network, plays an important role in the construction of national key infrastructure, industrial control systems, smart home, etc. How to ensure the information security of the Internet of Things has become the core content of national network security. [0003] However, the existing solutions all equate the Internet of Things with the Internet, and directly apply traditional Internet security methods to the Internet of Things. However, traditional security technology methods, such as malicious code binary features and mali...

AI Technical Summary

Problems solved by technology

[0003] However, the existing solutions all equate the Internet of Things with the Internet, and directly apply traditional Internet security methods to the Internet of Things. However, traditional security technology methods, such as malicious code binary features and malicious code behavior characteristics, have several obvious defects. Unable to meet IoT security requirements

[0004] 1. Traditional technical means include two categories: static technology based on malicious code binary features as the basis for identification and dynamic technology based on malicious code behavior characteristics as the basis for identification. The disadvantage of static technology is that it can only identify existing features in the feature library Malicious code, as the types of malicious code increase sharply, the signature database will become larger and larger, and the detection and killing efficiency will drop sharply. However, due to the large number of IoT terminals, the detection and killing time will increase exponentially

The disadvantage of dynamic technology is that it needs a virtual environment to execute malicious code, so it can only run on user terminals, and it is difficult to use it in the protection of high-speed links. However, most IoT terminals are micro-terminal systems, or even without systems, dynamic technology cannot run at all

[0005] 2. Regardless of the "dynamic" or "static" malicious code identification technology, it is necessary to analyze the malicious code. However, most people in the security industry still use semi-manual and semi-automatic dynamic debugging technology to analyze malicious code. "Behavior" and "symptoms" are distinguished. For increasingly large and professional malicious codes, semi-automatic analysis and detection are inefficient and have little effect

Images