A security protection method and system for linking terminal side and flow side

Abstract

The invention provides a terminal side and traffic side linked security protection method and system. In a process of performing security protection on in-network, the terminal side data and the traffic side data are combined to implement the dynamic complementary update of a terminal side blacklist library and a network side blacklist library, linked detection is performed on in-network files byusing the blacklist libraries subjected to the complementary update, and alarming and fixed-point clearing are performed on malicious files. According to the terminal side and traffic side linked security protection method and system provided by the invention, no matter the in-network files are located on the terminal side or the traffic side, as long as the features of the in-network files existin the blacklist library of any side, the in-network files can be accurately detected via the linked detection, thereby effectively improving the detection rate and maintaining the security of the network environment.

Description

Technical field [0001] The present invention relates to the technical field of information security, and in particular to a security protection method and system linked to a terminal side and a flow side. Background technique [0002] Nowadays, cyber threats have risen to the level of national strategy, and cyber attacks have also changed from malicious attacks aimed at the public with no clear purpose to advanced threat attacks aimed at launching information warfare with specific targets. Traditional anti-malware software mostly uses a blacklist mechanism to detect unknown threats, relying on simple signature scanning technology as the core technology. This detection mechanism cannot achieve the purpose of real-time defense against unknown threats under the current cyber threat situation. At the same time, most of the existing blacklist mechanisms set up different blacklist libraries based on different devices, and perform feature matching on different devices during threat dete...

AI Technical Summary

Problems solved by technology

Traditional anti-malware software mostly uses the blacklist mechanism to detect unknown threats, relying on simple signature scanning technology as the core technology, this detection mechanism can no longer achieve the purpose of real-time defense against unknown threats under the current network threat situation

At the same time, most of the existing blacklist mechanisms set up different blacklist databases according to different device terminals, and perform feature matching on different device terminals during threat detection, without linkage between blacklist databases, which makes some applications The detection rate of threats cannot be fully satisfied in the scenario

Images