A confirmation method for web backdoor attack events

Abstract

The invention relates to network security protection technology and aims to provide a method for confirming WEB backdoor attack events. The present invention analyzes firewall, IDS, IPS and relevant WEB server log, extracts the log record of WEB backdoor attack type, according to the attack time, attacker IP, attacker port number, attacked IP, Attacked domain name, attack request header and attack response header to further judge whether the attack of the WEB backdoor is successful; return the confirmation result to the corresponding network protection device, and mark the confirmed WEB backdoor attack event as a successful attack event and display it to user. The invention can provide more scientific confirmation means for WEB backdoor attack events, improve the recognition rate and accuracy rate of WEB backdoor attacks by network security protection equipment, and reduce the alarm false alarm rate for confirming successful attacks.

Description

technical field [0001] The invention relates to network security protection technology, in particular to a method for confirming WEB backdoor attack events. Background technique [0002] WEB backdoor, called WebShell in English, refers to a webpage Trojan horse implemented by webpage codes for illegal purposes. Specifically, the attacker controls the entire WEB server by implanting a WEB backdoor, uploads and downloads files, and illegally tampers with files. [0003] With the increasing number of network attack incidents, the attack techniques and means of network hackers are becoming more and more sophisticated, and the open source hacking tools circulating on the Internet have reduced the cost of attacks. Therefore, there are countless illegal scanning, backdoor detection and other attack traffic every day. The logs on the firewall, IDS, and IPS devices are also the accumulation of tens of millions of attack data every day. The WEB backdoor attack incident is often the ...

AI Technical Summary

Problems solved by technology

[0005] However, the above means have the following disadvantages: (1) security personnel may not be able to handle all WEB backdoor attack events on the network security protection equipment in time

Because analysts related to information security in actual work often do not have the authority to operate and maintain the server, and cannot log in to the server for troubleshooting in time

(2) Only relying on the analyst's own experience is often unable to accurately judge whether the backdoor attack is successful, and there may be misjudgments

(3) There are too many false alarms on the network security protection equipment, causing security personnel to frequently turn pages when analyzing alarm records, and it is easy to ignore important attack clues

Images