Method, device and equipment for monitoring zombie network attack behavior and storage medium

Abstract

The embodiment of the invention discloses a method and device for monitoring zombie network attack behavior, electronic equipment and a storage medium. The method comprises the steps of acquiring a communication port of a zombie network to which a malicious sample belongs, control instruction information and an address of a remote control server according to the malicious sample; controlling the communication port of a setting terminal to be opened, and controlling the setting terminal to send the connection request instruction to the address of the remote control server; receiving a control instruction sent by the remote control server in real time, and analyzing the control instruction according to the coding mode information, determining attack intention information of the zombie network according to an analysis result, receiving and analyzing the control instruction sent by a remote control server of the zombie network in real time through a setting terminal, and performing long-term monitoring on the zombie network.

Description

technical field [0001] Embodiments of the present disclosure relate to the technical field of network security, and in particular to a method, device, electronic device, and storage medium for monitoring attack behaviors of botnets. Background technique [0002] A botnet refers to a malicious network formed by an attacker using a one-to-many control channel to control a large number of hosts. Different forms of network attacks can be carried out through botnets: (1) launch distributed denial of service attacks (DDos, distributed denial of service), DDoS attacks initiated by botnets are difficult to trace and cause great harm; (2) send garbage Mail, such as the Rustock botnet, can send an average of 30 billion spam every day; (3) steal sensitive information, occupy network traffic resources, and consume system performance; (4) form a malicious software distribution platform, and hackers use botnets to continuously carry out different attacks Attempts of various means form ne...

AI Technical Summary

Problems solved by technology

Different forms of network attacks can be carried out through botnets: (1) launch distributed denial of service attacks (DDos, distributed denial of service), DDoS attacks initiated by botnets are difficult to trace and cause great harm; (2) send garbage Mail, such as the Rustock botnet, can send an average of 30 billion spam every day; (3) steal sensitive information, occupy network traffic resources, and consume system performance; (4) form a malicious software distribution platform, and hackers use botnets to continuously carry out different attacks Attempts to create new attack methods and cause great harm to hosts in the network

[0003] At present, the detection of botnets mainly focuses on finding abnormal network behaviors based on traffic and detecting attack behaviors based on characteristics, without forming a long-term monitoring capability for botnets

Images