Terminal virus detection method and device based on data packet, and storage equipment

Abstract

Embodiments of the invention disclose a terminal virus detection method and device based on a data packet, and a storage device, and aim to solve the problem that a virus-infected terminal attacks other terminals with more vulnerabilities in a local area network. The method comprises the following steps: performing memory detection on all terminals; if the suspicious process is found, suspending the suspicious process; sending the suspicious process to a virtual machine; monitoring a data packet sent by a suspicious process in the virtual machine and a received callback information data packet, analyzing the data packet, and performing matching with a predetermined attack mode or callback rule; if the matching similarity is not lower than a threshold value, determining that the suspiciousprocess is a process infected by viruses, and handling the process; and if the matching similarity is lower than the threshold value, traversing the whole virtual machine memory and changing the CnC server address in the virtual machine memory into the address of the preset system.

Description

technical field [0001] The embodiments of the present invention relate to the field of virus detection, and in particular, to a terminal virus detection method, device and storage device based on data packets. Background technique [0002] Over the past few years, malicious attacks have become a daily problem for Internet users and associated devices. Software vulnerabilities in networked machines are increasingly being discovered, many of which are system vulnerabilities. Criminals use these loopholes to infiltrate into various terminals. While these software vulnerabilities continue to be patched, network devices remain vulnerable to attacks. [0003] Generally, manufacturers analyze network traffic to combat malicious attacks. For example, traditional IPS devices are often deployed by enterprises to combat known network attacks. However, traditional IPS devices cannot effectively protect against unknown attacks, and at the same time cannot repair the attacked terminal...

AI Technical Summary

Problems solved by technology

[0005] It can be imagined that there is a virus that can spread horizontally, so that the number of terminals attacked on the internal network will inevitably increase, which will inevitably cause greater persecution to the network, and at the same time increase the time required to repair all terminals

Even if the software patch can be fixed quickly, the malware can no longer destroy the repaired software, but these endpoints are still vulnerable to other malicious programs and repeated infections

Images