TWI381284B - Anti-hacker detection and protection system and method - Google Patents

Description

Anti-hacker detection and protection system and method

The present invention relates to an anti-hacker detection and protection system and method, and more particularly to an anti-hacker detection and protection system and method combining trap detection, malicious behavior analysis and information security protection.

With the advent of the Internet broadband era and the prevalence of e-commerce transactions, the various behavior patterns between people are gradually affected by the Internet. Because of the fast and convenient network, the network becomes a part of human life, so network security is therefore Gradually received attention.

Usually, the purpose of network security protection is to prevent viruses or hackers from invading the user's computer. Therefore, users will set up protection devices such as intrusion prevention devices or anti-virus software to block attacks from outside. However, intrusion prevention devices or anti-virus software do not trap the mechanism for detecting viruses or hackers. They can only protect against known viruses or attack features, so they cannot protect against unknown attacks and malicious websites. In other words, if the virus or hacker data is updated too slowly, it will greatly increase the likelihood of user being victimized. In addition, since the manufacturers providing intrusion prevention equipment or anti-virus software are mostly from European countries and regions, it is difficult to balance the latest power or malicious platforms generated in specific areas due to the cost of the manufacturers, resulting in poor security protection.

In order to serve users in a specific area, it is a better solution to provide network security services by a regional Internet Service Provider (ISP). However, if the current ISP only installs some purchased intrusion prevention equipment or anti-virus equipment on its computer room, the problem of updating the above-mentioned virus or hacker data cannot be solved. In summary, how can we propose an anti-hacker protection system and method that enables ISPs to perform trap detection, malicious behavior analysis and information security protection actions in real time to enhance the security of their customers when using the network. It is an urgent problem to be solved.

In order to solve the above-mentioned shortcomings of the prior art, the present invention provides an anti-hacker detection and protection system and method for detecting, analyzing, monitoring and blocking protection of large-scale automated malicious behavior, and at the same time, if the system finds a platform In the event of a disaster, the affected station will be notified of the follow-up.

The anti-hacker detection and protection method of the present invention is applied to a network system, the network system having at least one trapping device, an analyzing device and a service platform, and the anti-hacker detection and protection method comprises at least the following steps: (1) placing the trapping device on a preset network to form a subject information when the trapping device is attacked; (2) inputting the subject information into the analyzing device, causing the analyzing device to perform or Analyzing the information of the subject information to form a malicious information record, and then inputting the malicious information record into the service platform; and (3) causing the service platform to initiate a corresponding anti-hacker protection action according to the malicious information record.

In a preferred aspect, the analyzing device has a central control station and at least one virtual machine, and step (2) includes: (2-1) causing the central control station to distribute the received information to The virtual machine (2-2) causes the virtual machine to execute the information and analyze the information to transmit the analysis result back to the central control machine, and then the central control machine generates a malicious information record; 2-3) transmitting the malicious information record to the service platform, and returning the status of the virtual machine to an initial state.

The anti-hacker detection and protection system of the present invention is applied to a network system, and the anti-hacker detection protection system includes at least: a trapping device, which is set in a network segment that may be attacked by a hacker. And forming an information for the attack on the trapping device; the analyzing device inputs the information to perform or analyzes the information of the received information to form a malicious information record; and the service platform is based on the malicious information record Start the corresponding anti-hacker protection action.

In a preferred aspect, the analyzing device comprises: a central control machine; and at least one virtual machine station configured to perform the information and perform analysis to transmit the analysis result back to the central control machine And the central control machine forms a malicious information record according to the analysis result, wherein the central control machine transmits the malicious information record to the service platform, and returns the state of the virtual machine to an initial state, The service platform performs subsequent alerting or immediate protection services.

Therefore, the anti-hacker detection and protection system and method of the present invention combines trap detection, malicious behavior analysis and information security protection to actively and maliciously detect malicious stations, such as malicious attackers, Virus-infected people, zombies, zombie control stations, and malicious download points to prevent user-side computer devices from being misconnected to these malicious sites and being implanted with Trojans or backdoors. At the same time, if the system finds that the station is suffering, it will also actively send an alarm message to the receiving station for processing, which greatly enhances the security of the user when using the network.

The embodiments of the present invention are described in the following detailed description of the embodiments of the present invention, and those skilled in the art can readily understand other advantages and advantages of the present invention. The present invention has been described and illustrated with reference to the various embodiments of the invention.

Please refer to FIG. 1 , which is a block diagram showing the basic system architecture of the anti-hacker detection and protection system of the present invention. As shown, the anti-hacker detection and protection system 4 of the present invention is applied to a network system having at least one trapping device 41, an analyzing device 42, and a service platform 43.

The trapping device 41, the analyzing device 42, and the service platform 43 can be implemented in the form of software, and can be integrated on the same computer or set in different computers. First, the trapping device 41 is placed in a network segment that may be subjected to the hacker 1 attack to form a subject information when the trapping device 41 is attacked to input the subject information to the analyzing device 42. Then, the analyzing device 42 performs or analyzes the formed information record to form a malicious information record, and then initiates a corresponding anti-hacker protection action according to the malicious information record through the service platform 43, for example, using the information security protection device to the user end. Instant protection.

Referring to FIG. 2, it is a block diagram of a system architecture of an embodiment of the anti-hacker detection and protection system of the present invention. As shown, the analysis device 42 further includes a central control unit 421; and at least one virtual machine. The virtual machine 422 is used to expand the execution and analysis of the received information, so the information is executed and analyzed to transmit the analysis result back to the central control machine, and then the central control unit Based on the analysis results, the station forms a malicious information record. In addition, the virtual machine 422 executes the information to find files, file records, account numbers, login files, or external programs, and malicious programs and groups for downloading data that are added, deleted, modified, or copied. Finally, a malicious information record is generated, which is information of a malicious attacker, a virus infected person, a zombie computer, a zombie computer control station, and a malicious download point.

Next, the analyzing device 42 transmits the malicious reward record to the service platform 43, and returns the trusted virtual machine 422 to an initial state, so that the malicious information is recorded by the service platform 43 to determine whether an alarm needs to be executed. Or immediate protection.

In a preferred embodiment, the service platform 43 includes a malicious station surviving detection module 43a, a hazard class distinguishing module 43b, a malicious station database 43c, and a trusted user database 43e.

The malicious station survival detecting module 43a is configured to determine whether the malicious station is alive. The hazard class distinguishing module 43b is configured to determine the hazard level of the malicious station by the discovery time and the frequency of occurrence of the malicious station, so that the service platform forms a malicious station list.

Secondly, the service platform includes a malicious platform database 43c for storing the malicious website list, so that the service platform can block the connection of the malicious platform executed by the user according to the malicious website list through an information security protection device 44. The information security protection device 44 can be a protection server, a router or a gateway device, etc., for ensuring protection against hacking.

In addition, the service platform 43 can compare the malicious information record with the malicious website list in the malicious station database 43c to form malicious activity distribution information, malicious activity status, and trend change analysis. The service platform 43 compares the malicious information record with the user data to generate the user database 43e according to the comparison result, and immediately notifies the affected user terminal according to the information of the user database. Process and provide analysis of trends in malicious activity trends to users at any time.

Please refer to FIG. 3 , which is a schematic diagram of a basic operation flow of the anti-hacker detection and protection method of the present invention. The anti-hacker detection and protection method is applied to a network system, and the network system has at least one trapping device. Analytical equipment and service platform. As shown in the figure, first, in step S31, the trapping device is placed on a preset network to form the subject information when the trapping device is attacked, and then proceeds to step S32.

In the step S32, the subject information is input to the analyzing device, so that the analyzing device performs or analyzes the information of the subject information to form a malicious information record, and then inputs the malicious information record into the service platform, and then proceeds to the step. S33.

In the step S33, the service platform is caused to initiate a corresponding anti-hacker protection action according to the malicious reward record.

The trapping device is used to test the information security status of the customer network segment, and the trapping device disperses and widely places the trapping device according to the activity degree of the network segment to improve the trapping rate.

Please refer to FIG. 4 , which is a schematic diagram of the operation of the first embodiment of the anti-hacker detection and protection method of the present invention. As shown in the figure, first, step S41 is executed to enable the central control station to receive the information. It is distributed to the virtual machine, and then proceeds to step S42.

In step S42, the virtual machine station is caused to execute the received information and analyze to transfer the analysis result back to the central control machine, and then the central control machine generates a malicious information record, and then proceeds to step S43.

In step S43, the malicious information record is transmitted to the service platform, and the state of the virtual machine is returned to the initial state.

The above virtual machine is used to expand the information execution and analysis capabilities; the virtual machine performs the information to find out the files, file records, account numbers, and login files that are added, deleted, modified or copied. , or externally connected, malicious programs and configurations for performing data downloads, generating malicious information records; and the malicious information records are information of malicious attackers, virus infected persons, zombies, zombie control stations or malicious download points. .

Referring to FIG. 5, it is a schematic diagram of the operation of the second embodiment of the anti-hacker detection and protection method of the present invention. As shown in the figure, in the step S51, the service platform starts corresponding according to the malicious information record. The anti-hacker protection action proceeds to step S52.

In the step S52, the service platform determines whether the malicious station survives the malicious level of the malicious station to form a malicious station list, and then proceeds to step S53.

In the step S53, the malicious level of the malicious station is determined by the discovery time and the frequency of occurrence of the malicious station, and then proceeds to step S54.

In the step S54, the service platform further includes a malicious platform database for storing the malicious station list, and the service platform immediately blocks the connection of the malicious website executed by the user according to the malicious website list through an information security protection device. The step proceeds to step S55.

In the step S55, the service platform compares the malicious information record with the malicious station list in the malicious station database to form malicious activity distribution information, malicious activity situation and trend change analysis.

It can be seen from the above embodiments that the anti-hacker detection and protection method utilizes an active attack and lure method to obtain various malicious data of a malicious station for attack, and is used for subsequent data analysis, so as to facilitate the analysis result to provide information security protection. Device and client for information security protection. The service platform can compare the malicious information record with the user data to generate the user database according to the comparison result, and immediately notify the affected user terminal for subsequent processing according to the data of the user database. And provide analysis of the trend of malicious activity trends to users at any time. This trend change analysis is used to analyze national or regional attack patterns, attack weaknesses, and frequently encountered communications.

In summary, the anti-hacker detection and protection method and system of the present invention can perform malicious behavior detection, analysis and blocking protection on a large-scale basis, and if the system finds the existence of a malicious platform or hacker attack behavior, it will take the initiative. The client or the receiving station is informed to prevent the user computer device from being connected to the malicious platform or being maliciously implanted into the Trojan or the backdoor program, and then controlled to become a zombie computer. The invention can also be planned as an independent information security service product or to add value to an existing security service.

The above-described embodiments are merely illustrative of the principles, features, and effects of the present invention, and are not intended to limit the scope of the present invention. Any person skilled in the art can practice the above without departing from the spirit and scope of the present invention. The examples are modified and altered. Any changes or modifications made to the use of the present disclosure will still be covered by the scope of the following claims. Therefore, the scope of protection of the present invention should be as set forth in the scope of the claims described below.

1. . . Hacker

2. . . Internet

3. . . Trust station

4. . . Anti-hacker detection and protection system

41. . . Trap device

42. . . Analytical equipment

421. . . Central control machine

422. . . Virtual machine

43. . . Service Platform

43a. . . Malicious station survival detection module

43b. . . Hazard class distinguishing module

43c. . . Malicious platform database

43e. . . Trusted user database

44. . . Information security equipment

S31 to S33. . . step

S41 to S43. . . step

S51 to S55. . . step

1 is a block diagram showing the basic system architecture of the anti-hacker detection and protection system of the present invention.

Figure 2 is a block diagram showing the system architecture of one embodiment of the anti-hacker detection and protection system of the present invention.

Figure 3 is a schematic diagram showing the basic operation flow of the anti-hacker detection and protection method of the present invention.

Figure 4 is a schematic diagram showing the operation of the first embodiment of the anti-hacker detection and protection method of the present invention.

Figure 5 is a schematic diagram showing the operation of the second embodiment of the anti-hacker detection and protection method of the present invention.

1. . . Hacker

2. . . Internet

3. . . Trust station

4. . . Anti-hacker detection and protection system

41. . . Trap system

42. . . Analytical equipment

43. . . Service Platform

Claims (21)

An anti-hacker detection and protection method is applied to a network system, which has at least one trapping device, an analysis device and a service platform including a central control machine and at least one virtual machine platform, and the reverse The method for detecting and detecting a guest includes at least the following steps: (1) placing the trapping device on a preset network to form a subject information when the trapping device is attacked; and (2) receiving the subject information Entering the analysis device, causing the analysis device to perform or analyze the formed information record to form a malicious information record, and then input the malicious information record into the service platform; and (3) causing the service platform to initiate the corresponding according to the malicious information record The anti-hacker protection action, wherein the virtual machine station performs the information to be added, deleted, modified or copied to find files, file records, account numbers, login files, or external connection and execution data. Download the malware and configuration, and generate the malicious information record. For example, in the anti-hacker detection and protection method of claim 1, the step (1) is to disperse and widely place the lure device according to the activity degree of the network segment to improve the trapping rate. For example, in the anti-hacker detection and protection method of claim 1, wherein the step (2) includes: (2-1) causing the central control machine to distribute the received information to the virtual machine; (2-2) causing the virtual machine to execute the subject information and analyze it, Transmitting the analysis result back to the central control machine, and then generating a malicious information record by the central control machine; and (2-3) transmitting the malicious information record to the service platform, and replying the status of the virtual machine station To the initial state. For example, in the anti-hacker detection and protection method of claim 3, the virtual machine is used to expand the ability of the information to be executed and analyzed. For example, in the anti-hacker detection and protection method of claim 1, the malicious information record is information of a malicious attacker, a virus infected person, a zombie computer, a zombie computer control station or a malicious download point. For example, in the anti-hacker detection and protection method of claim 1, the step (3) includes the step of judging whether the malicious station survives and the malicious station has a hazard level to form a malicious station list. For example, in the anti-hacker detection and protection method of claim 6, wherein the malicious station's hazard level is judged by the discovery time and frequency of occurrence of the malicious station. For example, in the anti-hacker detection and protection method of claim 1, wherein the service platform includes a malicious platform database for storing a list of malicious stations, and step (3) includes enabling the service platform to pass an information security The protection device immediately blocks the connection of the malicious platform executed by the user according to the malicious website list. For example, in the anti-hacker detection and protection method of claim 1, wherein the service platform includes a malicious platform database for storing a list of malicious stations, and step (3) includes causing the service platform to use the malicious information. The record is compared with the list of malicious stations in the malicious platform database to form a step of analyzing malicious information, malicious activity and trend change analysis. For example, in the anti-hacker detection and protection method of claim 9, the trend change analysis is used for sample analysis of national or regional attack patterns, attack weaknesses, and frequently-recognized communications. For example, in the anti-hacker detection and protection method of claim 8, wherein the service platform includes a database of the user database, and step (3) includes causing the service platform to compare the malicious information record with the user data. If yes, the affected user database is generated, and the affected user is immediately notified according to the data of the user database for subsequent processing. For example, in the anti-hacker detection and protection method of claim 1, the trapping device, the analyzing device and the service platform are provided on the same computer or on different computers. An anti-hacker detection and protection system is applied to a network system, and the anti-hacker detection protection system includes at least: a trapping device, which is placed on a preset network segment for being subjected to the trapping device Forming the subject information during the attack; the analyzing device includes a central control unit and at least one virtual machine station, and the analyzing device inputs the subject information to perform or analyze the subject information to form a malicious information record; and the service The platform activates the corresponding anti-hacker protection action according to the malicious information record. The virtual machine station executes the information to find out files, file records, account numbers, login files, external files, and malicious programs and configurations that are added, deleted, modified, or copied. . The anti-hacker detection and protection system of claim 13 wherein the at least one virtual machine is configured to perform the analysis and analyze the information to transmit the analysis result to the central control unit. The central control machine forms a malicious information record based on the analysis result. For example, in the anti-hacker detection and protection system of claim 14 of the patent scope, the virtual machine station is used to expand the ability of the information to be executed and analyzed. For example, in the anti-hacker detection and protection system of claim 13, wherein the malicious information record is information of a malicious attacker, a virus infected person, a zombie computer, a zombie computer control station or a malicious download point. For example, in the anti-hacker detection and protection system of claim 13 of the patent scope, the service platform includes: a malicious station survival detection module, which is used to determine whether a malicious station is alive; and a hazard class distinguishing module is used The malicious station is determined by the discovery time and the frequency of occurrence of the malicious station, so that the malicious platform list is formed by the service platform. For example, in the anti-hacker detection and protection system of claim 17, wherein the service platform includes a malicious platform database for storing the A list of malicious stations, by which the service platform immediately blocks the connection of malicious stations executed by the user according to the malicious website list through an information security protection device. For example, the anti-hacker detection and protection system of claim 18, wherein the malicious station database compares the malicious information record with the list of malicious stations in the malicious platform database to form malicious activity distribution information, Analysis of malicious activity and trend changes. For example, in the anti-hacker detection and protection system of claim 13 of the patent application, the service platform includes a database of user data for storing the user data, so that the service platform can immediately obtain the data of the user. Notify the affected client for subsequent processing. For example, in the anti-hacker detection and protection system of claim 13 of the patent scope, the lure device, the analysis device and the service platform are provided on the same computer or on different computers.