The invention relates to a webpagehanging trojan detecting and protecting method and a webpagehanging trojan detecting and protecting system, as well as a method for extracting a corresponding code. The system injects a section of script code for automatically extracting a tag into an intercepted Web page and sends the Web page to a client side; the client side runs the script code, extracts the code of the tag related to the webpage hanging horse, and sends the code and a URL (Uniform Resource Locator) of the Web page to the system; and the system can match a URL to be detected with a safe URL in a corresponding baseline, if match is failed, abnormal detection is carried out on the URL to be detected, so that the security level is confirmed. The webpagehanging trojan detecting and protecting method and the webpagehanging trojan detecting and protecting system as well as the method for extracting the corresponding code have small dependence on the environment, failure in report can be reduced, and the code of the tag can be effectively extracted.

Webpagehanging trojan detecting and protecting method and system as well as method for extracting corresponding code

The invention provides a method and device for detecting intranet Trojans. The method for detecting the intranet Trojans comprises the following steps: S1, collecting network data packets; S2, identifying baleful domain names by using D1-D3, wherein D1 is for identifying the domain names of DNS request data with abnormal heartbeats, D2 is for judging whether the domain names pointing to special IPs are skipped to be DNS requests pointing to normal IP, and D3 is for judging whether the domain names accessed by the DNS appear in browser access domain names; and S3, identifying the Trojans by using D4-D5, wherein D4 is for judging whether reverse traffic appears, if yes, identifying to be the Trojan, and D5 is for judging whether a request packet or a response packet in the traffic accords with RFC provisions, if not, identifying to be the Trojan. According to the method and device for detecting the intranet Trojans disclosed by the invention, comprehensive detection is performed based on communication behavior characteristics of the Trojans, the unknown Trojans can be found timely and alarmed more accurately, and failure in alarm can be reduced.

Method and device for detecting intranet Trojans

The invention discloses a website safety detection method and website safety detection system, relating to the field of website safety. The system comprises a client and a server end, wherein the server end further comprises a storage module, a scheduling module and a scanning module. The method comprises the following steps: obtaining website information to be detected by the client through a user operation interface and generating a safety detection task by the website information to be detected to be stored into the storage module of the server end; receiving the safety detection task sent by the scheduling module and analyzing a website to be scanned; starting to scan and feeding a scanning schedule and a scanning result back to the scheduling module; and updating the received scanning schedule and scanning result to the storage module by the scheduling module so as to be convenient for a user to inquire. With the adoption of the method disclosed by the invention, the user can freely and conveniently enjoy safety detection services of the website; and a group user can enjoy intensive scanning and leak checking functions through the client arrangement; and the website safety can be effectively guaranteed.

Website safety detection method and website safety detection system

The invention is applicable to the technical field of computer security, and provides a method and a system for detecting hung Trojans of a web page. The method includes steps of A, acquiring contents of the web page; B, analyzing the acquired contents of the web page and extracting a script object; C, constructing an object execution engine to imitate execution of object contents of the script object; and D, monitoring imitation execution of the object contents and determining that the object contents contain dangerous data when abnormal behaviors appear. The method and the system have the advantages that the efficiency of detection for the hung Trojans of the web page can be effectively improved, and an omission ratio and a false detecting rate of the detection for the hung Trojans of the web page are reduced.

Method and system for detecting hung Trojans of web page

The invention discloses a detecting method and device of bat loopholes and relates to the field of information safety. The bat loopholes in a bat script can be detected quickly and accurately so that the safety of a computer system can be protected. According to the main technical scheme, a bat virtual machine for bat script operation is established; the bat script operates on the bat virtual machine, and the process behavior of the bat script during operation is recorded; the process behavior and a preset malicious behavior base are matched, and the preset malicious behavior base comprises the judging rules of a know malicious behavior script; and if matching is successful, the fact that the bat script is the bat loopholes is determined. The detecting method and device are mainly used in the processing of bat loophole detecting.

Detecting method and device of bat loopholes

The invention discloses a method and a device for detecting web Trojan. The technical proposal comprises the steps of obtaining html webpage script information from a webpage; executing the html webpage script information and recording behavior characteristics generated in the process of execution; matching the behavior characteristics with stored bug feature codes, and when matching is successful, determining the webpage content contains the web Trojan. The device comprises: a script information acquisition module, a behavior characteristic extraction module and a web Trojan characteristic matching module. The technical proposal can be adopted to comparatively comprehensively detect the web Trojan and overcome the problem of detection limitation caused by relying on the third party software in the prior art.

Method and device for detecting web Trojan

The invention discloses a method and a device for identifying vbs webpage Trojan horse, and belongs to computer field The method includes steps of conversing vbs code to js statement according to preset mapping relation; analyzing the js statement; and identifying webpage Trojan horse behavior of the analyzed js statement The device includes a conversion module, a analysis module and a identifying module The invention converses the vbs code to js statement according to the preset mapping relation; analyzes and identifies the webpage Trojan horse behavior of the js statement, unifies the identification of the vbs webpage Trojan horse and the js webpage Trojan horse, and does not need to configure a set of characteristic library for the vbs webpage Trojan horse, thereby simplifying development and maintain process and reducing cost

Yong Yang

Papers

Method and device for detecting web Trojan

Method and device for identifying vbs webpage Trojan horse