CN105119938A - Method for defending against innerport recall trojan - Google Patents

Abstract

The invention belongs to the technical field of information security under the network environment, provides a method for defending against an innerport recall trojan, and aims to solve a problem that anti-virus software cannot well find variations of a known Trojan and a new Trojan. The method comprises: firstly establishing a credible program list, and storing the credible program list at an intranet exit gateway; secondly, performing security context marking on a message to be sent; and finally, extracting a security context of the message at the intranet exit, comparing the extracted security context with the content of the credible program list, and releasing the message if a program name and a MD5 value in the message are consistent with the program name and the MD5 value of one application in the credible program list, or discarding the message, restricting the release and adding an application associated with the message into a blacklist if the program name and the MD5 value are different from the program name and the MD5 value of any application in the credible program list. Therefore, a problem of poor intranet security caused by the fact that the variations of the known Trojan and the new Trojan cannot be effectively detected through a traditional Trojan detection method is effectively solved.

Description

A preventive method against bounce-back Trojans at intranet ports

technical field

The invention belongs to the technical field of information security under the network environment, and in particular relates to a method for preventing a bounce-back Trojan at an intranet port.

Background technique

In the field of network security, malicious codes are growing rapidly, and various malicious codes are flooding the Internet. The most serious ones are viruses and Trojan horses. The purpose of viruses is to destroy computer systems and files, while Trojan horses are more inclined to steal confidential information. . A Trojan has a client and a server. Generally speaking, the server and the client cooperate with each other to complete some activities of destruction and information theft. At present, Trojan horses can completely avoid killing and hide their own traces. Due to firewall restrictions, most Trojan horses are now rebounding Trojan horses.

Rebound port Trojan exploits the weakness of the firewall:

Firewall often can carry out very strict filtering to the link that connects, but neglects to guard against the link that connects; So, contrary to general Trojan horse, the service end (controlled end) of rebounding port type Trojan horse uses active port, the client The terminal (control terminal) uses a passive port, and the Trojan horse regularly monitors the existence of the control terminal, and when it finds that the control terminal is online, it will immediately pop up the port to actively connect to the active port opened by the control terminal.

For the sake of concealment, the passive port of the control terminal is generally opened at 80, so that even if the user uses port scanning software to check his own port, what he finds is a normal network connection, and there will be no suspicion.

At present, the detection methods for Trojans are mainly signature scanning and active defense methods. The method of judging Trojans based on scanning signatures has the disadvantage that once a Trojan mutates or a new Trojan is generated, there is no way for antivirus software to be better. detection.

And the method of active defense also has no way to detect the Trojan horse that uses kernel technology well.

Contents of the invention

The purpose of the present invention is to provide a method for preventing rebounding Trojan horses at intranet ports, which is used to overcome the problem that anti-virus software cannot find known variants of Trojan horses and new Trojan horses well.

In order to solve the above problems, the technical solution of the present invention is:

A method for preventing rebounding Trojans at intranet ports, comprising the following steps:

Step 1. Determine the list of trusted programs:

Set the key-value for all trusted programs, where the key is the program name, and the value is the MD5 (MessageDigestAlgorithm5) value of the executable program;

The intranet egress gateway saves a key-value list, which is the list of trusted programs;

Step 2. Hit the security tab:

Mark the network packets sent by each host application in the intranet with a security context. The content of the security context label includes:

(1) The name of the program that sent this message,

(2) MD5 value of the program,

(3) MAC (Medium/MediaAccessControl) address of the host;

Step 3. The egress gateway of the intranet captures all outgoing messages in the intranet;

Step 4. Detect the security context provided in the message and analyze the content of the message:

Extract the security context in the message, compare it with the trusted program list (key-value list) of the gateway, if the program name and MD5 value are consistent with the trusted program list, then release and create a cache (cache); Within the set time, if the network message sent by the same program of the host corresponding to the MAC address is captured again, it will be released directly;

Otherwise, the data packet will be discarded, the release will be restricted, and the relevant information will be recorded in the log; at the same time, the external network IP address connected by the message will be recorded in the blacklist.

The advantages of the present invention are:

(1) Solve the threat that the anti-virus software cannot detect the latest Trojans and variants of existing Trojans.

(2) No longer only relying on the traditional website whitelist method, because the rebounding Trojans often connect to third-party websites to obtain information, and these third-party websites are mostly safe and credible websites.

The present invention verifies the subject of the message sending through the security context, thereby determining the security of the connection, not only judging based on the information in the white list.

(3) Do not destroy existing network protocols and network applications. The security context is only added in the network message through the kernel module of the system when the application program passes through the local network card, and does not affect the existing network application.

The judgment of the security context is also through the kernel module, which extracts the security context in the message and restores the message and passes it to the gateway. The judgment module will check the verification code of the application program to determine whether it is released or not.

The whole process will not have any impact on users and programs, and is a completely transparent process.

Description of drawings

Figure 1 shows the security context marking process of the intranet host application through the host sending a message.

Fig. 2 shows the process of the intranet gateway extracting the security context and analyzing the data packet after receiving the external data packet.

Detailed ways

According to the above description, the technical solutions in the present invention will be further described in detail in conjunction with the drawings and embodiments.

In this embodiment, it is assumed that an intranet host is A, a network application program on this host is WA, a security label adding module MA, an intranet gateway G, and a security context analysis and control module MG on the gateway.

First, determine the trusted application program, store its program name and program MD5 value in the trusted program list (key-value list) and store it in the intranet egress gateway. You can dynamically add or delete the trusted application list according to your needs. Content;

WA connects to the external network to send messages, adds module MA through the security label, adds security context to the message, including the MAC address of the machine, the name of the application that sends the message, and the MD5 check value of the application, and then passes the The network card sends the message to the egress gateway of the intranet, as shown in Figure 1;

The gateway control module MG captures the message, extracts the security context in the message, and compares the application program name and corresponding check value of the sending message with the application program in the trusted program list, as shown in Figure 2;

If the application name does not exist in the list, the message will be discarded, and the host address and suspicious application program that sent the message will be recorded in the blacklist, and the administrator or operator of the host will be notified to conduct a security check on the host; If the security context is different from the MD5 check value saved in the gateway, the same processing will be carried out;

If the program name and MD5 check value in the security context are the same as the list of trusted programs in the gateway, remove the security context from the message and return it to a normal message and send it to the gateway G, create a cache, and notify the program at the same time The corresponding host will no longer mark the data packets sent by the program within 10 minutes, and will directly release the packets sent by the host program if they are captured within 10 minutes. After 10 minutes, normal marking, capture and processing will be performed. .

The above is only a specific embodiment of the present invention. Any feature disclosed in this specification, unless specifically stated, can be replaced by other equivalent or alternative features with similar purposes; all the disclosed features, or All method or process steps may be combined in any way, except for mutually exclusive features and/or steps.

Claims (1)

1. A method for preventing bounce-back Trojans at intranet ports, comprising the following steps: Step 1. Determine the list of trusted programs: Set the key-value for all trusted programs, where the key is the program name, and the value is the MD5 value of the executable program; The intranet egress gateway saves a key-value list, which is the list of trusted programs; Step 2. Hit the security tab: Mark the network packets sent by each host application in the intranet with a security context. The content of the security context label includes: (1) The name of the program that sent this message, (2) MD5 value of the program, (3) MAC address of the host; Step 3. The egress gateway of the intranet captures all outgoing messages in the intranet; Step 4. Detect the security context provided in the message and analyze the content of the message: Extract the security context in the message and compare it with the trusted program list of the gateway. If the program name and MD5 value are consistent with the trusted program list, it will be released and a cache will be established; The network packets sent by the same program of the host corresponding to the MAC address are directly released; Otherwise, the data packet will be discarded, the release will be restricted, and the relevant information will be recorded in the log; at the same time, the external network IP address connected by the message will be recorded in the blacklist.