US 2022/0070192 A1Published application

Network malicious behavior detection method and networking system using same

AssigneeQnap Systems, Inc.

InventorsCharng-Da LU, Shih-Chan HUANG, Shih-Ming HU

Life of this patent

Estimating the term…

Loading patent…

Abstract

A network malicious behavior detection method, including: checking each piece of network packet to determine whether a protocol payload contained therein matches an element in a predetermined protocol payload set, marking each piece of the network packet as a suspicious network packet if the check result is true, and transferring each piece of the network packet to a target device if the check result is false; and performing a malicious behavior checking process on at least one piece of the suspicious network packet, blocking the transfer of at least one piece of the suspicious network packet to the target device if the check result is true, and enabling the transfer of at least one piece of the suspicious network packet to the target device if the check result is false.

Claims21

Dependent claims

A network malicious behavior detection method, which is implemented by a networking system having a path control module, a packet characteristic extraction module, a mirroring module, a packet characteristic checking module and a package behavior analysis module, the method including:

using the packet characteristic extraction module to get data in at least one layer of each piece of network packet to generate a characteristic data segment for each piece of the network packet, the layer being selected from a group consisting of the network layer, the transmission layer and the data link layer;
using the packet characteristic checking module to check each piece of the characteristic data segment to determine whether a protocol payload contained therein matches an element in a predetermined protocol payload set, if the check result is true, drive the mirroring module to generate a mirror packet according to a piece of the network packet corresponding to the check result, and if the check result is false, drive the path control module to enable a piece of the network packet corresponding to the check result to be transferred to a target device;
and
using the packet behavior analysis module to perform a malicious behavior detecting process on at least one piece of the mirror packet, if the check result is true, drive the path control module to block a transfer of at least one piece of the network packet corresponding to the check result to the target device, and if the check result is false, drive the path control module to enable at least one piece of the network packet corresponding to the check result to be transferred to the target device.

1 more element

A networking system, which is operable on a network and has a path control module, a packet characteristic extraction module, a mirror processing module, a packet characteristic checking module, and a packet behavior analysis module to implement a network malicious behavior detection method, the method including:

using the packet characteristic extraction module to get data in at least one layer of each piece of network packet to generate a characteristic data segment for each piece of the network packet, the layer being selected from a group consisting of the network layer, the transmission layer and the data link layer;
using the packet characteristic checking module to check each piece of the characteristic data segment to determine whether a protocol payload contained therein matches an element in a predetermined protocol payload set, if the check result is true, drive the mirroring module to generate a mirror packet according to a piece of the network packet corresponding to the check result, and if the check result is false, drive the path control module to enable a piece of the network packet corresponding to the check result to be transferred to a target device;
and
using the packet behavior analysis module to perform a malicious behavior detecting process on at least one piece of the mirror packet, if the check result is true, drive the path control module to block a transfer of at least one piece of the network packet corresponding to the check result to the target device, and if the check result is false, drive the path control module to enable at least one piece of the network packet corresponding to the check result to be transferred to the target device.

1 more element

A network malicious behavior detection method, which is implemented by a networking system having a path control module, a packet characteristic checking module, and a packet behavior analysis module, the method including:

using the packet characteristic checking module to check each piece of the network packet to determine whether a protocol payload contained therein matches an element in a predetermined protocol payload set, mark each piece of the network packet corresponding to the check result as a suspicious network packet if the check result is true, and drive a path control module to transfer each piece of the network packet corresponding to the check result to a target device if the check result is false;
and
using the packet behavior analysis module to perform a malicious behavior checking process on at least one piece of the suspicious network packet, drive the path control module to block a transfer of at least one piece of the suspicious network packet corresponding to the check result to the target device if the check result is true, and drive the path control module to enable a transfer of at least one piece of the suspicious network packet corresponding to the check result to the target device if the check result is false.

A networking system, which is operable on a network and has a path control module, a packet characteristic checking module, and a packet behavior analysis module to perform a network malicious behavior detection method, the method including:

using the packet characteristic checking module to check each piece of the network packet to determine whether a protocol payload contained therein matches an element in a predetermined protocol payload set, mark each piece of the network packet corresponding to the check result as a suspicious network packet if the check result is true, and drive a path control module to transfer each piece of the network packet corresponding to the check result to a target device if the check result is false;
and
using the packet behavior analysis module to perform a malicious behavior checking process on at least one piece of the suspicious network packet, drive the path control module to block a transfer of at least one piece of the suspicious network packet corresponding to the check result to the target device if the check result is true, and drive the path control module to enable a transfer of at least one piece of the suspicious network packet corresponding to the check result to the target device if the check result is false.

Dependencies are inferred from the claim text.