Snort를 기반으로 악성 다운로드 탐지 시스템

Abstract

Nowadays, libraries in school, government, company have spent a large quantity of money to purchase electronic resources to meet the demand of people who need original documents at home and abroad; however, some readers use download tools to do bulk download of the full resources, which constitute malicious downloads. Once the malicious downloads are found by database provider, they will block IP or IP segment of the users which will cause the database unavailable to many users. In this paper, I propose a malicious downloads detection system to prevent libraries from malicious downloads. The whole system is mainly divided into four modules: data collection, packet parsing, statistical analysis and response. The experiment shows that the system is able to detect malicious downloads efficiently.