METHOD AND SYSTEM FOR DEFENDING AGAINST MALICIOUS WEBSITE

• US 20180183799A1
• Filed: 12/28/2016
• Published: 06/28/2018
• Est. Priority Date: 12/28/2016
• Status: Abandoned Application

• Current Assignee: Nanning Fugui Precision Industrial Co., Ltd.
• Original Assignee: Hon Hai Precision Industry Co., Ltd., Nanning Fugui Precision Industrial Co., Ltd.
• Inventors: YANG, KAI-YU
• Application Number:
  US15/391,866
• Publication Number:
  US 20180183799A1
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system for defending against malicious website includes an intelligent module and a deploying module. The intelligent module collects and stores information as to malicious website from third-party trusted websites. The malicious website is rated for risk and a malicious website having a high risk is preset as a dangerous website, and a deploying signal is sent after the preset dangerous website is set. The deploying module adds the dangerous website information preset dangerous website to a flow table and deploys the flow table to a plurality of OpenFlow (OF) switch. An OF switch can detect whether a browsing website to be opened by a user is recorded in the flow table, and if so, the OF switch blocks the browsing of such website. A method for defending against malicious website is also disclosed.

Claims

1. A method for defending against malicious website, comprising:

regularly collecting malicious website information from third-party trusted websites and storing the malicious website information;

rating the malicious website based on level of risk and setting the malicious website having a high risk as a preset dangerous website;

sending a deploying signal after the preset dangerous website is set;

according to the deploying signal, joining the information of the preset dangerous website to a flow table and deploying the flow table to a plurality of OpenFlow (OF) switches;

detecting whether a browsing website to be opened is recorded in the flow table; and

when the browsing website is recorded in the flow table, blocking browsing of such website at an Access Layer of a server network.

2. The method as claimed in claim 1, further comprising:

when the browsing website is not recorded in the flow table,

querying the information of the malicious website and determining whether the browsing website is a malicious website.

3. The method as claimed in claim 2, further comprising:

when the browsing website is a malicious website, querying information of the malicious website; and

joining the browsing website in the flow table to update the flow table and deploying the new flow table to the OF switch.

4. The method as claimed in claim 1, further comprising:

regularly transmitting malicious website data by each OF switch, the malicious website data comprises at least one blocked website and number of times blocked for the at least one blocked website; and

regularly querying the malicious website data of each OF switch.

5. The method as claimed in claim 4, further comprising:

providing an interface to set a preset available space of the flow table;

determining whether a remaining space of the flow table is less than the preset available space; and

when the remaining space of the flow table is less than the preset available space, replacing information in the flow table related to a malicious website having the least number of times blocked with information relating to a new malicious website.

6. The method as claimed in claim 5, further comprising:

when the remaining space of the flow table is more than or equivalent to the preset available space, joining information of the new malicious website to the flow table.

7. The method as claimed in claim 1, wherein the third-party trusted website comprises GOOGLE website.

8. A system for defending against malicious website, comprising:

an intelligent module, configured to regularly collect malicious website information from third-party trusted websites and storing the malicious website information, rate the malicious website based on level of risk and setting the malicious website having a high risk as a preset dangerous website, and send a deploying signal after the preset dangerous website is set; and

a deploying module, configured to, according to the deploying signal, join the information of the preset dangerous website to a flow table and deploy the flow table to a plurality of OpenFlow (OF) switch;

wherein the OF switch detects whether a browsing website to be opened is recorded in the flow table, and when the browsing website is recorded in the flow table, the OF switch blocks browsing of such website at an access layer of a server network.

9. The system as claimed in claim 8, wherein the system further comprises a matching module, when the browsing website is not recorded in the flow table, the OF switch transmits a DSN Query package to the matching module, according to the DSN Query package, the matching module queries the information of the malicious website and determines whether the browsing website is a malicious website.

10. The system as claimed in claim 9, wherein when the browsing website is a malicious website, the matching module transmits a malicious website signal to the deploying module, according to the malicious website signal, the deploying module queries information of the malicious website and joins the browsing website in the flow table to update the flow table, and deploys the new flow table to the OF switch.

11. The system as claimed in claim 8, wherein the OF switch regularly transmits malicious website data, the malicious website data comprises at least one blocked website and number of times blocked for the at least one blocked website, the intelligent module regularly queries the malicious website data of each OF switch.

12. The system as claimed in claim 11, wherein intelligent module further provides an interface to set a preset available space of the flow table and determines whether a remaining space of the flow table is less than the preset available space, when the remaining space of the flow table is less than the preset available space, the deploying module replaces information in the flow table related to a malicious website having the least number of times blocked with information relating to a new malicious website.

13. The system as claimed in claim 12, wherein when the remaining space of the flow table is more than or equivalent to the preset available space, the deploying module joins information of a new malicious website to the flow table.

14. The system as claimed in claim 9, wherein the third-party trusted website comprises GOOGLE website.