Automated network attack characteristic generation method

Abstract

The invention discloses an automated network attack characteristic generation method, comprising the following steps: 1) a virtual operating system is installed in a virtual host, an operation environment coincident with the real application of a brittle program is configured, and a taint data operation rule is configured; 2) the brittle program is started, all network input thereof is marked as the taint data to be monitored, the state of the taint data is recorded, and relative operation command of the taint data is recorded to form a taint transmission flow graph; 3) when the abnormal operation of the taint data is detected, a command sequence operated and handled by the brittle the taint data starting from the input data pack is obtained from the taint transmission flow graph; 4) the command sequence is processed to be a compiling performing command, and a judging output sentence is added to generate Turing-type attack characteristics. The method of the invention is favourable for finding unknown bug attack behaviour and extracting the attack flow and has no need of obtaining brittle program source code, the generated attack characteristics are more accurate, and the attack characteristic generation process is automatic and quick.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a method for generating network attack features. Background technique [0002] With the rapid development of network applications, attackers' attack targets and attack methods have greatly increased, and the attack speed is faster and more destructive. The manual feature generation that relies on the analysis experience of professionals is time-consuming and laborious, and the quality of the generated features is also low. It is difficult to guarantee and cannot meet the application requirements. Automatic attack signature generation has become a research hotspot in the field of attack signature generation. The essence of the attack signature is the representation method for identifying and filtering the same type of attack input. Inspecting and filtering input using attack signatures in various network and host intrusion prevention systems is a common meth...

AI Technical Summary

Problems solved by technology

However, most of the existing white-box feature generation methods face the limitations of relying on program source code and requiring manual analysis by experienced analysts, resulting in limited application scenarios and a large amount of manual analysis time.

Images