Generation method and device for malicious software network intrusion detection feature codes

Abstract

The embodiment of the invention provides a generation method and device for malicious software network intrusion detection feature codes. According to the generation method and device, malicious software network feature codes are automatically extracted under various running environments, and the network feature code extracting efficiency, universality and the speed of the response of an NIDS and an NIPS to newly-developing malicious software are improved. The method comprises the steps that malicious software program samples run on at least two running devices with different running environments, and a network packet capture file generated when each running device runs the corresponding malicious software program sample is intercepted; data flow reassembly, communication data classification, common substring extraction and feature code generation are carried out on each network packet capture file in sequence to obtain the malicious software network intrusion detection feature codes.

Description

technical field [0001] The invention relates to the communication field, in particular to a method and device for generating a feature code for network intrusion detection of malicious software. Background technique [0002] At this stage, the network intrusion of malicious software has caused serious danger to Internet security. At present, the malicious The network communication of the software is detected, but in the prior art, the NIDS feature code needs to be extracted by engineers manually or semi-manually by tracking the network behavior of the malware code sample on a single running device, the extraction efficiency is low, and the NIDS signature is reduced. and the response speed of the NIPS system to emerging malware, and the signatures obtained only from the running results of malware code samples in a single operating environment often have the parameters of the single operating environment, so the obtained signatures are not universal. sex. Contents of the in...

AI Technical Summary

Problems solved by technology

[0002] At this stage, the network intrusion of malicious software has caused serious danger to Internet security. At present, the malicious The network communication of the software is detected, but in the prior art, the NIDS feature code needs to be extracted by engineers manually or semi-manually by tracking the network behavior of the malware code sample on a single running device, the extraction efficiency is low, and the NIDS signature is reduced. and the response speed of the NIPS system to emerging malware, and the signatures obtained only from the running results of malware code samples in a single operating environment often have the parameters of the single operating environment, so the obtained signatures are not universal. sex

Images