Method for analyzing non-public database protocol request data packet

Abstract

The invention discloses an analysis method of a non-public database protocol request data packet. The method comprises the following steps: step 1) extracting a plurality of request rules, including an initial position of a request data packet message header, an occurrence position of a request command length field and a request command initial position, and forming a protocol message rule table by using each request rule and data of a field determined to be unchanged in each request rule; 2) according to the protocol message rule table obtained in the step 1), marking a field determined to beunchanged in each request rule as a coloring node, and generating a rule tree; 3) searching the rule tree generated in the step 2), inputting the message of the request data packet to be analyzed andthe rule tree corresponding to the message, and matching each data packet to be analyzed with the rule tree to obtain a request rule corresponding to the rule leaf node; and 4) analyzing the to-be-analyzed data packet according to the initial position of the message header in the request rule, the appearing position of the request command length field and the starting position of the request command, and obtaining the request command.

Description

technical field [0001] The invention relates to the field of network security communication, in particular to a non-public database protocol request data packet analysis method. Background technique [0002] Computer network security audit (Audit) refers to the use of records, system activities and user activities and other information to check, review and verify the environment and activities of operational events in accordance with certain security policies, so as to discover system vulnerabilities, intrusion behaviors or improve system performance. process. [0003] However, when auditing some database traffic, the communication protocol standards of some databases are not disclosed, which leads to difficulties in security auditing and real-time monitoring of such databases, and there are security risks when using them. At present, the more commonly used method is the method of directional matching of specific strings. Parsing, unstable performance, slow parsing. SUMM...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to overcome the existing character strings in the current method for directional matching of specific character strings that cannot fully cover all the content in this type of non-public database, and cannot match and parse some wrong commands or meaningless character strings. Unstable performance and slow parsing speed. Provides a non-public database protocol request packet parsing method, solves the problem of difficult audit and monitoring caused by non-public database communication protocols, and improves the safety factor.

Images