A malicious payload labeling method for intrusion detection system with separated recording and picking processes

Abstract

The present invention provides a method for labeling malicious payloads in an intrusion detection system with separated recording and picking processes, characterized in that it includes the following steps: a network message is connected to the intrusion detection system, and decoding and reassembly are completed; a message reassembly module triggers detection after receiving a unidirectional message; an attack detection module obtains the complete payload content containing the malicious payload after reassembly, and selects a pre-matching rule sequence from a rule set; the offset, length, and type of the feature in the reassembled payload are recorded; and the offset and length of the malicious payload are output. The present invention proposes for the first time a method for labeling malicious payloads in an intrusion detection system; the present invention separates the recording and picking processes of the malicious payload, effectively reducing the number of times the payload is copied during the attack detection process and reducing the load on the intrusion detection system.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a malicious payload labeling method for an intrusion detection system with separated recording and picking processes. Background Art

[0002] Malicious payloads are the components of a network attack that inflict harm on victims. Analyzing malicious payloads has become an integral part of intrusion behavior analysis. Signature-based network intrusion detection systems record a large number of predefined malicious payloads. Attack payloads consist of fixed strings or regular expressions that describe strings that meet specific constraints.

[0003] Intrusion detection systems detect attacks by comparing incoming traffic against a set of rules. When an attack is detected, an alert log is generated. This alert contains information such as the time the intrusion occurred, a five-tuple, the alert action, and the alert ID. While network security administrators can obtain alerts about attacks, they are unable to locate and extract the malicious payload contained in the original traffic. To address this issue, we propose a malicious payload annotation scheme for intrusion detection systems. This approach separates logging and extraction to achieve malicious payload annotation. Summary of the Invention

[0004] The purpose of this invention is to provide a malicious payload labeling method for an intrusion detection system that separates the recording and retrieval processes. This method can output the position offset, length, and specific content of the malicious payload in the reassembled payload in the alert. This design, which separates the recording and retrieval processes, effectively reduces the number of payload copies required during attack detection, thereby reducing the load on the intrusion detection system.

[0005] To achieve the above object, the present invention adopts the following technical solutions:

[0006] A malicious payload labeling method for an intrusion detection system with separated recording and picking processes, characterized by comprising the following steps:

[0007] S1: Network messages are connected to the intrusion detection system and decoded and reassembled;

[0008] S2: After receiving the unidirectional message, the message reassembly module triggers the detection work;

[0009] S3: The attack detection module obtains the complete payload content containing the malicious payload after reassembly and selects a pre-matching rule sequence from the rule set: signature0 to signaturei, where signaturek contains the two malicious payload features "ABC" and "DEF";

[0010] S4: When the detection recorder successfully matches the "ABC" and "DEF" payload features of signaturek with the reassembled payload, it records the offset, length, and type of the features in the reassembled payload;

[0011] S5: After the detection is completed, the payload picker obtains the reassembled payload and the detection recorder data structure according to the detection result, obtains the malicious payload content "ABC" and "DEF" from the reassembled payload, and outputs the offset and length of the malicious payload.

[0012] In step S4, the specific process of detecting the recorder is as follows:

[0013] S4.1: The attack detection module traverses signatureatur0~signaturei and extracts signaturex, where x∈[0,i];

[0014] S4.2: The attack detection module compares the attack signature in signaturex with the reassembled payload; if it fails, it returns to the previous step;

[0015] S4.3: If the comparison is successful, the detection recorder records the offset position and length of the first malicious payload feature in the reassembled payload; then loops to compare the next malicious payload feature in the rule; if the comparison fails, the process returns to step 1.

[0016] S4.4: After the rule comparison is completed, the recorder contains the offset, length, and type data of all malicious payload features; enter the picker module;

[0017] S4.5: The picker module obtains the reassembled payload, obtains the detection recorder data structure, traverses the location of the malicious payload in the detection recorder, and picks up the malicious payload content, offset and length information into the log file.

[0018] The system for implementing the malicious payload labeling includes: a detection recorder module and a payload picker module. The detection recorder module is used to record the offset and length of the malicious payload that can match the pattern in the rule during the detection process of the attack detection module; when the detection is completed, if the message matches the rule, the result of the detection recorder is sent to the payload picker module; if the message does not match the rule, the malicious payload information stored in the detection recorder is released; the payload picker picks up the malicious payload according to the data recorded by the detection.

[0019] The detection recorder technology realizes:

[0020] The intrusion detection module is extended and the detection recorder module is embedded. The detection recorder module uses a linked list data structure to complete the recording of detection results.

[0021] The load picker technology achieves:

[0022] The independent picker module is implemented and connected to the detection recorder module. The payload picker module picks up malicious payloads after the detection recorder completes recording.

[0023] Compared with the prior art, the present invention has the following beneficial effects:

[0024] This invention proposes for the first time a method for marking malicious payloads in an intrusion detection system. This invention separates the recording and picking processes of malicious payloads, effectively reducing the number of payload copies during attack detection and reducing the load on the intrusion detection system. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a flow chart of intrusion system detection in the prior art;

[0026] Figure 2 A diagram showing the relationship between system modules and the malicious payloads of the present invention;

[0027] Figure 3 This is a schematic diagram of the steps for labeling malicious payloads in the present invention;

[0028] Figure 4 A typical deployment diagram of the intrusion detection system of the present invention;

[0029] Figure 5 Detection logger flow chart for intrusion detection system;

[0030] Figure 6 Flowchart of the payload picker for the intrusion detection system. DETAILED DESCRIPTION

[0031] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0032] Example

[0033] A malicious payload labeling method for an intrusion detection system with separated recording and picking processes, characterized by comprising the following steps:

[0034] S1: Network messages are connected to the intrusion detection system and decoded and reassembled;

[0035] S2: After receiving the unidirectional message, the message reassembly module triggers the detection work;

[0036] S3: The attack detection module obtains the complete payload content containing the malicious payload after reassembly and selects a pre-matching rule sequence from the rule set: signature0 to signaturei, where signaturek contains the two malicious payload features "ABC" and "DEF";

[0037] S4: When the detection recorder successfully matches the "ABC" and "DEF" payload features of signaturek with the reassembled payload, it records the offset, length, and type of the features in the reassembled payload;

[0038] S5: After the detection is completed, the payload picker obtains the reassembled payload and the detection recorder data structure according to the detection result, obtains the malicious payload content "ABC" and "DEF" from the reassembled payload, and outputs the offset and length of the malicious payload.

[0039] like Figure 5 As shown, in step S4, the specific process of detecting the recorder is as follows:

[0040] S4.1: The attack detection module traverses signatureatur0~signaturei and extracts signaturex, where x∈[0,i];

[0041] S4.2: The attack detection module compares the attack signature in signaturex with the reassembled payload; if it fails, it returns to the previous step;

[0042] S4.3: If the comparison is successful, the detection recorder records the offset position and length of the first malicious payload feature in the reassembled payload; then loops to compare the next malicious payload feature in the rule; if the comparison fails, the process returns to step 1.

[0043] S4.4: After the rule comparison is completed, the recorder contains the offset, length, and type data of all malicious payload features; enter the picker module;

[0044] S4.5: The picker module obtains the reassembled payload, obtains the detection recorder data structure, traverses the location of the malicious payload in the detection recorder, and picks up the malicious payload content, offset and length information into the log file.

[0045] The system for implementing the malicious payload labeling includes: a detection recorder module and a payload picker module. The detection recorder module is used to record the offset and length of the malicious payload that can match the pattern in the rule during the detection process of the attack detection module; when the detection is completed, if the message matches the rule, the result of the detection recorder is sent to the payload picker module; if the message does not match the rule, the malicious payload information stored in the detection recorder is released; the payload picker picks up the malicious payload according to the data recorded by the detection.

[0046] The detection recorder technology realizes:

[0047] The intrusion detection module is extended and the detection recorder module is embedded. The detection recorder module uses a linked list data structure to complete the recording of detection results.

[0048] like Figure 6 As shown, the load picker technology achieves:

[0049] The independent picker module is implemented and connected to the detection recorder module. The payload picker module picks up malicious payloads after the detection recorder completes recording.

[0050] Deployment method: Typical deployment diagram of intrusion detection system ( Figure 1 ) includes LAN computers, servers, switches, firewalls, routers, and an intrusion detection system server. The intrusion detection system acts as a bypass device, collecting switch mirrored traffic as input and analyzing network requests and interaction traffic from all computers and servers in the network environment.

[0051] like Figure 4 As shown in Figure 1, when the intrusion detection system is first deployed, the specific implementation method is as follows:

[0052] a. Configure the switch mirror port;

[0053] b. Connect the switch mirror port to the intrusion detection system traffic collection network port;

[0054] c. Configure the IP address of the intrusion detection system management port;

[0055] d. Log in to the intrusion detection system web client and check the intrusion detection system alarm log.

[0056] The above shows and describes the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions are merely preferred examples of the invention and are not intended to limit the present invention. Various changes and improvements may be made to the present invention without departing from the novel spirit and scope of the present invention. Such changes and improvements fall within the scope of the invention claimed. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A malicious payload labeling method for an intrusion detection system with separated recording and picking processes, characterized in that: The steps include: S1: Network messages are connected to the intrusion detection system and decoded and reassembled; S2: After receiving the unidirectional message, the message reassembly module triggers the detection work; S3: The attack detection module obtains the complete payload content including the malicious payload after reassembly and selects the pre-matching rule sequence from the rule set: signature0~signature i , where signature k Contains two malicious payload features: "ABC" and "DEF"; S4: Detection recorder in signature k When the "ABC" and "DEF" payload features are successfully matched with the reassembled payload, the offset, length, and type of the features in the reassembled payload are recorded; S5: After the detection is completed, the payload picker obtains the reassembled payload and the detection recorder data structure based on the detection results, obtains the malicious payload content "ABC" and "DEF" from the reassembled payload, and outputs the offset and length of the malicious payload; In step S4, the specific process of detecting the recorder is as follows: S4.1: Attack detection module traverses signature0~signature i , take out the signature x , where x∈[0,i]; S4.2: The attack detection module will signature x Compare the attack signature in the .hash with the reassembled payload; if it fails, return to the previous step; S4.3: The comparison is successful. The detection recorder records the offset position and length of the first malicious payload feature in the reassembled payload and then loops to compare the next malicious payload feature in the rule. If the comparison fails, return to the first step; S4.4: After the rule comparison is completed, the recorder contains the offset, length, and type data of all malicious payload features; enter the picker module; S4.5: The picker module obtains the reassembled payload and the detection recorder data structure, traverses the location of the malicious payload in the detection recorder, and picks up the malicious payload content, offset, and length information into the log file; The system for implementing the malicious payload labeling includes: a detection recorder module and a payload picker module. The detection recorder module is used to record the offset and length of the malicious payload that can match the pattern in the rule during the detection process of the attack detection module; when the detection is completed, if the message matches the rule, the result of the detection recorder is sent to the payload picker module; if the message does not match the rule, the malicious payload information stored in the detection recorder is released; the payload picker picks up the malicious payload according to the data recorded by the detection.

Images