A vulnerability attack detection method and device

Abstract

The present invention discloses a vulnerability attack detection method and device, which relate to the field of vulnerability detection technology, and the main purpose is to flexibly use the attack traffic of a vulnerability attack provider; the main technical scheme includes: obtaining a vulnerability attack data packet of N attack traffics sent to a first target machine, wherein the N attack traffics are derived from at least one vulnerability attack provider, and N is a positive integer greater than or equal to 2; parsing the vulnerability attack data packet to obtain attack feature data corresponding to each of the attack traffics; combining and processing each of the attack feature data to form an attack traffic message for a second target machine; and performing a vulnerability attack on the second target machine based on the attack traffic message.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability detection, and in particular to a vulnerability attack detection method and device. Background Art

[0002] With the continuous development of attack technology, vulnerabilities have become the main factor affecting software security. The existence of vulnerabilities provides an entry and path for attackers to maliciously invade, allowing attackers to access or destroy software systems without authorization.

[0003] In order to reduce the possibility of malicious attacks on software systems, it is necessary to perform vulnerability attack detection on the software system to detect the vulnerabilities in the software system. The results of vulnerability attack detection on the software system are an important basis for subsequent patching of vulnerabilities in the software system.

[0004] At present, when performing vulnerability attack detection on a software system, a security vulnerability scanning tool provided by a security agency is usually used as a vulnerability attack provider to perform vulnerability attack detection on the software system. Security vulnerability scanning tools are usually collected and produced by security agencies, and the attack traffic included is pre-packaged. When using the security vulnerability scanning tool, even if the software system only needs part of the attack traffic in the security vulnerability scanning tool, the security vulnerability scanning tool must be used as a whole to perform vulnerability attacks on the software system including all attack traffic. In addition, when multiple security vulnerability scanning tools need to be used, it is impossible to uniformly call the attack traffic in each security vulnerability scanning tool to perform vulnerability attack detection on the software system.

[0005] It can be seen that the existing vulnerability attack detection method cannot flexibly use the attack traffic in the vulnerability attack provider, so there is an urgent need for a vulnerability attack detection method and device to flexibly use the attack traffic of the vulnerability attack provider. Summary of the invention

[0006] In view of this, the present invention proposes a vulnerability attack detection method and device, the main purpose of which is to flexibly use the attack traffic of the vulnerability attack provider.

[0007] In order to achieve the above object, the present invention mainly provides the following technical solutions:

[0008] In a first aspect, the present invention provides a vulnerability attack detection method, the method comprising:

[0009] Obtain vulnerability attack data packets of N attack flows sent to the first target machine, wherein the N attack flows are from at least one vulnerability attack provider, and N is a positive integer greater than or equal to 2;

[0010] Parsing the vulnerability attack data packets to obtain attack feature data corresponding to each of the attack flows;

[0011] Combining and processing the attack feature data to form an attack flow message for the second target machine;

[0012] Perform vulnerability attack detection on the second target machine based on the attack traffic message.

[0013] In a second aspect, the present invention provides a vulnerability attack detection device, the device comprising:

[0014] An acquisition unit, configured to acquire vulnerability attack data packets of N attack flows sent to a first target machine, wherein the N attack flows are from at least one vulnerability attack provider, and N is a positive integer greater than or equal to 2;

[0015] A parsing unit, used for parsing the vulnerability attack data packets to obtain attack feature data corresponding to each of the attack flows;

[0016] A combining unit, used for processing each of the attack feature data to form an attack flow message for the second target machine;

[0017] A detection unit is used to perform vulnerability attack detection on the second target machine based on the attack traffic message.

[0018] In a third aspect, the present invention provides a computer-readable storage medium, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the vulnerability attack detection method described in the first aspect.

[0019] In a fourth aspect, the present invention provides an electronic device, comprising: a memory for storing a program; and a processor, coupled to the memory, for running the program to execute the vulnerability attack detection method described in the first aspect.

[0020] By means of the above technical scheme, the vulnerability attack detection method and device provided by the present invention, when there is a need for vulnerability attack detection, obtains vulnerability attack data packets of multiple attack flows sent to the first target machine, and the acquired attack flows come from at least one vulnerability attack provider. Parse the vulnerability attack data packet to obtain attack feature data corresponding to each attack flow. Then, the attack feature data are combined and processed to form an attack flow message for the second target machine, and finally, vulnerability attack detection is performed on the second target machine based on the attack flow message. It can be seen that the scheme provided by the present invention can uniformly extract the attack feature data reflecting the vulnerability exploitation techniques accumulated by the vulnerability attack provider, and obtain the attack flow message for the second target machine by recombining the attack feature data, so as to perform vulnerability attack detection on the second target machine using the attack flow message that meets the vulnerability attack detection requirements of the second target machine. Therefore, the scheme provided by the present invention can realize the flexible use of the attack flow of the vulnerability attack provider on the basis of utilizing the vulnerability exploitation techniques accumulated by the vulnerability attack provider.

[0021] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 A flowchart of a vulnerability attack detection method provided by an embodiment of the present invention is shown;

[0024] Figure 2 A flowchart of a vulnerability attack detection method provided by another embodiment of the present invention is shown;

[0025] Figure 3 A schematic diagram of the structure of a vulnerability attack detection device provided by an embodiment of the present invention is shown;

[0026] Figure 4 A schematic structural diagram of a vulnerability attack detection device provided by another embodiment of the present invention is shown. DETAILED DESCRIPTION

[0027] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0028] Vulnerabilities are defects in the functional design of software systems and errors in writing and implementing them. With the continuous development of attack technologies, vulnerabilities have become a major factor affecting software security. The existence of vulnerabilities provides an entry and path for attackers to maliciously invade, allowing attackers to access or destroy software systems without authorization.

[0029] In order to reduce the possibility of malicious attacks on software systems, it is necessary to perform vulnerability attack detection on software systems to detect the vulnerabilities in the software systems. Vulnerability attack detection is an important operation to correct vulnerabilities in software systems, and the results of vulnerability attack detection on software systems are an important basis for subsequent patching of vulnerabilities in software systems.

[0030] At present, when performing vulnerability attack detection on a software system, a security vulnerability scanning tool provided by a security agency is usually used as a vulnerability attack provider to perform vulnerability attack detection on the software system. The security vulnerability scanning tool is usually collected and produced by a security agency, and the attack traffic included in it is pre-packaged. When using the security vulnerability scanning tool, even if the software system only needs part of the attack traffic in the security vulnerability scanning tool, the security vulnerability scanning tool must be used as a whole to perform vulnerability attack detection on the software system including all attack traffic. Exemplarily, the security vulnerability scanning tool includes 100 attack traffics, and the software system only needs 50 attack traffics with attack classification 1 in the security vulnerability scanning tool, but the security vulnerability scanning tool as a whole uses all 100 attack traffics to perform vulnerability attack detection on the software system. In addition, when multiple security vulnerability scanning tools need to be used, it is impossible to uniformly call the attack traffic in each security vulnerability scanning tool to perform vulnerability attack detection on the software system. For example, it is necessary to use security vulnerability scanning tool 1 and security vulnerability scanning tool 2 to detect vulnerability in the software system. Security vulnerability scanning tool 1 and security vulnerability scanning tool 2 cannot be called at the same time. Security vulnerability scanning tool 2 can only be called after security vulnerability scanning tool 1 is called.

[0031] It can be seen that the existing vulnerability attack detection method cannot flexibly use the attack traffic in the vulnerability attack provider. In order to flexibly use the attack traffic of the vulnerability attack provider, the embodiment of the present invention provides a vulnerability attack detection method and device. The vulnerability attack method and device provided by the embodiment of the present invention are described in detail below.

[0032] like Figure 1 As shown, an embodiment of the present invention provides a vulnerability attack detection method, which mainly includes:

[0033] 101. Obtain vulnerability attack data packets of N attack flows sent to a first target machine, wherein the N attack flows originate from at least one vulnerability attack provider.

[0034] The vulnerability attack provider is the object that initiates attack traffic to the first target machine. The types of vulnerability attack providers include at least the following two types: the first type, the vulnerability attack provider is a security vulnerability scanning tool, which includes a large amount of attack traffic, each of which contains virus code or Trojan code, and can attack and detect vulnerabilities in the software system. The security vulnerability scanning tool is provided by a security agency. The second type, the vulnerability attack provider is an independent attack script, which provides an attack traffic that includes virus code or Trojan code. The attack script is a script written by business personnel according to the vulnerability exploitation framework rules after discovering a new vulnerability attack method, and it exists independently.

[0035] When there is a need to flexibly apply the attack traffic of vulnerability attack providers, the number and type of vulnerability attack providers are determined based on the need. The following is an example of the selection of vulnerability attack providers:

[0036] Exemplarily, when there is a need to flexibly apply the attack traffic of a vulnerability attack provider, a vulnerability attack provider is selected. The selected vulnerability attack provider is a security vulnerability scanning tool provided by a security agency, which includes N attack traffic, where N is a positive integer greater than or equal to 2.

[0037] Exemplarily, when there is a need to flexibly apply the attack traffic of multiple vulnerability attack providers, multiple vulnerability attack providers are selected, and the sum of the attack traffic of the multiple vulnerability attack providers is N, where N is greater than or equal to the total number of vulnerability attack providers. The situations of multiple vulnerability attack providers include the following: First, multiple vulnerability attack providers are all security vulnerability scanning tools, in which case the attack traffic in multiple security vulnerability scanning tools can be flexibly used; second, multiple vulnerability attack providers are all independent attack scripts, in which case the attack traffic provided by multiple independent attack scripts can be flexibly used; third, multiple vulnerability attack providers include both security vulnerability scanning tools and independent attack scripts, in which case the attack traffic of both security vulnerability scanning tools and attack scripts can be combined and used flexibly.

[0038] It should be noted that for a vulnerability attack provider with one attack flow, its attack flow belongs to one attack classification. For a vulnerability attack provider with multiple attack flows, the attack flows included may belong to the same attack classification or to at least two attack classifications. For one attack classification, the attack classification corresponds to a software function, and the attack flow belonging to the attack classification performs vulnerability attack detection on the code of the corresponding software function.

[0039] The target of the vulnerability attack provider is the first target machine, and the selected vulnerability attack providers all launch attacks on the first target machine. The first target machine is a machine with a software system deployed, and the deployed software system is the object of attack. When the first target machine is attacked, the attack traffic of the vulnerability attack provider must be sent to the first target machine. Therefore, the purpose of the first target machine is to obtain the vulnerability attack data packets of N attack traffic sent to the first target machine by the selected vulnerability attack provider. The obtained vulnerability attack data packets are the data basis for the flexible use of the attack traffic of the selected vulnerability attacker.

[0040] The vulnerability attack data packet is obtained through a packet capture tool, and the packet capture tool intercepts the data of the attack traffic sent to the first target machine. Before the vulnerability attack provider attacks the first target machine, the packet capture tool is turned on. Then the vulnerability attack provider is used to attack the first target machine, and the packet capture tool intercepts the data of each attack traffic sent to the first target machine. After all the attacks of the vulnerability attack providers are completed, the packet capture tool is closed. The vulnerability attack data packet generated by the packet capture tool is a process characteristic analysis software package (pcap) data packet, which includes attack traffic data of the attack traffic attacking the first target machine. After the packet capture tool obtains the vulnerability attack data packet, the vulnerability attack data packet is obtained from the packet capture tool. The specific type of the packet capture tool is not specifically limited in this embodiment. Optionally, the packet capture tool is a wireshark packet capture tool.

[0041] It should be noted that in this embodiment, the number of vulnerability attack data packets generated by the packet capture tool is not specifically limited. For example, each attack flow can have its own vulnerability attack data packet. For example, all attack flows correspond to the same vulnerability attack data packet. For example, there are multiple vulnerability attack data packets, and each vulnerability attack data packet corresponds to part of the attack flow. For example, one vulnerability attack provider corresponds to one vulnerability attack data packet.

[0042] The vulnerability attack data packet is the data basis for the flexible use of the attack traffic of the selected vulnerability attacker. The vulnerability attack data packet includes attack traffic data, which is composed of initiator data and responder data. The initiator data is the data of the vulnerability attack provider launching an attack on the first target machine, and the responder data is the data of the first target machine responding to the attack of the vulnerability attack provider. The initiator data includes attack feature data, which is data carrying virus code or Trojan code.

[0043] Exemplarily, the attack traffic data in the vulnerability attack data packet includes: attack traffic name, attack traffic sending time, source IP, source port, destination IP, destination port, HTTP method, URI, HTTP version, response code, response message, HTTP header, HTTP body. The source IP, source port, response code, and response message are all responder data, where the source IP is the IP of the vulnerability attack provider, and the source port is the port of the vulnerability attack provider. The attack traffic name, attack traffic sending time, destination IP, destination port, HTTP method, URI, HTTP version, HTTP header, and HTTP body are all initiator data, where the destination IP is the IP of the first target machine, the destination port is the port of the first target machine, HTTP method is the transmission protocol method, HTTP version is the transmission protocol version, HTTP header is the transmission protocol header, HTTP body is the transmission protocol body, and URI is the resource identifier of the attack traffic. HTTP method, URI, HTTP version, HTTP header, and HTTP body are all attack feature data, which are data with a high probability of carrying virus code or Trojan code.

[0044] 102. Parse the vulnerability attack data packet to obtain attack feature data corresponding to each attack flow.

[0045] The attack traffic data in the vulnerability attack data packet consists of initiator data and responder data. The initiator data includes attack feature data. The attack feature data is data carrying virus code or Trojan code. The attack feature data is the data basis for flexibly using the attack traffic of the selected vulnerability attacker.

[0046] The attack feature data exists in the vulnerability attack data packet and needs to be obtained by parsing the vulnerability attack data packet. The following describes the process of parsing the vulnerability attack data packet to obtain the attack feature data corresponding to each attack flow. The process includes the following steps 1 to 2:

[0047] Step 1: parse the vulnerability attack data packet to obtain the attack flow data corresponding to each attack flow.

[0048] The vulnerability attack data packet includes attack traffic data, so when parsing the vulnerability attack data packet, the vulnerability attack data packet can be directly decomposed into a transmission protocol log, such as an HTTP log. The transmission protocol log is stored in a preset format, wherein the preset format can be but is not limited to a JSON format.

[0049] The decomposed transmission protocol log includes attack traffic data, which is composed of initiator data and responder data. Exemplarily, the transmission protocol log includes attack traffic data of multiple attack flows. For one attack flow, the corresponding attack traffic data includes: attack flow name, attack flow sending time, destination IP, destination port, HTTP method, URI, HTTP version, HTTP header, and HTTP body, which are all initiator data.

[0050] Step 2: extract the data with target attributes in each attack traffic data as corresponding attack feature data.

[0051] For an attack traffic, the data that determines whether it can launch a vulnerability attack on the target machine is the data carrying virus code or Trojan code. Therefore, it is necessary to extract the data carrying virus code or Trojan code as attack feature data, and use these attack feature data to combine them into an attack traffic message that meets the vulnerability attack detection needs of the second target machine.

[0052] The data with target attributes in each attack traffic data is extracted as the corresponding attack feature number. These data with target attributes are data with a high probability of carrying virus code and / or Trojan code, so it is necessary to extract the data with a high probability of carrying virus code or Trojan code as attack feature data. Exemplarily, the data with target attributes include HTTP method, URI, HTTP version, HTTP header, and HTTP body. Therefore, the attack feature data is: HTTP method, URI, HTTP version, HTTP header, and HTTP body.

[0053] 103. Combining and processing the attack feature data to form an attack traffic message targeting the second target machine.

[0054] The second target machine is a machine with a software system deployed, and the software system deployed is the object of attack. The second target machine and the first target machine can be the same or different. The same here means that the first target machine and the second target machine are machines with the same software system deployed. The same software system is the same software system or a software system with the same function. The different here means that the first target machine and the second target machine are machines with different software systems deployed. Different software systems are software systems with different functional parts or completely different functions. It should be noted that regardless of whether the first target machine and the second target machine are the same or different, the attack traffic sent by the vulnerability attack provider to the first target machine contains attack traffic that can be flexibly used by the second target machine.

[0055] The attack traffic message is formed for the second target machine, and the attack traffic it includes needs to meet the vulnerability attack detection requirements of the second target machine. Therefore, when forming the attack traffic message for the second target machine, it is necessary to combine the attack feature data based on the vulnerability attack detection requirements of the second target machine. The specific process of combining and processing the attack feature data to form the attack traffic message for the second target machine is described below. The process includes the following steps 1 to 2:

[0056] Step 1: Select M target attack feature data from N attack feature data.

[0057] The target attack feature data is the attack feature data that meets the vulnerability attack detection requirements of the second target machine, and is selected from all the attack feature data. Methods for selecting M target attack feature data from all the attack feature data include the following:

[0058] The first method is to select attack feature data corresponding to one or more vulnerability attack providers among the vulnerability attack providers that launch attacks on the first target machine as target attack feature data.

[0059] This method is applicable to the scenario where the attack traffic of one or more vulnerability attack providers is used to perform vulnerability attack detection on the second target machine. In other words, the vulnerability attack detection requirement of the second target machine is to use the attack traffic of one or more vulnerability attack providers to perform vulnerability attack detection on it.

[0060] There are several situations for vulnerability attack providers involved in the target attack feature data: First, there are one or more vulnerability attack providers, and each vulnerability attack provider corresponds to one or more attack categories. For an attack category, the attack category corresponds to a software function, and the attack traffic belonging to the attack category performs vulnerability attack detection on the code of the corresponding software function. Second, there are multiple vulnerability attack providers, and one vulnerability attack provider only corresponds to one attack category, and different vulnerability attack providers correspond to different attack categories. For a vulnerability attack provider, it can only use the attack traffic it includes to perform vulnerability attack detection on the code of the software function corresponding to its attack category in the software system. Third, there are multiple vulnerability attack providers, one vulnerability attack provider only corresponds to one attack category, and different vulnerability attack providers correspond to the same attack category, and all vulnerability attack providers use the attack traffic they include to perform vulnerability attack detection on the code of the same software function in the software system. For a vulnerability in the software system, using only the attack traffic in one vulnerability attack provider to detect its attack may result in a false alarm, so it is necessary to use multiple vulnerability attack providers to detect its attack to reduce the possibility of false alarms. Fourth, based on the above situations 2 and 3, there are multiple vulnerability attack providers, one vulnerability attack provider corresponds to only one attack classification, and among the multiple vulnerability attack providers, there are vulnerability attack providers with the same attack classification and there are also vulnerability attack providers with different attack classifications.

[0061] It should be noted that in order to save time in collecting attack methods during vulnerability attack and increase the accumulation of attack methods, the attack feature data corresponding to all vulnerability attack providers that attack the first target machine can be selected as target attack feature data.

[0062] The second method is to determine repeated attack feature data and single attack feature data among the N attack feature data; for the repeated attack feature data, select one attack feature data to retain and remove the unselected attack feature data; and select both the single attack feature data and the retained attack feature data as the target attack feature data.

[0063] This method is suitable for the scenario of avoiding repeated attack detection on the same vulnerability. In other words, the vulnerability attack detection requirement of the second target machine is to avoid repeated attack detection on the same vulnerability.

[0064] Repeated attack feature data will cause repeated attack detection of the same vulnerability in the second target machine, which will increase the time cost of vulnerability attack detection and attack calculation cost. Therefore, in order to avoid repeated attack detection of the same vulnerability, it is necessary to determine the repeated attack feature data in all attack feature data.

[0065] After determining the repeated attack feature data, one of the repeated attack feature data is selected to be retained, and the unselected attack feature data is discarded. The method of selecting the attack feature data here may include the following two methods: the first method is to randomly select one of the attack feature data to be retained; the second method is to display the repeated attack feature data in the form of an interactive window for business personnel to select. Business personnel can select the retained attack feature data based on their business experience. After any attack feature data is selected, it is retained and the remaining unselected attack feature data are discarded.

[0066] After processing the repeated attack feature data, both the single attack feature data and the reserved attack feature data are selected as the target attack feature data. Since there is no duplication between the single attack feature data and the reserved attack feature data, when attack traffic messages are formed based on these attack data and attack detection is performed on the second target machine based on the attack traffic messages, the same vulnerability in the second target machine can be avoided from being repeatedly attacked and detected.

[0067] The third method is to determine the attack classification corresponding to each attack feature data; select the attack feature data corresponding to at least one attack classification as the target attack feature data, wherein at least one attack classification is determined based on the vulnerability attack detection requirements of the second target machine.

[0068] This method is applicable to the scenario of performing vulnerability attack detection on the code of the specified function in the second target machine. In other words, the vulnerability attack detection requirement of the second target machine is to perform vulnerability attack detection on the code of the specified function.

[0069] The second target machine may need to perform vulnerability attack detection on the code of one or more specified functions in some specified scenarios. Therefore, in order to improve the pertinence of vulnerability attack detection, it is necessary to use the attack feature data corresponding to the specified function to form an attack traffic message for the second target machine. The specified scenario described here may be: the software system of the second target machine has a certain development sequence for its function development. During the development of a function, it is necessary to perform vulnerability attack detection on the code of the function or the function whose development sequence is before it.

[0070] The attack classification corresponding to each attack feature data can be determined based on the attack traffic corresponding to the attack feature data. Generally, the vulnerability attack provider will identify the attack classification corresponding to the attack traffic, so the attack classification of each attack feature data can be determined based on the attack classification corresponding to the attack traffic. For an attack classification, the attack classification corresponds to a software function, and the attack traffic belonging to the attack classification performs vulnerability attack detection on the code of the corresponding software function. After determining the attack classification corresponding to each attack feature data, the attack feature data of the attack classification that belongs to the vulnerability attack detection requirement of the second target machine is selected as the target attack feature data.

[0071] A fourth method is to remove attack feature data corresponding to a first attack flow, wherein the first attack flow is attack flow marked as abnormal; and select attack feature data that is not removed as the target attack feature data.

[0072] Vulnerability attacks are provided by security agencies or written by business personnel. Therefore, due to the capacity limitations of security agencies and business personnel, some attack traffic from vulnerability attack providers may have quality issues, which may lead to false alarms or undetected vulnerabilities. Using quality attack traffic to attack target machines will threaten the security of the software system and should be avoided.

[0073] In order to avoid using attack traffic with quality problems, business personnel can summarize attack traffic with quality problems based on the project experience of previous vulnerability attack projects and fill it into the preset document. The preset document records the attack traffic with quality problems as the first attack traffic, that is, these first attack traffic are marked as abnormal attack traffic. When it is necessary to generate an attack traffic message for the second target machine, the preset document can be read to remove the attack feature data corresponding to the first attack traffic, and the attack feature data that has not been removed can be selected as the target attack feature data, thereby avoiding the use of quality attack traffic to attack the second target machine.

[0074] Step 2: Integrate the attack feature data of each target to form the attack traffic message.

[0075] The integrated attack feature data of each target will be used as attack traffic and exist in the attack traffic message. The attack traffic message is equivalent to a new vulnerability attack provider. The attack traffic included in it is based on the vulnerability attack detection requirements of the second target machine, and is formed by flexibly using the attack traffic of one or more vulnerability attack providers. It can launch an attack on the second target machine and meet the vulnerability attack detection requirements of the second target machine.

[0076] The following is an explanation of the process of integrating the attack feature data of each target to form an attack flow message, which includes: processing the attack feature data of each target into a preset format to form the attack flow corresponding to each target attack feature data; integrating the formed attack flow to obtain the attack flow message.

[0077] The preset format is used to define the positional relationship between each data in the target attack feature data. After the positional relationship between each data in the target attack feature data is determined, the attack traffic corresponding to the target attack feature data is formed. The preset format is not specifically limited in the embodiment. For example, the preset format is: HTTP method+URI+HTTP version+HTTP header+HTTP body.

[0078] After determining the attack flow of each target attack feature data, the formed attack flow is added to the preset document to form an attack flow message. In the attack flow message, a number is set for the formed attack flow, and a corresponding relationship between the number and the corresponding attack flow is established.

[0079] 104. Perform vulnerability attack detection on the second target machine based on the attack traffic message.

[0080] The attack traffic message is directed at the second target machine and is obtained by flexibly using the attack traffic combination of one or more vulnerability attack providers, which can meet the vulnerability attack detection needs of the second target machine to the greatest extent.

[0081] The attack traffic message includes one or more attack traffics. When performing a vulnerability attack on the second target machine, it is necessary to perform vulnerability attack detection on the second target machine based on the attack traffic message. Before performing vulnerability attack detection on the second target machine based on the attack traffic message, it is necessary to obtain the address and port of the second target machine, and then based on the address and port of the second target machine, call the attack traffic in the attack traffic message to perform vulnerability attack detection on the second target machine.

[0082] The purpose of obtaining the address and port of the second target machine is to set the attack path of the attack traffic message. After obtaining the address and port of the second target machine, the attack path of the attack traffic message is set, and based on the attack path, the attack traffic in the attack traffic message is called to be sent to the second target machine, so that the attack traffic in the attack traffic message performs vulnerability attack detection on the second target machine.

[0083] The purpose of performing vulnerability attack detection on the second target machine based on the attack traffic message is mainly to discover the vulnerabilities existing in the second target machine. Therefore, the specific process of performing vulnerability attack detection on the second target machine based on the attack traffic message is: determine whether there is a second attack traffic in the attack traffic sent to the second target machine, and the second attack traffic is the attack traffic detected by the threat detection device in the attack traffic message. When it is determined that there is a second attack traffic in the attack traffic sent to the second target machine, a vulnerability prompt is issued based on the second attack traffic. When it is determined that there is no second attack traffic in the attack traffic sent to the second target machine, a prompt is issued that the second target machine has no vulnerability.

[0084] When it is determined that the second attack traffic exists in the attack traffic sent to the second target machine, it means that there is a vulnerability in the second target machine and the second attack traffic has successfully penetrated into the second target machine. In order to patch the vulnerability in the software system of the second target machine in time, it is necessary to issue a vulnerability prompt based on the second attack traffic so that the business personnel know which vulnerabilities need to be patched, and then the business personnel can patch the vulnerabilities as soon as possible in a targeted manner.

[0085] When it is determined that the second attack traffic does not exist in the attack traffic sent to the second target machine, it means that there is no vulnerability in the second target machine corresponding to the attack traffic in the attack traffic message. In order to make the business personnel understand that there is no vulnerability in the second target machine corresponding to the attack traffic in the attack traffic message, a prompt is issued that the second target machine has no vulnerability.

[0086] The vulnerability attack detection method provided by the embodiment of the present invention, when there is a vulnerability attack detection demand, obtains a vulnerability attack data packet of multiple attack flows sent to the first target machine, and the acquired attack flow comes from at least one vulnerability attack provider. Parse the vulnerability attack data packet to obtain the attack feature data corresponding to each attack flow. Then, the attack feature data are combined and processed to form an attack flow message for the second target machine, and finally the second target machine is subjected to vulnerability attack detection based on the attack flow message. It can be seen that the scheme provided by the embodiment of the present invention can uniformly extract the attack feature data reflecting the vulnerability exploitation techniques accumulated by the vulnerability attack provider, and obtain the attack flow message for the second target machine by recombining the attack feature data, so as to use the attack flow message that meets the vulnerability attack detection demand of the second target machine to perform vulnerability attack detection on the second target machine. Therefore, the scheme provided by the embodiment of the present invention can realize the flexible use of the attack flow of the vulnerability attack provider on the basis of utilizing the vulnerability exploitation techniques accumulated by the vulnerability attack provider.

[0087] Further, according to Figure 1 Another embodiment of the present invention further provides a vulnerability attack detection method, such as Figure 2 As shown, the method mainly includes:

[0088] 201. Enable the packet capture tool.

[0089] The vulnerability attack data packet is obtained by a packet capture tool, and the packet capture tool intercepts the attack traffic data sent to the first target machine. The specific type of the packet capture tool is not specifically limited in this embodiment, and optionally, the packet capture tool is a wireshark packet capture tool.

[0090] 202. Enable at least one vulnerability attack to provide a vulnerability attack data packet that is sent from the first target machine to N attack flows.

[0091] When there is a need to flexibly apply the attack traffic of the vulnerability attack provider, the number and type of vulnerability attack providers are determined based on the need. It should be noted that no matter what number and type of vulnerability attack providers are selected, it should be ensured that there is attack traffic in the attack traffic of the vulnerability attack provider that meets the vulnerability attack detection requirements of the second target machine.

[0092] When attack traffic is sent to the first target machine, the packet capture tool intercepts the data of the attack traffic sent to the first target machine.

[0093] 203. When at least one vulnerability attack provider finishes attacking the first target machine, close the packet capture tool to obtain vulnerability attack data packets of N attack flows sent to the first target machine.

[0094] After all vulnerability attack providers have finished their attacks, the packet capture tool is closed. The packet capture tool can generate a vulnerability attack data packet based on the intercepted data, namely a process characteristic analysis software package (pcap) data packet, which includes attack flow data of the attack flow attacking the first target machine.

[0095] 204. Parse the vulnerability attack data packet to obtain attack feature data corresponding to each attack flow.

[0096] 205. Combining and processing the attack feature data to form an attack flow message for the second target machine.

[0097] The attack traffic message can be stored in a preset location, so that when there is a target machine with the same vulnerability attack detection requirements as the second target machine, the attack traffic message can be directly called for use.

[0098] 206. Obtain the address and port of the second target machine, and based on the address and port of the second target machine, call the attack traffic in the attack traffic message to perform vulnerability attack detection on the second target machine.

[0099] 207. Determine whether the attack traffic sent to the second target machine contains the second attack traffic. If so, execute step 208; otherwise, execute step 209.

[0100] The specific method for determining whether the second attack traffic exists in the attack traffic sent to the second target machine is: obtaining a threat detection file, and detecting whether the second attack traffic is recorded in the threat detection file. If the second attack traffic is recorded, it means that the second attack traffic exists in the attack traffic sent to the second target machine. If the second attack traffic is not recorded, it means that the second attack traffic does not exist in the attack traffic sent to the second target machine.

[0101] The threat detection file is obtained by the threat detection device detecting the vulnerability attack of the second target machine. Once the danger detection device detects the second attack traffic, the second attack traffic will be recorded in the threat detection file. The second attack traffic is the attack traffic detected by the threat detection device in the attack traffic message.

[0102] 208. Issue a vulnerability prompt based on the second attack traffic.

[0103] When it is determined that the second attack traffic exists in the attack traffic sent to the second target machine, it means that there is a vulnerability in the second target machine and the second attack traffic has successfully penetrated into the second target machine. In order to patch the vulnerability in the software system of the second target machine in time, it is necessary to issue a vulnerability prompt based on the second attack traffic so that the business personnel know which vulnerabilities need to be patched, and then the business personnel can patch the vulnerabilities as soon as possible in a targeted manner.

[0104] 209. Issue a prompt that the second target machine has no vulnerabilities.

[0105] When it is determined that the second attack traffic does not exist in the attack traffic sent to the second target machine, it means that the attack traffic in the attack traffic message against the second target machine has not successfully attacked the second target machine, and a prompt is issued that the second target machine has no vulnerability, informing the business personnel that the second target machine does not have a vulnerability corresponding to the attack traffic message.

[0106] Further, according to the above method embodiment, another embodiment of the present invention also provides a vulnerability attack detection device, such as Figure 3 As shown, the device comprises:

[0107] An acquisition unit 31 is used to acquire vulnerability attack data packets of N attack flows sent to the first target machine, wherein the N attack flows are from at least one vulnerability attack provider, and N is a positive integer greater than or equal to 2;

[0108] The parsing unit 32 is used to parse the vulnerability attack data packet to obtain attack feature data corresponding to each attack flow;

[0109] A combining unit 33 is used to process each of the attack feature data to form an attack flow message for the second target machine;

[0110] The detection unit 34 is used to perform vulnerability attack detection on the second target machine based on the attack traffic message.

[0111] The vulnerability attack detection device provided by the embodiment of the present invention, when there is a vulnerability attack detection demand, obtains a vulnerability attack data packet of multiple attack flows sent to the first target machine, and the acquired attack flows come from at least one vulnerability attack provider. Parse the vulnerability attack data packet to obtain the attack feature data corresponding to each attack flow. Then, the attack feature data are combined and processed to form an attack flow message for the second target machine, and finally the second target machine is subjected to vulnerability attack detection based on the attack flow message. It can be seen that the scheme provided by the embodiment of the present invention can uniformly extract the attack feature data reflecting the vulnerability exploitation techniques accumulated by the vulnerability attack provider, and obtain the attack flow message for the second target machine by recombining the attack feature data, so as to use the attack flow message that meets the vulnerability attack detection demand of the second target machine to perform vulnerability attack detection on the second target machine. Therefore, the scheme provided by the embodiment of the present invention can realize the flexible use of the attack flow of the vulnerability attack provider on the basis of utilizing the vulnerability exploitation techniques accumulated by the vulnerability attack provider.

[0112] Optional, such as Figure 4 As shown, the combination unit 33 includes:

[0113] A selection module 331 is used to select M target attack feature data from the N attack feature data, wherein the target attack feature data meets the vulnerability attack detection requirements of the second target machine, and M is a positive integer less than or equal to N;

[0114] The integration module 332 is used to integrate the target attack feature data to form the attack traffic message.

[0115] Optional, such as Figure 4 As shown, the selection module 331 includes:

[0116] The first selection submodule 3311 is used to determine the repeated attack feature data and the independent attack feature data among the N attack feature data; for the repeated attack feature data, one attack feature data is selected to be retained, and the unselected attack feature data is discarded; and both the independent attack feature data and the retained attack feature data are selected as the target attack feature data.

[0117] Optional, such as Figure 4 As shown, the selection module 331 includes:

[0118] The second selection submodule 3312 is used to determine the attack category corresponding to each of the attack feature data; select the attack feature data corresponding to at least one attack category as the target attack feature data, wherein the at least one attack category is based on the vulnerability attack detection requirements of the second target machine.

[0119] Optional, such as Figure 4 As shown, the selection module 331 includes:

[0120] The third selection submodule 3313 is used to remove the attack feature data corresponding to the first attack traffic, wherein the first attack traffic is the attack traffic marked as abnormal; and select the attack feature data that is not removed as the target attack feature data.

[0121] Optional, such as Figure 4 As shown, the integration module 332 includes:

[0122] The processing submodule 3321 is used to process each of the target attack feature data into a preset format to form attack flows corresponding to each of the target attack feature data;

[0123] The integration submodule 3322 is used to integrate the formed attack traffic to obtain the attack traffic message.

[0124] Optional, such as Figure 4 As shown, the detection unit 34 is specifically used to issue a vulnerability prompt based on the second attack traffic when it is determined that there is a second attack traffic in the attack traffic sent to the second target machine, wherein the second attack traffic is the attack traffic detected by the threat detection device in the attack traffic message.

[0125] Optional, such as Figure 4 As shown, the device also includes:

[0126] The calling unit 35 is used to obtain the address and port of the second target machine; based on the address and port of the second target machine, the attack traffic in the attack traffic message is called to carry out a vulnerability attack on the second target machine.

[0127] Optional, such as Figure 4 As shown, the parsing unit 32 includes:

[0128] The parsing module 321 is used to parse the vulnerability attack data packet to obtain attack flow data corresponding to each attack flow;

[0129] The extraction module 322 is used to extract the data with target attributes in each of the attack traffic data as corresponding attack feature data, wherein the data with target attributes is data carrying virus code and / or Trojan code.

[0130] In the vulnerability attack detection device provided by the embodiment of the present invention, the detailed description of the method used in the operation process of each functional module can be found in Figure 1-Figure 2 The corresponding method of the method embodiment is explained in detail and will not be repeated here.

[0131] Further, according to the above embodiment, another embodiment of the present invention further provides a computer-readable storage medium, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute Figure 1-Figure 2 The vulnerability attack detection method described in the method embodiment.

[0132] Further, according to the above embodiment, another embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0133] Memory, used to store programs;

[0134] A processor, coupled to the memory, configured to run the program to perform Figure 1-Figure 2 The vulnerability attack detection method described in the method embodiment.

[0135] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0136] It is understandable that the related features in the above methods and devices can be referenced to each other. In addition, the "first", "second" and the like in the above embodiments are used to distinguish the embodiments, but do not represent the advantages and disadvantages of the embodiments.

[0137] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0138] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the best mode of the present invention.

[0139] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0140] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0141] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components in the operating method, device, and framework of the deep neural network model according to an embodiment of the present invention. The present invention may also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0142] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

Claims

1. A vulnerability attack detection method, characterized in that: The method comprises: When there is a need to flexibly apply the attack traffic of vulnerability attack providers, determine the number and type of vulnerability attack providers based on the need; Obtain vulnerability attack data packets of N attack flows sent to the first target machine, wherein the N attack flows are from a vulnerability attack provider determined based on the quantity and the type, and N is a positive integer greater than or equal to 2; Parsing the vulnerability attack data packets to obtain attack feature data corresponding to each of the attack flows; Combining and processing the attack feature data to form an attack flow message for the second target machine; Perform vulnerability attack detection on the second target machine based on the attack traffic message.

2. The method according to claim 1, characterized in that: Combining and processing the attack feature data to form an attack flow message for the second target machine includes: Selecting M target attack feature data from the N attack feature data, wherein the target attack feature data meets the vulnerability attack detection requirements of the second target machine, and M is a positive integer less than or equal to N; The attack feature data of each target are integrated to form the attack traffic message.

3. The method according to claim 2, characterized in that Selecting M target attack feature data from the N attack feature data includes: Determine repeated attack feature data and single attack feature data among the N attack feature data; For repeated attack feature data, one attack feature data is selected and retained, and the unselected attack feature data is discarded; Both the independently existing attack feature data and the retained attack feature data are selected as the target attack feature data.

4. The method according to claim 2, characterized in that: Selecting M target attack feature data from the N attack feature data includes: Determine the attack classification corresponding to each of the attack feature data; Attack feature data corresponding to at least one attack classification is selected as the target attack feature data, wherein the at least one attack classification is based on a vulnerability attack detection requirement of the second target machine.

5. The method according to claim 2, characterized in that: Selecting M target attack feature data from the N attack feature data includes: Eliminating attack feature data corresponding to the first attack traffic, wherein the first attack traffic is attack traffic marked as abnormal; The attack feature data that are not eliminated are selected as the target attack feature data.

6. The method according to claim 2, characterized in that Integrating the target attack feature data to form the attack traffic message includes: Processing each of the target attack feature data into a preset format to form attack flows corresponding to each of the target attack feature data; The formed attack traffic is integrated to obtain the attack traffic message.

7. The method according to any one of claims 1 to 6, characterized in that: Performing vulnerability attack detection on the second target machine based on the attack traffic message includes: When it is determined that the attack traffic sent to the second target machine contains second attack traffic, a vulnerability prompt is issued based on the second attack traffic, wherein the second attack traffic is the attack traffic detected by the threat detection device in the attack traffic message.

8. The method according to any one of claims 1 to 6, characterized in that: Before performing vulnerability attack detection on the second target machine based on the attack traffic message, the method further includes: Obtaining the address and port of the second target machine; Based on the address and port of the second target machine, the attack traffic in the attack traffic message is called to perform vulnerability attack detection on the second target machine.

9. The method according to any one of claims 1 to 6, characterized in that: Parsing the vulnerability attack data packets to obtain attack feature data corresponding to each attack flow includes: Parsing the vulnerability attack data packets to obtain attack flow data corresponding to each of the attack flows; The data with target attributes in each of the attack traffic data are extracted as corresponding attack feature data, wherein the data with target attributes are data carrying virus codes and / or Trojan codes.

10. A vulnerability attack detection device, characterized in that: The device comprises: An acquisition unit is used to determine the number and type of vulnerability attack providers based on the demand when there is a demand for flexibly applying the attack traffic of the vulnerability attack provider; obtain vulnerability attack data packets of N attack traffics sent to the first target machine, wherein the N attack traffics are from the vulnerability attack providers determined based on the number and the type, and N is a positive integer greater than or equal to 2; A parsing unit, used for parsing the vulnerability attack data packets to obtain attack feature data corresponding to each of the attack flows; A combining unit, used for combining and processing each of the attack feature data to form an attack flow message for the second target machine; A detection unit is used to perform vulnerability attack detection on the second target machine based on the attack traffic message.

11. A computer-readable storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the vulnerability attack detection method described in any one of claims 1 to claim 9.

12. An electronic device, characterized in that: The electronic device comprises: Memory, used to store programs; A processor, coupled to the memory, is used to run the program to execute the vulnerability attack detection method described in any one of claims 1 to claim 9.

Images