A method and apparatus for obtaining vulnerability attack streams

Abstract

This invention provides a method and apparatus for obtaining vulnerability attack streams. The method includes: determining a vulnerability attack name; using a network protocol analysis program to match and search the vulnerability attack name to obtain a session stream corresponding to the vulnerability attack name; using the network protocol analysis program to process the session stream to obtain a corresponding attack stream data packet; and storing the attack stream data packet. This method allows for the acquisition of vulnerability attack streams without requiring input of 5-tuple information, making it simple and convenient to operate without manual intervention, thus simplifying the operation process.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and in particular to a method and apparatus for obtaining vulnerability attack streams. Background Technology

[0002] With the rapid development of Internet technology, network security has become an increasingly important issue of concern. After a vulnerability security incident occurs, vulnerability attack flow is crucial for vulnerability analysis and verification. BPS (BreakingPoint Systems) is a security tester with simulated attack traffic for nearly 10,000 vulnerabilities. However, the extraction process of these nearly 10,000 attack flows often takes a lot of time. Traditional BPS attack flow extraction can only be done manually, one attack flow at a time, which is very inconvenient.

[0003] To address the aforementioned issues, the existing approach involves creating a blank CSV file and writing the quintuple information corresponding to the pcap data packet to be segmented into the blank CSV file to obtain a target CSV file; acquiring a target pcap file containing the pcap data packet to be segmented; matching the quintuple information in the target CSV file with the target pcap file; and if a match is found, segmenting the matched pcap data packet from the target pcap file.

[0004] Existing technologies require users to input specific 5-tuples to match and segment data packets. However, in many testing instruments, the 5-tuples for each vulnerability attack are randomly assigned. Since the 5-tuples for each vulnerability attack flow are not fixed, it is impossible to achieve the purpose of segmenting each vulnerability attack flow in the testing instrument by having the user input the 5-tuples. Summary of the Invention

[0005] This invention provides a method and apparatus for obtaining vulnerability attack streams without requiring input of quintuple information.

[0006] To address the aforementioned technical problems, embodiments of the present invention provide a method for obtaining a vulnerability attack stream, comprising:

[0007] Identify the vulnerability / attack name;

[0008] The network protocol analysis program is used to match and search the vulnerability attack names to obtain the session streams corresponding to the vulnerability attack names;

[0009] The network protocol analysis program is used to process the session stream to obtain the corresponding attack stream data packets;

[0010] Store the attack stream data packets.

[0011] As an optional embodiment, the step of using a network protocol analysis program to match and search for the vulnerability attack name to obtain the session stream corresponding to the vulnerability attack name includes:

[0012] Enter the vulnerability attack name in the txt file;

[0013] The network protocol analysis program uses the vulnerability attack name in the txt file to run a computer programming script to match and search for the vulnerability attack name, and obtain the session stream corresponding to the vulnerability attack name.

[0014] As an optional embodiment, the step of using the network protocol analysis program to run a computer programming script based on the vulnerability attack name in the txt file to achieve matching and searching of the vulnerability attack name and obtain the session stream corresponding to the vulnerability attack name includes:

[0015] Obtain test reports from the testing equipment used to detect vulnerabilities;

[0016] The network protocol analysis program uses the vulnerability attack name in the txt file to run a computer programming script to obtain a session stream matching the vulnerability attack name from the test report.

[0017] As an optional embodiment, the step of processing the session stream using the network protocol analysis program to obtain the corresponding attack stream data packets includes:

[0018] Obtain the total data packet from the tester used to detect vulnerabilities;

[0019] The network protocol analysis program uses the session flow to match and segment the total data packets to obtain the corresponding attack flow data packets.

[0020] As an optional embodiment, storing the attack stream data packets includes:

[0021] The attack stream data packets are stored in a target format, which includes the pacp file format.

[0022] Another embodiment of the present invention also provides an apparatus for obtaining vulnerability attack streams, comprising:

[0023] The determination module is used to identify the name of the vulnerability attack.

[0024] The lookup module is used to match and search the vulnerability attack name using a network protocol analysis program to obtain the session stream corresponding to the vulnerability attack name;

[0025] The processing module is used to process the session stream using the network protocol analysis program to obtain the corresponding attack stream data packets;

[0026] A storage module is used to store the attack stream data packets.

[0027] As an optional embodiment, the step of using a network protocol analysis program to match and search for the vulnerability attack name to obtain the session stream corresponding to the vulnerability attack name includes:

[0028] Enter the vulnerability attack name in the txt file;

[0029] The network protocol analysis program uses the vulnerability attack name in the txt file to run a computer programming script to match and search for the vulnerability attack name, and obtain the session stream corresponding to the vulnerability attack name.

[0030] As an optional embodiment, the step of using the network protocol analysis program to run a computer programming script based on the vulnerability attack name in the txt file to achieve matching and searching of the vulnerability attack name and obtain the session stream corresponding to the vulnerability attack name includes:

[0031] Obtain test reports from the testing equipment used to detect vulnerabilities;

[0032] The network protocol analysis program uses the vulnerability attack name in the txt file to run a computer programming script to obtain a session stream matching the vulnerability attack name from the test report.

[0033] As an optional embodiment, the step of processing the session stream using the network protocol analysis program to obtain the corresponding attack stream data packets includes:

[0034] Obtain the total data packet from the tester used to detect vulnerabilities;

[0035] The network protocol analysis program uses the session flow to match and segment the total data packets to obtain the corresponding attack flow data packets.

[0036] As an optional embodiment, storing the attack stream data packets includes:

[0037] The attack stream data packets are stored in a target format, which includes the pacp file format.

[0038] Based on the disclosure of the above embodiments, it can be understood that the beneficial effects of the embodiments of the present invention include: determining the vulnerability attack name, using a network protocol analysis program to obtain the corresponding session stream based on the vulnerability attack name, processing the session stream to obtain the vulnerability attack stream with the corresponding vulnerability attack name, and finally saving it. The overall method only requires knowing the vulnerability attack name and does not require the use of potentially uncertain or non-fixed information such as five-tuple information, which increases convenience; moreover, the entire segmentation process is completed automatically by the machine without human intervention, making the operation simple and convenient, thereby avoiding errors caused by manual matching of data packets and improving the efficiency and accuracy of attack data packet segmentation of the tester. Attached Figure Description

[0039] Figure 1 This is a flowchart of the method for obtaining a vulnerability attack stream in an embodiment of the present invention.

[0040] Figure 2 This is a flowchart of a method for obtaining a vulnerability attack stream according to another embodiment of the present invention.

[0041] Figure 3 This is a flowchart of a method for obtaining a vulnerability attack stream according to another embodiment of the present invention.

[0042] Figure 4 This is an application flowchart of the vulnerability attack flow acquisition method in an embodiment of the present invention.

[0043] Figure 5 This is a structural block diagram of the device for obtaining vulnerability attack streams in an embodiment of the present invention. Detailed Implementation

[0044] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but these are not intended to limit the scope of the invention.

[0045] It should be understood that various modifications can be made to the embodiments disclosed herein. Therefore, the following description should not be considered as limiting, but merely as an example of embodiments. Other modifications within the scope and spirit of this disclosure will be apparent to those skilled in the art.

[0046] The accompanying drawings, which are included in and form part of this specification, illustrate embodiments of the present disclosure and, together with the general description of the disclosure given above and the detailed description of the embodiments given below, serve to explain the principles of the disclosure.

[0047] These and other features of the invention will become apparent from the following description of preferred forms of embodiments given as non-limiting examples, with reference to the accompanying drawings.

[0048] It should also be understood that although the invention has been described with reference to some specific examples, those skilled in the art can certainly implement many other equivalent forms of the invention, which have the features described in the claims and are therefore all within the scope of protection defined herein.

[0049] The above and other aspects, features and advantages of this disclosure will become more apparent when taken in conjunction with the accompanying drawings and in view of the following detailed description.

[0050] Specific embodiments of the present disclosure are described thereafter with reference to the accompanying drawings; however, it should be understood that the disclosed embodiments are merely examples of the present disclosure and can be implemented in various ways. Well-known and / or repeated functions and structures are not described in detail to avoid unnecessary or redundant details that could obscure the present disclosure. Therefore, the specific structural and functional details disclosed herein are not intended to be limiting, but merely to serve as the basis and representative basis for the claims to teach those skilled in the art to use the present disclosure in a variety of substantially any suitable detailed structures.

[0051] This specification may use the phrases “in one embodiment,” “in another embodiment,” “in yet another embodiment,” or “in still another embodiment,” all of which may refer to one or more of the same or different embodiments according to this disclosure.

[0052] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0053] like Figure 1 As shown, this embodiment of the invention provides a method for obtaining a vulnerability attack stream, including:

[0054] Identify the vulnerability / attack name;

[0055] The network protocol analysis program is used to match and search for vulnerability attack names to obtain the session stream corresponding to the vulnerability attack names;

[0056] The corresponding attack stream data packets are obtained by processing the session stream using a network protocol analyzer.

[0057] Store attack stream data packets.

[0058] For example, the system first determines the vulnerability attack name, then checks if a network protocol analysis program is installed on the system. If so, it uses the program directly; otherwise, it matches and installs it. This network protocol analysis program can be, but is not limited to, WinDump.exe, python2.7, tshark.exe, etc. Windump is a classic network protocol analysis software for Windows, and Python is a computer programming language. In this embodiment, tshark.exe is preferred. tshark is a network protocol analysis tool within the Wireshark network analysis tool suite, primarily used for packet capture and analysis in a command-line environment, supporting Windows, Linux, and other environments. Once a network protocol analysis program is confirmed, it can be used to match and search for the vulnerability attack name, obtaining the corresponding session stream. The session stream is then processed to obtain the corresponding attack stream data packets. The system can then store these attack stream data packets for later use.

[0059] Based on the disclosure of the above embodiments, it can be understood that the beneficial effects of this embodiment include: determining the vulnerability attack name, using a network protocol analysis program to obtain the corresponding session stream based on the vulnerability attack name, processing the session stream to obtain the vulnerability attack stream with the corresponding vulnerability attack name, and finally saving it. The overall method only requires knowing the vulnerability attack name and does not require the use of potentially uncertain or non-fixed information such as five-tuple information, which increases convenience; moreover, the entire segmentation process is completed automatically by the machine without human intervention, making the operation simple and convenient, thereby avoiding errors caused by manual matching of data packets and improving the efficiency and accuracy of attack data packet segmentation of the tester.

[0060] Specifically, such as Figure 2 As shown, a network protocol analyzer is used to match and search for vulnerability attack names, obtaining the session stream corresponding to the vulnerability attack names, including:

[0061] Enter the vulnerability attack name in the txt file;

[0062] A network protocol analysis program is used to run a computer programming script based on the vulnerability attack names in a txt file to match and search for the vulnerability attack names and obtain the session stream corresponding to the vulnerability attack names.

[0063] Furthermore, combined Figure 3 As shown, a network protocol analyzer uses a computer programming script to run based on the vulnerability attack names in a txt file to match and search for the vulnerability attack names, obtaining the session stream corresponding to the vulnerability attack names, including:

[0064] Obtain test reports from the testing equipment used to detect vulnerabilities;

[0065] A network protocol analyzer is used to run a computer programming script based on the vulnerability attack names in a txt file to obtain session streams matching the vulnerability attack names in a self-test report.

[0066] For example, a Python script is run based on a network protocol analysis program. The vulnerability attack name entered in the txt file is matched with multiple test reports of the tester to obtain the session stream corresponding to the vulnerability attack name, i.e., the Stream session.

[0067] Furthermore, when processing the session stream using a network protocol analyzer to obtain the corresponding attack stream data packets, the process includes:

[0068] Obtain the total data packet from the tester used to detect vulnerabilities;

[0069] The corresponding attack flow data packets are obtained by matching and segmenting the total data packets based on the session flow using a network protocol analysis program.

[0070] For example, network protocol analyzers can be used to perform matching searches on the total data packets of the tester, such as the total PCAP data packets, based on the session flow, in order to segment and obtain the attack flow data packets corresponding to the vulnerability attack name.

[0071] Once the attack flow data packets are obtained, store the attack flow data packets, including:

[0072] Attack stream packets are stored in the target format, which includes the PCAP file format.

[0073] For example, storing attack stream packets in PCAP file format.

[0074] In practical applications, using the network protocol analysis program (tool) tshark.exe, the following commands can be used to perform segmentation:

[0075] tshark.exe -r: Total data packets from the test instrument to be segmented; .pcap -Y; "tcp.streameq 1" -w Data packets saved after segmenting session 1 stream.pcap; Analysis of tshark parameters used in the command:

[0076] -r<infile|-> : Set the filename and path to be read ('-' indicates standard input, input from the terminal), supports pcapng or pcap format;

[0077] -Y<display filter> : Display the filter using Wireshark to show the filter expression;

[0078] tcp.stream eq 1: This is a Wireshark filter expression, meaning to filter packets in tcp.stream session stream 1, that is, to filter out attack stream packets. To filter packets in tcp.stream session stream 2, you can use tcp.stream eq 2; to filter packets in tcp.stream session stream 3, you can use tcp.stream eq 3.

[0079] -w<outfile|-> It supports writing packets to the "outfile" file in pcapng or pcap format, which is equivalent to storing attack stream packets.

[0080] Furthermore, based on the aforementioned instructions, this embodiment can achieve data stream segmentation between operating systems and testing devices on the Internet. For example, the method in this embodiment can segment attack traffic from testing devices, thereby quickly and accurately segmenting the required attack traffic data packets.

[0081] like Figure 4 As shown, the specific operation process is as follows:

[0082] 1. Install network protocol analysis programs (tools) such as WinDump.exe and python2.7. If you already have them, you can skip this step.

[0083] 2. Collect traffic data packets and attack reports from the testing equipment;

[0084] 3. Enter the vulnerability attack name / tester attack name to be segmented into the txt file;

[0085] 4. Using a network protocol analysis program, run a Python script based on the vulnerability attack name in the txt file. By matching the test report of the tester, obtain the corresponding Stream session. Then, continue to use the network protocol analysis program / tool, such as WinDump.exe, to match and segment the corresponding attack stream data packet in the total data packet of the tester using the obtained Stream session. Save the attack stream data packet in pcap file format. This completes the segmentation and acquisition of the vulnerability attack stream.

[0086] like Figure 5 As shown, another embodiment of the present invention also provides a device 100 for obtaining vulnerability attack streams, comprising:

[0087] The determination module is used to identify the name of the vulnerability attack.

[0088] The lookup module is used to match and search the vulnerability attack name using a network protocol analysis program to obtain the session stream corresponding to the vulnerability attack name;

[0089] The processing module is used to process the session stream using the network protocol analysis program to obtain the corresponding attack stream data packets;

[0090] A storage module is used to store the attack stream data packets.

[0091] As an optional embodiment, the step of using a network protocol analysis program to match and search for the vulnerability attack name to obtain the session stream corresponding to the vulnerability attack name includes:

[0092] Enter the vulnerability attack name in the txt file;

[0093] The network protocol analysis program uses the vulnerability attack name in the txt file to run a computer programming script to match and search for the vulnerability attack name, and obtain the session stream corresponding to the vulnerability attack name.

[0094] As an optional embodiment, the step of using the network protocol analysis program to run a computer programming script based on the vulnerability attack name in the txt file to achieve matching and searching of the vulnerability attack name and obtain the session stream corresponding to the vulnerability attack name includes:

[0095] Obtain test reports from the testing equipment used to detect vulnerabilities;

[0096] The network protocol analysis program uses the vulnerability attack name in the txt file to run a computer programming script to obtain a session stream matching the vulnerability attack name from the test report.

[0097] As an optional embodiment, the step of processing the session stream using the network protocol analysis program to obtain the corresponding attack stream data packets includes:

[0098] Obtain the total data packet from the tester used to detect vulnerabilities;

[0099] The network protocol analysis program uses the session flow to match and segment the total data packets to obtain the corresponding attack flow data packets.

[0100] As an optional embodiment, storing the attack stream data packets includes:

[0101] The attack stream data packets are stored in a target format, which includes the pacp file format.

[0102] Another embodiment of the present invention also provides an electronic device, comprising:

[0103] One or more processors;

[0104] Memory, configured to store one or more programs;

[0105] When the one or more programs are executed by the one or more processors, the one or more processors shall implement the methods described above.

[0106] An embodiment of the present invention also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the method described above. It should be understood that the various solutions in this embodiment have the corresponding technical effects in the above method embodiments, and will not be repeated here.

[0107] This invention also provides a computer program product tangibly stored on a computer-readable medium and including computer-readable instructions, which, when executed, cause at least one processor to perform methods as described in the embodiments above. It should be understood that the various solutions in this embodiment have the corresponding technical effects in the above method embodiments, and will not be repeated here.

[0108] It should be noted that the computer storage medium of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. Computer-readable media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections with one or more wires, portable computer disks, hard disks, random access storage media (RAM), read-only storage media (ROM), erasable programmable read-only storage media (EPROM or flash memory), optical fibers, portable compact disk read-only storage media (CD-ROM), optical storage media, magnetic storage media, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program configured for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, antenna, optical fiber, RF, etc., or any suitable combination thereof.

[0109] It should be understood that although this application is described according to various embodiments, not every embodiment contains only one independent technical solution. This way of describing the specification is only for clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

[0110] The above embodiments are merely exemplary embodiments of the present invention and are not intended to limit the present invention. The scope of protection of the present invention is defined by the claims. Those skilled in the art can make various modifications or equivalent substitutions to the present invention within its spirit and scope of protection, and such modifications or equivalent substitutions should also be considered to fall within the scope of protection of the present invention.

Claims

1. A method for obtaining a vulnerability attack flow, characterized by, The method comprises the following steps: determining a vulnerability attack name; performing a matching search on the vulnerability attack name by using a network protocol analyzer to obtain a session stream corresponding to the vulnerability attack name; in the case of unknown five-tuple or random and unstable five-tuple, without five-tuple information, only by knowing the vulnerability attack name, a corresponding Stream session is obtained by using a test report of the network protocol analyzer matching tester, so that corresponding attack stream data packets are matched and segmented from the total data packets of the tester; storing the attack stream data packets filtered from the session stream.

2. The method of claim 1, wherein, The step of performing a matching search on the vulnerability attack name by using a network protocol analyzer to obtain a session stream corresponding to the vulnerability attack name comprises the following steps: inputting the vulnerability attack name in a txt file; running a computer program design script based on the vulnerability attack name in the txt file by using the network protocol analyzer to realize the matching search on the vulnerability attack name and obtain a session stream corresponding to the vulnerability attack name.

3. The method of claim 2, wherein, The step of running a computer program design script based on the vulnerability attack name in the txt file by using the network protocol analyzer to realize the matching search on the vulnerability attack name and obtain a session stream corresponding to the vulnerability attack name comprises the following steps: obtaining a test report of a tester for detecting vulnerabilities; running a computer program design script based on the vulnerability attack name in the txt file by using the network protocol analyzer to obtain a session stream matching the vulnerability attack name from the test report.

4. The method of claim 1, wherein, The step of storing the attack stream data packets comprises the following step: storing the attack stream data packets in a target format, wherein the target format comprises a PCAP file format.

5. A vulnerability attack flow obtaining apparatus characterized by comprising: The method comprises the following steps: a determining module for determining a vulnerability attack name; a searching module for performing a matching search on the vulnerability attack name by using a network protocol analyzer to obtain a session stream corresponding to the vulnerability attack name; a processing module for, in the case of unknown five-tuple or random and unstable five-tuple, without five-tuple information, only by knowing the vulnerability attack name, obtaining a corresponding Stream session by using a test report of the network protocol analyzer matching tester, so that corresponding attack stream data packets are matched and segmented from the total data packets of the tester; a storing module for storing the attack stream data packets filtered from the session stream.

6. The apparatus for obtaining a vulnerability attack flow according to claim 5, wherein The step of performing a matching search on the vulnerability attack name by using a network protocol analyzer to obtain a session stream corresponding to the vulnerability attack name comprises the following steps: inputting the vulnerability attack name in a txt file; running a computer program design script based on the vulnerability attack name in the txt file by using the network protocol analyzer to realize the matching search on the vulnerability attack name and obtain a session stream corresponding to the vulnerability attack name.

7. The apparatus for obtaining a vulnerability attack flow according to claim 6, wherein The step of running a computer program design script based on the vulnerability attack name in the txt file by using the network protocol analyzer to realize the matching search on the vulnerability attack name and obtain a session stream corresponding to the vulnerability attack name comprises the following steps: obtaining a test report of a tester for detecting vulnerabilities; running a computer program design script based on the vulnerability attack name in the txt file by using the network protocol analyzer to obtain a session stream matching the vulnerability attack name from the test report. running a computer programming script based on the vulnerability attack name in the txt file to obtain a session flow matching the vulnerability attack name from the test report using the network protocol analysis program.

8. The apparatus for obtaining a vulnerability attack flow according to claim 5, wherein, The storing the attack flow data packet comprises: storing the attack flow data packet in a target format, the target format comprising a PCAP file format.

Images