Method and apparatus for online detection of attack code based on network traffic analysis

Abstract

The application relates to an attack code online detection method and device based on network flow analysis. The method comprises the following steps: analyzing a vulnerability execution path by using a vulnerability data set; according to the vulnerability execution path, combining semantic analysis on known vulnerability information, extracting various information elements in a vulnerability reproduction process, and constructing a vulnerability execution feature; performing automatic local dynamic micro-execution based on the vulnerability execution feature, obtaining relevant network data packets generated by attack codes, filtering irrelevant data and common data, and forming an attack code feature library; and performing homology online detection on a program to be tested by using the attack code feature library, and locating a specific position of an attack code segment. The application can realize efficient and accurate automatic vulnerability attack code real-time detection by analyzing network flow without relying on a large amount of manual analysis.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of software and information security, and relates to network traffic analysis technology, in particular to attack code online detection technology based on network traffic analysis. BACKGROUND

[0002] Network traffic analysis is a threat detection technology that uses automated techniques to examine network traffic. This technology mainly monitors network traffic, connections and objects to gain insight into the types of traffic, network packets or data flowing through the network, in order to identify signs of malicious behavior. Malicious network behaviors are diverse, such as distributed denial of service (DDoS), spam with viruses or malicious links, spam advertising and horse website and phishing website, etc. Although the purposes and means of these malicious network behaviors are not the same, these malicious behaviors all need the help of network resources to achieve the purpose of attack.

[0003] Dynamic program analysis is a computer software analysis method by running the program, and the conventional methods include fuzz testing, dynamic taint analysis, dynamic symbolic execution, etc. Dynamic analysis often needs enough test cases to execute the target program to cover all program branches as much as possible. Compared with static analysis, dynamic analysis needs to spend more time to trace the vulnerability to the exact location in the code. Local dynamic micro-execution technology uses the program control flow graph generated by static analysis to set the program context and slice the vulnerability code, and realizes local micro-execution of the target location, preventing the consumption of a large amount of resources and avoiding the interference of vulnerability irrelevant information.

[0004] Attack code is a piece of code that exploits software vulnerabilities or security flaws to trigger unexpected behavior in computer software, hardware or electronic devices. Such unexpected behavior usually includes gaining control of a computer system, privilege escalation or denial of service (DoS or DDoS) attacks. Attack code is usually written by malicious actors as an attack means, or by security researchers for proof of concept. Attack code sometimes also participates in malicious attacks as part of a multi-component attack. This way does not directly execute malicious behavior, but uses vulnerabilities to release or load malicious software (backdoor trojans, spyware, etc.), indirectly stealing information from infected systems.

[0005] In the field of information security, homology analysis refers to using the homology relationship between samples to find traceability traces and determine the source of variants. The main purpose is to judge whether different samples have similarity and internal correlation, including family homology, developer homology, attack resource homology and tool machine homology, etc., and finally realize the ability to reveal attack organization, attack target, attack technology and attack intention.

[0006] The existing attack code analysis algorithm excessively depends on manual analysis, cannot balance efficiency and accuracy, and cannot well realize real-time detection of attack codes. SUMMARY

[0007] The application aims to provide an attack code online detection method and device based on network flow analysis.

[0008] The technical scheme adopted by the application is as follows:

[0009] An attack code online detection method based on network flow analysis comprises the following steps:

[0010] Analyzing a vulnerability execution path by using a vulnerability data set;

[0011] According to the vulnerability execution path, combining semantic analysis of known vulnerability information, extracting various information elements in a vulnerability reproduction process, and constructing a vulnerability execution feature;

[0012] Based on the vulnerability execution feature, automatic local dynamic micro-execution is performed, relevant network data packets generated by attack codes are acquired, irrelevant data and common data are filtered, and an attack code feature library is formed;

[0013] The attack code feature library is used for homology online detection of a program to be tested, and the specific position of an attack code segment is located.

[0014] Further, the vulnerability execution path is analyzed by using a vulnerability data set, comprising:

[0015] Based on a conventional static analysis method, a control flow graph corresponding to software, a library, and a system kernel with a vulnerability is generated, and part of function call information contained in the vulnerability feature is used for filtering and screening, combined with an application software entry point and a kernel system call point, to find an optimal path reaching a vulnerability position;

[0016] For all the generated optimal paths, directed fuzz testing is performed with the vulnerability as a guide, and all the paths are traversed until a POC triggering a vulnerability behavior is acquired.

[0017] Further, according to the vulnerability execution path, combining semantic analysis of known vulnerability information, various information elements are extracted in a vulnerability reproduction process, and a vulnerability execution feature is constructed, comprising:

[0018] Using semantic analysis, regular matching, and multi-element matching methods, known vulnerability information is analyzed, and vulnerability function information, a kernel version, a vulnerability type, and system call information are extracted.

[0019] In the vulnerability reproduction process, the current function, function parameters, associated variables and context information are recorded when the target vulnerability is triggered, and the analysis results in the previous step are saved as vulnerability execution characteristics.

[0020] Further, the automatic local dynamic micro-execution based on the vulnerability execution characteristics is performed, the relevant network data packets generated by the attack code are obtained, and irrelevant data and common data are filtered to form an attack code feature library, including:

[0021] Based on the vulnerability execution characteristics, the target position code is locally dynamically micro-executed, and the data stream and network data packet generated by the attack code in the vulnerability triggering process are dynamically recorded and collected;

[0022] The network data packet generated by the network operation related to the dynamic data prototype is filtered, and the network data packet generated by the program related data prototype is retained;

[0023] The network data packet with common characteristics between programs is filtered, the intersection part of all data packets of all programs is discarded, and the difference set is retained as the attack code characteristics specific to each program to form an attack code feature library.

[0024] Further, the attack code feature library is used for homology online detection of the to-be-tested program, and the specific position of the attack code segment is located, including:

[0025] Through dynamic analysis of the to-be-tested program and related resources, all network data packets generated by the to-be-tested program are extracted;

[0026] Based on the feature comparison mode, all feature vectors identical to the to-be-tested program in the attack code feature library are found and classified according to the application dimension, and all programs similar to the to-be-tested program are found in the sample library through homology analysis;

[0027] If the known attack code or its variant is found in the to-be-tested program through homology analysis, the specific position of the attack code segment is located through local dynamic micro-execution, so as to identify the attack code segment attached to the normal service.

[0028] An attack code online detection device based on network traffic analysis, comprising:

[0029] A vulnerability execution path analysis module is used for analyzing the vulnerability execution path by using a vulnerability data set;

[0030] A vulnerability execution characteristic extraction module is used for extracting a plurality of information elements in a vulnerability reproduction process according to the vulnerability execution path and in combination with semantic analysis of known vulnerability information to construct vulnerability execution characteristics;

[0031] The flow feature extraction and screening module is used for automatic local dynamic micro-execution based on the vulnerability execution features, obtaining relevant network data packets generated by the attack code, and filtering irrelevant data and common data to form an attack code feature library.

[0032] The homology online detection module is used for homology online detection of the program to be tested by using the attack code feature library, and positioning the specific position of the attack code segment.

[0033] Compared with the prior art, the positive effects of the present application are:

[0034] The present application can realize efficient and accurate automatic real-time detection of attack codes by analyzing network flow without relying on a large amount of manual analysis, can realize online detection and real-time early warning of attack codes, and can realize security evaluation of target software.

[0035] The present application can quickly locate the specific position of the attack code segment and identify the attack code segment attached to the normal service. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 The present application is a network flow analysis-based attack code online detection method.

[0037] Figure 2 The present application is a vulnerability execution path analysis flowchart.

[0038] Figure 3 The present application is a flow feature screening process chart.

[0039] Figure 4 The present application is a homology online detection flowchart. DETAILED DESCRIPTION

[0040] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below with reference to specific embodiments and drawings.

[0041] 1. The network flow analysis-based attack code online detection method of the present application, as shown in Figure 1 , contains the following steps and points;

[0042] 1.1. Vulnerability execution path analysis: through static analysis, combining control flow chart, function call information and application software entry point / kernel system call point, the optimal path to the vulnerability position, i.e. the vulnerability execution path, is calculated, and vulnerability Fuzzing (fuzzing test) traversal is performed to obtain the POC that can trigger the vulnerability.

[0043] 1.2. Vulnerability execution feature extraction: According to the vulnerability execution path, combined with the semantic analysis of known vulnerability information (such as CVE, etc.), a variety of information elements are extracted in the vulnerability reproduction process (vulnerability reproduction is performed by directed testing based on the vulnerability execution path), and vulnerability execution features are constructed.

[0044] 1.3. Traffic feature extraction and screening: Based on the vulnerability execution features, automatic local dynamic micro-execution is performed, relevant network data packets generated by the attack code are obtained, and irrelevant data and common data are filtered to obtain the traffic features of the attack code.

[0045] 1.4. Homology online detection: Extract the relevant traffic features of the target application, find similar target applications based on feature comparison (compare the traffic features of the target application with the traffic features of the attack code), and locate the specific position of the attack code segment.

[0046] 2. As described in point 1.1, vulnerability execution path analysis includes the following steps:

[0047] 2.1. Based on the conventional static analysis method, the control flow graph (CFG) of the software, library, system kernel with existing vulnerabilities is generated, and the function call information contained in part of the vulnerability features is used for filtering and screening, combined with application software entry point / kernel system call point and other factors, to find the optimal path to the vulnerability location.

[0048] 2.2. For all generated optimal paths, directed fuzz testing is performed with vulnerability as the guide and all paths are traversed until the POC (Proof of Concept, vulnerability concept verification) that can trigger the vulnerability behavior is obtained.

[0049] Figure 2For the vulnerability execution path analysis process in one embodiment of the present application, sys_recvmsg represents the recvmsg system call, allows users to specify structures to receive data, can receive data into multiple buffers, and can receive control information. udpv6_recvmsg, ping_recvmsg, raw_recvmsg, rawv6_recvmsg, tcp_recvmsg, and udp_recvmsg represent function implementations of the recvmsg system call at different layers, such as tcp_recvmsg is an implementation of the recvmsg system call at the TCP layer, ip_cmsg_recv_offset represents a related processing function for adding control information in the protocol, inet_recv_error and ipv6_recv_error represent related processing functions called for different error values when the recv function (one of the most commonly used functions in socket programming) reports an error, and ip_cmsg_recv_checksum represents the ip_cmsg_recv_checksum function in net / ipv4 / ip_sockglue.c in the Linux kernel before version 4.10.1.

[0050] Figure 2 A typical execution path analysis process is shown. Each process shown in the figure represents all paths that can reach the target vulnerability location ip_cmsg_recv_checksum in the CFG graph obtained by static analysis of the sample; due to incorrect expectations of the data layout of the function, local users are allowed to cause denial of service (buffer over-read) or other unexpected consequences through constructed system calls, such as using the MSG_MORE flag in combination with loopback UDP transmission. The priority shown in the figure is the path priority obtained by the optimal path finding algorithm, which takes into account function call information, application software entry point / kernel system call point, etc. The higher the value, the higher the vulnerability reachability of the path, and the more likely it is to execute to the target vulnerability location when reproduced.

[0051] 3.1. Use semantic analysis, regular matching, multi-element matching (function matching / variable domain matching / enumeration matching), etc. to analyze known vulnerability information (such as vulnerability details published in the CVE (Common Vulnerabilities & Exposures) database) and extract vulnerability function information, kernel version, vulnerability type, system call, etc.

[0052] 3.2. In the vulnerability reproduction process, record the current function, function parameters, associated variables and context information when triggering the target vulnerability, and save the analysis results in the previous step (step 3.1) (i.e. the extracted vulnerability function information, kernel version, vulnerability type, system call, etc.) as vulnerability execution characteristics.

[0053] 4. As shown in point 1.3, traffic feature extraction and screening includes the following steps:

[0054] 4.1. Based on the vulnerability execution characteristics, perform local dynamic micro-execution on the target location code, and dynamically record and collect the data stream and network data packets generated by the attack code during the vulnerability triggering process.

[0055] 4.2. Data prototype filtering: To avoid interference from program-irrelevant data, filter the data stream related to dynamic data prototypes (such as random numbers, user inputs, etc.) and network packets generated by network operations, and retain network packets generated by program-related data prototypes (such as hardcoding, etc.), as shown in Figure 3 .

[0056] 4.3. Common feature filtering: To extract features that can express the program's specificity, filter network packets that have common features between programs (for example, general protocol connection requests, etc.), discard the intersection part of all packets of all programs, and retain the difference set as the attack code features unique to each program, forming an attack code feature library, as shown in Figure 3 .

[0057] 5. As shown in point 1.4, the homogeneity online detection process is shown in Figure 4 , which includes the following steps:

[0058] 5.1. Extract all network data packets generated by the program under test through dynamic analysis of the program under test and related resources.

[0059] 5.2. Based on feature comparison, find all feature vectors identical to the program under test in the attack code feature library in step 4.3 and classify them by application dimension, and find all similar programs to the program under test in the sample library through homogeneity analysis. The application dimension refers to different platforms or operating systems to which the application belongs, such as windows, android and ios; the sample library is a pre-collected application sample or system software sample through the Internet, and these samples mainly run on the Internet or mobile Internet.

[0060] 5.3. If known attack codes or their variants are found in the program under test through homogeneity analysis, the specific location of the attack code fragment can be located through local dynamic micro-execution, thereby identifying the attack code fragment attached to the normal service.

[0061] Another embodiment of the present application provides an attack code online detection device based on network traffic analysis, comprising:

[0062] a vulnerability execution path analysis module for analyzing vulnerability execution paths by using vulnerability data sets;

[0063] a vulnerability execution feature extraction module for extracting various information elements in the vulnerability reproduction process according to the vulnerability execution paths and combining semantic analysis of known vulnerability information to construct vulnerability execution features;

[0064] a traffic feature extraction and screening module for automatic local dynamic micro-execution based on the vulnerability execution features, obtaining relevant network data packets generated by the attack code, and filtering irrelevant data and common data to form an attack code feature library;

[0065] a homology online detection module for homology online detection of the program to be tested by using the attack code feature library and locating the specific position of the attack code segment.

[0066] The specific implementation process of each module can be found in the description of the method of the present application above.

[0067] Another embodiment of the present application provides a computer device (computer, server, smart phone, etc.), comprising a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing each step of the method of the present application.

[0068] Another embodiment of the present application provides a computer readable storage medium (such as ROM / RAM, magnetic disk, optical disk), which stores a computer program, and the computer program is executed by a computer to realize each step of the method of the present application.

[0069] The specific embodiments of the present application disclosed above are intended to help understand the content of the present application and to implement the same, and those skilled in the art can understand that various substitutions, changes and modifications are possible without departing from the spirit and scope of the present application. The present application should not be limited to the content disclosed in the embodiments of the present application, and the protection scope of the present application is defined by the scope of the claims.

Claims

1. An online detection method for attack code based on network traffic analysis, characterized in that, Includes the following steps: Analyze vulnerability execution paths using vulnerability datasets; Based on the vulnerability execution path and combined with semantic analysis of known vulnerability information, various information elements are extracted during the vulnerability reproduction process to construct vulnerability execution characteristics; Automated local dynamic micro-execution is performed based on vulnerability execution characteristics to obtain relevant network data packets generated by the attack code, and irrelevant and common data are filtered to form an attack code feature library; The attack code signature library is used to perform online homology detection on the program under test and to locate the specific location of the attack code fragment; The automated local dynamic micro-execution based on vulnerability execution characteristics acquires relevant network data packets generated by the attack code, and filters irrelevant and common data to form an attack code feature library, including: Based on the vulnerability execution characteristics, local dynamic micro-execution is performed on the code at the target location, and the data streams and network packets generated by the attack code during the vulnerability triggering process are dynamically recorded and collected. Filter the data streams and network packets generated by network operations related to dynamic data prototypes, and retain the network packets generated by program-related data prototypes. Network data packets with common characteristics among programs are filtered out, discarding the intersection of all data packets from all programs, and retaining the difference as the attack code characteristics unique to each program, thus forming an attack code characteristic library.

2. The method according to claim 1, characterized in that, The analysis of vulnerability execution paths using vulnerability datasets includes: Based on conventional static analysis methods, corresponding control flow graphs are generated for vulnerable software, libraries, and system kernels. The vulnerability features themselves contain partial function call information for filtering and screening. Combined with the application software entry point and kernel system call point, the optimal path to the vulnerability location is found. For all generated optimal paths, perform targeted fuzzing based on the vulnerability and traverse all paths until a Proof of Concept (POC) that can trigger the vulnerability behavior is obtained.

3. The method according to claim 1, characterized in that, Based on the vulnerability execution path and combined with semantic analysis of known vulnerability information, various information elements are extracted during the vulnerability reproduction process to construct vulnerability execution characteristics, including: Using semantic analysis, regular expression matching, and multi-element matching methods, we analyze known vulnerability information and extract vulnerability function information, kernel version, vulnerability type, and system call information. During the vulnerability reproduction process, when the target vulnerability is triggered, the current function, function parameters, associated variables, and context information are recorded and saved along with the analysis results from the previous step as vulnerability execution characteristics.

4. The method according to claim 3, characterized in that, The known vulnerability information refers to the vulnerability information that has been published in the CVE database.

5. The method according to claim 1, characterized in that, The data streams associated with the dynamic data prototype include random numbers and user input; the data prototypes associated with the program include hard-coded data.

6. The method according to claim 1, characterized in that, The step of using an attack code signature library to perform online homology detection on the program under test and locating the specific position of the attack code fragment includes: By dynamically analyzing the program under test and related resources, all network data packets generated by the program under test are extracted. Based on feature comparison, all feature vectors identical to those of the program under test are found in the attack code feature library and categorized by application dimension. Homology analysis is then used to find all programs similar to the program under test in the sample library. If known attack code or its variants are found in the program under test through homology analysis, the specific location of the attack code fragment is located through local dynamic micro-execution, thereby identifying the attack code fragment attached to the normal service.

7. An online attack code detection device based on network traffic analysis employing the method described in any one of claims 1 to 6, characterized in that, include: The vulnerability execution path analysis module is used to analyze vulnerability execution paths using vulnerability datasets. The vulnerability execution feature extraction module is used to extract various information elements and construct vulnerability execution features during the vulnerability reproduction process based on the vulnerability execution path and semantic analysis of known vulnerability information. The traffic feature extraction and filtering module is used to perform automated local dynamic micro-execution based on vulnerability execution features, obtain relevant network data packets generated by the attack code, and filter irrelevant and common data to form an attack code feature library. The online homology detection module is used to perform online homology detection on the program under test using an attack code signature library, and to locate the specific location of the attack code fragment.

8. A computer device, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a computer, implements the method according to any one of claims 1 to 6.

Images