A vulnerability attack detection method, device, equipment and storage medium

Abstract

The application discloses a vulnerability attack detection method and device, equipment and a storage medium, and relates to the technical field of network security. The method comprises the following steps: extracting the attributes and distribution characteristics of vulnerability exploitation components in a vulnerability exploitation sample to obtain a vulnerability exploitation mode; identifying and locating the vulnerability exploitation components in to-be-detected traffic to obtain to-be-detected traffic vulnerability exploitation components and the distribution characteristics of the to-be-detected traffic vulnerability exploitation components; and performing vulnerability attack detection on the vulnerability exploitation components in the to-be-detected traffic by using the distribution characteristics of the to-be-detected traffic vulnerability exploitation components and the characteristics of the vulnerability exploitation mode and based on a deep matching model. The application proposes the concept of a vulnerability exploitation mode, and vulnerability attack detection can be performed by using the vulnerability exploitation mode. Since the feature code of the vulnerability attack is not required, unknown vulnerability attacks can be detected, and the method is suitable for vulnerability attack detection of various types.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a vulnerability attack detection method and device, equipment and a storage medium. BACKGROUND

[0002] A vulnerability is a security defect or error in the process of software design or implementation that can be exploited by an attacker. Current mainstream vulnerabilities include memory destruction type vulnerabilities, injection type vulnerabilities, file type vulnerabilities, etc. The memory destruction type vulnerabilities include buffer overflow, memory out-of-bounds, reuse after release, and formatted string. The injection type vulnerabilities include SQL (Structured Query Language) injection vulnerabilities, cross-site scripting XSS (Cross Site Scripting) vulnerabilities, command injection, etc. The file type vulnerabilities refer to vulnerabilities existing in office software such as Office and Adobe and multimedia processing software and causing security risk errors when processing input files.

[0003] At present, the research on vulnerability attack detection methods is still preliminary, mainly focusing on the detection of WEB (World Wide Web) vulnerability attacks and malicious codes, such as the detection of SQL injection attacks, XSS vulnerability attacks, and Shellcode detection. The current mainstream vulnerability attack detection method is a feature code-based detection method, in which a feature code is a unique feature sequence in a vulnerability attack stream or a vulnerability attack file. The vulnerability attack is detected by matching the feature code in the vulnerability attack stream with the feature code in the feature library. However, the current vulnerability attack detection based on keywords or some rules can detect known vulnerability attacks, but is powerless against unknown vulnerability attacks. In addition, although the keyword search method can be used to detect injection type vulnerabilities, it is difficult to detect memory destruction type vulnerabilities. For memory destruction type vulnerabilities, it is difficult to use artificial intelligence methods to improve the performance of vulnerability attack detection due to the small number of samples and poor quality.

[0004] In summary, how to detect unknown vulnerability attacks is a problem to be further solved in the art. SUMMARY

[0005] Therefore, the present application aims to provide a vulnerability attack detection method, device, equipment and storage medium, which can detect unknown vulnerability attacks without feature codes of vulnerability attacks and is suitable for vulnerability attack detection of various types. The specific scheme is as follows:

[0006] In a first aspect, the present application discloses a vulnerability attack detection method, comprising:

[0007] extracting attributes and distribution characteristics of exploit components in exploit samples to obtain exploit patterns;

[0008] identifying and locating exploit components in the to-be-tested traffic to obtain exploit components in the to-be-tested traffic and distribution characteristics of the exploit components in the to-be-tested traffic;

[0009] detecting exploit components in the to-be-tested traffic based on a deep matching model by using the distribution characteristics of the exploit components in the to-be-tested traffic and the characteristics of the exploit patterns.

[0010] Optionally, the extracting attributes and distribution characteristics of exploit components in exploit samples to obtain exploit patterns comprises:

[0011] clustering feature vectors of exploit samples by using unsupervised learning to obtain exploit patterns.

[0012] Optionally, the clustering feature vectors of exploit samples by using unsupervised learning to obtain exploit patterns comprises:

[0013] extracting all exploit components in exploit samples, and obtaining attributes and distribution characteristics of the exploit components to obtain feature vectors of the exploit samples;

[0014] projecting the feature vectors to a latent space by using an encoding-decoding model to obtain latent space vectors of the exploit samples;

[0015] dividing the latent space vectors into a preset number of regions based on a clustering algorithm, and regarding the latent space vectors in a same region as a same exploit pattern to obtain a plurality of different exploit patterns comprising the attributes.

[0016] Optionally, the identifying and locating exploit components in the to-be-tested traffic to obtain exploit components in the to-be-tested traffic and distribution characteristics of the exploit components in the to-be-tested traffic comprises:

[0017] identifying and locating exploit components in the to-be-tested traffic based on an integrated model to obtain exploit components in the to-be-tested traffic and distribution characteristics of the exploit components in the to-be-tested traffic.

[0018] Optionally, the identifying and locating exploit components in the to-be-tested traffic based on an integrated model to obtain exploit components in the to-be-tested traffic and distribution characteristics of the exploit components in the to-be-tested traffic comprises:

[0019] Based on an integrated model that includes expert knowledge, convolutional neural networks, and wavelet transform, the vulnerability exploitation components in the traffic under test are identified and located, and the vulnerability exploitation components and their distribution characteristics are obtained.

[0020] Optionally, the step of utilizing the distribution characteristics of the exploit components in the traffic under test and the characteristics of the exploitation patterns, and performing vulnerability attack detection on the exploit components in the traffic under test based on a deep matching model, includes:

[0021] The feature bag model is used to represent the exploit component and exploit pattern of the traffic under test using histogram vectors, resulting in the corresponding histogram vector of the traffic under test and the histogram vector of the pattern.

[0022] A multi-channel deep matching model based on DSSM is used to calculate the similarity between the histogram vector of the traffic to be tested and the histogram vector of the pattern, so as to detect the vulnerability attacks of the exploit components in the traffic to be tested.

[0023] Optionally, the step of using a multi-channel deep matching model based on DSSM to calculate the similarity between the histogram vector of the traffic to be tested and the histogram vector of the pattern, in order to detect vulnerability attacks by exploit components in the traffic to be tested, includes:

[0024] By using a pre-created sub-model of the traffic vulnerability exploit component, the histogram vector of the traffic to be tested is mapped to a vector space with semantic features as coordinate dimensions, thus obtaining the feature vector of the traffic vulnerability exploit component to be tested.

[0025] The pattern histogram vector is mapped to a vector space with coordinate dimensions as semantic features using a pre-created vulnerability exploitation pattern sub-model to obtain the feature vector of the vulnerability exploitation pattern.

[0026] The similarity between the feature vector of the vulnerability exploitation component in the traffic under test and the feature vector of the vulnerability exploitation pattern is calculated using a multi-channel deep matching model based on DSSM, so as to obtain the vulnerability attack detection result of the vulnerability exploitation component in the traffic under test; wherein, the traffic vulnerability exploitation component sub-model is a neural network model with the same structure but different parameters that is created in advance for the vulnerability exploitation component in the traffic under test, and the vulnerability exploitation pattern sub-model is a neural network model with the same structure but different parameters that is created in advance for the vulnerability exploitation pattern.

[0027] Secondly, this application discloses a vulnerability attack detection device, comprising:

[0028] The information extraction module is used to extract the attributes and distribution characteristics of the exploit components in the exploit samples to obtain the exploit patterns.

[0029] The identification and positioning module is configured to identify and position exploit components in the to-be-tested traffic, and obtain the to-be-tested traffic exploit components and distribution characteristics of the to-be-tested traffic exploit components.

[0030] The vulnerability attack detection module is configured to perform vulnerability attack detection on the exploit components in the to-be-tested traffic by using the distribution characteristics of the to-be-tested traffic exploit components and the characteristics of the exploit patterns and based on a deep matching model.

[0031] In a third aspect, the present application discloses an electronic device, comprising a processor and a memory; wherein the processor implements the vulnerability attack detection method as described above when executing a computer program stored in the memory.

[0032] In a fourth aspect, the present application discloses a computer readable storage medium for storing a computer program; wherein the computer program is executed by a processor to implement the vulnerability attack detection method as described above.

[0033] It can be seen that, the present application first extracts the attributes and distribution characteristics of exploit components in exploit samples to obtain exploit patterns, then identifies and positions exploit components in to-be-tested traffic to obtain to-be-tested traffic exploit components and distribution characteristics of the to-be-tested traffic exploit components, and finally performs vulnerability attack detection on the exploit components in the to-be-tested traffic by using the distribution characteristics of the to-be-tested traffic exploit components and the characteristics of the exploit patterns and based on a deep matching model. The present application proposes the concept of exploit patterns, and the exploit patterns can be used for vulnerability attack detection. Since the exploit patterns do not need feature codes of vulnerability attacks, unknown vulnerability attacks can be detected, and the exploit patterns are suitable for vulnerability attack detection of various types. BRIEF DESCRIPTION OF DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are only embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of the provided drawings.

[0035] Figure 1 A vulnerability attack detection method flow chart disclosed by the present application;

[0036] Figure 2 An exploit pattern detection process schematic diagram based on a deep matching model disclosed by the present application;

[0037] Figure 3 A specific vulnerability attack detection method flow chart disclosed by the present application;

[0038] Figure 4 A schematic diagram of an integrated model-based vulnerability exploitation component identification and positioning disclosed by the present application;

[0039] Figure 5 A specific clustering model training process schematic diagram disclosed by the present application;

[0040] Figure 6 A vulnerability attack detection method flow chart disclosed by the present application;

[0041] Figure 7 A vulnerability exploitation pattern histogram vector representation schematic diagram disclosed by the present application;

[0042] Figure 8 A vulnerability attack detection device structure schematic diagram disclosed by the present application;

[0043] Figure 9 A schematic diagram of an electronic device structure disclosed by the present application. DETAILED DESCRIPTION

[0044] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0045] The present embodiment discloses a vulnerability attack detection method, referring to Figure 1 The method comprises the following steps:

[0046] Step S11: Extract the attributes and distribution characteristics of the vulnerability exploitation components in the vulnerability exploitation sample to obtain a vulnerability exploitation pattern.

[0047] In the present embodiment, the attributes and distribution characteristics of the vulnerability exploitation components in the vulnerability exploitation sample, such as the name, number, length, relative position, type, meaning, etc. of the vulnerability exploitation components, are extracted to obtain the vulnerability exploitation pattern of the above vulnerability exploitation components, that is, the vulnerability exploitation pattern in the vulnerability exploitation sample is extracted.

[0048] It should be noted that this application proposes the concept of vulnerability exploitation patterns. Before explaining vulnerability exploitation patterns, we will first introduce vulnerability exploitation and vulnerability exploitation components in the field of vulnerability attack detection technology. Vulnerability exploitation is the core of vulnerability attack, which is the process of using carefully constructed data as input to the target program to trigger the vulnerability of the target program and gain control of the target program by taking advantage of the target program's specific functions. Vulnerability exploitation components are code snippets that implement a certain vulnerability exploitation function (such as leaking memory addresses, hijacking stack pointers, jumping control flow to a specified location, disabling stack protection, filling empty instructions, etc.) or some data required for vulnerability exploitation (such as vulnerability triggering data, URLs, etc.). The resource locator (Uniform Resource Locator), command fields, address fields, jump addresses, shellcode, etc., are chained together by several exploit primitives. By assembling these exploit components, an exploit sample can be constructed. The exploit pattern proposed in this application refers to the method of exploitation, a description of the exploitation process. In the data domain, it manifests as the attributes and distribution characteristics of the exploit components, closely related to their type, length, number, relative positions, logical relationships, and organization. Common exploit patterns include command chaining patterns for injection vulnerabilities and ret2shellcode, ret2system, and ret2libc for overflow vulnerabilities in different environments. Furthermore, different types of vulnerabilities have different exploit patterns, and even the same type of vulnerability may have multiple exploit patterns. From the perspective of state change, the exploit pattern is a key intermediate state sequence that guides the program from the vulnerability triggering state to the successful exploitation state. From the perspective of vulnerability attack traffic, the exploit pattern manifests as the attributes and distribution characteristics of the exploit components, and these exploit components are replaceable.

[0049] Specifically, extracting the attributes and distribution characteristics of the exploit components in the exploit samples to obtain the exploit pattern can include: using unsupervised learning to cluster the feature vectors of the exploit samples to obtain the exploit pattern. In this embodiment, unsupervised learning can be used to cluster the feature vectors of the exploit samples to obtain the exploit pattern of the exploit components.

[0050] Step S12: Identify and locate the exploit components in the traffic to be tested, and obtain the exploit components in the traffic to be tested and their distribution characteristics.

[0051] It should be noted that, since different types of vulnerabilities are different in vulnerability exploitation mode, but present certain similarities in partial vulnerability exploitation components, the NOP chain, the ROP (Return-oriented programming) chain distributed in different memory regions, the Shellcode with different functions and the like can be identified and located, and then the different vulnerability exploitation modes can be matched according to the types and distribution of the vulnerability exploitation components. In the embodiment, after the attributes and distribution characteristics of the vulnerability exploitation components in the vulnerability exploitation sample are extracted, the vulnerability exploitation mode is obtained, and then the vulnerability exploitation components in the to-be-tested traffic can be further identified and located, so as to obtain the vulnerability exploitation components in the to-be-tested traffic and the corresponding distribution characteristics.

[0052] In a specific implementation, the vulnerability exploitation components in the to-be-tested traffic can be identified and located based on the integrated model, and then the vulnerability exploitation components in the to-be-tested traffic and the distribution characteristics of the vulnerability exploitation components in the to-be-tested traffic are obtained. The integrated model can include but is not limited to an integrated model of expert knowledge, a convolutional neural network and a wavelet transform, and the like.

[0053] Step S13: performing vulnerability attack detection on the vulnerability exploitation components in the to-be-tested traffic by using the distribution characteristics of the vulnerability exploitation components in the to-be-tested traffic and the characteristics of the vulnerability exploitation mode and based on a deep matching model.

[0054] In the embodiment, after the vulnerability exploitation components in the to-be-tested traffic are identified and located, the vulnerability exploitation components in the to-be-tested traffic and the distribution characteristics of the vulnerability exploitation components in the to-be-tested traffic are obtained, and then the distribution characteristics of the vulnerability exploitation components in the to-be-tested traffic and the characteristics of the vulnerability exploitation mode can be compared and analyzed by using the pre-created deep matching model, so as to perform vulnerability attack detection on the vulnerability exploitation components in the to-be-tested traffic.

[0055] In a specific implementation, the vulnerability attack detection on the vulnerability exploitation components in the to-be-tested traffic by using the distribution characteristics of the vulnerability exploitation components in the to-be-tested traffic and the characteristics of the vulnerability exploitation mode and based on a deep matching model can specifically include: performing histogram vector representation on the vulnerability exploitation components in the to-be-tested traffic and the vulnerability exploitation mode by using a bag-of-features model, to obtain a to-be-tested traffic histogram vector and a mode histogram vector; and performing similarity calculation on the to-be-tested traffic histogram vector and the mode histogram vector by using a multi-channel deep matching model established based on a DSSM, to detect the vulnerability attack of the vulnerability exploitation components in the to-be-tested traffic. In the embodiment, refer to Figure 2As shown, after identifying and locating the exploit components in the to-be-tested traffic, obtaining the exploit components in the to-be-tested traffic and the corresponding distribution features, the abstract method of the bag-of-feature (BOF) model can be used to convert the exploit components in the to-be-tested traffic and the exploit patterns into histogram vectors, that is, the bag-of-feature model is used to represent different exploit patterns and the exploit components in the to-be-tested traffic, and then the corresponding histogram vectors of the to-be-tested traffic and the pattern histogram vectors are obtained. It should be noted that each dimension of the histogram vector represents the frequency of occurrence of an exploit component, and the distribution features of the exploit components include but are not limited to the category, size, number, position and the like of the components; further, considering that the matching algorithm based on distance measure or other similarity measure is seriously restricted by the vector feature space, the unknown exploit attacks often have poor matching, and the deep matching model based on the deep structured semantic model (DSSM) is used to identify the exploit patterns in the to-be-tested traffic, so as to mine the potential deep semantic features, and thus has high matching accuracy. Specifically, the similarity between the above to-be-tested traffic histogram vector and the above pattern histogram vector can be calculated by using the multi-channel deep matching model based on DSSM, and finally the high-confidence exploit attack detection result is obtained.

[0056] It can be seen that, in the embodiment of the application, the properties and distribution features of the exploit components in the exploit samples are extracted to obtain the exploit patterns, then the exploit components in the to-be-tested traffic are identified and located to obtain the exploit components in the to-be-tested traffic and the distribution features of the exploit components in the to-be-tested traffic, and then the distribution features of the exploit components in the to-be-tested traffic and the features of the exploit patterns are used to detect the exploit components in the to-be-tested traffic based on the deep matching model. The embodiment of the application proposes the concept of exploit patterns, and the exploit attack detection can be performed through the exploit patterns. Since the exploit attack code is not required, unknown exploit attacks can be detected, and the exploit attack detection of various types can be performed, such as injection-type exploit attack detection and memory destruction-type exploit attack detection.

[0057] The embodiment of the application discloses a specific exploit attack detection method, as shown in Figure 3 The method comprises the following steps:

[0058] Step S21: Extract all exploit components in the exploit samples, and obtain the properties and distribution features of the exploit components to obtain the feature vectors of the exploit samples.

[0059] In this embodiment, all exploit components in the exploit sample can be extracted by detailed analysis on different types of exploit samples such as stack overflow, heap overflow, formatted string, command injection, file type, etc., combined with the actual exploit construction idea, then the attribute information of the above exploit components is obtained, all the above exploit components in the exploit sample are concatenated, then abstracted into a multi-step functional component representation form associated with the exploit attack implementation, to obtain the distribution characteristics of the exploit components, and then obtain the feature vector of the exploit sample. The feature vector includes but is not limited to the number, type, relative position, etc. of the exploit components. Specifically, the exploit sample feature vector is shown in Table 1:

[0060] Table 1

[0061]

[0062] Step S22: projecting the feature vector into the hidden space using the encoding-decoding model to obtain the hidden space vector of the exploit sample.

[0063] In this embodiment, after obtaining the feature vector of the exploit sample, the encoding-decoding model such as the autoencoder model can be further used to project the feature vector of the exploit sample into the hidden space to obtain the hidden space vector of the exploit sample.

[0064] Step S23: dividing the hidden space vector into a preset number of regions based on a clustering algorithm, and regarding the hidden space vectors in the same region as the same exploit mode to obtain a plurality of different exploit modes including the attribute.

[0065] In this embodiment, after projecting the feature vector into the hidden space to obtain the hidden space vector of the exploit sample, the above hidden space vector can be divided into a preset number of regions based on a clustering algorithm, and the hidden space vectors in the same region are regarded as the same exploit mode, and then a plurality of different exploit modes including the above attribute are obtained. In a specific embodiment, see Figure 4As shown, all exploit samples in the exploit sample library are first obtained, and then the feature extraction preprocessing operation is performed on the exploit components in the exploit samples to obtain the distribution feature vectors of the exploit components, and then each distribution feature vector is input into the autoencoder model, wherein the autoencoder model includes an input layer, a hidden space and an output layer. The distribution feature vectors of the exploit samples can be projected to the hidden space through the hidden space layer in the autoencoder model to obtain corresponding hidden space vectors. Then, the hidden space vectors are represented in space to obtain a decision boundary of the exploit pattern. Finally, the hidden space vectors in the decision boundary are divided by using a clustering algorithm, and the samples in the same region are regarded as the same exploit pattern, and then a plurality of different exploit patterns are obtained. It can be understood that the number of different exploit patterns obtained is the number of categories of the clustering algorithm.

[0066] Step S24: identifying and positioning the exploit components in the to-be-tested traffic based on the integrated model including expert knowledge, a convolutional neural network and wavelet transform to obtain the exploit components in the to-be-tested traffic and the distribution features of the exploit components in the to-be-tested traffic.

[0067] In this embodiment, after the same hidden space vectors in the same region are regarded as the same exploit pattern and a plurality of different exploit patterns including the attributes are obtained, the exploit components in the to-be-tested traffic can be identified and positioned based on the integrated model. Specifically, the exploit components in the to-be-tested traffic can be identified and positioned based on the integrated model including expert knowledge, a convolutional neural network and wavelet transform, so as to obtain the exploit components in the to-be-tested traffic and the corresponding distribution features.

[0068] Specifically, referring to Figure 5 As shown, when the integrated model including expert knowledge, a convolutional neural network and wavelet transform is used to identify and position the exploit components in the to-be-tested traffic, the to-be-tested traffic is first subjected to data stream analysis, grayscale imaging and threshold analysis, and then is input into the attack component identification and positioning module based on expert knowledge, the attack component identification and positioning module based on texture features of Region-CNN and the attack component identification and positioning module based on wavelet transform frequency domain feature analysis. Then, the exploit components identified by each module are integrated and analyzed to obtain the corresponding exploit component identification result, and then the feature vectors of the exploit components, such as the number, name and relative position of the components, are obtained.

[0069] For the identification and positioning of exploit components based on expert knowledge, it needs to be pointed out that simple exploits have high recognizability on attack statements, so for exploit samples with obvious attack statements and high recognition degree of code reuse addresses, expert knowledge can be directly used to match and position the exploit components in the test traffic. For example, in the Win2003 SP1 English version system, the VirtualProtect() function memory address 0x7c83e413 for implementing the DEP (Data Execution Prevention) function, the HeapCreate() function memory address 0x6f901286 for opening executable memory in WinXP SP3 English version, the general ROP (including pop operation assembly code for each register) position in Linux x64 system, and the _libc_csu_init function memory address 0x040061a.

[0070] For the identification and positioning of exploit components based on convolutional neural networks, it needs to be pointed out that exploit components exhibit local fluctuations and traceable texture characteristics in image representation, especially in the same execution environment. The address regions of ROPGadget are similar or have certain semantic convergence, so they may be similar in memory address and have similar texture characteristics. Therefore, different exploit patterns can be identified according to the texture characteristics. For more complex exploits, the entire exploit sample can be mapped to a grayscale image according to the special fluctuation rule of the data domain value of the specific exploit component, and the convolutional neural network (CNN) can be used to identify and position the exploit components in the test traffic based on the local texture sensitivity.

[0071] For the identification and positioning of exploit components based on wavelet transform, it needs to be pointed out that the code reuse segment takes values from a fixed region of memory address segment, so there are similar value ranges in its values, such as the special fluctuation pattern of the ROP chain in the value domain, and after Fourier transform, it presents the form of short-time high-frequency pulse signal different from the background frequency domain, and this frequency domain signal form reflects the characteristics of different exploit components. In addition, the wavelet transform based on variable window frequency domain transformation can effectively find short ROP chains and return their positions, so according to this characteristic, the frequency domain characteristics signature of different exploit components can be established by pre-analyzing and sampling the exploit sample library. In this way, in actual application, only the frequency domain characteristics in the wavelet analysis result of the test traffic and the frequency domain characteristics signature need to be compared to identify and position the potential exploit components.

[0072] Step S25: Use the feature bag model to perform histogram vector representation of the traffic exploitation component and the exploitation pattern to obtain the corresponding traffic histogram vector and pattern histogram vector.

[0073] In this embodiment, after identifying and locating the exploit components in the traffic under test, and obtaining the distribution characteristics of the exploit components and their distribution characteristics, the feature bag model can be used to convert the exploit components and exploit patterns into histogram vectors, resulting in the corresponding histogram vectors of the traffic under test and the pattern histogram vectors. For details, see... Figure 6 As shown, when using the bag-of-features model to represent different exploitation patterns, some exploitation samples can be randomly collected from the exploitation sample library as training samples. Then, the exploitation components in the training samples are represented as component vectors. Next, a clustering algorithm is used to divide these component vectors into K classes, where K is an integer greater than 2, which can be determined empirically. Each class can represent a type of exploitation component, thus obtaining the trained clustering model. This clustering model can classify the components in any exploitation sample into K classes. Finally, see... Figure 7 As shown, the component vectors of all exploit components in the exploit pattern library are input into the trained clustering model, and the frequency of each component in the exploit pattern is counted to obtain a histogram vector. It can be understood that each dimension in the histogram vector represents the frequency of occurrence of a certain exploit component. In practical applications, the component vectors of the exploit components of the traffic to be tested can be directly input into the trained clustering model, and the frequency of occurrence of each of the exploit components of the traffic to be tested can be counted to obtain the corresponding histogram vector of the traffic to be tested.

[0074] Step S26: Using a pre-created traffic exploit component sub-model, the histogram vector of the traffic to be tested is mapped to a vector space with semantic features as coordinate dimensions to obtain the feature vector of the traffic exploit component to be tested; wherein, the traffic exploit component sub-model is a neural network model with the same structure but different parameters, which is pre-created for the exploit components in the traffic to be tested.

[0075] In this embodiment, a sub-model with the same structure but different parameters is pre-established for the traffic exploitation components in the traffic to be tested, namely the traffic exploitation component sub-model. This sub-model can extract the deep semantics of the exploitation components in the traffic to be tested. Specifically, after obtaining the histogram vector of the traffic to be tested and the pattern histogram vector, the traffic exploitation sub-model can be used to map the histogram vector of the traffic to be tested to a vector space with semantic features as coordinate dimensions, thereby obtaining the feature vector of the exploitation component in the traffic to be tested.

[0076] Step S27: mapping the mode histogram vector to a vector space with semantic features as coordinate dimensions by using a pre-created exploit pattern sub-model to obtain a feature vector of the exploit pattern; the exploit pattern sub-model is a neural network model with the same structure but different parameters pre-created for the exploit pattern.

[0077] In this embodiment, a neural network model with the same structure but different parameters is constructed for each type of exploit pattern to obtain n exploit pattern sub-models, where n is the number of exploit patterns, and the exploit pattern sub-models can extract deep semantics of the exploit patterns. Specifically, the exploit pattern sub-models are used to map the mode histogram vector to a vector space with semantic features as coordinate dimensions to obtain a feature vector of the exploit pattern.

[0078] Step S28: calculating the similarity between the feature vector of the exploit component in the to-be-tested traffic and the feature vector of the exploit pattern by using a multi-channel deep matching model based on DSSM to obtain a vulnerability attack detection result of the exploit component in the to-be-tested traffic.

[0079] In this embodiment, the multi-channel deep matching model based on DSSM can calculate the similarity between the feature vector of the exploit component in the to-be-tested traffic and the feature vector of the exploit pattern to obtain a detection result with high confidence.

[0080] It can be seen that the embodiments of the present application propose the concept of exploit pattern, use the attributes and distribution characteristics of exploit components to describe the exploit pattern, and vectorize the exploit pattern. Unsupervised learning is used, and a clustering algorithm is used to extract exploit patterns in exploit samples to obtain the best decision interface of different exploit patterns. An integrated model including expert knowledge, convolutional neural network and wavelet transform is used to identify and locate exploit components in to-be-tested traffic, so as to realize detection of vulnerability attacks. Since the feature code of the vulnerability attack is not required, the embodiments of the present application can detect various types of unknown vulnerability attacks.

[0081] Correspondingly, the embodiments of the present application also disclose a vulnerability attack detection device, as shown in Figure 8 The device comprises:

[0082] An information extraction module 11 is configured to extract the attributes and distribution characteristics of exploit components in exploit samples to obtain exploit patterns.

[0083] The identification and positioning module 12 is configured to identify and position the exploit components in the to-be-tested traffic, to obtain the exploit components in the to-be-tested traffic and distribution characteristics of the exploit components in the to-be-tested traffic.

[0084] The exploit attack detection module 13 is configured to perform exploit attack detection on the exploit components in the to-be-tested traffic by using the distribution characteristics of the exploit components in the to-be-tested traffic and the characteristics of the exploit patterns and based on a deep matching model.

[0085] In the foregoing embodiments, the specific working procedures of the modules can refer to the corresponding content disclosed in the foregoing embodiments, which will not be described herein again.

[0086] It can be seen that in the embodiments of the present application, the properties and distribution characteristics of the exploit components in the exploit samples are extracted to obtain exploit patterns, then the exploit components in the to-be-tested traffic are identified and positioned to obtain the exploit components in the to-be-tested traffic and the distribution characteristics of the exploit components in the to-be-tested traffic, and then the exploit attack detection is performed on the exploit components in the to-be-tested traffic by using the distribution characteristics of the exploit components in the to-be-tested traffic and the characteristics of the exploit patterns and based on a deep matching model. The embodiments of the present application propose the concept of exploit patterns, and the exploit attack detection can be performed through the exploit patterns. Since the exploit attack code is not required, the unknown exploit attack can be detected, and the exploit attack detection of multiple types is applicable.

[0087] In some specific embodiments, the information extraction module 11 can specifically include:

[0088] The feature vector clustering unit is configured to cluster the feature vectors of the exploit samples by using unsupervised learning, to obtain the exploit patterns.

[0089] In some specific embodiments, the feature vector clustering unit can specifically include:

[0090] The information extraction unit is configured to extract all the exploit components in the exploit samples, and obtain the properties and distribution characteristics of the exploit components to obtain the feature vectors of the exploit samples.

[0091] The vector projection unit is configured to project the feature vectors to a latent space by using an encoding-decoding model, to obtain the latent space vectors of the exploit samples.

[0092] The latent space vector division unit is configured to divide the latent space vectors into a preset number of regions based on a clustering algorithm, and take the latent space vectors in the same region as the same exploit pattern, to obtain multiple different exploit patterns including the properties.

[0093] In some specific embodiments, the identification and positioning module 12 may specifically include:

[0094] The first identification and localization unit is used to identify and locate the vulnerability exploitation components in the traffic under test based on the integrated model, and to obtain the vulnerability exploitation components in the traffic under test and the distribution characteristics of the vulnerability exploitation components in the traffic under test.

[0095] In some specific embodiments, the first identification and positioning unit may specifically include:

[0096] The second identification and localization unit is used to identify and localize the exploit components in the traffic under test based on an integrated model including expert knowledge, convolutional neural networks and wavelet transform, so as to obtain the exploit components in the traffic under test and the distribution characteristics of the exploit components in the traffic under test.

[0097] In some specific embodiments, the vulnerability attack detection module 13 may specifically include:

[0098] The histogram vector representation unit is used to represent the exploit component and the exploit pattern of the traffic under test using the feature bag model, so as to obtain the corresponding histogram vector of the traffic under test and the histogram vector of the pattern.

[0099] The first similarity calculation unit is used to calculate the similarity between the histogram vector of the traffic to be tested and the histogram vector of the pattern using a multi-channel deep matching model based on DSSM, so as to detect the vulnerability attacks of the exploit components in the traffic to be tested.

[0100] In some specific embodiments, the first similarity calculation unit may specifically include:

[0101] The first vector mapping unit is used to map the traffic histogram vector to be tested to a vector space with coordinate dimensions as semantic features using a pre-created traffic vulnerability exploitation component sub-model, thereby obtaining the feature vector of the traffic vulnerability exploitation component to be tested.

[0102] The second vector mapping unit is used to map the pattern histogram vector to a vector space with semantic features as coordinate dimensions using a pre-created vulnerability exploitation pattern sub-model, so as to obtain the feature vector of the vulnerability exploitation pattern.

[0103] The second similarity calculation unit is configured to calculate the similarity between the feature vector of the to-be-tested traffic exploit component and the feature vector of the exploit pattern by using a multi-channel deep matching model established based on the DSSM, so as to obtain the exploit attack detection result of the exploit component in the to-be-tested traffic. The traffic exploit component sub-model is a neural network model with the same structure but different parameters, which is created in advance for the exploit component in the to-be-tested traffic. The exploit pattern sub-model is a neural network model with the same structure but different parameters, which is created for the exploit pattern.

[0104] Further, the embodiment of the present application further discloses an electronic device, Figure 9 FIG. 1 is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the contents in the figure should not be considered as any limitation on the use range of the present application.

[0105] Figure 9 A structural diagram of an electronic device 20 is provided in the embodiment of the present application. The electronic device 20 can specifically include at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is configured to store a computer program, and the processor 21 is configured to load and execute the computer program to implement the related steps in the exploit attack detection method disclosed in any of the preceding embodiments. In addition, the electronic device 20 in the embodiment can be an electronic computer.

[0106] In the embodiment, the power supply 23 is configured to provide working voltage for each hardware device on the electronic device 20. The communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the present application, which is not limited here. The input / output interface 25 is configured to obtain external input data or output data to the outside, and the specific interface type can be selected according to the specific application needs, which is not limited here.

[0107] In addition, the memory 22 as a carrier for resource storage can be a read-only memory, a random access memory, a magnetic disk, or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage mode can be temporary storage or permanent storage.

[0108] The operating system 221 is configured to manage and control each hardware device on the electronic device 20 and the computer program 222, which can be Windows Server, Netware, Unix, Linux, etc. The computer program 222 can further include computer programs capable of performing other specific work in addition to the computer programs capable of performing the vulnerability attack detection method disclosed in any of the foregoing embodiments and executed by the electronic device 20.

[0109] Further, the present application also discloses a computer readable storage medium for storing a computer program; wherein the computer program is executed by a processor to implement the vulnerability attack detection method disclosed above. For the specific steps of the method, please refer to the corresponding content disclosed in the foregoing embodiments, which will not be described here.

[0110] Each embodiment in the present specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. For the same or similar parts between each embodiment, please refer to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and please refer to the method part for the relevant part.

[0111] The skilled person can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. In order to clearly show the interchangeability of hardware and software, the composition and steps of each example have been described in the above description. Whether the functions are realized by hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0112] The steps of the method or algorithm described in combination with the embodiments disclosed herein can be directly implemented by hardware, software modules executed by a processor, or a combination of both. The software modules can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0113] Finally, it needs to be pointed out that in this document, relational terms such as first and second and the like can only be intended to distinguish one entity or operation from another entity or operation without necessarily requiring or implying any such actual relationship or order between such entities or operations. Moreover, the terms "comprising", "including", or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by the statement "comprising a" does not exclude the existence of additional identical elements in the process, method, article, or apparatus including the stated element.

[0114] The above describes in detail a vulnerability attack detection method, device, equipment and storage medium provided by the present application. The principles and implementation manners of the present application are described by applying specific examples. The above example description is only used to help understand the method and core idea of the present application. Meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manner and application range can be changed. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A vulnerability attack detection method, characterized in that, include: The attributes and distribution characteristics of the exploit components in the exploit samples are extracted to obtain the exploit patterns. The vulnerability exploitation components in the traffic to be tested are identified and located to obtain the vulnerability exploitation components in the traffic to be tested and their distribution characteristics. The vulnerability exploitation components in the traffic under test are detected by utilizing the distribution characteristics of the vulnerability exploitation patterns and the characteristics of the vulnerability exploitation patterns, and by using a deep matching model. The method of detecting vulnerability attacks by utilizing the distribution characteristics of the vulnerability exploitation components in the traffic under test and the characteristics of the vulnerability exploitation patterns, and based on a deep matching model, includes: using a feature bag model to represent the vulnerability exploitation components and the vulnerability exploitation patterns in the traffic under test as histogram vectors, obtaining the corresponding histogram vectors of the traffic under test and the pattern histogram vectors; and using a multi-channel deep matching model based on DSSM to calculate the similarity between the histogram vectors of the traffic under test and the pattern histogram vectors, so as to detect vulnerability attacks by the vulnerability exploitation components in the traffic under test. Each dimension of the histogram vector represents the frequency of occurrence of a vulnerability exploit component. The distribution characteristics of the vulnerability exploit components include the component's category, size, quantity, and location.

2. The vulnerability attack detection method according to claim 1, characterized in that, The extraction of attributes and distribution characteristics of exploit components in the exploit samples to obtain exploit patterns includes: Unsupervised learning is used to cluster the feature vectors of vulnerability exploitation samples to obtain vulnerability exploitation patterns.

3. The vulnerability attack detection method according to claim 2, characterized in that, The method of clustering feature vectors of vulnerability exploitation samples using unsupervised learning to obtain vulnerability exploitation patterns includes: Extract all exploit components from the exploit sample and obtain the attributes and distribution characteristics of the exploit components to obtain the feature vector of the exploit sample. The feature vector is projected into the latent space using an encoder-decoder model to obtain the latent space vector of the vulnerability exploitation sample; The latent space vector is divided into a preset number of regions based on a clustering algorithm, and the latent space vectors in the same region are regarded as the same vulnerability exploitation mode, resulting in multiple different vulnerability exploitation modes including the attribute.

4. The vulnerability attack detection method according to claim 1, characterized in that, The process of identifying and locating exploit components in the traffic under test, and obtaining the exploit components and their distribution characteristics, includes: Based on the ensemble model, the vulnerability exploitation components in the traffic under test are identified and located, and the vulnerability exploitation components in the traffic under test and their distribution characteristics are obtained.

5. The vulnerability attack detection method according to claim 4, characterized in that, The method of identifying and locating exploit components in the traffic under test based on the ensemble model, and obtaining the exploit components in the traffic under test and their distribution characteristics, includes: Based on an integrated model that includes expert knowledge, convolutional neural networks, and wavelet transform, the vulnerability exploitation components in the traffic under test are identified and located, and the vulnerability exploitation components and their distribution characteristics are obtained.

6. The vulnerability attack detection method according to claim 1, characterized in that, The method of using a multi-channel deep matching model based on DSSM to calculate the similarity between the histogram vector of the traffic under test and the histogram vector of the pattern, in order to detect vulnerability attacks by exploit components in the traffic under test, includes: By using a pre-created sub-model of the traffic vulnerability exploit component, the histogram vector of the traffic to be tested is mapped to a vector space with semantic features as coordinate dimensions, thus obtaining the feature vector of the traffic vulnerability exploit component to be tested. The pattern histogram vector is mapped to a vector space with coordinate dimensions as semantic features using a pre-created vulnerability exploitation pattern sub-model to obtain the feature vector of the vulnerability exploitation pattern. The similarity between the feature vector of the vulnerability exploitation component in the traffic under test and the feature vector of the vulnerability exploitation pattern is calculated using a multi-channel deep matching model based on DSSM, so as to obtain the vulnerability attack detection result of the vulnerability exploitation component in the traffic under test; wherein, the traffic vulnerability exploitation component sub-model is a neural network model with the same structure but different parameters that is created in advance for the vulnerability exploitation component in the traffic under test, and the vulnerability exploitation pattern sub-model is a neural network model with the same structure but different parameters that is created in advance for the vulnerability exploitation pattern.

7. A vulnerability attack detection device, characterized in that, include: The information extraction module is used to extract the attributes and distribution characteristics of the exploit components in the exploit samples to obtain the exploit patterns. The identification and localization module is used to identify and locate the exploit components in the traffic under test, and to obtain the exploit components in the traffic under test and the distribution characteristics of the exploit components in the traffic under test. The vulnerability attack detection module is used to detect vulnerability attacks on the vulnerability exploitation components in the traffic under test by utilizing the distribution characteristics of the vulnerability exploitation components and the characteristics of the vulnerability exploitation mode, and based on a deep matching model. The vulnerability attack detection module is specifically used to use the feature bag model to represent the vulnerability exploitation components and the vulnerability exploitation patterns of the traffic to be tested as histogram vectors, so as to obtain the corresponding histogram vectors of the traffic to be tested and the pattern histogram vectors; and to use a multi-channel deep matching model based on DSSM to calculate the similarity between the histogram vectors of the traffic to be tested and the pattern histogram vectors, so as to detect the vulnerability attacks of the vulnerability exploitation components in the traffic to be tested. Each dimension of the histogram vector represents the frequency of occurrence of a vulnerability exploit component. The distribution characteristics of the vulnerability exploit components include the component's category, size, quantity, and location.

8. An electronic device, characterized in that, It includes a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the vulnerability attack detection method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein, when the computer programs are executed by a processor, they implement the vulnerability attack detection method as described in any one of claims 1 to 6.

Images