An attack payload generation method and device, electronic equipment and storage medium

Abstract

The application relates to an attack load generation method and device, electronic equipment and a storage medium, wherein the attack load generation method comprises the following steps: obtaining existing attack samples to form an attack sample pool, and splitting the attack samples in the attack sample pool to obtain attack load fragments; generating an attack fragment graph according to the attack load fragments, wherein the nodes on the attack fragment graph are the attack load fragments, and the weight of the edges is the number of times of connecting two attack load fragments in sequence; classifying the nodes on the attack fragment graph, and generating new attack loads according to the attack fragment graph with classification to perform WAF bypass testing; and adding the new attack loads to the attack sample pool after the new attack loads successfully bypass the WAF. The application can effectively detect the defense capability of the WAF, find the weaknesses and configuration omissions of the WAF, and thus improve the defense capability of the WAF.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to an attack payload generation method and device, electronic equipment and storage medium. BACKGROUND

[0002] The main function of a Web Application Firewall (WAF) is to identify and block various network attacks, such as SQL injection (SQLi), cross-site scripting (XSS), cross-site request forgery (CSRF), etc. In recent years, with the continuous upgrading of network attack means, traditional rule-based WAFs have been unable to meet the needs of modern network security, so how to improve the defense capabilities of WAFs has become the current research focus. Attackers may use various means to bypass WAFs, such as using encoding, encryption, etc. to hide attack payloads. This requires WAFs to be able to identify and block these bypass means. However, existing WAF systems often cannot effectively handle these problems. In order to solve these problems, researchers have proposed many new methods and technologies. For example, using machine learning methods to automatically identify and block new attack means, using deep learning methods to identify and block means to bypass WAFs, etc. However, these methods and technologies often require a large amount of data and computing resources, and may introduce new security problems. For example, machine learning models may be exploited by attackers by inputting specific data to mislead the model, making it unable to correctly identify attacks.

[0003] Therefore, the present application provides an attack payload generation method, device, electronic equipment and storage medium. SUMMARY

[0004] (1) Technical problem to be solved

[0005] The present application provides an attack payload generation method, device, electronic equipment and storage medium, and the technical problem to be solved is how to detect configuration defects of WAFs and improve the defense capabilities of WAFs.

[0006] (2) Technical solutions

[0007] In a first aspect, the present application provides an attack payload generation method, comprising:

[0008] Obtaining existing attack samples to form an attack sample pool, and splitting the attack samples in the attack sample pool to obtain attack payload fragments;

[0009] Generating an attack fragment graph according to the attack payload fragments, wherein the nodes on the attack fragment graph are attack payload fragments, and the weight of the edges is the number of times of connecting two attack payload fragments in sequence;

[0010] Classify the nodes on the attack fragment graph, and generate a new attack payload according to the classified attack fragment graph to perform a WAF bypass test;

[0011] After the new attack payload successfully bypasses the WAF, the new attack payload is added to the attack sample pool.

[0012] Further, the classification of the nodes on the attack fragment graph comprises:

[0013] Classify the nodes on the attack fragment graph, and aggregate nodes of the same type together to form a plurality of cluster nodes, and label each node according to cluster information.

[0014] Further, the generation of a new attack payload according to the classified attack fragment graph to perform a WAF bypass test comprises:

[0015] According to the classification of each node on the attack fragment graph, a cluster node graph is generated, and the cluster node graph comprises a plurality of cluster nodes.

[0016] Calculate the weighted in-degree of each cluster node, and select a starting node of a cluster node path in the cluster nodes as a current node according to the weighted in-degree.

[0017] Calculate the weighted out-degree of a direct node with the current node as the starting node, and select a next node of a cluster node path in the cluster nodes according to the weighted out-degree.

[0018] Replace the cluster nodes on the obtained cluster node path with attack fragment nodes to generate a new attack payload to perform a WAF bypass test.

[0019] Further, the replacement of the cluster nodes with attack fragment nodes comprises:

[0020] Calculate the importance of each attack fragment node corresponding to the cluster node, and select a preset number of attack fragment nodes as backup attack fragment nodes according to the importance.

[0021] Replace the cluster node with an attack fragment node in the backup attack fragment nodes.

[0022] Further, after the generation of a new attack payload according to the classified attack fragment graph to perform a WAF bypass test, the method further comprises:

[0023] After the new attack payload successfully bypasses the WAF, replace the used attack fragment nodes with unused attack fragment nodes in the backup attack fragment nodes to generate a new attack payload.

[0024] Further, after generating a new attack payload according to the attack fragment graph with classification to perform WAF bypass testing, the method further comprises:

[0025] After the new attack payload successfully bypasses the WAF, distances of paths from each other cluster node to the current cluster node are calculated;

[0026] According to the distances, other cluster nodes are selected to replace cluster nodes on the path of the current cluster node, and a new cluster node path is generated;

[0027] According to the new cluster node path, a new attack payload is generated again.

[0028] In a second aspect, the present application provides an attack payload generation device, comprising:

[0029] A sample splitting module is configured to obtain existing attack samples to form an attack sample pool, and split the attack samples in the attack sample pool to obtain attack payload fragments;

[0030] A first generation module is configured to generate an attack fragment graph according to the attack payload fragments, wherein nodes on the attack fragment graph are attack payload fragments, and weights of edges are times of connection of two attack payload fragments in sequence;

[0031] A second generation module is configured to classify the nodes on the attack fragment graph, and generate a new attack payload according to the attack fragment graph with classification to perform WAF bypass testing;

[0032] A payload adding module is configured to add the new attack payload to the attack sample pool after the new attack payload successfully bypasses the WAF.

[0033] In a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the attack payload generation method as described above when executing the computer program.

[0034] In a fourth aspect, the present application provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executable on a processor to implement the attack payload generation method as described above.

[0035] (3) Advantageous Effects

[0036] The above technical solutions of the present application have the following advantages:

[0037] The attack payload generation method provided by the first aspect of the application can detect the configuration perfection degree of the WAF by generating an attack payload, and improve the defense capability of the WAF. This method can not only effectively detect the defense capability of the WAF, but also help the tester better understand and prevent network attacks, so as to find the weaknesses and configuration omissions of the WAF and propose corresponding improvement measures, thereby improving the defense capability of the WAF.

[0038] It can be understood that the beneficial effects of the second aspect, the third aspect and the fourth aspect described above can be referred to the related description in the first aspect described above, and will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0040] Figure 1 The flowchart of the attack payload generation method provided by the present application is shown in the figure;

[0041] Figure 2 The structure diagram of the attack payload generation device provided by the present application is shown in the figure;

[0042] Figure 3 The structure diagram of the electronic device provided by the present application is shown in the figure. DETAILED DESCRIPTION

[0043] In the following description, specific details such as specific system structures, techniques, etc. are presented in order to thoroughly understand the embodiments of the present application. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits and methods are omitted to avoid unnecessary details that hinder the description of the present application.

[0044] It should be understood that when used in the specification and claims of the present application, the term "comprising" indicates the presence of the described features, whole, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, whole, steps, operations, elements, components and / or sets thereof.

[0045] In addition, in the description of the specification and the appended claims of the present application, the terms "first", "second", "third" and the like are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0046] Reference to "one embodiment" or "some embodiments" or "one implementation" or "some implementations" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. The appearances of the phrase "in one embodiment" or "in some embodiments" or "in one implementation" or "in some implementations" in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily referring to some, but not all, embodiments. The terms "including," "comprising," "having" and variations thereof mean "including but not limited to," unless expressly specified otherwise. "A plurality" means "two or more."

[0047] In the digital age, network security has become an important issue. Web Application Firewall (WAF) plays a crucial role in this scenario, effectively preventing malicious attacks and protecting website data security. The main function of WAF is to identify and block various network attacks such as SQL injection (SQLi), Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), etc. In recent years, with the continuous upgrading of network attack methods, traditional rule-based WAF has been unable to meet the needs of modern network security, therefore, how to improve the defense capability of WAF has become the current research focus.

[0048] However, the current WAF system faces many challenges. First, due to the diversity of network attack methods, WAF needs to be able to deal with various types of attacks. For example, SQL injection attack is a common network attack method, attackers try to obtain sensitive information in the database by inserting malicious SQL code in the input field. In order to prevent such attacks, WAF needs to be able to identify and block malicious SQL code. However, attackers may use various means to bypass WAF, such as using encoding, encryption, etc. to hide attack payloads. This requires WAF to be able to identify and block these bypass methods. However, existing WAF systems often cannot effectively handle these problems.

[0049] In order to solve these problems, researchers have proposed many new methods and technologies. For example, using machine learning methods to automatically identify and block new attack methods, using deep learning methods to identify and block WAF bypass methods, etc. However, these methods and technologies often require a large amount of data and computing resources, and may introduce new security problems. For example, the machine learning model may be exploited by attackers, by inputting specific data to mislead the model, so that it cannot correctly identify attacks.

[0050] In order to explore a wider range of attack payloads, more attack payloads of the same kind, and automatically learn new features, obtain more attack payloads bypassing the network application firewall, and then optimize the defense configuration of the WAF, the application provides an attack payload generation method, which generates attack payloads to detect the configuration perfection degree of the WAF, and improves the defense capability of the WAF. This method not only can effectively detect the defense capability of the WAF, but also can help the tester to better understand and prevent network attacks, so as to find the weaknesses and configuration omissions of the WAF, and propose corresponding improvement measures, thereby improving the defense capability of the WAF.

[0051] The specific embodiments of the application will be further described in detail below in combination with the drawings and examples. The following examples are used to illustrate the application, but not to limit the scope of the application.

[0052] As shown in Figure 1 The attack payload generation method provided by the embodiment includes:

[0053] S100, obtaining existing attack samples to form an attack sample pool, and splitting the attack samples in the attack sample pool to obtain attack payload fragments.

[0054] In application, existing attack samples can be collected to form an attack sample pool. In order to improve the success rate of bypassing the WAF, the target should be as rich as possible, which can include attack samples that have been detected and have not been detected, and can include attack samples with modification ability to attack targets and only query, and can also include scripts of different injection attacks, such as XSS and SQLi.

[0055] When collecting existing attack samples, these samples can bypass the WAF, or can be blocked by the WAF; can have attack ability, or can be harmless to the website related equipment. Injection attack samples can be generated for the website backend database, and XSS attack samples can be generated for mobile terminals, PCs and other equipment. In order to improve the coverage of bypassing the WAF, the collected attack samples can include SQLi injection samples, and can also include XSS injection samples.

[0056] In order to improve the attack ability and test the defense effect of the WAF, the attack samples collected by the tester can contain the code characteristics, framework characteristics and software characteristics of the attack target as much as possible, and according to the version characteristics, cover the attack samples abandoned by the old version and the attack samples added by the new version. For example, the attack samples can contain common keywords such as SELECT and OR, and can also contain new keywords such as ALWAYS and CTE. The samples in the attack sample pool can be dynamically updated, the attack samples that bypass the WAF in the test process can be put into the attack payload pool, and the tester can obtain and add at any time through other ways.

[0057] The attack samples in the attack sample pool can be split to obtain ordered attack load fragments. The attack load fragments are spliced according to the original order to obtain the original attack sample. The attack sample can be divided into ordered multiple attack load fragments by using database query language keywords or programming language keywords as the splitting basis. For example, SELECT password FROM user WHERE id=1 can be split into 6 fragments of SELECT, password, FROM, user, WHERE, and id=1, which are ordered and can be spliced into the original attack load according to the original order. Modified natural language processing (NLP) techniques can also be used for code splitting, such as using n-gram models for splitting. Such splitting can be fully automatic without human intervention to set keywords. The specific splitting method is not limited in the present application, and can be flexibly set according to the requirements.

[0058] S200, generating an attack fragment graph according to the attack load fragments. The nodes on the attack fragment graph are attack load fragments, and the weight of the edge is the number of times of connection between two attack load fragments.

[0059] In the application, all ordered attack load fragments can be integrated to form a weighted directed graph, i.e., an attack fragment graph. The nodes on the attack fragment graph are attack load fragments, and the weight of the edge is the number of times of connection between two attack load fragments.

[0060] The attack fragment graph is a weighted directed graph, and each node on the graph is an attack load fragment. The order of the ordered multiple attack load fragments obtained by splitting each attack sample is a directed edge on the graph, and the weight of each directed edge is the number of times of direct connection between two attack load fragments. For example, for (SELECT, password, FROM, user) obtained by splitting SELECT password FROM user, and for (SELECT, *, FROM, user, WHERE, id=1) obtained by splitting SELECT*FROM user WHERE id=1, there is one directed edge between (SELECT, password) with a weight of 1, and there is one directed edge between (FROM, user) with a weight of 2.

[0061] S300, classifying the nodes on the attack fragment graph, and generating new attack loads according to the classified attack fragment graph to perform WAF bypass testing.

[0062] In the application, the nodes on the attack fragment graph can be classified, the nodes of the same type are aggregated together to form multiple node clusters, and each node is labeled according to the cluster information. Based on the classified attack fragment graph, a new attack payload is generated and sent to the server for WAF bypass test.

[0063] The same type of nodes on the attack fragment graph have similar meanings and carry similar functions in the attack payload, and can be replaced with each other. On the one hand, in order to cover a wider range of potential attack payloads, different types of attack payload fragments can be used to generate new types of attack payloads that do not exist in the existing attack sample pool, and the defense strategy of the WAF for new types or some types is missing. On the other hand, the same attack payload fragment can be replaced with each other to achieve more attack payloads of the same type, and the WAF defense for some types is missing. Based on the support vector machine (SVM) method, the feature information of each node (node in-degree, node out-degree, connected edge weight, attack fragment information, neighbor attack fragment information, etc.) can be extracted, the feature vector of each node can be calculated, and finally the support vector machine algorithm is used for training. Each path on the attack fragment graph represents an attack payload, and by selecting the path on the graph, a new attack payload is formed and sent to the server for testing.

[0064] S400, after the new attack payload successfully bypasses the WAF, the new attack payload is added to the attack sample pool.

[0065] In the application, if the generated new attack payload can bypass the WAF, the test personnel is reported, and the attack payload is added to the attack sample pool for supplementing the rules.

[0066] The attack payload generation method provided by the embodiment of the application provides rules for generating new attack payloads by dynamically updating the attack sample pool; all attack payloads in the attack sample pool are split to obtain ordered attack payload segments; by integrating the ordered attack payload segments, a weighted directed graph, i.e., an attack fragment graph, is formed; the nodes of the attack fragment graph are classified to form multiple node clusters on the graph; finally, by selecting the path on the attack fragment graph, a new attack payload is generated and tested.

[0067] Such an embodiment can automatically discover new WAF bypass attack payload types, improve the success rate of bypassing WAF, and discover new features introduced in new versions of network application servers in a timely manner, on the one hand, by a dynamically updated attack sample pool without manual configuration rules, and by adding new attack samples. On the other hand, through node classification, different attack payloads of the same type can be obtained by replacing different nodes of the same type, and different attack payloads can be obtained by replacing nodes of different types, and attack payloads bypassing WAF can be found through two dimensions of breadth and depth.

[0068] In some embodiments, the method further includes: generating a cluster node graph according to the classification of each node on the attack shard graph, the cluster node graph including a plurality of cluster nodes; calculating a weighted in-degree of each cluster node, and selecting a starting node of a cluster node path as a current node according to the weighted in-degree; calculating a weighted out-degree of a direct node with the current node as a starting node, and selecting a next node of the cluster node path according to the weighted out-degree; and replacing the cluster nodes on the obtained cluster node path with attack shard nodes to generate a new attack payload for WAF bypass testing.

[0069] In some embodiments, the method further includes: calculating the importance of each attack shard node corresponding to the cluster node, selecting a preset number of attack shard nodes as backup attack shard nodes according to the importance, and replacing the cluster node with an attack shard node in the backup attack shard nodes.

[0070] In an application, each path on the attack shard graph corresponds to a new attack payload, such as the attack shard graph A->B->C, and the possible attack payloads are A, A->B, A->B->C, B, B->C, and C. It can be predicted that the number of attack payloads derived from a large-scale attack shard graph is too large, and testing one by one will greatly reduce the testing efficiency. In order to improve the efficiency of bypassing WAF and find attack payloads that can bypass WAF as quickly as possible, an optimized search method is proposed.

[0071] Specifically, a cluster node graph can be generated according to the classification of each node on the attack shard graph. For the attack shard graph with classification, the subgraph is divided according to the classification cluster, each subgraph is abstracted as a new cluster node, the edges between cluster nodes are the edges of internal nodes of the cluster, and the weight of the edge is the sum of the weights of the nodes. Attack shards of the same type belong to the same cluster and are aggregated into a cluster node in the cluster node graph. For given two cluster nodes i and j, the directed edge <i,j> exists if and only if < m, n > exists. If directed edge < i, j > exists, then weight W(i, j) = ∑we<m,n>, m e i, n e j, we<m,n> is the weight of directed edge from attack fragment m to attack fragment n, and 0 if it does not exist.

[0072] The weighted in-degree of all nodes in the cluster node graph is recalculated. For each cluster node i, its weighted in-degree WIN(i) = ∑w<j,i> is calculated. For all node pairs (j, i), w<j,i> is the weight of directed edge from j to i if it exists, otherwise it is 0. The starting node of the cluster node path L is selected, and all cluster nodes are sorted by weighted in-degree from small to large, and selected as the starting node of the path in order from small to large. The weighted in-degree is negatively related to the likelihood of the current cluster node and the starting node of the cluster node path, so a node is selected as the starting node of the cluster node path L in order from small to large, and this node is selected as the current node i.

[0073] The weighted out-degree of the adjacent nodes of the current node is calculated. For the current node i, the weighted out-degree WOUT(j) = w<i,j> * ∑w<j,k> of the direct node j starting from node i is calculated. For all node pairs (j, k), w<j,k> is the weight of directed edge from j to k if it exists, otherwise it is 0. The next node of the cluster node path L is selected, and all cluster nodes are sorted by weighted out-degree from large to small, and selected as the next node of the current path in order from small to large. The weighted out-degree of the cluster node represents the number of attack loads that can be generated by the current node in the current path, and the larger the value, the more attack loads use this node, and the more attack loads that can exist. Therefore, a node is selected as the next node of the current path L in order from large to small.

[0074] The newly added node is set as i, and the above steps are repeated, and each loop can output a complete cluster node path. Since the cluster node graph may have a loop, the loop may never be jumped out. The maximum length γ of the path L can be set, and the recursion is not continued when the maximum length is reached. If the current node is the starting node and there is no next node, the starting node of the cluster node path L is reselected.

[0075] The cluster nodes are converted into attack shard nodes to generate specific attack payloads. For each cluster node i, the importance of each attack shard node m is calculated, and the calculation method is Q(m) = WOUT(m) + WIN(m). According to the importance ranking, the more important the attack shard node, the higher the success rate of bypassing the WAF, so the attack shard node with high importance is preferentially selected as the replacement of the current cluster node. Since the number of attack shard nodes is too large, a number threshold σ can be set, and only the attack shard nodes with importance in the top σ are considered for generating attack payloads, which are set as backup attack shard nodes. The cluster node path is replaced by the attack shard node to form an attack payload.

[0076] In some embodiments, after generating a new attack payload for WAF bypass testing according to the attack shard graph with band classification, the method further comprises: after the new attack payload successfully bypasses the WAF, replacing the used attack shard node with an unused attack shard node in the backup attack shard node to generate a new attack payload.

[0077] In applications, considering finding more similar attack payloads, based on the attack payload that has successfully bypassed the WAF, a new attack payload can be obtained by reselecting the attack shard node. After the generated new attack payload successfully bypasses the WAF, the specific scheme for searching for similar attack payloads is as follows: for the cluster node path and backup attack shard node generated in the above steps, all backup attack shard nodes are sorted according to the importance Q; according to the importance Q from large to small, the unused backup attack shard node is used to replace the used attack shard node to form a new attack payload.

[0078] The backup attack shard nodes are sorted according to the importance: for all cluster nodes i in the cluster node path L, there are σ backup attack shard nodes, i.e. i*σ backup attack shard nodes. These backup attack shard nodes are sorted according to the importance Q from large to small. Select the replacement node to generate a new attack payload: according to the order from large to small, the unused backup attack shard node is used to replace the attack shard node on the current path to form a new attack shard path, and then spliced into an attack payload. For example, for the existing attack payload path A->B->C, the backup attack payload shards are sorted from large to small as X, Y, Z, which correspond to positions B, B, and C, respectively. The new attack payload paths that can be generated are A->X->C, A->Y->C, and A->B->Z.

[0079] In some embodiments, after generating a new attack payload according to the attack fragment graph classified by the band to perform WAF bypass testing, the method further comprises: after the new attack payload successfully bypasses the WAF, calculating the distance of each other cluster node to the current cluster node path; selecting other cluster nodes to replace the cluster nodes on the current cluster node path according to the distance, generating a new cluster node path; and generating a new attack payload according to the new cluster node path.

[0080] In applications, in order to find more different types of attack payloads, based on the attack payload that has successfully bypassed the WAF, a new attack payload can also be obtained by reselecting cluster nodes. After the generated new attack payload successfully bypasses the WAF, the specific scheme for searching for a new type of attack payload is as follows:

[0081] For the cluster node path generated in the above steps, the distance D(i, L) of all other cluster nodes i to the current cluster node path L is calculated = min{dis(i, j)}, j e L. dis(i, j) is the shortest distance from node i to node j; all cluster nodes are sorted according to the distance L, and other cluster nodes are used to replace the cluster nodes in the current cluster node path L according to the distance L from large to small, to form a new cluster node path L ′ , and finally generate an attack payload according to the new cluster node path.

[0082] Calculate the distance of the cluster node to the cluster node path L: for each node i not on the current cluster node path L, define its distance D(i, L) to the path L = min{dis(i, j)}, j e L. dis(i, j) is the shortest distance from node i to node j. Select a replacement cluster node to generate a new cluster node path: sort all nodes not on the current cluster node path L according to the distance, and use other cluster nodes to replace the cluster nodes in the current cluster node path L in order from large to small, to form a new cluster node path L'.

[0083] For example, for the existing cluster node path A->B->C, the other cluster nodes are sorted by distance from large to small as X, Y, Z, corresponding to positions B, B, and C respectively. The new attack payload paths that can be generated are A->X->C, A->Y->C, and A->B->Z. The method of converting the cluster node path L' into an attack fragment path is the same as described above.

[0084] The application generates a new attack load based on reconstruction of an attack load, can automatically learn the structure in an existing attack load, and reaches a website vulnerability attack load caused by generation of new characteristics and new functions with lower human intervention, thereby improving the success rate of bypassing a WAF. The generation scheme proposed in the application can search for a new attack load from two dimensions of width and depth, can mine attack loads of the same type and find attack loads of different types in an attack sample pool according to the distance definition of attack fragment nodes and cluster nodes, and can cover defense defects of a WAF as much as possible. The search scheme proposed in the application gives an efficient search path in a wide attack sample space, and can find more attack loads in a short time.

[0085] Corresponding to the attack load generation method described in the above embodiments, as shown in the attack load generation device 200 is provided in the embodiments. Figure 2 The attack load generation device 200 includes:

[0086] A sample splitting module 201 is configured to obtain an existing attack sample to form an attack sample pool, and split attack samples in the attack sample pool to obtain attack load fragments.

[0087] A first generation module 202 is configured to generate an attack fragment graph according to the attack load fragments, wherein nodes on the attack fragment graph are attack load fragments, and the weight of an edge is the number of times of connection of two attack load fragments in sequence.

[0088] A second generation module 203 is configured to classify nodes on the attack fragment graph, and generate a new attack load according to the attack fragment graph with classification to perform WAF bypass testing.

[0089] A load adding module 204 is configured to add the new attack load to the attack sample pool after the new attack load successfully bypasses the WAF.

[0090] It should be noted that the information interaction, execution process and the like between the above modules / units are based on the same concept as the method embodiments of the application, and the specific functions and the technical effects brought by the same can be referred to the method embodiments part, which will not be described here.

[0091] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above functional units and modules is taken as an example, and in actual application, the above functions can be completed by different functional units and modules according to needs, that is, the internal structure of the apparatus is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit or module in the embodiment can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit, and the integrated unit can be realized in the form of hardware or in the form of software functional unit. In addition, the specific names of each functional unit or module are only for the convenience of mutual distinction, and do not limit the protection scope of the present application. The specific working process of the unit or module in the system can refer to the corresponding process in the foregoing method embodiment, and will not be repeated here.

[0092] The embodiment of the present application also provides an electronic device 300, as shown in the figure, comprising a memory 301, a processor 302, and a computer program 303 stored in the memory 301 and executable on the processor 302, and the processor 302 implements the steps of the attack load generation method provided in the first aspect when executing the computer program 303. Figure 3

[0093] In application, the electronic device can include, but is not limited to, a processor and a memory, Figure 3 It is only an example of the electronic device and does not constitute a limitation on the electronic device, and can include more or fewer components than shown, or combine certain components, or different components, for example, input / output devices, network access devices, etc. The input / output device can include a camera, an audio acquisition / playback device, a display screen, etc. The network access device can include a network module for wireless network with external devices.

[0094] In application, the processor can be a central processing unit (CPU), and the processor can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0095] ​In applications, the storage can be an internal storage unit of the electronic device, such as a hard disk or a memory of the electronic device, in some embodiments. The storage can also be an external storage device of the electronic device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, and the like, in other embodiments. The storage can include both the internal storage unit and the external storage device of the electronic device. The storage is used to store an operating system, an application program, a boot loader, data, and other programs, such as program codes of computer programs, and the like. The storage can also be used to temporarily store data that has been output or will be output.

[0096] The embodiments of the present application further provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the steps in the above-mentioned various method embodiments.

[0097] The embodiments of the present application implement all or part of the processes in the above-mentioned method embodiments, which can be completed by a computer program instructing related hardware. The computer program can be stored in a computer readable storage medium, and when executed by a processor, the computer program can implement the steps in the above-mentioned various method embodiments. The computer program includes computer program codes, which can be in the form of source code, object code, executable files, or some intermediate forms, etc. The computer readable medium at least includes any entity or device capable of carrying the computer program code to an electronic device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. For example, a U disk, a mobile hard disk, a magnetic disk or an optical disk, etc.

[0098] Those skilled in the art can realize that the devices and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0099] In the embodiments provided by the present application, it should be understood that the disclosed devices and methods can be implemented in other manners. For example, the embodiments of the device described above are merely schematic, and the mutual coupling or direct coupling or communication connection between the shown or discussed elements can be indirect coupling or communication connection through some interfaces; the indirect coupling or communication connection between the elements can be in electrical, mechanical or other forms.

[0100] The above descriptions are merely used to illustrate the technical solutions of the present application, rather than limit the present application; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: they can still make modifications to the technical solutions described in the foregoing embodiments, or make equivalent replacements to some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. An attack payload generation method, characterized by, The method comprises the following steps: An existing attack sample is obtained to form an attack sample pool, and the attack samples in the attack sample pool are split to obtain attack load fragments; An attack fragment graph is generated according to the attack load fragments, wherein the nodes on the attack fragment graph are the attack load fragments, and the weight of the edge is the number of times of connection between two attack load fragments in sequence; The nodes on the attack fragment graph are classified, and a new attack load is generated according to the classified attack fragment graph to perform WAF bypass testing; After the new attack load successfully bypasses the WAF, the new attack load is added to the attack sample pool.

2. The attack payload generation method of claim 1, wherein, The classification of the nodes on the attack fragment graph comprises: The nodes on the attack fragment graph are classified, and nodes of the same type are aggregated together to form a plurality of cluster nodes, and each node is labeled according to cluster information.

3. The attack payload generation method of claim 1, wherein, The WAF bypass testing of the new attack load generated according to the classified attack fragment graph comprises: A cluster node graph is generated according to the classification of each node on the attack fragment graph, wherein the cluster node graph comprises a plurality of cluster nodes; The weighted in-degree of each cluster node is calculated, and a starting node of a cluster node path is selected as a current node according to the weighted in-degree in the cluster nodes; The weighted out-degree of a direct node with the current node as the starting node is calculated, and the next node of the cluster node path is selected according to the weighted out-degree in the cluster nodes; The cluster nodes on the obtained cluster node path are replaced by attack fragment nodes to generate a new attack load for WAF bypass testing.

4. The attack payload generation method of claim 3, wherein, The replacement of the cluster nodes by the attack fragment nodes comprises: The importance of each attack fragment node corresponding to the cluster node is calculated, and a preset number of attack fragment nodes are selected as backup attack fragment nodes according to the importance; The cluster node is replaced by an attack fragment node in the backup attack fragment nodes.

5. The attack payload generation method of claim 4, wherein, After the WAF bypass testing of the new attack load generated according to the classified attack fragment graph, the following steps are further included: After the new attack load successfully bypasses the WAF, an unused attack fragment node in the backup attack fragment nodes is used to replace the used attack fragment node to generate a new attack load.

6. The attack payload generation method of claim 3, wherein, After the WAF bypass testing of the new attack load generated according to the classified attack fragment graph, the following steps are further included: After the new attack load successfully bypasses the WAF, the distance of each other cluster node to the current cluster node path is calculated; According to the distance, an other cluster node is selected to replace the cluster node on the current cluster node path to generate a new cluster node path; According to the new cluster node path, a new attack load is generated.

7. An attack payload generation apparatus characterized by comprising: The method comprises the following steps: A sample splitting module is configured to obtain an existing attack sample to form an attack sample pool, and split the attack samples in the attack sample pool to obtain attack load fragments; A first generation module is configured to generate an attack fragment graph according to the attack load fragments, wherein the nodes on the attack fragment graph are the attack load fragments, and the weight of the edge is the number of times of connection between two attack load fragments in sequence; A second generation module is configured to classify the nodes on the attack fragment graph, and generate a new attack payload based on the classified attack fragment graph for WAF bypass testing. A payload adding module is configured to add the new attack payload to the attack sample pool after the new attack payload successfully bypasses the WAF.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor implements the attack payload generation method of any one of claims 1-6 when executing the computer program.

9. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 8. The computer program implements the attack payload generation method of any one of claims 1-6 when executed by the processor.

Images