Communication protocol vulnerability mining method and system based on generative adversarial network

Abstract

The present invention provides a communication protocol vulnerability mining method and system based on a generative adversarial network, and the method includes: performing hybrid training on a forward feedback network and a support vector machine based on a preset message training data set to generate a generative adversarial network; generating effective test data based on the generative adversarial network, inputting the effective test data into a target test system for operation, and judging whether the target test system has an abnormality; when it is determined that the target test system has an abnormality, judging whether the abnormality is caused by a communication protocol through an abnormality detection result, and if so, mining vulnerabilities in the communication protocol. The present invention generates effective test data based on a generative adversarial network, mines communication protocol vulnerabilities in the target system based on the effective test data, and assists in completing communication protocol vulnerability mining without requiring any structural knowledge of the protocol, effectively improving the efficiency and security of communication protocol vulnerability mining.

Description

Technical Field

[0001] The present invention relates to the technical field of communication protocol vulnerability mining, and in particular to a communication protocol vulnerability mining method and system based on a generative adversarial network. Background Art

[0002] Communication protocol refers to the communication rules agreed upon in advance by the communicating parties, which can be simply understood as the common language used by computers to conduct conversations with each other. In computer communication, communication protocols are used to implement the standards between computers and network connections. If the network does not have a unified communication protocol, the information transmission between computers cannot be recognized. If there are loopholes in the communication protocol, the information between the data ends cannot be transmitted to each other, resulting in the inability of the information system to interact normally. Therefore, the normal operation of the communication protocol is very important in the interaction between ends and systems. However, the existing communication protocol vulnerabilities all require the realization of knowing the protocol type, determining the protocol structure, and then designing a mining solution for the protocol type, resulting in a long detection time for the communication protocol, and the exposure of the protocol structure also increases the communication risk of the target system. Therefore, the present invention proposes a communication protocol vulnerability mining method and system based on a generative adversarial network. Summary of the invention

[0003] The present invention provides a communication protocol vulnerability mining method and system based on a generative adversarial network, which solves the above-mentioned problem and achieves the purpose of communication protocol vulnerability mining and detection without any structural knowledge of the protocol, thereby effectively improving the efficiency and security of communication protocol vulnerability mining.

[0004] The present invention provides a communication protocol vulnerability mining method based on a generative adversarial network, which is characterized by comprising:

[0005] Step 1: Perform hybrid training on the feedforward network and the support vector machine based on the preset message training data set to generate a generative adversarial network;

[0006] Step 2: Generate valid test data based on the generative adversarial network, input the valid test data into the target test system for operation, and determine whether there is any abnormality in the target test system;

[0007] Step 3: When it is determined that the target test system has an anomaly, anomaly detection is performed. Based on the anomaly detection result, it is determined whether the anomaly is caused by the communication protocol. If so, vulnerability mining is performed on the communication protocol, and the communication protocol vulnerability detection result is output.

[0008] Preferably, in a communication protocol vulnerability mining method based on a generative adversarial network, step 1 specifically includes:

[0009] Based on the preset message training data set, the feedback-forward network is trained according to a preset training number of times to obtain a feedback-forward network generation model;

[0010] Obtaining generated data of the forward feedback network generation model during the training process as training generated data, and adding the training generated data to a preset message training data set to generate a new training set;

[0011] Based on the new training set, the support vector machine is trained according to a preset training number of times to obtain a support vector machine judgment model;

[0012] Based on the preset message training data set, the feedback-forward network generation model and the support vector machine judgment model are synchronously merged and trained to obtain a generative adversarial network.

[0013] Preferably, in a communication protocol vulnerability mining method based on a generative adversarial network, a forward feedback network generation model and a support vector machine judgment model are synchronously merged and trained based on a preset message training data set to obtain a generative adversarial network, including:

[0014] Record the synchronous merge training results of each round;

[0015] Compare the current synchronous merging training result with the optimal result to obtain a first effect gain, and when the first effect gain is greater than zero, use the current synchronous merging training result as the optimal result;

[0016] When the first effect gain is less than or equal to zero, the original optimal result is kept unchanged, and it is determined whether the attenuation amplitude value corresponding to the first effect gain is within a preset range;

[0017] If not, then the synchronous merging training is terminated;

[0018] If yes, then continue the next round of synchronous merging training based on the preset message training data set, and while obtaining the second effect gain, compare the previous synchronous merging training result with the next round of synchronous merging training result to obtain the secondary effect gain.

[0019] If the second effect gain is greater than zero, the current synchronous merge training result is taken as the optimal result;

[0020] If the second effect gain is less than or equal to zero, it is determined whether the gain or attenuation amplitude value corresponding to the secondary effect gain is within a preset range;

[0021] If the gain or attenuation amplitude value corresponding to the secondary effect gain is not within the preset range, then the synchronous merging training is terminated;

[0022] Otherwise, the original current optimal result is kept unchanged, and the synchronous merge training is continued based on the preset message training data set.

[0023] Preferably, in a communication protocol vulnerability mining method based on a generative adversarial network, step 2 specifically includes:

[0024] After sending the test data to the generative adversarial network for computational processing, valid test data is generated;

[0025] Input valid test data into the target test system to obtain system operation results;

[0026] Determine whether the system operation result is a system crash or abnormal operation. If so, determine that the target test system has an abnormality;

[0027] Otherwise, the target test system is judged to be normal.

[0028] Preferably, in a communication protocol vulnerability mining method based on a generative adversarial network, step 3 specifically includes:

[0029] After determining that the target test system has an abnormality, confirming the fault type of the target test system and determining whether the abnormality is caused by the communication protocol;

[0030] If yes, any data frame is taken as the initial data frame, and the initial data frame is taken as the starting point, and the communication protocol is compared frame by frame based on the preset data frame database to obtain the comparison result, and the suspected data frame is determined based on the comparison result;

[0031] Compare the suspected data frame with its corresponding standard data frame, etc., to determine the abnormal data frame and vulnerability type corresponding to the communication protocol, and the communication protocol vulnerability detection result;

[0032] Based on the communication protocol vulnerability detection results, an error message is generated and sent to the display page for display.

[0033] Preferably, in a communication protocol vulnerability mining method based on a generative adversarial network, the target test system confirms the fault type, specifically including:

[0034] Obtain system call data corresponding to normal operation of the communication protocol, and determine similar call programs of the target test system based on the system call data;

[0035] Synchronously obtain preset test data, input the preset test data into the similar calling program, obtain the test running result, and if the test running result is normal, determine that the system data of the target test system is normal and the communication protocol is abnormal;

[0036] Otherwise, the system data is determined to be abnormal and the test results are sent to the display segment for display.

[0037] Preferably, in a communication protocol vulnerability mining method based on a generative adversarial network, a suspected data frame is compared with its corresponding standard data frame, etc., to determine the abnormal data frame and vulnerability type corresponding to the communication protocol, and the communication protocol vulnerability detection result specifically includes:

[0038] Compare the suspected data frame with its corresponding standard data frame to obtain abnormal feature data;

[0039] Obtain frame correlation features of all data corresponding to the communication protocol of the suspected data frame, and calculate the correlation degree between each abnormal feature data based on the frame correlation features;

[0040] Based on the correlation degree, determining an abnormal demarcation point, and merging the associated suspected data frames based on the abnormal demarcation point to obtain multiple abnormal frame sets;

[0041] The mutual correlation between each suspected data frame in each abnormal frame set is calculated respectively, and based on the mutual correlation, the abnormality-inducing data frame in each abnormal frame set is determined respectively;

[0042] Extract the abnormal data features corresponding to the abnormality-inducing data frame, and determine the abnormal cause and corresponding vulnerability type corresponding to the abnormal frame set based on the abnormal data features;

[0043] According to the abnormal causes and corresponding vulnerability types corresponding to all abnormal frame sets, the communication protocol vulnerability detection results are generated.

[0044] Preferably, in a communication protocol vulnerability mining method based on a generative adversarial network, while determining the abnormality-inducing data frame in each abnormal frame, it also includes:

[0045] Perform data display association on the abnormality-induced data frame and the remaining suspected data frames in the corresponding abnormal frame set, and synchronously use the abnormality-induced data frame as the abnormal data frame;

[0046] A position corresponding to the abnormal data frame is obtained, a position tag is generated based on the position, and the position tag is automatically inserted into a plurality of vulnerability types included in the communication protocol vulnerability detection result.

[0047] The present invention provides a communication protocol vulnerability mining system based on a generative adversarial network, comprising:

[0048] A network model generation module is used to perform hybrid training on a feedforward network and a support vector machine based on a preset message training data set to generate a generative adversarial network;

[0049] The system anomaly judgment module is used to generate valid test data based on the generative adversarial network, input the valid test data into the target test system for operation, and judge whether there is an anomaly in the target test system;

[0050] The protocol anomaly judgment module performs anomaly detection when it is determined that the target test system has an anomaly. Based on the detection result, it determines whether the anomaly is caused by the communication protocol, and determines the location of the communication protocol anomaly and the type of vulnerability.

[0051] Preferably, in a communication protocol vulnerability mining system based on a generative adversarial network, the network model generation module includes:

[0052] A generation model training unit is used to train the forward feedback network according to a preset number of training times based on a preset message training data set to obtain a forward feedback network generation model;

[0053] A data set updating unit, used to obtain the generated data of the forward feedback network generation model in the training process as training generated data, and add the training generated data to the preset message training data set to generate a new training set;

[0054] The discriminant model training unit is used to train the support vector machine based on the new training set according to a preset training number of times to obtain a support vector machine discriminant model;

[0055] The synchronous merging training unit is used to synchronously merge the training of the forward feedback network generation model and the support vector machine judgment model based on a preset message training data set to obtain a generative adversarial network.

[0056] Compared with the prior art, the present invention has at least the following beneficial effects:

[0057] The present invention performs hybrid training on a feedback-forward network and a support vector machine based on a preset message training data set to generate a generative adversarial network with high generalization ability and robustness, and then generates effective test data based on the generative adversarial network. Based on the effective test data, communication protocol vulnerabilities in the target system are mined, and communication protocol vulnerability mining is assisted without any structural knowledge of the protocol, thereby effectively improving the efficiency and security of communication protocol vulnerability mining.

[0058] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures specifically pointed out in this application document.

[0059] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0061] Figure 1 A flow chart of a communication protocol vulnerability mining method based on a generative adversarial network according to the present invention;

[0062] Figure 2 This is a flowchart of step 1 of a communication protocol vulnerability mining method based on a generative adversarial network of the present invention;

[0063] Figure 3 This is a flowchart of step 2 of a communication protocol vulnerability mining method based on a generative adversarial network according to the present invention;

[0064] Figure 4 This is a schematic diagram of a communication protocol vulnerability mining system based on a generative adversarial network according to the present invention. DETAILED DESCRIPTION

[0065] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0066] Embodiment 1:

[0067] The present invention provides a communication protocol vulnerability mining method based on a generative adversarial network, such as Figure 1 As shown, including:

[0068] Step 1: Perform hybrid training on the feedforward network and the support vector machine based on the preset message training data set to generate a generative adversarial network;

[0069] Step 2: Generate valid test data based on the generative adversarial network, input the valid test data into the target test system for operation, and determine whether there is any abnormality in the target test system;

[0070] Step 3: When it is determined that the target test system has an anomaly, anomaly detection is performed. Based on the anomaly detection result, it is determined whether the anomaly is caused by the communication protocol. If so, vulnerability mining is performed on the communication protocol, and the communication protocol vulnerability detection result is output.

[0071] In this embodiment, multiple message data of the target communication protocol are merged to generate a preset message training data set.

[0072] The beneficial effects of the above technical solution are as follows: the present invention performs hybrid training on the forward feedback network and the support vector machine based on a preset message training data set to generate a generative adversarial network with high generalization ability and robustness, and then generates effective test data based on the generative adversarial network. Based on the effective test data, communication protocol vulnerabilities in the target system are mined, and communication protocol vulnerability mining is assisted without any structural knowledge of the protocol, which effectively improves the efficiency and security of communication protocol vulnerability mining.

[0073] Embodiment 2:

[0074] On the basis of Example 1, step 1, such as Figure 2 As shown, specifically including:

[0075] Based on the preset message training data set, the feedback-forward network is trained according to a preset training number of times to obtain a feedback-forward network generation model;

[0076] Obtaining generated data of the forward feedback network generation model during the training process as training generated data, and adding the training generated data to a preset message training data set to generate a new training set;

[0077] Based on the new training set, the support vector machine is trained according to a preset training number of times to obtain a support vector machine judgment model;

[0078] Based on the preset message training data set, the feedback-forward network generation model and the support vector machine judgment model are synchronously merged and trained to obtain a generative adversarial network.

[0079] In this embodiment, the preset number of training times refers to the total number of training rounds of the forward feedback network.

[0080] In this embodiment, the preset training number two refers to the total training rounds of the support vector machine.

[0081] The beneficial effects of the above technical solution are as follows: the present invention first trains the forward feedback network and the support vector machine separately, and then adopts a hybrid training method for training, which is conducive to giving full play to the randomness of the fuzzy test and can dig out unexpected vulnerabilities in the target test system;

[0082] The generated data of the forward feedback network generation model in the training process is obtained as the training generated data, and the training generated data is added to the preset message training data set to generate a new training set, and then the support vector machine is trained based on the new training set, which is beneficial to improve the generalization ability and robustness of the support vector machine judgment model, thereby improving the generalization ability and robustness of the generative network.

[0083] Embodiment 3:

[0084] On the basis of Example 2, the forward feedback network generation model and the support vector machine decision model are synchronously merged and trained based on a preset message training data set to obtain a generative adversarial network, including:

[0085] Record the synchronous merge training results of each round;

[0086] Compare the current synchronous merging training result with the optimal result to obtain a first effect gain, and when the first effect gain is greater than zero, use the current synchronous merging training result as the optimal result;

[0087] When the first effect gain is less than or equal to zero, the original optimal result is kept unchanged, and it is determined whether the attenuation amplitude value corresponding to the first effect gain is within a preset range;

[0088] If not, then the synchronous merging training is terminated;

[0089] If yes, then continue the next round of synchronous merging training based on the preset message training data set, and while obtaining the second effect gain, compare the previous synchronous merging training result with the next round of synchronous merging training result to obtain the secondary effect gain.

[0090] If the second effect gain is greater than zero, the current synchronous merge training result is taken as the optimal result;

[0091] If the second effect gain is less than or equal to zero, it is determined whether the gain or attenuation amplitude value corresponding to the secondary effect gain is within a preset range;

[0092] If the gain or attenuation amplitude value corresponding to the secondary effect gain is not within the preset range, then the synchronous merging training is terminated;

[0093] Otherwise, the original current optimal result is kept unchanged, and the synchronous merge training is continued based on the preset message training data set.

[0094] In this embodiment, the first effect gain refers to the difference in training effect between the current synchronous combined training result and the optimal result. When the difference is a positive value, the training effect is enhanced, and when the difference is a negative value, the training effect is attenuated.

[0095] In this embodiment, the second effect gain refers to the difference in training effect between the next round of synchronous combined training results and the optimal result.

[0096] The secondary effect gain refers to the difference in training effect between the previous synchronous merge training result (the synchronous merge training result adjacent to the next round of synchronous merge training result that does not become the optimal structure) and the next round of synchronous merge training result.

[0097] The beneficial effects of the above technical solution are as follows: the present invention records the results of each round of synchronous merging training; then compares the current synchronous merging training result with the optimal result to obtain a first effect gain, and when the first effect gain is greater than zero, the current synchronous merging training result is used as the optimal result; when the first effect gain is less than or equal to zero, the original optimal result is kept unchanged, and it is determined whether the attenuation amplitude value corresponding to the first effect gain is within a preset range; if not, the synchronous merging training is terminated; if so, the next round of synchronous merging training is continued based on the preset message training data set, and while obtaining the second effect gain, the previous synchronous merging training result is compared with the next round of synchronous merging training result to obtain the second effect gain. If the second effect gain is greater than zero, the current synchronous merge training result is used as the optimal result; if the second effect gain is less than or equal to zero, it is determined whether the gain or attenuation amplitude value corresponding to the secondary effect gain is within the preset range; if the gain or attenuation amplitude value corresponding to the secondary effect gain is not within the preset range, the synchronous merge training is terminated; otherwise, the original current optimal result is kept unchanged, and the synchronous merge training is continued based on the preset message training data set, which is conducive to timely discovering the nodes with the best training effect, avoiding the problem of poor effect of the generative adversarial network due to fewer training rounds, and effectively avoiding the problem of effect reversal due to more training rounds, and realizing automatic detection and confirmation of the best end point of model training.

[0098] Embodiment 4:

[0099] Based on Example 1, step 2, such as Figure 3 As shown, specifically including:

[0100] After sending the test data to the generative adversarial network for computational processing, valid test data is generated;

[0101] Input valid test data into the target test system to obtain system operation results;

[0102] Determine whether the system operation result is a system crash or abnormal operation. If so, determine that the target test system has an abnormality;

[0103] Otherwise, the target test system is judged to be normal.

[0104] The beneficial effects of the above technical solution are as follows: after the test data is sent to the generative adversarial network for computational processing, valid test data is generated, which effectively improves the applicability of the tested system of the test data; the valid test data is input into the target test system to obtain the system operation result, so that the tester can complete the fuzzy test without knowing the communication protocol structure knowledge; finally, it is judged whether the system operation result is a system crash or abnormal operation. If so, it is determined that there is an abnormality in the target test system; otherwise, it is determined that the target test system is normal, thereby realizing the network security test of the target test system.

[0105] Embodiment 5:

[0106] On the basis of Example 1, step 3 specifically includes:

[0107] After determining that the target test system has an abnormality, confirming the fault type of the target test system and determining whether the abnormality is caused by the communication protocol;

[0108] If yes, any data frame is taken as the initial data frame, and the initial data frame is taken as the starting point, and the communication protocol is compared frame by frame based on the preset data frame database to obtain the comparison result, and the suspected data frame is determined based on the comparison result;

[0109] Compare the suspected data frame with its corresponding standard data frame, etc., to determine the abnormal data frame and vulnerability type corresponding to the communication protocol, and the communication protocol vulnerability detection result;

[0110] Based on the communication protocol vulnerability detection results, an error message is generated and sent to the display page for display.

[0111] The beneficial effects of the above technical solution are as follows: after determining that an abnormality exists in the target test system, the present invention confirms the type of fault in the target test system, realizes automatic confirmation of the type of network security vulnerability in the target test system, and provides a basis for network maintenance by network operation and maintenance personnel. When the abnormality is caused by the communication protocol, any data frame is used as the initial data frame, and the initial data frame is used as the starting point. Based on a preset data frame database, the communication protocol is compared frame by frame to obtain a comparison result, and based on the comparison result, a suspected data frame is determined; the suspected data frame is compared with its corresponding standard data frame, etc., to determine the abnormal data frame corresponding to the communication protocol and the vulnerability type, and the communication protocol vulnerability detection result; based on the communication protocol vulnerability detection result, an error message is generated and sent to a display page for display, thereby realizing active mining of communication protocol vulnerabilities, which is beneficial to improving the network integrity of the target test system.

[0112] Embodiment 6:

[0113] Based on Example 5, the target test system confirms the fault type, specifically including:

[0114] Obtain system call data corresponding to normal operation of the communication protocol, and determine similar call programs of the target test system based on the system call data;

[0115] Synchronously obtain preset test data, input the preset test data into the similar calling program, obtain the test running result, and if the test running result is normal, determine that the system data of the target test system is normal and the communication protocol is abnormal;

[0116] Otherwise, the system data is determined to be abnormal and the test results are sent to the display segment for display.

[0117] In this embodiment, the preset test data refers to the test data corresponding to the similar calling program. The data is pre-stored in the database. The similar calling program refers to other programs in the target test system that are similar to the valid test data calling plug-in or data.

[0118] The beneficial effects of the above technical solution are as follows: the present invention obtains the system call data corresponding to the normal operation of the communication protocol, and determines the similar call program of the target test system based on the system call data; synchronously obtains the preset test data, inputs the preset test data into the similar call program, and obtains the test operation result. If the test operation result is normal, it is judged that the system data of the target test system is normal and the communication protocol has an abnormality; otherwise, it is judged that the system data is abnormal, and the test result is sent to the display segment for display, thereby realizing the automatic confirmation of the network security vulnerability type of the target test system, and providing a basis for network operation and maintenance personnel's network maintenance and communication protocol vulnerability mining.

[0119] Embodiment 7:

[0120] On the basis of Example 5, the suspected data frame is compared with its corresponding standard data frame, etc., to determine the abnormal data frame and vulnerability type corresponding to the communication protocol, and the communication protocol vulnerability detection result specifically includes:

[0121] Compare the suspected data frame with its corresponding standard data frame to obtain abnormal feature data;

[0122] Obtain frame correlation features of all data corresponding to the communication protocol of the suspected data frame, and calculate the correlation degree between each abnormal feature data based on the frame correlation features;

[0123] Based on the correlation degree, determining an abnormal demarcation point, and merging the associated suspected data frames based on the abnormal demarcation point to obtain multiple abnormal frame sets;

[0124] The mutual correlation between each suspected data frame in each abnormal frame set is calculated respectively, and based on the mutual correlation, the abnormality-inducing data frame in each abnormal frame set is determined respectively;

[0125] Extract the abnormal data features corresponding to the abnormality-inducing data frame, and determine the abnormal cause and corresponding vulnerability type corresponding to the abnormal frame set based on the abnormal data features;

[0126] According to the abnormal causes and corresponding vulnerability types corresponding to all abnormal frame sets, the communication protocol vulnerability detection results are generated.

[0127] The beneficial effects of the above technical solution are as follows: the present invention first compares the suspected data frame with its corresponding standard data frame to obtain abnormal feature data; obtains the frame association features of all data corresponding to the suspected data frame in the communication protocol, and calculates the correlation between each abnormal feature data based on the frame association features; determines the abnormal demarcation point based on the correlation, realizes the automatic classification of multiple vulnerabilities in the communication protocol, which is beneficial to improve the targeted repair of the later vulnerabilities by the operation and maintenance personnel; then merges the associated suspected data frames based on the abnormal demarcation point to obtain multiple abnormal frame sets; calculates the interactive correlation between each suspected data frame in each abnormal frame set respectively, and determines the abnormal inducing data frames in each abnormal frame set based on the interactive correlation, confirms the inducing point corresponding to each vulnerability, which is beneficial to improve the later vulnerability maintenance efficiency; extracts the abnormal data features corresponding to the abnormal inducing data frame, and determines the abnormal cause and the corresponding vulnerability type corresponding to the abnormal frame set based on the abnormal data features; generates the communication protocol vulnerability detection result according to the abnormal cause and the corresponding vulnerability type corresponding to all abnormal frame sets, realizes the automatic mining and error reporting of communication protocol vulnerabilities, which is beneficial to improve the security of the target test system.

[0128] Embodiment 8:

[0129] On the basis of Example 7, while determining the abnormality inducing data frame in each abnormal frame, it also includes:

[0130] Perform data display association on the abnormality-induced data frame and the remaining suspected data frames in the corresponding abnormal frame set, and synchronously use the abnormality-induced data frame as the abnormal data frame;

[0131] A position corresponding to the abnormal data frame is obtained, a position tag is generated based on the position, and the position tag is automatically inserted into a plurality of vulnerability types included in the communication protocol vulnerability detection result.

[0132] The beneficial effects of the above technical solution are as follows: data display association is performed between the abnormality-inducing data frame and the remaining suspected data frames in the corresponding abnormal frame set, and the abnormality-inducing data frame is synchronously used as the abnormal data frame; the position corresponding to the abnormal data frame is obtained, a position tag is generated based on the position, and the position tag is automatically inserted into the multiple vulnerability types included in the communication protocol vulnerability detection results, which is beneficial for network operation and maintenance personnel to quickly confirm the location of the protocol vulnerability and quickly find the related vulnerability location for synchronous repair, which is beneficial to improving the vulnerability repair efficiency of network operation and maintenance personnel.

[0133] Embodiment 9:

[0134] The present invention provides a communication protocol vulnerability mining system based on a generative adversarial network, comprising:

[0135] A network model generation module is used to perform hybrid training on a feedforward network and a support vector machine based on a preset message training data set to generate a generative adversarial network;

[0136] The system anomaly judgment module is used to generate valid test data based on the generative adversarial network, input the valid test data into the target test system for operation, and judge whether there is an anomaly in the target test system;

[0137] The protocol anomaly judgment module performs anomaly detection when it is determined that the target test system has an anomaly. Based on the detection result, it determines whether the anomaly is caused by the communication protocol, and determines the location of the communication protocol anomaly and the type of vulnerability.

[0138] The beneficial effects of the above technical solution are as follows: the present invention performs hybrid training on the forward feedback network and the support vector machine based on a preset message training data set through a network model generation module to generate a generative adversarial network with high generalization ability and robustness, and then generates effective test data based on the generative adversarial network through a system anomaly judgment module and a protocol anomaly judgment module, and performs communication protocol vulnerability mining on the target system based on the effective test data, assisting in the completion of communication protocol vulnerability mining without any structural knowledge of the protocol, thereby effectively improving the efficiency and security of communication protocol vulnerability mining.

[0139] Embodiment 10:

[0140] Based on Example 9, the network model generation module includes:

[0141] A generation model training unit is used to train the forward feedback network according to a preset number of training times based on a preset message training data set to obtain a forward feedback network generation model;

[0142] A data set updating unit, used to obtain the generated data of the forward feedback network generation model in the training process as training generated data, and add the training generated data to the preset message training data set to generate a new training set;

[0143] The discriminant model training unit is used to train the support vector machine based on the new training set according to a preset training number of times to obtain a support vector machine discriminant model;

[0144] The synchronous merging training unit is used to synchronously merge the training of the forward feedback network generation model and the support vector machine judgment model based on a preset message training data set to obtain a generative adversarial network.

[0145] The beneficial effects of the above technical solution are as follows: the present invention firstly trains the forward feedback network and the support vector machine separately by means of the generation model training unit and the discrimination model training unit, and then trains them by means of the synchronous merging training unit in a hybrid training manner, which is conducive to giving full play to the randomness of the fuzzy test and can dig out unexpected vulnerabilities of the target test system;

[0146] Among them, the generated data of the forward feedback network generation model in the training process is obtained through the data set updating unit, and the generated data is used as the training generated data. The training generated data is added to the preset message training data set to generate a new training set, and then the support vector machine is based on the new training set, which is beneficial to improve the generalization ability and robustness of the support vector machine judgment model, thereby improving the generalization ability and robustness of the generative network.

[0147] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A communication protocol vulnerability mining method based on generative adversarial network, characterized in that: include: Step 1: Perform hybrid training on the feedforward network and the support vector machine based on the preset message training data set to generate a generative adversarial network; Step 2: Generate valid test data based on the generative adversarial network, input the valid test data into the target test system for operation, and determine whether there is any abnormality in the target test system; Step 3: When it is determined that the target test system has an anomaly, an anomaly detection is performed. Based on the anomaly detection result, it is determined whether the anomaly is caused by the communication protocol. If so, vulnerability mining is performed on the communication protocol, and the communication protocol vulnerability detection result is output; Wherein, step 3 specifically includes: After determining that the target test system has an abnormality, confirming the fault type of the target test system and determining whether the abnormality is caused by the communication protocol; If yes, any data frame is taken as the initial data frame, and the initial data frame is taken as the starting point, and the communication protocol is compared frame by frame based on the preset data frame database to obtain the comparison result, and the suspected data frame is determined based on the comparison result; Compare the suspected data frame with its corresponding standard data frame, determine the abnormal data frame and vulnerability type corresponding to the communication protocol, and generate the communication protocol vulnerability detection result; Based on the communication protocol vulnerability detection results, an error message is generated and sent to the display page for display; Among them, the suspected data frame is compared with its corresponding standard data frame to determine the abnormal data frame and vulnerability type corresponding to the communication protocol, and the communication protocol vulnerability detection result is generated, which specifically includes: Compare the suspected data frame with its corresponding standard data frame to obtain abnormal feature data; Obtain frame correlation features of all data corresponding to the communication protocol of the suspected data frame, and calculate the correlation degree between each abnormal feature data based on the frame correlation features; Based on the correlation degree, determining an abnormal demarcation point, and merging the associated suspected data frames based on the abnormal demarcation point to obtain multiple abnormal frame sets; The mutual correlation between each suspected data frame in each abnormal frame set is calculated respectively, and based on the mutual correlation, the abnormality-inducing data frame in each abnormal frame set is determined respectively; Extract the abnormal data features corresponding to the abnormality-inducing data frame, and determine the abnormal cause and corresponding vulnerability type corresponding to the abnormal frame set based on the abnormal data features; Generate communication protocol vulnerability detection results based on the abnormal causes and corresponding vulnerability types corresponding to all abnormal frame sets; Wherein, while determining the abnormality-inducing data frames in each abnormal frame set, it also includes: Perform data display association on the abnormality-induced data frame and the remaining suspected data frames in the corresponding abnormal frame set, and synchronously use the abnormality-induced data frame as the abnormal data frame; A position corresponding to the abnormal data frame is obtained, a position tag is generated based on the position, and the position tag is automatically inserted into a plurality of vulnerability types included in the communication protocol vulnerability detection result.

2. According to claim 1, a communication protocol vulnerability mining method based on a generative adversarial network is characterized in that: Step 1 specifically includes: Based on the preset message training data set, the feedback-forward network is trained according to a preset training number of times to obtain a feedback-forward network generation model; Obtaining generated data of the forward feedback network generation model during the training process as training generated data, and adding the training generated data to a preset message training data set to generate a new training set; Based on the new training set, the support vector machine is trained according to a preset training number of times to obtain a support vector machine judgment model; Based on the preset message training data set, the feedback-forward network generation model and the support vector machine judgment model are synchronously merged and trained to obtain a generative adversarial network.

3. According to claim 2, a communication protocol vulnerability mining method based on a generative adversarial network is characterized in that: Based on the preset message training data set, the forward feedback network generation model and the support vector machine judgment model are synchronously merged and trained to obtain a generative adversarial network, including: Record the synchronous merge training results of each round; Compare the current synchronous merging training result with the optimal result to obtain a first effect gain, and when the first effect gain is greater than zero, use the current synchronous merging training result as the optimal result; When the first effect gain is less than or equal to zero, the original optimal result is kept unchanged, and it is determined whether the attenuation amplitude value corresponding to the first effect gain is within a preset range; If not, then the synchronous merging training is terminated; If yes, then continue the next round of synchronous merging training based on the preset message training data set, and while obtaining the second effect gain, compare the previous synchronous merging training result with the next round of synchronous merging training result to obtain the secondary effect gain. If the second effect gain is greater than zero, the current synchronous merge training result is taken as the optimal result; If the second effect gain is less than or equal to zero, it is determined whether the gain or attenuation amplitude value corresponding to the secondary effect gain is within a preset range; If the gain or attenuation amplitude value corresponding to the secondary effect gain is not within the preset range, then the synchronous merging training is terminated; Otherwise, the original optimal result is kept unchanged, and the synchronous merge training is continued based on the preset message training data set.

4. According to claim 1, a communication protocol vulnerability mining method based on a generative adversarial network is characterized in that: Step 2 specifically includes: After sending the test data to the generative adversarial network for computational processing, valid test data is generated; Input valid test data into the target test system to obtain system operation results; Determine whether the system operation result is a system crash or abnormal operation. If so, determine that the target test system has an abnormality; Otherwise, the target test system is judged to be normal.

5. According to claim 1, a communication protocol vulnerability mining method based on a generative adversarial network is characterized in that: The target test system confirms the fault type, including: Obtain system call data corresponding to normal operation of the communication protocol, and determine similar call programs of the target test system based on the system call data; Synchronously obtain preset test data, input the preset test data into the similar calling program, obtain the test running result, and if the test running result is normal, determine that the system data of the target test system is normal and the communication protocol is abnormal; Otherwise, the system data is determined to be abnormal, and the test results are sent to the display page for display.

6. A communication protocol vulnerability mining system based on generative adversarial network, characterized in that: include: A network model generation module is used to perform hybrid training on a feedforward network and a support vector machine based on a preset message training data set to generate a generative adversarial network; The system anomaly judgment module is used to generate valid test data based on the generative adversarial network, input the valid test data into the target test system for operation, and judge whether there is an anomaly in the target test system; The protocol anomaly judgment module is used to perform anomaly detection when it is determined that the target test system has an anomaly, and based on the detection result, determine whether the anomaly is caused by the communication protocol, and determine the location of the communication protocol anomaly and the type of vulnerability; Among them, when it is determined that the target test system has an abnormality, the protocol abnormality judgment module performs abnormality detection, and based on the detection result, determines whether the abnormality is caused by the communication protocol, and determines the abnormal location of the communication protocol and the vulnerability type. The specific method includes: After determining that the target test system has an abnormality, confirming the fault type of the target test system and determining whether the abnormality is caused by the communication protocol; If yes, any data frame is taken as the initial data frame, and the initial data frame is taken as the starting point, and the communication protocol is compared frame by frame based on the preset data frame database to obtain the comparison result, and the suspected data frame is determined based on the comparison result; Compare the suspected data frame with its corresponding standard data frame, determine the abnormal data frame and vulnerability type corresponding to the communication protocol, and generate the communication protocol vulnerability detection result; Based on the communication protocol vulnerability detection results, an error message is generated and sent to the display page for display; Among them, the suspected data frame is compared with its corresponding standard data frame to determine the abnormal data frame and vulnerability type corresponding to the communication protocol, and the communication protocol vulnerability detection result is generated, which specifically includes: Compare the suspected data frame with its corresponding standard data frame to obtain abnormal feature data; Obtain frame correlation features of all data corresponding to the communication protocol of the suspected data frame, and calculate the correlation degree between each abnormal feature data based on the frame correlation features; Based on the correlation degree, determining an abnormal demarcation point, and merging the associated suspected data frames based on the abnormal demarcation point to obtain multiple abnormal frame sets; The mutual correlation between each suspected data frame in each abnormal frame set is calculated respectively, and based on the mutual correlation, the abnormality-inducing data frame in each abnormal frame set is determined respectively; Extract the abnormal data features corresponding to the abnormality-inducing data frame, and determine the abnormal cause and corresponding vulnerability type corresponding to the abnormal frame set based on the abnormal data features; Generate communication protocol vulnerability detection results based on the abnormal causes and corresponding vulnerability types corresponding to all abnormal frame sets; Wherein, while determining the abnormality-inducing data frames in each abnormal frame set, it also includes: Perform data display association on the abnormality-induced data frame and the remaining suspected data frames in the corresponding abnormal frame set, and synchronously use the abnormality-induced data frame as the abnormal data frame; A position corresponding to the abnormal data frame is obtained, a position tag is generated based on the position, and the position tag is automatically inserted into a plurality of vulnerability types included in the communication protocol vulnerability detection result.

7. A communication protocol vulnerability mining system based on generative adversarial network according to claim 6, characterized in that: Network model generation module, including: A generation model training unit is used to train the forward feedback network according to a preset number of training times based on a preset message training data set to obtain a forward feedback network generation model; A data set updating unit, used to obtain the generated data of the forward feedback network generation model in the training process as training generated data, and add the training generated data to the preset message training data set to generate a new training set; The discriminant model training unit is used to train the support vector machine based on the new training set according to a preset training number of times to obtain a support vector machine discriminant model; The synchronous merging training unit is used to synchronously merge the training of the forward feedback network generation model and the support vector machine judgment model based on a preset message training data set to obtain a generative adversarial network.

Images