A network security protection method and system based on mimicry defense

Abstract

The present invention relates to the technical field of network security protection, and discloses a network security protection method and system based on mimicry defense, including clustering analysis of multiple executables, dividing each executable into a baseline executable and a non-benchmark executable, using attack code to perform buffer overflow attack test on the executable, obtaining attack behavior characteristics, calculating the behavior similarity between the baseline attack behavior characteristics and the non-benchmark attack behavior characteristics, and judging whether there is a potential vulnerability exploitation path in the non-benchmark executable; judging whether the potential vulnerability exploitation path is effective according to the attack success rate of the attack code variant; and constructing a mimicry defense strategy according to the path characteristics of the vulnerability exploitation path. The present invention analyzes the impact of micro-architecture differences of different executables on buffer overflow attacks, identifies potential attack paths, and formulates more targeted mimicry defense strategies, thereby improving the defense effect of the executable against network attacks and ensuring the security of system operation.

Description

Technical Field

[0001] The present invention relates to the field of network security protection technology, and in particular to a network security protection method and system based on mimicry defense. Background Art

[0002] In the field of cyberspace security, mimicry defense is a dynamic heterogeneous redundant structure based on the inherent security mechanism of cyberspace. It provides defense theories and methods with universal and innovative significance to deal with unknown threats based on unknown vulnerabilities, backdoors, or viruses and Trojans in cyberspace. Technically speaking, mimicry defense is to determine the equivalence of multiple heterogeneous executors in given service functions or even performance through consistency or compliance testing of standardized protocols or specifications. Therefore, most conventional mimicry defenses are currently implemented based on feature matching.

[0003] In actual applications, due to the subtle differences in register usage and stack layout between different microarchitectures, the same attack code behaves inconsistently on different executables. Attackers can exploit this microarchitecture difference and trigger different vulnerability exploitation paths on different executables through carefully constructed attack codes, thereby bypassing existing defense measures. However, the current traditional mimicry defense mechanism cannot effectively deal with this problem. To address this problem, the mimicry defense mechanism must be able to deeply analyze the register usage and stack layout characteristics of different executables, identify potential attack paths, and adopt corresponding defense strategies. However, due to the complexity and diversity of microarchitectures, it is a very time-consuming and difficult task to comprehensively analyze the differences of all executables. At the same time, attackers may also exploit new microarchitecture features to continuously develop new attack methods, making it difficult for the mimicry defense mechanism to keep up with the development of attack technology. Therefore, how to establish an effective mapping relationship between different executables and achieve consistent analysis and defense of attack behaviors is a key technical problem that needs to be solved in the field of mimicry security. Summary of the invention

[0004] In order to solve the above technical problems, the present invention provides a network security protection method and system based on mimicry defense, which designs a more effective mimicry defense strategy by analyzing the differences in the micro-architecture of the executable body, so as to achieve the effect of improving the security of system operation.

[0005] In a first aspect, the present invention provides a network security protection method based on mimicry defense, the method comprising:

[0006] Performing cluster analysis on multiple executables with different micro-architectures to obtain an executable cluster, and dividing each executable in the executable cluster into a benchmark executable and a non-benchmark executable according to a stack frame structure and a function calling convention;

[0007] Using attack codes to perform buffer overflow attack tests on each execution body in the execution body cluster to obtain attack behavior characteristics, wherein the attack behavior characteristics include baseline attack behavior characteristics and non-baseline attack behavior characteristics;

[0008] Calculating the behavior similarity between the baseline attack behavior feature and the non-benchmark attack behavior feature, and judging whether there is a potential vulnerability exploitation path in the non-benchmark executable body according to the behavior similarity;

[0009] In response to the presence of a potential vulnerability exploitation path in the non-baseline executable body, identifying the potential vulnerability exploitation path for the non-baseline executable body, generating an attack code variant according to the identified potential vulnerability exploitation path, and judging whether the identified potential vulnerability exploitation path is valid according to the attack success rate of the attack code variant on the non-baseline executable body;

[0010] In response to the identified potential vulnerability exploitation path being valid, the valid potential vulnerability exploitation path is used as the vulnerability exploitation path, a mimicry defense strategy is constructed according to the path characteristics of the vulnerability exploitation path, and the mimicry defense strategy is deployed on each execution body.

[0011] Furthermore, the step of performing cluster analysis on multiple executables with different micro-architectures to obtain an executable cluster includes:

[0012] Extracting characteristic instructions and pipeline parameters of each execution body by disassembling, generating instruction set characteristic vectors according to the frequency distribution of the characteristic instructions, and generating pipeline structure characteristic vectors according to the pipeline parameters;

[0013] The instruction set feature vector and the pipeline structure feature vector are concatenated to obtain a micro-architecture feature vector, and a cluster analysis is performed on multiple execution bodies according to the micro-architecture feature vector to obtain an execution body cluster.

[0014] Furthermore, the step of using the attack code to perform a buffer overflow attack test on each executable body in the executable body cluster to obtain attack behavior characteristics includes:

[0015] Use Shellcode technology to generate attack codes, perform buffer overflow attack tests on each executable body, and extract memory access information, program control flow transfer information, and register status information of the attack code on the executable body;

[0016] An attack behavior feature is generated according to the memory access information, the program control flow transfer information and the register state information. The attack behavior feature includes a memory access mode, an instruction call sequence and a register state change.

[0017] Furthermore, in response to the existence of a potential vulnerability exploitation path in the non-baseline executable body, the step of identifying the potential vulnerability exploitation path for the non-baseline executable body and generating an attack code variant according to the identified potential vulnerability exploitation path includes:

[0018] Constructing a control flow graph of the non-benchmark executable body, and identifying a potential vulnerability exploitation path from the control flow graph based on a graph traversal algorithm, wherein the potential vulnerability exploitation path includes sensitive function calls and / or dangerous instruction sequences;

[0019] Critical register state information and memory area information are extracted from the potential vulnerability exploitation path, and based on the critical register state information and the memory area information, symbolic execution technology is used to generate an attack code variant for triggering the potential vulnerability exploitation path.

[0020] Furthermore, after the step of generating the attack code variant for triggering the potential vulnerability exploitation path, the method further includes:

[0021] Extracting stack structure features of the non-benchmark executable body according to the execution process of the attack code variant on each non-benchmark executable body, wherein the stack structure features include stack growth direction and stack frame alignment mode;

[0022] The stack structure characteristics of each non-baseline executable body are analyzed based on the Euclidean distance to obtain stack structure differences, and the stack operation instructions and relative jump offsets of the attack code variant are adjusted according to the stack structure differences to obtain an updated attack code variant.

[0023] Furthermore, the step of constructing a mimicry defense strategy according to the path characteristics of the vulnerability exploitation path includes:

[0024] Performing a disassembly analysis on the vulnerability exploitation path, extracting a function call instruction sequence, and determining a function call feature according to the function call instruction sequence, wherein the function call feature includes a parameter passing order and a return address offset;

[0025] Performing dynamic taint analysis on the vulnerability exploitation path to obtain memory access features, wherein the memory access features include a memory access address and a data flow direction;

[0026] A mimicry defense rule set is generated according to the function call characteristics and the memory access characteristics, and a mimicry defense strategy is constructed according to the difference between the mimicry defense rule set and the microarchitecture of each execution body.

[0027] In a second aspect, the present invention provides a network security protection system based on mimicry defense, the system comprising:

[0028] An executable body classification module is used to perform cluster analysis on multiple executable bodies with different micro-architectures to obtain an executable body cluster, and to divide each executable body in the executable body cluster into a benchmark executable body and a non-benchmark executable body according to a stack frame structure and a function calling convention;

[0029] A feature extraction module, used to perform a buffer overflow attack test on each executable body in the executable body cluster using an attack code to obtain attack behavior features, wherein the attack behavior features include a baseline attack behavior feature and a non-baseline attack behavior feature;

[0030] A vulnerability determination module, used to calculate the behavior similarity between the baseline attack behavior characteristics and the non-baseline attack behavior characteristics, and determine whether the non-baseline executable body has a potential vulnerability exploitation path according to the behavior similarity;

[0031] a vulnerability identification module, configured to identify the potential vulnerability exploitation path for the non-baseline executable body in response to the presence of a potential vulnerability exploitation path in the non-baseline executable body, generate an attack code variant according to the identified potential vulnerability exploitation path, and determine whether the identified potential vulnerability exploitation path is valid according to the attack success rate of the attack code variant on the non-baseline executable body;

[0032] The strategy generation module is used to respond to the identification of a valid potential vulnerability exploitation path, take the valid potential vulnerability exploitation path as the vulnerability exploitation path, construct a mimetic defense strategy according to the path characteristics of the vulnerability exploitation path, and deploy the mimetic defense strategy on each execution body.

[0033] Furthermore, the feature extraction module is also used to generate attack codes using Shellcode technology, perform buffer overflow attack tests on each execution body, and extract memory access information, program control flow transfer information, and register status information of the attack code on the execution body;

[0034] An attack behavior feature is generated according to the memory access information, the program control flow transfer information and the register state information. The attack behavior feature includes a memory access mode, an instruction call sequence and a register state change.

[0035] Furthermore, the vulnerability identification module also includes a code generation module;

[0036] The code generation module is used to construct a control flow graph of the non-benchmark executable body, and identify potential vulnerability exploitation paths from the control flow graph based on a graph traversal algorithm, wherein the potential vulnerability exploitation paths include sensitive function calls and / or dangerous instruction sequences;

[0037] Critical register state information and memory area information are extracted from the potential vulnerability exploitation path, and based on the critical register state information and the memory area information, symbolic execution technology is used to generate an attack code variant for triggering the potential vulnerability exploitation path.

[0038] Furthermore, the strategy generation module is also used to perform a disassembly analysis on the vulnerability exploitation path, extract a function call instruction sequence, and determine a function call feature according to the function call instruction sequence, wherein the function call feature includes a parameter passing order and a return address offset;

[0039] Performing dynamic taint analysis on the vulnerability exploitation path to obtain memory access features, wherein the memory access features include a memory access address and a data flow direction;

[0040] A mimicry defense rule set is generated according to the function call characteristics and the memory access characteristics, and a mimicry defense strategy is constructed according to the difference between the mimicry defense rule set and the microarchitecture of each execution body.

[0041] The present invention provides a network security protection method and system based on mimicry defense. Through the method, the impact of micro-architecture differences of different executors on buffer overflow attacks is analyzed, potential attack paths are identified, and more targeted mimicry defense strategies are formulated, thereby improving the defense effect of the executor against network attacks and ensuring the security of system operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a flowchart of a network security protection method based on mimicry defense in an embodiment of the present invention;

[0043] Figure 2 It is a structural diagram of a network security protection system based on mimicry defense in an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] See also Figure 1 The first embodiment of the present invention proposes a network security protection method based on mimicry defense, comprising steps S10 to S50:

[0046] Step S10, performing cluster analysis on multiple executables with different micro-architectures to obtain an executable cluster, and dividing each executable in the executable cluster into a benchmark executable and a non-benchmark executable according to a stack frame structure and a function calling convention;

[0047] Step S20, using the attack code to perform a buffer overflow attack test on each executable body in the executable body cluster to obtain attack behavior characteristics, wherein the attack behavior characteristics include a baseline attack behavior characteristic and a non-baseline attack behavior characteristic;

[0048] Step S30, calculating the behavior similarity between the baseline attack behavior feature and the non-benchmark attack behavior feature, and judging whether the non-benchmark executable body has a potential vulnerability exploitation path according to the behavior similarity;

[0049] Step S40, in response to the existence of a potential vulnerability exploitation path in the non-baseline executable body, identifying the potential vulnerability exploitation path for the non-baseline executable body, generating an attack code variant according to the identified potential vulnerability exploitation path, and judging whether the identified potential vulnerability exploitation path is valid according to the attack success rate of the attack code variant on the non-baseline executable body;

[0050] Step S50, in response to the identified potential vulnerability exploitation path being valid, taking the valid potential vulnerability exploitation path as the vulnerability exploitation path, constructing a mimicry defense strategy according to the path characteristics of the vulnerability exploitation path, and deploying the mimicry defense strategy on each execution body.

[0051] The present invention provides a mimicry defense method for executors of different microarchitectures. Microarchitecture is also called microarchitecture or microprocessor architecture. In computer engineering, a given instruction set architecture is executed in a processor. A given instruction set can be executed in different microarchitectures. In practical applications, the microarchitecture may be different due to different design purposes and technical improvements. One manifestation of different microarchitectures is the difference in register usage and stack layout, and this inconsistency poses a challenge to the design of mimicry defense mechanisms. Specifically, mimicry defense is an active defense behavior. In the field of cyberspace defense, under the premise that the target object's given service functions and performance remain unchanged, its internal architecture, redundant resources, operating mechanism, core algorithm, abnormal performance and other environmental factors, as well as unknown vulnerability backdoors or Trojan viruses that may be attached to it, can be strategically changed in time and space, thereby presenting a "seemingly true" scenario to the attacker, thereby disrupting the construction and effectiveness of the attack chain and doubling the cost of a successful attack. At present, conventional mimicry defense methods are mimicry defense methods based on feature matching, but the difference in microarchitecture will lead to differences in the features of the executable body, so that the mimicry defense mechanism cannot effectively deal with the attack of the attack code constructed for the structural difference. Therefore, the present invention provides a mimicry defense design method for executable bodies with different microarchitectures.

[0052] In the present invention, the micro-architecture of each execution body is first analyzed, and the execution bodies are classified based on the difference of micro-architecture. The specific steps include:

[0053] Extracting characteristic instructions and pipeline parameters of each execution body by disassembling, generating instruction set characteristic vectors according to the frequency distribution of the characteristic instructions, and generating pipeline structure characteristic vectors according to the pipeline parameters;

[0054] The instruction set feature vector and the pipeline structure feature vector are concatenated to obtain a micro-architecture feature vector, and a cluster analysis is performed on multiple execution bodies according to the micro-architecture feature vector to obtain an execution body cluster.

[0055] In this embodiment, for the executables of different micro-architectures, their instruction set architectures and pipeline designs are obtained to construct feature vectors, and the executables are classified by clustering algorithms to obtain executable clusters with similar micro-architectures. Among them, the executable refers to an execution unit that can meet specific time constraints. The executable can be a process, a lightweight process or a kernel thread, which is the basic unit of CPU scheduling and resource allocation.

[0056] Specifically, the instruction set architecture information of the executable body of different microarchitectures is obtained, and the binary file of the executable body is parsed by disassembly, and the machine language is converted into assembly language, so as to extract the characteristic instructions in the microarchitecture. The characteristic instructions here refer to instructions with specific functions and uses, which can be understood as extracting various types of instructions, including data transfer instructions, arithmetic operation instructions, bit operation instructions, program flow control instructions, string operation instructions, processor control instructions and other instructions. The characteristic instructions are sequentially encoded, and the instruction frequency distribution of each type of instruction is counted to generate an instruction set feature vector. Among them, each element in the vector represents the frequency of occurrence of a certain type of instruction. Then the instruction set feature vector is normalized by L2 norm to ensure the comparability of vectors between subsequent different executable bodies.

[0057] Pipeline design is an important part of micro-architecture. Pipeline design can reduce execution time and improve overall processing speed by optimizing the execution process of instructions. That is, pipeline design plays a vital role in improving the performance and efficiency of the processor. Therefore, in this embodiment, in addition to analyzing the characteristic instructions of the execution bodies of different micro-architectures, it is also necessary to analyze the pipelines of different execution bodies, that is, to obtain the pipeline parameters of the execution body through the performance analysis tool, including pipeline depth, functions of each level, forward and bypass logic, delays at each level, branch prediction accuracy and other parameters, and construct a feature vector describing the pipeline structure based on the pipeline parameters.

[0058] Finally, the above instruction set feature vector and pipeline structure feature vector are concatenated to form a complete micro-architecture feature vector. Clustering algorithms such as K-means clustering are used to perform cluster analysis on all executables to be classified to obtain multiple executable clusters. The executables within each executable cluster have similar micro-architecture characteristics.

[0059] After obtaining the execution body cluster with similar micro-architecture characteristics, the micro-architecture differences of the execution bodies in each execution body cluster are further analyzed, so that the execution bodies in the execution body cluster are further divided into benchmark execution bodies and non-benchmark execution bodies. Specifically, the binary files of the execution bodies in the execution body cluster are disassembled and analyzed, the stack frame structure information and function call conventions are extracted, and the stack frame structure information and function call conventions are converted into vectors, the cosine similarity between each execution body is calculated, and the execution body with a similarity greater than a threshold is used as a representative benchmark execution body, and the remaining execution bodies are used as non-benchmark execution bodies. In this embodiment, the execution bodies are classified based on the differences in micro-architectures, and the differences in micro-architectures are further refined through secondary classification, thereby providing more detailed data support for the design of subsequent mimicry defense strategies to improve the versatility and defense effect of mimicry defense strategies.

[0060] For the benchmark executable and the non-benchmark executable, in this embodiment, a buffer overflow attack test is used to analyze the different manifestations of micro-architecture differences in attack behaviors. The specific steps include:

[0061] Use Shellcode technology to generate attack codes, perform buffer overflow attack tests on each executable body, and extract memory access information, program control flow transfer information, and register status information of the attack code on the executable body;

[0062] An attack behavior feature is generated according to the memory access information, the program control flow transfer information and the register state information. The attack behavior feature includes a memory access mode, an instruction call sequence and a register state change.

[0063] In this embodiment, Shellcode technology is used to attack the buffer overflow of the executable body in the executable body cluster. The executable body here includes the base executable body and the non-base executable body. The attack process of the two is the same. Here, the attack process of the executable body is described. Specifically, the Metasploit framework is used to generate the Shellcode code of the target architecture corresponding to the executable body, and the overflow data is constructed according to the Shellcode code, and injected into the executable body memory space to trigger the buffer overflow vulnerability, execute the Shellcode code, and record the memory access operation of the attack code during the execution process through the plug-in tool, including the read and write address, the access address length, the access type and other information, and at the same time track the transfer of the program control flow, record the source address and target address of the jump instruction, record the call number and call parameters of the call instruction, etc. In addition, the number of general registers is extracted, including integer registers, floating-point registers, etc., and the functions of special registers, such as program counters, stack pointers and status registers, are analyzed, and the number, bit width, purpose and status of registers are recorded.

[0064] Then, according to the recorded memory access information, program control flow transfer information and register status information, the corresponding attack behavior characteristics are generated, which include memory access mode, instruction call sequence and register status change. Assume that the instruction sequence "pushebp, movebp, esp, subesp, 0x20" is executed continuously to access the memory area 0x7fff1000-0x7fff1028, and the EAX register value changes from 0 to 1. In a preferred embodiment, the instruction call sequence can be represented by a 3-gram model, such as [push-mov-sub, mov-sub-and, ...], the memory access mode can be represented by the starting address and length, such as [0x7fff1000, 40], and the register status change can be represented by a bitmap, such as 1100100000.

[0065] For the attack behavior features between the baseline executable body and the non-baseline executable body, the cosine similarity method is used to calculate the similarity between the two. In this embodiment, the three attack behavior features of the baseline executable body can be stored in the database to form an attack behavior feature library of a representative executable body, and then the attack behavior features of the non-baseline executable body are compared in the feature library to calculate the similarity. When the similarity is less than a preset threshold, it means that the behavior of the attack code executed on the non-baseline executable body and the baseline executable body is quite different. Since the defense strategy is generated based on feature matching, the defense effect on the baseline executable body is better than that on the non-baseline executable body. That is, for the current defense strategy, there may be potential vulnerability exploitation paths in the non-baseline executable body.

[0066] Based on this, in this embodiment, when it is determined that there is a potential vulnerability exploitation path, the potential vulnerability exploitation path is identified, and according to the key registers and memory areas involved in the identified potential vulnerability exploitation path, a symbolic execution technology is used to generate an attack code variant for triggering the path, so as to further confirm the potential vulnerability exploitation path, wherein the specific steps of path identification and attack code variant generation include:

[0067] Constructing a control flow graph of the non-benchmark executable body, and identifying a potential vulnerability exploitation path from the control flow graph based on a graph traversal algorithm, wherein the potential vulnerability exploitation path includes sensitive function calls and / or dangerous instruction sequences;

[0068] Critical register state information and memory area information are extracted from the potential vulnerability exploitation path, and based on the critical register state information and the memory area information, symbolic execution technology is used to generate an attack code variant for triggering the potential vulnerability exploitation path.

[0069] In this embodiment, a static program analysis method is used to construct a control flow graph of the executable body, that is, through a script automated analysis process, basic block and jump instruction information is extracted to construct a complete control flow graph, and a graph traversal algorithm is used to identify potential vulnerability exploitation paths from the control flow graph. Here, the program execution path containing sensitive function calls and dangerous instruction sequences is used as a potential vulnerability exploitation path, wherein sensitive functions include command executions such as system, sprintf, strcpy, and functions that are prone to stack overflows, and dangerous instruction sequences include instruction sequences such as stack migration that are prone to buffer overflows.

[0070] Extract key register state information and memory area information from potential vulnerability exploitation paths, such as using binary file parsing tools to extract the program's memory mapping information, determine the address range of the stack, heap, and executable segment, record register value changes and memory access patterns, changes in stack pointers and base pointers, etc., to build a register state vector and memory layout model. The register state vector contains the current value and flag bit status of each register, and the memory layout model records the starting address, size, and access rights of the key memory area.

[0071] Symbolic execution technology is used to generate attack code variants for triggering potential vulnerability exploitation paths. Specifically, a symbolic execution tool is used to analyze the potential vulnerability exploitation path, and the values ​​of key registers and memory areas are replaced with symbolic variables. Taking the KLEE tool as an example, the klee_make_symbolic function of KLEE is used to mark the target variable as a symbolic value. Through the path exploration engine of KLEE, all possible execution paths are systematically traversed. At the same time, during the execution process, the Z3 constraint solver is used to generate path constraints. According to the path constraints and symbolic execution results, the code generator based on LLVMIR is used to automatically construct attack code variants. The IRBuilder interface of LLVM is used to create an intermediate representation, and the corresponding instruction sequence is generated according to the constraints. In addition, the instruction sequence and memory access mode of Shellcode are adjusted for different register states and memory layouts, and multiple attack code variants are generated, including Shellcodes of different lengths and encoding methods. Preferably, the code optimizer of LLVM can also be used to eliminate redundant instructions to improve the concealment of the attack code. Finally, the generated LLVMIR is compiled into the machine code of the target architecture, thereby obtaining the optimized Shellcode attack code variant.

[0072] The present invention determines potential vulnerability exploitation paths through micro-architecture differences, and generates attack code variants based on the vulnerability exploitation paths to perform attack verification on the executable body, so as to facilitate the subsequent construction of a mimicry defense strategy based on the vulnerability exploitation path. It can effectively solve the current conventional defense method based on feature matching, and is more suitable for benchmark executable bodies with high micro-architecture similarity. It has a reduced defense effect on non-benchmark executable bodies with micro-architecture differences.

[0073] In order to make the attack code variant have a good attack effect on the execution bodies of various micro-architectures, in another preferred embodiment, the present invention also provides a method for updating and optimizing the attack code variant, and the specific updating steps include:

[0074] Extracting stack structure features of the non-benchmark executable body according to the execution process of the attack code variant on each non-benchmark executable body, wherein the stack structure features include stack growth direction and stack frame alignment mode;

[0075] The stack structure characteristics of each non-baseline executable body are analyzed based on the Euclidean distance to obtain stack structure differences, and the stack operation instructions and relative jump offsets of the attack code variant are adjusted according to the stack structure differences to obtain an updated attack code variant.

[0076] In this embodiment, the impact of the differences in stack growth direction and stack frame alignment between the executable bodies of different micro-architectures on the attack effect is mainly analyzed, so as to optimize and update the attack code variants. Specifically, a QEMU-based sandbox environment is constructed, and an independent virtual machine instance is created to run the target executable body. The gdbserver function of QEMU is used to cooperate with the GDB debugger to control the execution process. The attack code variant is injected into the memory space of the target executable body through the memory write interface provided by QEMU. Set breakpoints at the vulnerability trigger point, and use GDB's continue and step commands to execute step by step to trigger the vulnerability exploit code. Use GDB's x command to monitor memory state changes in real time and record the execution process of Shellcode. The specific steps can refer to the conventional QEMU and GDB debugging boot steps, which will not be repeated here.

[0077] Then, the execution log is obtained and analyzed, that is, the stack growth direction is determined by analyzing the change trend of the ESP value, and the stack frame alignment is determined according to the alignment of the ESP value before and after the function call, and then the stack structure vector model is constructed according to the stack structure features of the extracted stack growth direction and the stack frame alignment, wherein the stack structure vector model includes the stack growth direction and the stack frame alignment byte number. Finally, based on the stack structure feature vector, the stack structure difference between different execution bodies is determined using the Euclidean distance, that is, when the Euclidean distance is greater than the preset threshold, it is considered that there is a difference in the stack structure between the two execution bodies, and this difference may affect the execution effect of the attack code variant. Therefore, in this embodiment, according to the execution effect of the attack code variant on each execution body, the impact of the stack structure difference on the execution effect is analyzed, and the execution effect here includes the accuracy of the return address coverage and the Shellcode positioning. Then, according to the stack structure difference, the stack operation instructions and the relative jump offset in the Shellcode code are adjusted, such as reversing the stack operation instruction direction, filling instructions to ensure byte alignment, etc., so as to regenerate the attack code variants adapted to different stack structures.

[0078] In the present invention, the purpose of generating attack code variants based on potential vulnerability exploitation paths is to confirm the validity of potential vulnerability exploitation paths through the execution effect of attack code variants on the execution body. This is because in the actual execution process of the present invention, multiple potential vulnerability exploitation paths may be identified, but in fact not all identified potential vulnerability exploitation paths are valid paths. In order to improve the accuracy of path identification, thereby improving the generation efficiency of mimic defense strategies, in this embodiment, the validity of potential vulnerability exploitation paths is determined by the execution success rate of attack code variants running on the execution body. Specifically, for the identified potential vulnerability exploitation paths, attack code variants are used to perform attack tests, and the attack success rate is calculated by counting the number of successful code executions. Only potential vulnerability exploitation paths with an attack success rate greater than the success rate threshold will be confirmed as valid potential vulnerability exploitation paths, and the valid potential vulnerability exploitation paths will be used as the determined vulnerability exploitation paths.

[0079] In a preferred embodiment, for a determined vulnerability exploitation path, the present invention constructs a mimic defense strategy by extracting key code features and memory access features of the vulnerability exploitation path, and deploys corresponding defense measures on different execution bodies to increase the execution difficulty of the attack code, thereby improving the defense capability of the execution body. The specific steps include:

[0080] Performing a disassembly analysis on the vulnerability exploitation path, extracting a function call instruction sequence, and determining a function call feature according to the function call instruction sequence, wherein the function call feature includes a parameter passing order and a return address offset;

[0081] Performing dynamic taint analysis on the vulnerability exploitation path to obtain memory access features, wherein the memory access features include a memory access address and a data flow direction;

[0082] A mimicry defense rule set is generated according to the function call characteristics and the memory access characteristics, and a mimicry defense strategy is constructed according to the difference between the mimicry defense rule set and the microarchitecture of each execution body.

[0083] In this embodiment, according to the vulnerability exploitation path, a static analysis tool is used for disassembly to obtain the function call instruction sequence, and by analyzing the push instruction sequence and the stack operation after the call instruction, the function parameter transfer sequence and the return address storage location are determined to obtain the function call characteristics. At the same time, a dynamic taint analysis tool is used to track the vulnerability exploitation process. If the propagation of tainted data is detected, the address, length and data flow of the memory read and write operations are recorded to obtain the memory access characteristics, and then the mimic defense rule set is designed according to the function call characteristics and memory access characteristics. Preferably, the mimic defense rule set includes, for frame layout, randomizing the stack frame size and local variable offset; for the return address, using XOR encryption storage and decryption verification before the function returns; for sensitive memory areas, implementing fine-grained access control strategies, etc. On the basis of the mimic defense rule set, combined with the characteristics of different architecture execution bodies, such as register differences and instruction set differences, additional defense measures are added, such as for the ARM architecture execution body, additional protection for the R14 register is added, so that the generated defense strategy has higher versatility.

[0084] Finally, the formulated mimicry defense strategy is deployed on each executor in the executor cluster. In a preferred embodiment, the Dyninst binary rewriting tool is used to deploy customized defense measures on the target executor. Specifically, the defense logic is inserted through the BPatch interface of Dyninst to realize the dynamic transformation of the stack structure; code is added to the function prologue and epilogue to randomly adjust the stack pointer; the memory access stub function of Dyninst is used to insert the legality verification code before each memory write operation; at the same time, the overhead caused by the defense measures is monitored through performance counters, and the Valgrind memory detection tool is used to verify the effectiveness of the defense measures to ensure that no new memory errors are introduced.

[0085] In a preferred embodiment, after deploying the mimicry defense strategy, the method further includes:

[0086] Detect new microarchitectures and new attack techniques, and incrementally update and optimize the attack behavior feature library and mimicry defense strategies through machine learning algorithms.

[0087] In this embodiment, the network traffic data and system log data are continuously collected through the real-time monitoring system, the network packets related to the exception handling call are captured through the capture filter, and the memory access mode and instruction execution sequence information are extracted through the parsing rules.

[0088] Then, the original data stream is constructed based on network traffic and system logs, and the principal component analysis algorithm is used to extract new microarchitecture features and attack technology features from the original data stream. The eigenvalues ​​and eigenvectors are solved by calculating the feature covariance matrix. The first k principal components with the largest contribution rate are selected, and the original high-dimensional data is mapped to the principal component space to form a reduced-dimensional feature vector. The online random forest algorithm is used to classify and cluster the feature vectors. The random forest model is initialized, and the decision tree in the random forest is updated when a new feature vector is received. The Gini index is used as the node splitting criterion to dynamically adjust the tree structure. The existing feature library is updated according to the identified new attack patterns and defense bypass techniques.

[0089] Then, according to the importance score of the new feature, the weight and threshold of the defense strategy are adjusted, and the Pin dynamic binary instrumentation tool is used to deploy the updated feature library and optimized defense strategy to the target system. Specifically, the key code points, such as function entry and memory operation instructions, are located through the Pin API, and new defense logic is inserted at these points to achieve real-time defense against new attack variants. In addition, the Metasploit penetration testing framework can be used to verify the effectiveness of the updated defense strategy. By monitoring system performance indicators such as CPU usage and memory usage, it is ensured that the defense measures will not cause performance degradation of more than 10%, thereby ensuring that the execution performance of the executable body will not be affected.

[0090] This embodiment provides a network security protection method based on mimicry defense, which identifies and determines the vulnerability exploitation path by analyzing the differences between different micro-architectures, and constructs a mimicry defense strategy by extracting the key features of the vulnerability exploitation path, thereby achieving effective defense for different micro-architecture execution bodies, improving the defense effect of the defense strategy, and further ensuring the security of system operation.

[0091] See also Figure 2 Based on the same inventive concept, a network security protection system based on mimicry defense is proposed in the second embodiment of the present invention, including:

[0092] An executable body classification module 10 is used to perform cluster analysis on multiple executable bodies with different micro-architectures to obtain an executable body cluster, and to divide each executable body in the executable body cluster into a benchmark executable body and a non-benchmark executable body according to a stack frame structure and a function calling convention;

[0093] A feature extraction module 20, configured to perform a buffer overflow attack test on each executable body in the executable body cluster using an attack code to obtain attack behavior features, wherein the attack behavior features include a baseline attack behavior feature and a non-baseline attack behavior feature;

[0094] A vulnerability determination module 30 is used to calculate the behavior similarity between the baseline attack behavior feature and the non-baseline attack behavior feature, and determine whether the non-baseline executable body has a potential vulnerability exploitation path according to the behavior similarity;

[0095] a vulnerability identification module 40, configured to identify the potential vulnerability exploitation path for the non-baseline executable body in response to the presence of a potential vulnerability exploitation path in the non-baseline executable body, generate an attack code variant according to the identified potential vulnerability exploitation path, and determine whether the identified potential vulnerability exploitation path is valid according to the attack success rate of the attack code variant on the non-baseline executable body;

[0096] The strategy generation module 50 is used to respond to the identified potential vulnerability exploitation path being valid, take the valid potential vulnerability exploitation path as the vulnerability exploitation path, construct a mimetic defense strategy based on the path characteristics of the vulnerability exploitation path, and deploy the mimetic defense strategy on each execution body.

[0097] Furthermore, the feature extraction module 20 is also used to generate attack codes using Shellcode technology, perform buffer overflow attack tests on each execution body, and extract memory access information, program control flow transfer information, and register status information of the attack code on the execution body;

[0098] An attack behavior feature is generated according to the memory access information, the program control flow transfer information and the register state information. The attack behavior feature includes a memory access mode, an instruction call sequence and a register state change.

[0099] Furthermore, the vulnerability identification module 40 also includes a code generation module 401;

[0100] The code generation module 401 is used to construct a control flow graph of the non-benchmark executable body, and identify potential vulnerability exploitation paths from the control flow graph based on a graph traversal algorithm, wherein the potential vulnerability exploitation paths include sensitive function calls and / or dangerous instruction sequences;

[0101] Critical register state information and memory area information are extracted from the potential vulnerability exploitation path, and based on the critical register state information and the memory area information, symbolic execution technology is used to generate an attack code variant for triggering the potential vulnerability exploitation path.

[0102] Furthermore, the strategy generation module 50 is also used to perform a disassembly analysis on the vulnerability exploitation path, extract a function call instruction sequence, and determine a function call feature according to the function call instruction sequence, wherein the function call feature includes a parameter passing order and a return address offset;

[0103] Performing dynamic taint analysis on the vulnerability exploitation path to obtain memory access features, wherein the memory access features include a memory access address and a data flow direction;

[0104] A mimicry defense rule set is generated according to the function call characteristics and the memory access characteristics, and a mimicry defense strategy is constructed according to the difference between the mimicry defense rule set and the microarchitecture of each execution body.

[0105] The technical features and technical effects of the network security protection system based on mimicry defense proposed in the embodiment of the present invention are the same as the method proposed in the embodiment of the present invention, and will not be repeated here. Each module in the above-mentioned network security protection system based on mimicry defense can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0106] In summary, the embodiment of the present invention proposes a network security protection method and system based on mimicry defense. The method obtains an execution cluster by performing cluster analysis on multiple execution bodies with different microarchitectures, and divides each execution body in the execution cluster into a baseline execution body and a non-baseline execution body according to a stack frame structure and a function calling convention; uses an attack code to perform a buffer overflow attack test on each execution body in the execution cluster to obtain an attack behavior feature, wherein the attack behavior feature includes a baseline attack behavior feature and a non-baseline attack behavior feature; calculates the behavior similarity between the baseline attack behavior feature and the non-baseline attack behavior feature, and calculates the behavior similarity according to the behavior similarity. , determine whether there is a potential vulnerability exploitation path in the non-benchmark executable body; in response to the existence of a potential vulnerability exploitation path in the non-benchmark executable body, identify the potential vulnerability exploitation path for the non-benchmark executable body, generate attack code variants based on the identified potential vulnerability exploitation path, and determine whether the identified potential vulnerability exploitation path is valid based on the attack success rate of the attack code variant on the non-benchmark executable body; in response to the identified potential vulnerability exploitation path being valid, use the valid potential vulnerability exploitation path as the vulnerability exploitation path, construct a mimetic defense strategy based on the path characteristics of the vulnerability exploitation path, and deploy the mimetic defense strategy on each executable body. The present invention identifies and determines the vulnerability exploitation path by analyzing the differences between different micro-architectures, and constructs a mimetic defense strategy by extracting the key characteristics of the vulnerability exploitation path, thereby achieving effective defense of different micro-architecture executable bodies, improving the defense effect of the defense strategy, and further ensuring the security of system operation.

[0107] Each embodiment in this specification is described in a progressive manner, and the same or similar parts of each embodiment can be directly referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. It should be noted that the technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above-mentioned embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0108] The above-mentioned embodiments only express several preferred implementation modes of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in the technical field, several improvements and substitutions can be made without departing from the technical principles of the present invention, and these improvements and substitutions should also be regarded as the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be based on the protection scope of the claims.

Claims

1. A network security protection method based on mimicry defense, characterized in that: include: Cluster analysis is performed on multiple executable bodies with different micro-architectures to obtain an executable body cluster. According to the stack frame structure and function calling convention, each executable body in the executable body cluster is divided into a benchmark executable body and a non-benchmark executable body, specifically including: Disassemble and analyze the binary files of the executables in the executable cluster, extract the stack frame structure information and function calling conventions, convert the stack frame structure information and function calling conventions into vectors, calculate the cosine similarity between each executable, and use the executables with similarity greater than a threshold as representative benchmark executables, and the rest of the executables as non-benchmark executables; Using attack codes to perform buffer overflow attack tests on each execution body in the execution body cluster to obtain attack behavior characteristics, wherein the attack behavior characteristics include baseline attack behavior characteristics and non-baseline attack behavior characteristics; Calculating the behavior similarity between the baseline attack behavior feature and the non-benchmark attack behavior feature, and judging whether there is a potential vulnerability exploitation path in the non-benchmark executable body according to the behavior similarity; In response to the presence of a potential vulnerability exploitation path in the non-baseline executable body, identifying the potential vulnerability exploitation path for the non-baseline executable body, generating an attack code variant according to the identified potential vulnerability exploitation path, and judging whether the identified potential vulnerability exploitation path is valid according to the attack success rate of the attack code variant on the non-baseline executable body; In response to the identified potential vulnerability exploitation path being valid, the valid potential vulnerability exploitation path is used as the vulnerability exploitation path, a mimicry defense strategy is constructed according to the path characteristics of the vulnerability exploitation path, and the mimicry defense strategy is deployed on each execution body.

2. The network security protection method based on mimicry defense according to claim 1 is characterized in that: The step of performing cluster analysis on multiple executable bodies with different micro-architectures to obtain an executable body cluster comprises: Extracting characteristic instructions and pipeline parameters of each execution body by disassembling, generating instruction set characteristic vectors according to the frequency distribution of the characteristic instructions, and generating pipeline structure characteristic vectors according to the pipeline parameters; The instruction set feature vector and the pipeline structure feature vector are concatenated to obtain a micro-architecture feature vector, and a cluster analysis is performed on multiple execution bodies according to the micro-architecture feature vector to obtain an execution body cluster.

3. The network security protection method based on mimicry defense according to claim 1 is characterized in that: The step of using the attack code to perform a buffer overflow attack test on each executable body in the executable body cluster to obtain attack behavior characteristics includes: Use Shellcode technology to generate attack codes, perform buffer overflow attack tests on each executable body, and extract memory access information, program control flow transfer information, and register status information of the attack code on the executable body; An attack behavior feature is generated according to the memory access information, the program control flow transfer information and the register state information. The attack behavior feature includes a memory access mode, an instruction call sequence and a register state change.

4. The network security protection method based on mimicry defense according to claim 1 is characterized in that: In response to the non-baseline executable body having a potential vulnerability exploitation path, the step of identifying the potential vulnerability exploitation path for the non-baseline executable body and generating an attack code variant according to the identified potential vulnerability exploitation path comprises: Constructing a control flow graph of the non-benchmark executable body, and identifying a potential vulnerability exploitation path from the control flow graph based on a graph traversal algorithm, wherein the potential vulnerability exploitation path includes sensitive function calls and / or dangerous instruction sequences; Critical register state information and memory area information are extracted from the potential vulnerability exploitation path, and based on the critical register state information and the memory area information, symbolic execution technology is used to generate an attack code variant for triggering the potential vulnerability exploitation path.

5. The network security protection method based on mimicry defense according to claim 4 is characterized in that: After the step of generating an attack code variant for triggering the potential vulnerability exploitation path, the method further includes: Extracting stack structure features of the non-benchmark executable body according to the execution process of the attack code variant on each non-benchmark executable body, wherein the stack structure features include stack growth direction and stack frame alignment mode; The stack structure characteristics of each non-baseline executable body are analyzed based on the Euclidean distance to obtain stack structure differences, and the stack operation instructions and relative jump offsets of the attack code variant are adjusted according to the stack structure differences to obtain an updated attack code variant.

6. The network security protection method based on mimicry defense according to claim 1 is characterized in that: The step of constructing a mimic defense strategy according to the path characteristics of the vulnerability exploitation path includes: Performing a disassembly analysis on the vulnerability exploitation path, extracting a function call instruction sequence, and determining a function call feature according to the function call instruction sequence, wherein the function call feature includes a parameter passing order and a return address offset; Performing dynamic taint analysis on the vulnerability exploitation path to obtain memory access features, wherein the memory access features include a memory access address and a data flow direction; A mimicry defense rule set is generated according to the function call characteristics and the memory access characteristics, and a mimicry defense strategy is constructed according to the difference between the mimicry defense rule set and the microarchitecture of each execution body.

7. A network security protection system based on mimicry defense, characterized in that: include: The executable body classification module is used to perform cluster analysis on multiple executable bodies with different micro-architectures to obtain an executable body cluster, and divide each executable body in the executable body cluster into a benchmark executable body and a non-benchmark executable body according to the stack frame structure and function calling convention, specifically including: Disassemble and analyze the binary files of the executables in the executable cluster, extract the stack frame structure information and function calling conventions, convert the stack frame structure information and function calling conventions into vectors, calculate the cosine similarity between each executable, and use the executables with similarity greater than a threshold as representative benchmark executables, and the rest of the executables as non-benchmark executables; A feature extraction module, used to perform a buffer overflow attack test on each executable body in the executable body cluster using an attack code to obtain attack behavior features, wherein the attack behavior features include a baseline attack behavior feature and a non-baseline attack behavior feature; A vulnerability determination module, used to calculate the behavior similarity between the baseline attack behavior characteristics and the non-baseline attack behavior characteristics, and determine whether the non-baseline executable body has a potential vulnerability exploitation path according to the behavior similarity; a vulnerability identification module, configured to identify the potential vulnerability exploitation path for the non-baseline executable body in response to the presence of a potential vulnerability exploitation path in the non-baseline executable body, generate an attack code variant according to the identified potential vulnerability exploitation path, and determine whether the identified potential vulnerability exploitation path is valid according to the attack success rate of the attack code variant on the non-baseline executable body; The strategy generation module is used to respond to the identification of a valid potential vulnerability exploitation path, take the valid potential vulnerability exploitation path as the vulnerability exploitation path, construct a mimetic defense strategy according to the path characteristics of the vulnerability exploitation path, and deploy the mimetic defense strategy on each execution body.

8. The network security protection system based on mimicry defense according to claim 7 is characterized in that: The feature extraction module is also used to generate attack codes using Shellcode technology, perform buffer overflow attack tests on each execution body, and extract memory access information, program control flow transfer information, and register status information of the attack code on the execution body; An attack behavior feature is generated according to the memory access information, the program control flow transfer information and the register state information. The attack behavior feature includes a memory access mode, an instruction call sequence and a register state change.

9. The network security protection system based on mimicry defense according to claim 7 is characterized in that: The vulnerability identification module also includes a code generation module; The code generation module is used to construct a control flow graph of the non-benchmark executable body, and identify potential vulnerability exploitation paths from the control flow graph based on a graph traversal algorithm, wherein the potential vulnerability exploitation paths include sensitive function calls and / or dangerous instruction sequences; Critical register state information and memory area information are extracted from the potential vulnerability exploitation path, and based on the critical register state information and the memory area information, symbolic execution technology is used to generate an attack code variant for triggering the potential vulnerability exploitation path.

10. The network security protection system based on mimicry defense according to claim 7, characterized in that: The strategy generation module is further used to perform disassembly analysis on the vulnerability exploitation path, extract a function call instruction sequence, and determine function call features according to the function call instruction sequence, wherein the function call features include a parameter passing order and a return address offset; Performing dynamic taint analysis on the vulnerability exploitation path to obtain memory access features, wherein the memory access features include a memory access address and a data flow direction; A mimicry defense rule set is generated according to the function call characteristics and the memory access characteristics, and a mimicry defense strategy is constructed according to the difference between the mimicry defense rule set and the microarchitecture of each execution body.

Images