Vulnerability analysis method and device, electronic equipment, storage medium and program product

Abstract

The invention relates to a vulnerability analysis method and device, electronic equipment, a storage medium and a program product. The method comprises the following steps: acquiring a first data packet generated based on a network protocol to be analyzed in a cloud network, and analyzing the first data packet to determine a second data packet generated based on an unknown protocol in the first data packet; observing a message header field of the second data packet based on a hidden Markov model, and constructing a state machine model of the unknown protocol according to a plurality of observed states; generating a protocol format description file of the unknown protocol according to the content recorded by the state machine model; and generating a test case according to the protocol format description file, and analyzing vulnerabilities in the unknown protocol based on the test case. By adopting the method, vulnerability analysis of the self-developed proprietary protocol of the cloud computer can be realized, so that the use security of the cloud computer is improved by utilizing the vulnerabilities.

Description

Technical Field

[0001] The present application relates to the field of cloud security technology, and in particular to a vulnerability analysis method, device, electronic device, storage medium and program product. Background Art

[0002] Cloud PC is an overall service solution that provides desktops, applications, hardware and other resources to users in an on-demand and elastically allocated mode through transmission protocols. It is widely used in various business scenarios and is the core key and important guarantee for the product to provide users with "one-point access, ready-to-use" computing power services.

[0003] With the continuous development of network technology, the means of network attacks are becoming increasingly complex and diverse. As the basis of network communication, the vulnerabilities of transmission protocols often become targets for attackers to exploit. Therefore, it is of great significance to analyze the vulnerabilities of transmission protocols and discover and exploit these vulnerabilities to improve network security. However, most of the transmission protocols currently used by cloud computers are self-developed proprietary protocols. Due to factors such as the difficulty in acquiring protocol knowledge and the difficulty in modeling protocol descriptions, the industry has not yet developed a vulnerability analysis security detection solution for self-developed proprietary protocols.

[0004] Therefore, how to implement vulnerability analysis on cloud computer's self-developed proprietary protocols and use these vulnerabilities to improve the security of cloud computer use is still an urgent problem to be solved. Summary of the invention

[0005] Based on this, it is necessary to provide a vulnerability analysis method, device, electronic device, storage medium and program product that can realize vulnerability analysis of cloud computer's self-developed proprietary protocol to improve the security of cloud computer use by utilizing these vulnerabilities in response to the above technical problems.

[0006] In a first aspect, the present application provides a vulnerability analysis method, the method comprising:

[0007] Acquire a first data packet generated based on the network protocol to be analyzed in the cloud network, and parse the first data packet to determine a second data packet generated based on an unknown protocol in the first data packet;

[0008] Observe the message header field of the second data packet based on the hidden Markov model, and construct a state machine model of the unknown protocol according to the observed multiple states; wherein the state machine model is used to describe the transition probability between different states in the multiple states; wherein one state corresponds to a subfield in the message header field;

[0009] Generate a protocol format description file of the unknown protocol according to the content recorded by the state machine model;

[0010] A test case is generated according to the protocol format description file, and vulnerabilities in the unknown protocol are analyzed based on the test case.

[0011] In one of the embodiments, the process of observing the message header field of the second data packet based on the hidden Markov model includes:

[0012] Dividing the message header field into a plurality of subfields connected in sequence;

[0013] Observe the status corresponding to each subfield and the status corresponding to the suffix field in each subfield.

[0014] In one of the embodiments, observing the state corresponding to each subfield includes:

[0015] Obtain the first conditional probability distribution of known states;

[0016] For each subfield, obtain a second conditional probability distribution of a state corresponding to the subfield;

[0017] If the second conditional probability distribution is the same as the first conditional probability distribution, determining that the state corresponding to the subfield is the known state;

[0018] If the second conditional probability distribution is different from the first conditional probability distribution, a new state is established and used as the state of the subfield.

[0019] In one embodiment, observing the state corresponding to the suffix field in each subfield includes:

[0020] Performing a KS check on the status relationship between the subfield and the suffix field;

[0021] If the state relationship check succeeds, the state of the subfield is used as the state of the suffix field;

[0022] If the state relationship check fails, a new state is created and used as the state of the suffix field.

[0023] In one embodiment, constructing a state machine model of the unknown protocol based on the observed multiple states includes:

[0024] Acquire a state whose occurrence frequency is greater than or equal to a preset frequency among the multiple states during the observation process and use it as a state to be adopted;

[0025] The state machine model is constructed according to the state to be adopted.

[0026] In one embodiment, determining in the first data packet a second data packet generated based on an unknown protocol includes:

[0027] Using a finite state machine to identify known protocols and unknown protocols in the network protocol to be analyzed;

[0028] Parsing the unknown protocol to determine unknown layer protocols and known layer protocols in the multi-layer protocol;

[0029] The message format of the upper layer protocol of the unknown layer protocol is adopted to parse the payload of the lower layer protocol of the unknown layer protocol, and the data packet of the unknown layer protocol is obtained as the second data packet.

[0030] In a second aspect, a vulnerability analysis device is provided, comprising:

[0031] An acquisition module, configured to acquire a first data packet generated based on a network protocol to be analyzed in a cloud network, and parse the first data packet to determine a second data packet generated based on an unknown protocol in the first data packet;

[0032] A construction module, used to observe the message header field of the second data packet based on a hidden Markov model, and construct a state machine model of the unknown protocol according to the observed multiple states; wherein the state machine model is used to describe the transition probability between different states in the multiple states; wherein one state corresponds to a subfield in the message header field;

[0033] The processing module is further used to generate a protocol format description file of the unknown protocol according to the content recorded by the state machine model;

[0034] The processing module is further used to generate a test case according to the protocol format description file, and analyze the vulnerability in the unknown protocol based on the test case.

[0035] According to a third aspect, an electronic device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method described in the first aspect when executing the computer program.

[0036] According to a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0037] According to a fifth aspect, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0038] The above-mentioned vulnerability analysis method, device, electronic device, storage medium and program product regard the cloud computer's self-developed proprietary protocol as a random process, and each subfield constituting the protocol appears with a certain probability, and there is a corresponding relationship between the internal state of the protocol and the set of certain subfields. In this way, combining the hidden Markov model and the statistical calculation method, a state machine model of an unknown protocol is generated, and then a protocol format description file of the unknown protocol is generated based on the state machine model. A test case is generated according to the protocol format description file, and the vulnerability in the unknown protocol is analyzed based on the test case. The vulnerability analysis method provided in this embodiment does not require any prior knowledge, and uses an optimized causal segmentation reconstruction algorithm (causal equation) to reconstruct the state machine model of the unknown protocol to generate a basic structural description model of the unknown protocol. In this way, the state machine model of the unknown protocol is reconstructed by the causal segmentation reconstruction algorithm, which overcomes the blindness of the vulnerability mining test. In addition, the method provided in this embodiment can also realize the vulnerability analysis of the cloud computer's self-developed proprietary protocol (unknown protocol) to use these vulnerabilities to improve the use security of the cloud computer. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 An application environment diagram of a vulnerability analysis method in an embodiment;

[0041] Figure 2 A schematic diagram of a vulnerability analysis method in one embodiment;

[0042] Figure 3 is a schematic diagram of a state machine model in one embodiment;

[0043] Figure 4 A partial flow chart of a vulnerability analysis method in another embodiment;

[0044] Figure 5 A partial flow chart of a vulnerability analysis method in another embodiment;

[0045] Figure 6 A partial flow chart of a vulnerability analysis method in another embodiment;

[0046] Figure 7 is a schematic diagram of a state machine model in yet another embodiment;

[0047] Figure 8A schematic diagram of a protocol format description file in one embodiment;

[0048] Fig. 9 is a schematic diagram of each subfield in an embodiment;

[0049] Fig.10 is a schematic diagram of a vulnerability analysis system in one embodiment;

[0050] Fig.11 is a structural block diagram of a vulnerability analysis device in one embodiment;

[0051] Fig.12 FIG. 4 is a diagram showing the internal structure of an electronic device in one embodiment. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0053] The vulnerability analysis method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0054] In an exemplary embodiment, Figure 2 As shown, a vulnerability analysis method is provided, which is applied to Figure 1 The server in the example is used to illustrate, including the following steps 201 to 204. Among them:

[0055] Step 201: obtain a first data packet generated based on a network protocol to be analyzed in a cloud network, and parse the first data packet to determine a second data packet generated based on an unknown protocol in the first data packet.

[0056] The network protocol to be analyzed is a self-developed protocol, including known protocols and unknown protocols. The known protocols can be identified by means of a finite state machine.

[0057] The first data packet is captured by a device such as a network card. The process of capturing the first data packet can be implemented by programming using Winpcap (windows packet capture) or Libpcap (Packet Capture Library) function libraries.

[0058] By parsing the first data packet, a data packet generated based on a known protocol may be obtained, and a second data packet generated based on an unknown protocol may also be obtained.

[0059] Step 202: observe the message header field of the second data packet based on the hidden Markov model, and construct a state machine model of the unknown protocol according to the observed multiple states.

[0060] The state machine model is used to describe the transition probability between different states in the multiple states.

[0061] Among them, one state corresponds to a subfield in the message header field.

[0062] Among them, the Hidden Markov Model (HMM) is a statistical model that is used to describe a Markov process with hidden unknown parameters. The Hidden Markov Model consists of five elements, including two state sets and three probability matrices. The two state sets are represented as N and M respectively. Among them, N represents the number of states in the model, and the states can be transferred to each other. M represents the different observation symbols in each state, that is, the number of output characters. The three probability matrices are represented as A, B and π respectively. A represents the state transition probability distribution, which describes the probability of transitioning from one state to another. B represents the probability distribution of the observation symbol in each state, which describes the probability of generating a certain observation value in a given state. π represents the initial state distribution, which describes the probability of each state of the model at the initial moment.

[0063] The message header field includes multiple subfields, so multiple states can be observed, where one state corresponds to a subfield in the message header field.

[0064] According to the observed states, a state machine model (ε-machine model) of the unknown protocol can be constructed. The state machine model is used to describe the number of states, different observation symbols for each state, transition probabilities between different states, etc.

[0065] In this embodiment, the unknown protocol is regarded as a random process, the fields constituting the protocol appear with a certain probability, and there is a corresponding relationship between the internal state of the protocol and the set of certain fields.

[0066] Assume a discrete random process: . Denoted as , Derived from the symbol set A. Assuming that the random process is stationary, at any time, the process can be divided into historical and future Two parts. The first L characters of the future time are defined as , the last L characters of the historical time are defined as , Representation process A sample of, and so on, we can get To predict , first of all, we need to determine Conditional probability distribution about the future , that is, to establish an equation to achieve arrive 's mapping.

[0067] The state machine model consists of two parts: the causal state equation and the state transfer matrix. The causal state equation is the equation established to achieve arrive The causal state equation can be expressed as ,in,

[0068]

[0069] From this causal state equation, we can see that if two histories and The conditional probability distributions about the future are consistent, so there is reason to believe that they come from the same hidden state.

[0070] See also Figure 3 , Figure 3 The figure shows a state transition matrix in a simple ε-machine model. s|p indicates that the probability of transitioning to the next state when field s appears is p. For example, when s is equal to 1 and p is equal to 0.7, the probability of field 1 transitioning from state A to state B is 0.7. For example, when s is equal to 1 and p is equal to 0.1, the probability of field 1 transitioning from state B to state A is 0.1.

[0071] In this step, in the process of constructing the state machine model of the unknown protocol based on the observed multiple states, the causal state equation and the state transfer matrix are constructed. The subfields of the same state, the subfields of different states, etc. are determined by the causal state equation, and the state transfer probability of the subfield is determined by the state transfer matrix. By constructing the state machine model of the unknown protocol, the state and state transfer probability of each subfield in the message header field of the unknown protocol can be known.

[0072] Step 203: Generate a protocol format description file of the unknown protocol according to the content recorded in the state machine model.

[0073] The contents recorded by the state machine model include subfields, states of subfields, etc., and a protocol format description file can be generated based on these contents.

[0074] The basic components of the protocol format description file include service primitives and service primitive timing, protocol data units and their exchange timing, protocol states, protocol events, protocol variables, protocol operations and predicates, etc. Among them, service primitives and service primitive timing are used to describe the basic units for interaction between the parties in the protocol and the timing relationship between these units. Protocol data units and their exchange timing are used to define the structure of data units transmitted in the protocol and how these data units are exchanged between the communicating parties. Protocol states are used to describe the various states that the protocol may be in during the communication process, as well as the transition conditions between states. Protocol events are used to trigger protocol state transitions or events that perform specific protocol operations. Protocol variables are used to store and transmit information during the execution of the protocol. Protocol operations and predicates are used to describe the specific operations performed in the protocol, as well as the conditions (predicates) for performing these operations.

[0075] All message formats that make up an unknown protocol are collectively referred to as protocol formats. Protocol formats describe all possible message types and their structures in a protocol, as well as the associations and interactions between these messages.

[0076] Step 204: Generate a test case according to the protocol format description file, and analyze vulnerabilities in the unknown protocol based on the test case.

[0077] Generate test cases using the existing test case mutation rules in the system knowledge base and the protocol structure described in the protocol format description file. Encapsulate the test cases to obtain data packets. Establish a session with the target program through a man-in-the-middle or replay attack, and send the encapsulated data packet to the target program after guiding the target program to the data transmission stage. The target program is set on the target device, such as a server. Use the heartbeat and consistency detection algorithm to detect whether the target device is abnormal, so as to analyze the vulnerabilities in the unknown protocol.

[0078] In the above vulnerability analysis method, the cloud computer's self-developed proprietary protocol is regarded as a random process, and each subfield that constitutes the protocol appears with a certain probability, and there is a corresponding relationship between the internal state of the protocol and the set of certain subfields. In this way, the hidden Markov model and the statistical calculation method are combined to generate a state machine model of the unknown protocol, and then the protocol format description file of the unknown protocol is generated based on the state machine model. A test case is generated according to the protocol format description file, and the vulnerabilities in the unknown protocol are analyzed based on the test case. The vulnerability analysis method provided in this embodiment does not require any prior knowledge, and uses an optimized causal segmentation reconstruction algorithm (causal equation) to reconstruct the state machine model of the unknown protocol to generate a basic structure description model of the unknown protocol. In this way, the state machine model of the unknown protocol is reconstructed by the causal segmentation reconstruction algorithm, which overcomes the blindness of the vulnerability mining test. In addition, the method provided in this embodiment can also realize the vulnerability analysis of the cloud computer's self-developed proprietary protocol (unknown protocol) to use these vulnerabilities to improve the use security of the cloud computer.

[0079] In an exemplary embodiment, see Figure 4 , step 202 includes step 401 and step 402. Wherein:

[0080] Step 401: divide the message header field into a plurality of subfields connected in sequence.

[0081] The message header field is divided into a plurality of subfields connected in sequence, and the lengths of the subfields may be the same or different. Optionally, the length of each subfield is less than or equal to a preset length.

[0082] It should be noted that the subfields divided at this time are not the corresponding subfields in the state of the state machine model. The subfields divided in this step can be understood as subfields under the assumed state.

[0083] Step 402: observe the state corresponding to each subfield and the state corresponding to the suffix field in each subfield.

[0084] First assume that each subfield is in the same state, and then determine the actual state of the subfield.

[0085] Optionally, step 302 observes the state corresponding to each subfield, including:

[0086] Step 1: Obtain the first conditional probability distribution of the known state.

[0087] The known state is the state of the message header field that has been observed by the hidden Markov model.

[0088] Step 2: For each subfield, obtain a second conditional probability distribution of the state corresponding to the subfield.

[0089] Estimate the conditional probability distribution of each subfield corresponding to the state with respect to the future.

[0090] Step three: If the second conditional probability distribution is the same as the first conditional probability distribution, determine that the state corresponding to the subfield is the known state.

[0091] When the second conditional probability distribution of the state corresponding to the subfield is the same as the first conditional probability distribution of the known state, it is determined that the state corresponding to the subfield is the known state.

[0092] Step 4: If the second conditional probability distribution is different from the first conditional probability distribution, a new state is established and used as the state of the subfield.

[0093] If the second conditional probability distribution of the state corresponding to the subfield is different from the first conditional probability distribution of the known state, the state corresponding to the subfield is determined to be a new state.

[0094] Optionally, step 302 observes the state corresponding to each subfield, including:

[0095] Step 1: Perform a KS test (Kolmogorov-Smirnov test) on the status relationship between the subfield and the suffix field.

[0096] The KS test is used to compare whether two independent samples come from the same distribution. In this embodiment, it is used to compare whether the state of a subfield and the state of its suffix field conform to the same conditional probability distribution.

[0097] Step 2: If the status relationship check succeeds, the status of the subfield is used as the status of the suffix field.

[0098] The state relationship verification is successful when the state of the subfield and the state of its suffix field meet the same conditional probability distribution. Therefore, if the state relationship verification is successful, the state of the subfield is used as the state of the suffix field.

[0099] Step 3: If the state relationship check fails, a new state is created and used as the state of the suffix field.

[0100] The state relationship check failure means that the state of the subfield and the state of its suffix field do not conform to the same conditional probability distribution. Therefore, if the state relationship check fails, a new state is established and used as the state of the suffix field.

[0101] In an exemplary embodiment, see Figure 5 Step 202 constructs a state machine model of the unknown protocol based on the observed multiple states, including:

[0102] Step 501, obtaining a state whose occurrence frequency among the multiple states during the observation process is greater than or equal to a preset frequency and taking it as a state to be adopted.

[0103] The preset frequency can be set according to actual needs. The state to be adopted can be understood as a cycle state, which is reliable.

[0104] The state less than the preset frequency can be understood as a transient state, which may exist due to some interference and is unreliable.

[0105] Step 502: construct the state machine model according to the state to be adopted.

[0106] After removing the transient state, the state machine model is constructed in a cyclic state to obtain a more stable state machine model.

[0107] The method provided in this embodiment can improve the reliability and stability of the state machine model by filtering out transient states and using only cyclic states to construct the state machine.

[0108] In an exemplary embodiment, see Figure 6 Step 201 determines in the first data packet a second data packet generated based on an unknown protocol, including:

[0109] Step 601: using a finite state machine to identify known protocols and unknown protocols in the network protocol to be analyzed.

[0110] The known protocols in the network protocol to be analyzed are identified by using a finite state machine. The protocols other than the known protocols in the network to be analyzed are unknown protocols. A rule file is directly generated for the known protocols. The unknown protocols are first parsed at the known level.

[0111] Step 602, parse the unknown protocol to determine the unknown layer protocols and known layer protocols in the multi-layer protocol.

[0112] Unknown protocols include multi-layer protocols, and multi-layer protocols include unknown layer protocols and known layer protocols. The unknown protocol is parsed at a known layer to determine the upper layer protocol and the lower layer protocol of the unknown layer protocol. Among them, the upper layer protocol and the lower layer protocol are both known layer protocols.

[0113] Step 603, using the message format of the upper layer protocol of the unknown layer protocol, parse the payload of the lower layer protocol of the unknown layer protocol, obtain the data packet of the unknown layer protocol and use it as the second data packet.

[0114] First, the known layer protocol is parsed, the payload of the next layer protocol is extracted, and then the next layer protocol is parsed according to the message format of the previous layer protocol, and finally a data packet containing only the unknown layer protocol is obtained. The data packet containing only the unknown layer protocol is used as the second data packet. The second data packet includes the message header field and payload of the unknown protocol to be parsed.

[0115] above.

[0116] For ease of understanding, the vulnerability analysis method is explained below with a more specific embodiment.

[0117] Take the Internet Control Message Protocol (ICMP protocol) as an example of the network protocol to be analyzed.

[0118] The first step is to capture the first data packet generated based on ICMP through a network card or other device. This process is implemented using Winpcap or Libpcap function library programming.

[0119] The second step is to parse the captured first data packet and identify the known protocol through a finite state machine. Generate a rule file directly for the known protocol, parse the unknown protocol at the known level first, extract the payload of the next layer protocol of the unknown level protocol, parse the payload of the next layer protocol according to the message format of the previous layer protocol, and finally obtain a protocol data packet containing only the application layer part. The protocol data packet includes the message header field and payload of the unknown protocol to be parsed.

[0120] The third step is to start message analysis and obtain the state machine model of the message header field. The state machine model is as follows: Figure 6 shown.

[0121] The fourth step is to Figure 7 From the state machine model shown in the figure, it can be seen that {n} represents n consecutive bytes, and END means that the encapsulation is completed and waiting to be sent. In this example, since the values ​​of Type and Code are both fixed values ​​0x08 and 0x00, they are identified as the same field. Figure 7 The state machine model shown enables the corresponding fields to be assigned to the correct state machine.

[0122] The fifth step is to generate the corresponding protocol format description file. The generated protocol format description file is as follows: Figure 8 shown.

[0123] In the sixth step, the existing test case mutation rules in the system knowledge base are used to generate test cases for Fuzzing testing according to the protocol structure description obtained in the fifth step, and then encapsulate them.

[0124] Step 7: Establish a session with the target program through a man-in-the-middle or replay attack. After guiding the target program to the data transmission stage, send the encapsulated test case to the target program in the form of a data packet.

[0125] Step 8: Use the heartbeat and consistency detection algorithm to detect whether the target device has any abnormality in order to analyze the vulnerability of the ICMP protocol. If an abnormality occurs, the abnormal information and the test case that caused the abnormality are saved in the log file.

[0126] Optionally, after the fuzzing testing process is over, the test logs can also be submitted to researchers for in-depth analysis and usability studies.

[0127] See also Fig. 9 According to the content recorded in the state machine model, the message header fields of the ICMP protocol include Fig. 9 The subfields shown include Type+Code, Checksum, Identifier, Sequence number, and Payload.

[0128] See also Fig.10 The schematic diagram of the vulnerability analysis system is shown. When the terminal device sends a data packet, the message is captured and then analyzed for protocol, followed by description generation (generating a protocol format description file), description script parsing, test case generation, interaction state detection and simulation, and test message sending. In the process, consistency detection, heartbeat detection, etc. can also be performed, and data can be written in the log module.

[0129] It should be understood that, although the steps in the flowcharts of the embodiments described above are shown in sequence according to the instructions of the arrows, these steps are not necessarily performed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the flowcharts of the embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of the steps or stages in other steps.

[0130] Based on the same inventive concept, the embodiment of the present application also provides a vulnerability analysis device for implementing the vulnerability analysis method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more vulnerability analysis device embodiments provided below can refer to the limitations of the vulnerability analysis method above, and will not be repeated here.

[0131] In an exemplary embodiment, Fig.11As shown, a vulnerability analysis device 110 is provided, including: an acquisition module 111, a construction module 112 and a processing module 113, wherein:

[0132] The acquisition module 111 is used to acquire a first data packet generated based on the network protocol to be analyzed in the cloud network, and parse the first data packet to determine a second data packet generated based on an unknown protocol in the first data packet.

[0133] Construction module 112 is used to observe the message header field of the second data packet based on the hidden Markov model, and construct a state machine model of the unknown protocol according to the observed multiple states; wherein the state machine model is used to describe the transition probability between different states in the multiple states; wherein a state corresponds to a subfield in the message header field.

[0134] The processing module 113 is further configured to generate a protocol format description file of the unknown protocol according to the content recorded in the state machine model.

[0135] The processing module 113 is further configured to generate a test case according to the protocol format description file, and analyze vulnerabilities in the unknown protocol based on the test case.

[0136] Optionally, the construction module 112 is used to divide the message header field into a plurality of subfields connected in sequence; and observe a state corresponding to each subfield and a state corresponding to a suffix field in each subfield.

[0137] Optionally, the construction module 112 is used to obtain a first conditional probability distribution of a known state; for each subfield, obtain a second conditional probability distribution of the state corresponding to the subfield; if the second conditional probability distribution is the same as the first conditional probability distribution, determine that the state corresponding to the subfield is the known state; if the second conditional probability distribution is different from the first conditional probability distribution, establish a new state and use it as the state of the subfield.

[0138] Optionally, the construction module 112 is used to perform a KS check on the status relationship between the subfield and the suffix field; if the status relationship check succeeds, the status of the subfield is used as the status of the suffix field; if the status relationship check fails, a new status is established and used as the status of the suffix field.

[0139] Optionally, the construction module 112 is used to obtain a state whose occurrence frequency among the multiple states during the observation process is greater than or equal to a preset frequency and use it as a state to be adopted; and construct the state machine model according to the state to be adopted.

[0140] Optionally, the acquisition module 111 is used to identify known protocols and unknown protocols in the network protocol to be analyzed by means of a finite state machine; parse the unknown protocol to determine the unknown layer protocol and the known layer protocol in the multi-layer protocol; use the message format of the upper layer protocol of the unknown layer protocol to parse the payload of the lower layer protocol of the unknown layer protocol, obtain the data packet of the unknown layer protocol and use it as the second data packet.

[0141] Each module in the above vulnerability analysis device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in an electronic device in the form of hardware, or can be stored in a memory in an electronic device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0142] In an exemplary embodiment, an electronic device is provided. The electronic device may be a server, and its internal structure diagram may be as shown in FIG. Fig.12 As shown. The electronic device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the electronic device is used to store data. The input / output interface of the electronic device is used to exchange information between the processor and an external device. The communication interface of the electronic device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a vulnerability analysis method is implemented.

[0143] Those skilled in the art will understand that Fig.12 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0144] In an exemplary embodiment, an electronic device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0145] Acquire a first data packet generated based on the network protocol to be analyzed in the cloud network, and parse the first data packet to determine a second data packet generated based on an unknown protocol in the first data packet;

[0146] Observe the message header field of the second data packet based on the hidden Markov model, and construct a state machine model of the unknown protocol according to the observed multiple states; wherein the state machine model is used to describe the transition probability between different states in the multiple states; wherein one state corresponds to a subfield in the message header field;

[0147] Generate a protocol format description file of the unknown protocol according to the content recorded by the state machine model;

[0148] A test case is generated according to the protocol format description file, and vulnerabilities in the unknown protocol are analyzed based on the test case.

[0149] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0150] Dividing the message header field into a plurality of subfields connected in sequence;

[0151] Observe the status corresponding to each subfield and the status corresponding to the suffix field in each subfield.

[0152] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0153] Obtain the first conditional probability distribution of known states;

[0154] For each subfield, obtain a second conditional probability distribution of a state corresponding to the subfield;

[0155] If the second conditional probability distribution is the same as the first conditional probability distribution, determining that the state corresponding to the subfield is the known state;

[0156] If the second conditional probability distribution is different from the first conditional probability distribution, a new state is established and used as the state of the subfield.

[0157] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0158] Perform KS test on the status relationship between the subfield and the suffix field;

[0159] If the status relation check succeeds, the status of the subfield is used as the status of the suffix field;

[0160] If the state relationship check fails, a new state is created and used as the state of the suffix field.

[0161] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0162] Acquire a state whose occurrence frequency is greater than or equal to a preset frequency among the multiple states during the observation process and use it as a state to be adopted;

[0163] The state machine model is constructed according to the state to be adopted.

[0164] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0165] Using a finite state machine approach to identify known protocols and unknown protocols in the network protocol to be analyzed;

[0166] The unknown protocol is parsed to determine the unknown layer protocol and the known layer protocol in the multi-layer protocol;

[0167] The message format of the upper layer protocol of the unknown layer protocol is adopted to parse the payload of the lower layer protocol of the unknown layer protocol, and the data packet of the unknown layer protocol is obtained as the second data packet.

[0168] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0169] Acquire a first data packet generated based on the network protocol to be analyzed in the cloud network, and parse the first data packet to determine a second data packet generated based on an unknown protocol in the first data packet;

[0170] Observe the message header field of the second data packet based on the hidden Markov model, and construct a state machine model of the unknown protocol according to the observed multiple states; wherein the state machine model is used to describe the transition probability between different states in the multiple states; wherein one state corresponds to a subfield in the message header field;

[0171] Generate a protocol format description file of the unknown protocol according to the content recorded by the state machine model;

[0172] A test case is generated according to the protocol format description file, and vulnerabilities in the unknown protocol are analyzed based on the test case.

[0173] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0174] Dividing the message header field into a plurality of subfields connected in sequence;

[0175] Observe the status corresponding to each subfield and the status corresponding to the suffix field in each subfield.

[0176] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0177] Obtain the first conditional probability distribution of known states;

[0178] For each subfield, obtain a second conditional probability distribution of a state corresponding to the subfield;

[0179] If the second conditional probability distribution is the same as the first conditional probability distribution, determining that the state corresponding to the subfield is the known state;

[0180] If the second conditional probability distribution is different from the first conditional probability distribution, a new state is established and used as the state of the subfield.

[0181] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0182] Perform KS test on the status relationship between the subfield and the suffix field;

[0183] If the status relation check succeeds, the status of the subfield is used as the status of the suffix field;

[0184] If the state relationship check fails, a new state is created and used as the state of the suffix field.

[0185] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0186] Acquire a state whose occurrence frequency is greater than or equal to a preset frequency among the multiple states during the observation process and use it as a state to be adopted;

[0187] The state machine model is constructed according to the state to be adopted.

[0188] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0189] Using a finite state machine approach to identify known protocols and unknown protocols in the network protocol to be analyzed;

[0190] The unknown protocol is parsed to determine the unknown layer protocol and the known layer protocol in the multi-layer protocol;

[0191] The message format of the upper layer protocol of the unknown layer protocol is adopted to parse the payload of the lower layer protocol of the unknown layer protocol, and the data packet of the unknown layer protocol is obtained as the second data packet.

[0192] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0193] Acquire a first data packet generated based on the network protocol to be analyzed in the cloud network, and parse the first data packet to determine a second data packet generated based on an unknown protocol in the first data packet;

[0194] Observe the message header field of the second data packet based on the hidden Markov model, and construct a state machine model of the unknown protocol according to the observed multiple states; wherein the state machine model is used to describe the transition probability between different states in the multiple states; wherein one state corresponds to a subfield in the message header field;

[0195] Generate a protocol format description file of the unknown protocol according to the content recorded by the state machine model;

[0196] A test case is generated according to the protocol format description file, and vulnerabilities in the unknown protocol are analyzed based on the test case.

[0197] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0198] Dividing the message header field into a plurality of subfields connected in sequence;

[0199] Observe the status corresponding to each subfield and the status corresponding to the suffix field in each subfield.

[0200] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0201] Obtain the first conditional probability distribution of known states;

[0202] For each subfield, obtain a second conditional probability distribution of a state corresponding to the subfield;

[0203] If the second conditional probability distribution is the same as the first conditional probability distribution, determining that the state corresponding to the subfield is the known state;

[0204] If the second conditional probability distribution is different from the first conditional probability distribution, a new state is established and used as the state of the subfield.

[0205] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0206] Perform KS test on the status relationship between the subfield and the suffix field;

[0207] If the status relation check succeeds, the status of the subfield is used as the status of the suffix field;

[0208] If the state relationship check fails, a new state is created and used as the state of the suffix field.

[0209] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0210] Acquire a state whose occurrence frequency is greater than or equal to a preset frequency among the multiple states during the observation process and use it as a state to be adopted;

[0211] The state machine model is constructed according to the state to be adopted.

[0212] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0213] Using a finite state machine approach to identify known protocols and unknown protocols in the network protocol to be analyzed;

[0214] The unknown protocol is parsed to determine the unknown layer protocol and the known layer protocol in the multi-layer protocol;

[0215] The message format of the upper layer protocol of the unknown layer protocol is adopted to parse the payload of the lower layer protocol of the unknown layer protocol, and the data packet of the unknown layer protocol is obtained as the second data packet.

[0216] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0217] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0218] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A vulnerability analysis method, characterized in that: The method comprises: Acquire a first data packet generated based on the network protocol to be analyzed in the cloud network, and parse the first data packet to determine a second data packet generated based on an unknown protocol in the first data packet; Observe the message header field of the second data packet based on the hidden Markov model, and construct a state machine model of the unknown protocol according to the observed multiple states; wherein the state machine model is used to describe the transition probability between different states in the multiple states; wherein one state corresponds to a subfield in the message header field; Generate a protocol format description file of the unknown protocol according to the content recorded by the state machine model; A test case is generated according to the protocol format description file, and vulnerabilities in the unknown protocol are analyzed based on the test case.

2. The method according to claim 1, characterized in that The process of observing the message header field of the second data packet based on the hidden Markov model includes: Dividing the message header field into a plurality of subfields connected in sequence; Observe the status corresponding to each subfield and the status corresponding to the suffix field in each subfield.

3. The method according to claim 2, characterized in that The state corresponding to each subfield of the observation includes: Obtain the first conditional probability distribution of known states; For each subfield, obtain a second conditional probability distribution of a state corresponding to the subfield; If the second conditional probability distribution is the same as the first conditional probability distribution, determining that the state corresponding to the subfield is the known state; If the second conditional probability distribution is different from the first conditional probability distribution, a new state is established and used as the state of the subfield.

4. The method according to claim 2, characterized in that: Observe the status of the suffix field in each subfield, including: Performing a KS check on the status relationship between the subfield and the suffix field; If the state relationship check succeeds, the state of the subfield is used as the state of the suffix field; If the state relationship check fails, a new state is created and used as the state of the suffix field.

5. The method according to claim 1, characterized in that: The step of constructing a state machine model of the unknown protocol according to the observed multiple states includes: Acquire a state whose occurrence frequency is greater than or equal to a preset frequency among the multiple states during the observation process and use it as a state to be adopted; The state machine model is constructed according to the state to be adopted.

6. The method according to claim 1, characterized in that The determining in the first data packet that a second data packet generated based on an unknown protocol comprises: Using a finite state machine to identify known protocols and unknown protocols in the network protocol to be analyzed; Parsing the unknown protocol to determine unknown layer protocols and known layer protocols in the multi-layer protocol; The message format of the upper layer protocol of the unknown layer protocol is adopted to parse the payload of the lower layer protocol of the unknown layer protocol, and the data packet of the unknown layer protocol is obtained as the second data packet.

7. A vulnerability analysis device, characterized in that: include: An acquisition module, configured to acquire a first data packet generated based on a network protocol to be analyzed in a cloud network, and parse the first data packet to determine a second data packet generated based on an unknown protocol in the first data packet; A construction module, used to observe the message header field of the second data packet based on a hidden Markov model, and construct a state machine model of the unknown protocol according to the observed multiple states; wherein the state machine model is used to describe the transition probability between different states in the multiple states; wherein one state corresponds to a subfield in the message header field; The processing module is further used to generate a protocol format description file of the unknown protocol according to the content recorded by the state machine model; The processing module is further used to generate a test case according to the protocol format description file, and analyze the vulnerability in the unknown protocol based on the test case.

8. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images