Vulnerability utilization program detection method and system based on vulnerability utilization program characteristics

Abstract

The invention discloses a vulnerability utilization program detection method and system based on vulnerability utilization program characteristics, and relates to the technical field of vulnerability utilization program detection.The method comprises the steps that data accessed into a network is obtained as to-be-detected data, and the to-be-detected data is put into a packaging area to obtain packaging data; inputting the packaging data into a virtual space corresponding to the target system; and extracting abnormal behavior characteristics of the to-be-detected data in the virtual space based on the tracking network, comparing the abnormal behavior characteristics with standard characteristics, and marking the to-be-detected data corresponding to the behavior characteristics which do not conform to the standard characteristics as a vulnerability utilization program. According to the method, the to-be-detected data can be subjected to data coverage through the plurality of tracking points and the communication channels with the fixed tracks among the plurality of tracking points, so that a relatively comprehensive monitoring effect on the vulnerability utilization program is achieved, and the vulnerability utilization program is better determined.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability exploit program detection, and in particular to a vulnerability exploit program detection method and system based on vulnerability exploit program features. Background Art

[0002] An exploit is a code or program written by hackers or attackers to perform malicious operations by taking advantage of security holes in the target system. These programs are usually used for malicious purposes such as unauthorized access, data theft, system destruction, or spreading malware. Exploits are easily mixed in with accessed data, making them difficult to detect. They can be directly put into use with data and cause system instability and other serious problems, making it impossible to conduct comprehensive detection of the accessed data. Summary of the invention

[0003] The purpose of the present invention is to provide a vulnerability exploit detection method and system based on vulnerability exploit features to address the deficiencies in the background technology.

[0004] In order to achieve the above object, the present invention provides the following technical solution: a vulnerability exploit detection method based on vulnerability exploit features, comprising the following steps:

[0005] Acquire data accessed in the network as data to be detected, and put the data to be detected into the packaging area to obtain packaging data, wherein the packaging data includes the data to be detected and a tracking network for the data to be detected;

[0006] Put the packaged data into the virtual space corresponding to the target system;

[0007] Based on the tracking network, abnormal behavior features of the data to be detected in the virtual space are extracted, the abnormal behavior features are compared with the standard features, and the data to be detected corresponding to the behavior features that do not meet the standard features are marked as vulnerability exploits.

[0008] In a preferred embodiment, the step of acquiring data accessed in the network as data to be detected and putting the data to be detected into the packaging area to obtain packaging data includes:

[0009] A packaging area is constructed between the network access terminal and the target system, wherein the packaging area includes a tracking network element and a plurality of tracking network pending areas;

[0010] The data accessed in the network is used as the data to be detected and put into the packaging area, multiple data features in the data to be detected are extracted, and the corresponding tracking network pending area is matched according to the number of data features;

[0011] The tracking network in the pending area of ​​the matching tracking network is packaged with the data to be detected to obtain packaged data.

[0012] In a preferred embodiment, the step of constructing a packaging area between the network access terminal and the target system includes:

[0013] A data processing area for communication connection is set between the network access terminal and the target system, a plurality of main tracking points are set in the data processing area, communication channels are set between the plurality of main tracking points, and a plurality of strain channel points are set for the communication channels between the plurality of main tracking points to obtain a tracking network element;

[0014] Setting a plurality of tracking frames, marking corresponding tracking levels for the plurality of tracking frames respectively, and setting a replication architecture between the plurality of tracking frames and the tracking network element respectively, wherein the replication architecture includes a tracking point architecture corresponding to the tracking level of the tracking frame;

[0015] The replication structure and the tracking network element are matched to replicate the main tracking point and the communication channel between the main tracking points, the replication structure of the copied main tracking point is separated from the tracking network element to obtain multiple tracking points connected through the communication channel, and the multiple tracking points connected through the communication channel are loaded into the tracking network frame to obtain the tracking network pending area;

[0016] The tracking network element and multiple tracking network pending areas are used as packaging areas.

[0017] In a preferred embodiment, the step of packaging the data to be detected by matching the tracking network in the tracking network pending area to obtain the packaged data includes:

[0018] The tracking network in the tracking network pending area that matches the tracking network is called and separated from the tracking network pending area. After the tracking network is separated from the tracking network pending area, a new tracking network is copied again through the copy architecture corresponding to the tracking network pending area and stored in the tracking network pending area.

[0019] Acquire location information of multiple data features, wherein the location information includes data locations and data volumes of the data features in the data to be detected;

[0020] The tracking points in the tracking network are bound to the data features one-to-one, the communication positions of multiple strain channel points in the communication channel between the multiple tracking points are arranged, the fixed track of the communication channel is determined according to the communication positions of the multiple strain channel points, and the data to be detected is covered by the multiple tracking points and the communication channel with fixed tracks between the multiple tracking points to obtain the packaging data.

[0021] In a preferred embodiment, the step of putting the packaging data into the virtual space corresponding to the target system includes:

[0022] The corresponding target system is copied to obtain a virtual system;

[0023] Determine an operation space in the data processing area, and put the virtual system into the operation space to obtain the virtual space;

[0024] Put the packaging data into virtual space for operation.

[0025] In a preferred embodiment, the step of marking the to-be-detected data corresponding to the behavior features that do not meet the standard features as vulnerability exploits includes:

[0026] Extracting the running status information of the data to be detected in the virtual space based on the tracking network, and determining the abnormal behavior characteristics according to the running status information;

[0027] Determine the standard features of the data to be detected, compare the abnormal behavior features with the standard features, and mark the data to be detected corresponding to the behavior features that do not meet the standard features as vulnerability exploits.

[0028] In a preferred embodiment, the step of extracting the running status information of the data to be detected in the virtual space based on the tracking network and determining the behavior characteristics according to the running status information includes:

[0029] Obtain offset information of multiple tracking points and communication channels between the multiple tracking points in the packaging data, calculate the state index of the data to be detected according to the offset information, and determine the running state information according to the state index. The calculation formula of the state index includes:

[0030] in, is the state index, G L is the offset of the tracking point's communication position change, n y is the number of communication position changes of the strain channel points in the communication channel connected to the tracking point, G q is the number of communication channels whose communication positions change when there are strain channel points connected to the tracking points, ε, α and μ are all constants greater than zero;

[0031] formulating operating status information, wherein the operating status information includes a plurality of status index ranges and corresponding operating status degrees;

[0032] According to the running state information matching state index corresponding to the running state degree, the tracking point corresponding to the degree exceeding the safe running state is taken as the abnormal behavior feature.

[0033] The present invention also provides a vulnerability exploit program detection system based on vulnerability exploit program features, comprising:

[0034] A packaging module is used to obtain data accessed in the network as data to be detected, and put the data to be detected into a packaging area to obtain packaging data, wherein the packaging data includes the data to be detected and a tracking network for the data to be detected;

[0035] A data input module, connected to the packaging module, is used to input the packaging data into the virtual space corresponding to the target system;

[0036] The detection module is connected to the data input module and is used to extract abnormal behavior features of the data to be detected in the virtual space based on the tracking network, compare the abnormal behavior features with the standard features, and mark the data to be detected corresponding to the behavior features that do not meet the standard features as vulnerability exploits.

[0037] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0038] The present invention can change the transmission route of the communication channel through the strain channel point, and the transmission route here is the fixed track of the communication channel. After the route of the fixed communication channel, the data to be detected is covered by multiple tracking points and the communication channel with a fixed track between the multiple tracking points to obtain packaging data. The data to be detected can be covered by multiple tracking points and the communication channel with a fixed track between the multiple tracking points, which has a more comprehensive monitoring effect of the vulnerability exploit program and better determines the vulnerability exploit program. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0040] Figure 1 The figure is a flow chart of the method of the present invention.

[0041] Figure 2 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Example 1, please refer to Figure 1 As shown, the vulnerability exploit detection method based on vulnerability exploit features described in this embodiment includes the following steps:

[0044] S1. Acquire data accessed in the network as data to be detected, and put the data to be detected into a packaging area to obtain packaging data, wherein the packaging data includes the data to be detected and a tracking network for the data to be detected;

[0045] S2, putting the packaging data into the virtual space corresponding to the target system;

[0046] S3, extracting abnormal behavior features of the data to be detected in the virtual space based on the tracking network, comparing the abnormal behavior features with the standard features, and marking the data to be detected corresponding to the behavior features that do not meet the standard features as vulnerability exploits;

[0047] As described in the above steps S1-S3, a vulnerability exploit is a code or program that is written by a hacker or attacker to perform malicious operations by exploiting security vulnerabilities in the target system; these programs are usually used for malicious purposes such as unauthorized access, data theft, system destruction or spreading malware, and are easy to be mixed with the accessed data, making it difficult to be discovered. They will be directly put into use in the data, causing system instability and other bad problems, and it is impossible to perform a comprehensive detection of the accessed data; and in this application, the transmission route of the communication channel can be changed through the strain channel point, and the transmission route here is the fixed track of the communication channel. After the route of the fixed communication channel, the data to be detected is covered by multiple tracking points and the communication channel with a fixed track between the multiple tracking points to obtain packaged data, and the data to be detected can be covered by multiple tracking points and the communication channel with a fixed track between the multiple tracking points, which has a more comprehensive monitoring effect of vulnerability exploits and better identification of vulnerability exploits.

[0048] In one embodiment, the step S1 of acquiring data accessed in the network as data to be detected and putting the data to be detected into the packaging area to obtain packaging data includes:

[0049] S11, constructing a packaging area between the network access terminal and the target system, wherein the packaging area includes a tracking network element and a plurality of tracking network pending areas;

[0050] S12, taking the data accessed in the network as the data to be detected and putting it into the packaging area, extracting multiple data features from the data to be detected, and matching the corresponding tracking network pending area according to the number of data features;

[0051] S13, packaging the tracking network to be detected in the matching tracking network pending area to obtain packaged data;

[0052] As described in the above steps S11-S13, a packaging area is constructed between the network access terminal and the target system. The target system is a system for accepting data in the network in the future. The packaging area here is a running server between the network access terminal and the target system. The packaging area includes a tracking network element and a plurality of tracking network pending areas. The tracking network pending area here is an area for storing tracking networks. The data accessed in the network is then used as data to be detected. The data to be detected will not be directly put into the target system for use, so as to avoid the existence of vulnerability exploits in the accessed data to attack the target system and ensure the stable operation of the target system. The data accessed in the network is used as data to be detected and put into the packaging area. Multiple data features in the data to be detected are extracted, and the corresponding tracking network pending area is matched according to the number of data features. An adapted tracking network can be obtained according to the actual data to be detected. Subsequent behavioral feature detection is performed between the tracking network and the data to be detected, so as to obtain whether the data to be detected has vulnerability exploit features. Then, the data to be detected is packaged by matching the tracking network in the corresponding tracking network pending area to obtain packaged data, so as to complete the preprocessing of the data to be detected and facilitate the subsequent monitoring of vulnerability exploit features of the data to be detected.

[0053] In one embodiment, the step S11 of constructing a packaging area between the network access terminal and the target system includes:

[0054] S111, a data processing area for communication connection is set between the network access terminal and the target system, a plurality of main tracking points are set in the data processing area, communication channels are set between the plurality of main tracking points, and a plurality of strain channel points are set for the communication channels between the plurality of main tracking points to obtain a tracking network element;

[0055] S112, setting a plurality of tracking frames, marking corresponding tracking levels for the plurality of tracking frames respectively, and setting a replication architecture between the plurality of tracking frames and the tracking network elements respectively, wherein the replication architecture includes a tracking point architecture corresponding to the tracking levels of the tracking frames;

[0056] S113, the copy structure and the tracking network element are aligned to copy the main tracking point and the communication channel between the main tracking points, the copy structure of the copied main tracking point is separated from the tracking network element to obtain a plurality of tracking points connected through the communication channel, and the plurality of tracking points connected through the communication channel are loaded into the tracking network frame to obtain a tracking network pending area;

[0057] S114, using the tracking network element and multiple tracking network pending areas as packaging areas;

[0058] As described in the above steps S111-S114, a data processing area is set between the network access terminal and the target system, and the data processing area and the network access terminal are connected in communication, and the data processing area and the target system are connected in communication, as an area for vulnerability exploit detection between the network access terminal and the target system. In order to detect the vulnerability exploit, multiple main tracking points are set in the data processing area, and communication channels are set between the multiple main tracking points. Multiple strain channel points are set corresponding to the communication channels between the multiple main tracking points. The strain channel points here can determine the communication trajectory of the communication channel. The strain channel points serve as connection nodes in the communication channel. Multiple tracking frames are set. The tracking frames are used to store multiple tracking points that are subsequently copied and connected through the communication channel. Corresponding to the multiple tracking points, the tracking frames are used to store multiple tracking points that are subsequently copied and connected through the communication channel. The corresponding tracking levels (tracking levels represent the number of tracking points) are marked on the frames respectively, and replication architectures are respectively set between the multiple tracking frames and the tracking network elements, the replication architectures include tracking point architectures corresponding to the tracking levels of the tracking frames, for example, if the tracking level of the tracking frame corresponds to N tracking points, then the replication architecture corresponding to the tracking frame has N replication points, and the multiple replication points are collectively connected to obtain the tracking point architecture, and then the replication architecture is fitted with the tracking network element to replicate the main tracking point and the communication channel between the main tracking points, and the replication architecture of the replicated main tracking point is separated from the tracking network element to obtain multiple tracking points connected through the communication channel, and the multiple tracking points connected through the communication channel are placed in the tracking frame to obtain the tracking network pending area, and the tracking network element and the multiple tracking network pending areas are used as the packaging area;

[0059] In one embodiment, the step S13 of packaging the data to be detected by matching the corresponding tracking network in the pending area of ​​the tracking network to obtain the packaged data includes:

[0060] S131, calling the tracking network in the tracking network pending area that matches the tracking network to be determined and separating it from the tracking network pending area. After the tracking network is separated from the tracking network pending area, a new tracking network is copied again through the copy architecture corresponding to the tracking network pending area and stored in the tracking network pending area.

[0061] S132, obtaining location information of multiple data features, wherein the location information includes data locations and data volumes of the data features in the data to be detected;

[0062] S133, binding the tracking points in the tracking network to the data features one-to-one, arranging the communication positions of the multiple strain channel points in the communication channel between the multiple tracking points, determining the fixed track of the communication channel according to the communication positions of the multiple strain channel points, covering the data to be detected through the multiple tracking points and the communication channel with the fixed track between the multiple tracking points, and obtaining the packaging data;

[0063] As described in the above steps S131-S133, the data accessed in the network is taken as the data to be detected and put into the packaging area, and multiple data features in the data to be detected are extracted. The data features have corresponding positions and data volumes involved in the entire data to be detected. The corresponding tracking network pending area is matched according to the number of data features, and the tracking network in the matching tracking network pending area is called and separated from the tracking network pending area. After the tracking network is separated from the tracking network pending area, a new tracking network is copied again through the copy architecture corresponding to the tracking network pending area and stored in the tracking network pending area. After the tracking network in the tracking network pending area is used, the same new tracking network is copied again by the tracking network element through the copy architecture. The used tracking network is directly destroyed later. The tracking networks in multiple tracking pending areas can be continuously supplemented through the tracking network element and the copy architecture. After obtaining multiple data features, After obtaining the position information of the feature, the tracking points in the tracking network are bound to the data features one-to-one, and the communication positions of the multiple strain channel points in the communication channel between the multiple tracking points are arranged. The arrangement here is random, mainly to obtain a transmission channel with a randomly arranged fixed transmission trajectory, and the fixed trajectory of the communication channel is determined according to the communication positions of the multiple strain channel points. The transmission route of the communication channel can be changed through the strain channel points. The transmission route here is the fixed trajectory of the communication channel. After the route of the fixed communication channel is determined, the data to be detected is covered by multiple tracking points and the communication channel with fixed trajectories between the multiple tracking points to obtain packaging data. The data to be detected can be covered by multiple tracking points and the communication channel with fixed trajectories between the multiple tracking points, which has a more comprehensive monitoring effect of vulnerability exploits and better determination of vulnerability exploits.

[0064] In one embodiment, the step S2 of putting the packaging data into the virtual space corresponding to the target system includes:

[0065] S21, copying the corresponding target system to obtain a virtual system;

[0066] S22, determining an operation space in the data processing area, and putting the virtual system into the operation space to obtain a virtual space;

[0067] S23. Put the packaging data into the virtual space for operation.

[0068] As described in the above steps S21-S23, the target system is a system used to access data through the network. In order to avoid the existence of vulnerability exploits therein, a virtual system with the same system structure as the target system is copied here, and then an operating space is determined in the data processing area. The operating space is used to carry the virtual system. The operating space carrying the virtual system is used as the virtual space, and then the packaged data is put into the virtual space for operation. In the virtual space, the behavioral characteristics of the packaged data in the virtual system can be used to detect whether the data accessed from the network has the behavioral characteristics of vulnerability exploits, and the security of the network access data can be comprehensively monitored.

[0069] In one embodiment, the step S3 of marking the to-be-detected data corresponding to the behavior features that do not meet the standard features as vulnerability exploits includes:

[0070] S31, extracting the running status information of the data to be detected in the virtual space based on the tracking network, and determining the abnormal behavior characteristics according to the running status information;

[0071] S32, determining standard features of the data to be detected, comparing the abnormal behavior features with the standard features, and marking the data to be detected corresponding to the behavior features that do not meet the standard features as vulnerability exploits;

[0072] In one embodiment, the step S31 of extracting the running status information of the data to be detected in the virtual space based on the tracking network and determining the behavior characteristics according to the running status information includes:

[0073] S311, obtaining offset information of multiple tracking points and communication channels between the multiple tracking points in the packaging data, calculating a state index of the data to be detected according to the offset information, and determining the operation state information according to the state index. The calculation formula of the state index includes:

[0074] Among them, φ is the state index, G L is the offset of the tracking point's communication position change, n y is the number of communication position changes of the strain channel points in the communication channel connected to the tracking point, G q is the number of communication channels whose communication positions change when there are strain channels connected to the tracking points. ε, α and μ are all constants greater than zero. It should be noted that G L , G q With n y The larger the value of The larger the value is, the worse the state of the data to be detected is;

[0075] S312, formulating operation status information, wherein the operation status information includes a plurality of state index ranges and corresponding operation status degrees;

[0076] S313. Match the operating status degree corresponding to the status index according to the operating status information, and use the tracking points corresponding to the safe operating status degree as abnormal behavior features. The operating status degree ensures the safe operating status degree, the suspicious operating status degree and the dangerous operating status degree. Each operating status degree corresponds to a numerical range of the status index.

[0077] As described in the above steps S131-S313, when the packaged data is put into the virtual space for vulnerability exploit detection, the state index of the data to be detected in the virtual space is calculated based on the tracking network. When there is a vulnerability exploit in the data to be detected, the vulnerability exploit will show abnormal behavior characteristics when entering the virtual space, and then the data characteristics in the data to be detected will change. Here, the movement of the data to be detected can be tracked by the tracking point, and the security of the data to be detected can be understood through the number of communication position changes of strain channel points in the communication channel connected to the tracking point and the number of communication channels connected to the tracking point with strain channel points having communication position changes. Then, the data characteristics corresponding to the tracking points with abnormal changes are used as abnormal behavior characteristics. The abnormal behavior characteristics include the changes in the abnormal communication positions of the data characteristics in the virtual space, and then the standard characteristics of the data to be detected are determined, and the abnormal behavior characteristics are compared with the standard characteristics. The data to be detected corresponding to the behavior characteristics that do not meet the standard characteristics are marked as vulnerability exploits, which can better detect vulnerability exploits. By packaging the data, we can more comprehensively understand whether the vulnerability exploits are mixed in the network access data. Then, when the packaged data is safe, the tracking points in the packaged data can be separated from the data to be detected, and the tracking points can be invalidated. The data to be detected can be put into the target system for normal use, and the target system can be assisted by the virtual space to detect vulnerability exploits to ensure the security of the data used by the target system.

[0078] Example 2, please refer to Figure 2 As shown, the vulnerability exploit detection system based on vulnerability exploit features described in this embodiment includes:

[0079] A packaging module is used to obtain data accessed in the network as data to be detected, and put the data to be detected into a packaging area to obtain packaging data, wherein the packaging data includes the data to be detected and a tracking network for the data to be detected;

[0080] A data input module, connected to the packaging module, is used to input the packaging data into the virtual space corresponding to the target system;

[0081] The detection module is connected to the data input module and is used to extract abnormal behavior features of the data to be detected in the virtual space based on the tracking network, compare the abnormal behavior features with the standard features, and mark the data to be detected corresponding to the behavior features that do not meet the standard features as vulnerability exploits.

[0082] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A vulnerability exploit detection method based on vulnerability exploit features, characterized in that: The following steps are involved: Acquire data accessed in the network as data to be detected, and put the data to be detected into the packaging area to obtain packaging data, wherein the packaging data includes the data to be detected and a tracking network for the data to be detected; Put the packaged data into the virtual space corresponding to the target system; Based on the tracking network, abnormal behavior features of the data to be detected in the virtual space are extracted, the abnormal behavior features are compared with the standard features, and the data to be detected corresponding to the behavior features that do not meet the standard features are marked as vulnerability exploits.

2. The vulnerability exploit detection method based on vulnerability exploit features according to claim 1, characterized in that: The step of obtaining data accessed in the network as data to be detected and putting the data to be detected into the packaging area to obtain packaging data includes: A packaging area is constructed between the network access terminal and the target system, wherein the packaging area includes a tracking network element and a plurality of tracking network pending areas; The data accessed in the network is used as the data to be detected and put into the packaging area, multiple data features in the data to be detected are extracted, and the corresponding tracking network pending area is matched according to the number of data features; The tracking network in the pending area of ​​the matching tracking network is packaged with the data to be detected to obtain packaged data.

3. The vulnerability exploit detection method based on vulnerability exploit features according to claim 2, characterized in that: The step of constructing a packaging area between the network access terminal and the target system includes: A data processing area for communication connection is set between the network access terminal and the target system, a plurality of main tracking points are set in the data processing area, communication channels are set between the plurality of main tracking points, and a plurality of strain channel points are set for the communication channels between the plurality of main tracking points to obtain a tracking network element; Setting a plurality of tracking frames, marking corresponding tracking levels for the plurality of tracking frames respectively, and setting a replication architecture between the plurality of tracking frames and the tracking network element respectively, wherein the replication architecture includes a tracking point architecture corresponding to the tracking level of the tracking frame; The replication structure and the tracking network element are matched to replicate the main tracking point and the communication channel between the main tracking points, the replication structure of the copied main tracking point is separated from the tracking network element to obtain multiple tracking points connected through the communication channel, and the multiple tracking points connected through the communication channel are loaded into the tracking network frame to obtain the tracking network pending area; The tracking network element and multiple tracking network pending areas are used as packaging areas.

4. The vulnerability exploit detection method based on vulnerability exploit features according to claim 3, characterized in that: The step of packaging the data to be detected by the tracking network in the pending area of ​​the matching tracking network to obtain the packaged data comprises: The tracking network in the tracking network pending area that matches the tracking network is called and separated from the tracking network pending area. After the tracking network is separated from the tracking network pending area, a new tracking network is copied again through the copy architecture corresponding to the tracking network pending area and stored in the tracking network pending area. Acquire location information of multiple data features, wherein the location information includes data locations and data volumes of the data features in the data to be detected; The tracking points in the tracking network are bound to the data features one-to-one, the communication positions of multiple strain channel points in the communication channel between the multiple tracking points are arranged, the fixed track of the communication channel is determined according to the communication positions of the multiple strain channel points, and the data to be detected is covered by the multiple tracking points and the communication channel with fixed tracks between the multiple tracking points to obtain the packaging data.

5. The vulnerability exploit detection method based on vulnerability exploit features according to claim 1, characterized in that: The step of putting the packaging data into the virtual space corresponding to the target system includes: The corresponding target system is copied to obtain a virtual system; Determine an operation space in the data processing area, and put the virtual system into the operation space to obtain the virtual space; Put the packaging data into virtual space for operation.

6. The vulnerability exploit detection method based on vulnerability exploit features according to claim 1, characterized in that: The step of marking the to-be-detected data corresponding to the behavior features that do not meet the standard features as vulnerability exploits includes: Extracting the running status information of the data to be detected in the virtual space based on the tracking network, and determining the abnormal behavior characteristics according to the running status information; Determine the standard features of the data to be detected, compare the abnormal behavior features with the standard features, and mark the data to be detected corresponding to the behavior features that do not meet the standard features as vulnerability exploits.

7. The vulnerability exploit detection method based on vulnerability exploit features according to claim 6, characterized in that: The step of extracting the running status information of the data to be detected in the virtual space based on the tracking network and determining the behavior characteristics according to the running status information includes: Obtain offset information of multiple tracking points and communication channels between the multiple tracking points in the packaging data, calculate the state index of the data to be detected according to the offset information, and determine the running state information according to the state index. The calculation formula of the state index includes: in, is the state index, G L is the offset of the tracking point's communication position change, n y is the number of communication position changes of the strain channel points in the communication channel connected to the tracking point, G q is the number of communication channels whose communication positions change when there are strain channel points connected to the tracking points, ε, α and μ are all constants greater than zero; formulating operating status information, wherein the operating status information includes a plurality of status index ranges and corresponding operating status degrees; According to the running state information matching state index corresponding to the running state degree, the tracking point corresponding to the degree exceeding the safe running state is taken as the abnormal behavior feature.

8. A vulnerability exploit detection system based on vulnerability exploit features, used to implement a vulnerability exploit detection method based on vulnerability exploit features as claimed in any one of claims 1 to 7, characterized in that: include: A packaging module is used to obtain data accessed in the network as data to be detected, and put the data to be detected into a packaging area to obtain packaging data, wherein the packaging data includes the data to be detected and a tracking network for the data to be detected; A data input module, connected to the packaging module, is used to input the packaging data into the virtual space corresponding to the target system; The detection module is connected to the data input module and is used to extract abnormal behavior features of the data to be detected in the virtual space based on the tracking network, compare the abnormal behavior features with the standard features, and mark the data to be detected corresponding to the behavior features that do not meet the standard features as vulnerability exploits.

Images