Method for detecting attack on computer system
By extracting exploit strings from computer systems and using pattern recognition and machine learning models, combined with honeypot technology, attacks can be automatically identified and responded to. This solves the problem of difficulty in identifying and responding to attacks on embedded systems in existing technologies, and achieves efficient attack detection and protection.
Patent Information
- Application Number
- CN202510529523.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2024-04-29
- Filing Date
- 2025-04-25
- Publication Date
- 2025-10-31
AI Technical Summary
Existing technologies struggle to automatically identify and respond to various attacks, especially those targeting embedded systems, and traditional methods cannot effectively utilize machine learning to identify the correlation between malicious communication traffic and specific attacks.
By extracting exploit strings from computer systems, using pattern recognition algorithms and machine learning models, the system automatically identifies whether security vulnerabilities exist in communication data. Combined with honeypot technology, it simulates attacks on target systems to capture communication traffic. Through filtering and model training using a security vulnerability database, it achieves automatic identification and response to attacks.
It enables automated attack identification and response to computer systems, especially targeted protection for embedded systems, improving attack detection efficiency, reducing the impact on target systems, and adapting to rapidly changing attack scenarios.
Smart Images
Figure CN120880680A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to methods for detecting attacks on computer systems. Background Technology
[0002] In an increasingly interconnected world, identifying cyber threats within communication traffic is a crucial area of research. Research in this field heavily relies on categorizing communication traffic into benign and malicious types, with malicious traffic intended to be blocked.
[0003] Machine learning can be used to identify the types of security vulnerabilities exploited by malicious communication traffic (e.g., cross-site scripting, SQL injection, or denial-of-service attacks in web applications), but this involves security vulnerability types specific to the corresponding communication protocols. However, when protecting data processing systems (target systems), regardless of the target system, protocol, or type of exploit, it is often more important to identify which specific security vulnerability (e.g., a vulnerability published in the CVE (Common Vulnerabilities and Exposures) database) an attacker (using malicious data traffic, i.e., one or more messages) exploits to attack the data processing system.
[0004] Therefore, it is desirable to be able to identify various attack methods, especially to associate (malicious) data traffic with specific attacks, in order to be able to respond appropriately. Summary of the Invention
[0005] According to various embodiments, a method for detecting attacks on a computer system is provided, comprising: for each of one or more security vulnerabilities, extracting at least one exploit string associated with the security vulnerability from the code of a program that exploits the security vulnerability, wherein each extracted exploit string is a string sent by a corresponding program to exploit the security vulnerability associated with the exploit string; receiving a message through the computer system; searching for the extracted exploit string in the payload data of the received message; and in response to finding one of the extracted exploit strings in one of the received messages, outputting an alert indicating that an attack exploiting the security vulnerability associated with the found exploit string has occurred, and alert information describing the message and the security vulnerability.
[0006] For example, a message that finds an exploit string that belongs to a security vulnerability (i.e., an exploit string associated with a security vulnerability) is marked with the identifier of that security vulnerability, and, for example, the user is informed that the computer system has been attacked against that security vulnerability, or security measures are automatically initiated (e.g., blocking ports, configuring firewalls accordingly, blocking accounts, etc.).
[0007] The method described above enables the automatic identification of any security vulnerabilities that should be exploited within (a portion of) captured communication data, regardless of the programming language of the exploit code (i.e., the program code intended to exploit the vulnerability). Various pattern recognition algorithms can be used to search for exploit strings in the payload data, and these algorithms can be updated during operation (e.g., during honeypot runs). There is no need to search for any fixed-code templates. Therefore, known security vulnerabilities (e.g., newly released vulnerabilities) can be automatically introduced, or security vulnerabilities (e.g., exploit strings extracted for security vulnerabilities) can be automatically updated. Less common security vulnerabilities in systems and services can also be identified if exploit strings are extracted for these vulnerabilities.
[0008] The methods described above can be used to identify targeted attacks on any system (e.g., honeypots or even the target system itself). With the increasing number of embedded systems connected to the internet, these methods can be particularly useful for identifying targeted attacks on such systems (e.g., automotive control devices) so that manufacturers (e.g., OEMs) and suppliers can respond accordingly. This identification prevents attackers from gaining control of the embedded system and causing it to crash, be damaged, or be tampered with.
[0009] Various embodiments are described below.
[0010] Example 1 is a method for detecting attacks on a computer system as described above.
[0011] Example 2 is based on the method of Example 1, wherein the computer system receiving the message implements a honeypot (for simplicity, it is also said in this document: according to one implementation, the computer system "is" a honeypot).
[0012] Therefore, the attack targets the functionality (interface, protocol, etc.) provided by the honeypot. By using the honeypot as the receiving computer system, it can be assumed that the communication traffic (i.e., messages) received by the receiving computer system primarily originates from the attacker, thus allowing for relatively frequent discovery of exploit strings. This significantly improves the efficiency of searching for messages used in the attack compared to using a "normal" computer system to capture communication traffic.
[0013] Example 3 is a method according to Example 1 or 2, further comprising: in response to finding one of the extracted exploit strings in one of the received messages, establishing security measures on the computer system or other computer system (e.g., the computer system to be protected if the computer system receiving the message is a honeypot).
[0014] This allows for the automatic protection of the computer system from the following security vulnerabilities, including detecting an attacker attempting to exploit the vulnerability.
[0015] Example 4 is a method according to any one of Examples 1 to 3, which includes identifying one or more security vulnerabilities by filtering security vulnerabilities from a security vulnerability database, wherein security vulnerabilities existing in functions not available in the computer system (e.g., operating system, services, interfaces, etc., which may depend on the version used) are filtered out.
[0016] This allows for efficient searching of messages that exploit security vulnerabilities present in the computer system to be protected (where it is assumed that if the computer system receiving the message is a honeypot, then that computer system also possesses the functionality (at least the functionality of interest) of the computer system to be protected). These relevant (or considered) security vulnerabilities can be automatically identified through corresponding filtering, and the set of (one or more) security vulnerabilities can be updated (e.g., periodically and / or automatically) by examining received messages to identify said security vulnerabilities (i.e., searching for associated exploit strings in the messages for said security vulnerabilities as described above).
[0017] Example 5 is a method according to any one of Examples 1 to 4, including using training data items to train a machine learning model for detecting malicious communication traffic, each training data item being formed by a message in which one of the extracted exploit strings is found and a description of a security vulnerability associated with the exploit string found in the message.
[0018] Therefore, if the search for exploit strings has been conducted for a sufficiently long time in accordance with the above method, the data obtained during this period can be used to train machine learning models (e.g., neural networks), in which the security vulnerability associated with the found exploit string (i.e., the identifier of the security vulnerability) is used as a label for, for example, the corresponding message.
[0019] Example 6 is a computer system configured to perform a method according to any one of Examples 1 to 5.
[0020] Example 7 is a computer program including instructions that, when executed by a processor, cause the processor to perform a method according to any one of Examples 1 to 5.
[0021] Example 8 is a computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform a method according to any one of Examples 1 to 6. Attached Figure Description
[0022] In the accompanying drawings, similar reference numerals generally refer to the same parts in different views. The drawings are not necessarily drawn to scale, but generally focus on illustrating the principles of the invention. In the following description, various aspects will be described with reference to the accompanying drawings.
[0023] Figure 1 A computer network is shown.
[0024] Figure 2 An architecture illustrating a process for analyzing communication traffic (including malicious messages) according to one embodiment is shown.
[0025] Figure 3 A flowchart illustrating a method for detecting (and identifying) attacks on a computer system (specifically for detecting communication traffic that exploits security vulnerabilities) according to one embodiment is shown. Detailed Implementation
[0026] The following detailed description refers to the accompanying drawings, which, for illustrative purposes, illustrate specific details and aspects in which the invention may be practiced within this disclosure. Other aspects may be used and structural, logical, and electrical changes may be made without departing from the scope of the invention. The various aspects of this disclosure are not necessarily mutually exclusive, as some aspects of this disclosure may be combined with one or more other aspects of this disclosure to form new aspects.
[0027] The various examples are described in more detail below.
[0028] Figure 1 Computer network 100 is shown.
[0029] Computer network 100 includes multiple data processing devices 101-105 interconnected via communication connections. Data processing devices 101-105 include, for example, server computer 101, control device 102, and user terminals 103, 104.
[0030] Server computer 101 provides various services, such as internet pages, bank portals, etc. Control device 102 is, for example, a control device for robotic equipment, such as the control device in an autonomous vehicle. Therefore, server computer 101 and control device 102 perform different tasks and are typically accessible from user terminals 103, 104. This is especially true when server computer 101 provides functionality to users (e.g., a bank portal). However, control device 102 can also be accessed externally (e.g., to allow for configuration). Depending on the tasks of server computer 101 or control device 102, they may store security-related data and perform security-related tasks. Therefore, they must be protected against attackers. For example, an attacker using one of the user terminals 104 could, through a successful attack, obtain confidential data (e.g., keys), tamper with accounts, or even tamper with control device 102, leading to an incident.
[0031] The security measure against this type of attack is a so-called honeypot 106 (implemented by one of the data processing devices 105). The honeypot is claimed to provide a function that can therefore be used as bait to attract potential attackers. However, this honeypot is isolated from secret information or critical functions, thus attacks on the honeypot are conducted in a controlled environment, and the risk of affecting actual functionality is minimized. This allows the honeypot to understand the threat situation by recognizing attacks on the target system (e.g., one of the server computers 101 or one of the control devices 102) and to respond accordingly by implementing appropriate measures on the target system without allowing these attacks to compromise the target system.
[0032] The automotive industry is particularly interested in honeypots because there is very little data on real-world attacks. Therefore, honeypot 106 can be implemented, for example, in a vehicle, depending on the implementation. Computer network 100 can then at least partially include the vehicle's internal network (but also include networks providing connectivity to the vehicle from the outside, such as mobile radio networks).
[0033] Therefore, a honeypot is a deceptive system that mimics a target system (also known as a "valuable target"). It lures attackers to attack the honeypot and reveals the attack vectors targeting the real valuable target. Thus, a web server (or web server software) is a popular option that a honeypot mimics. Because web servers constitute a large part of the public internet, continuous monitoring of threats against web servers is crucial. In other words, a honeypot is a decoy resource that mimics a valuable target system to attract attackers. Honeypots are used to receive attacks so that defenders closely monitoring the system can gain insight into the adversary's strategy.
[0034] According to various embodiments, a method is provided for detecting communication traffic (i.e., communication data consisting of messages) that exploits security vulnerabilities (e.g., vulnerabilities known from the CVE (Common Vulnerabilities and Exposures) database) in communication data captured by a honeypot. As mentioned above, a honeypot is a deceptive system that can be attacked to attract potential attackers. Therefore, the data source of the communication data processed by this method is not a protected network or computer system, but rather a honeypot system that should be attacked by an attacker.
[0035] Communication data (i.e., collections of messages) is captured and stored for analysis by recording the attacker's behavior on the honeypot system (corresponding to messages sent from the attacker's computer to the honeypot system). The advantage of using honeypots in this context is that there's no need to distinguish between benign and malicious traffic, since only the attacker interacts with the honeypot regardless, and because the host (here, the honeypot) uses the data, encryption via network protocols is largely unnecessary (i.e., the message content exists unencrypted on the host system, unlike within the network used to transmit the message). Furthermore, defenders (i.e., such as administrators of the target system) can gain a general understanding of the attacker's intent from the communication data recorded by the honeypot, provided they can identify which security vulnerabilities were exploited to attack the honeypot. While many automated attacks are designed to exploit any system, defenders often want to know more about attacks specifically targeting their target system. Only with this knowledge can defenders effectively tailor their security measures.
[0036] Especially for embedded devices with connectivity, understanding whether attackers are targeting these newly accessible systems is crucial. Insights from security vulnerability identification include which vulnerabilities attackers are currently exploiting and the rate at which newly released vulnerabilities are being used. According to various implementations, the methods described in this paper enable the automatic association of messages (e.g., network packets) with specific vulnerabilities. For example, this can form a pipeline for creating labeled data to analyze and train machine learning models (for identifying malicious traffic). Due to the sheer number of vulnerabilities published on the internet and their daily increase, the workload required to obtain labeled training data is enormous, and most large libraries are outdated. This is a significant problem in a rapidly evolving attack landscape—especially given the prevalence of AI-powered attacks.
[0037] Therefore, according to various embodiments, a method is provided that automatically identifies the exploitation of common security vulnerabilities (vulnerabilities and exposures, i.e., CVEs) in messages (e.g., network packets) received by a host system (e.g., a honeypot, or alternatively the target system itself to be evaluated), i.e., a method for detecting messages that exploit security vulnerabilities as described above.
[0038] An embodiment of this method will be described in more detail below. Therefore, the distinction between the exploit code and the exploit string is important.
[0039] The entire executable code is exploit code executed by the attacker (on their data processing system, i.e., the attacking system) to attack the target system.
[0040] The following is an example of the beginning of such code that exploits security vulnerability CVE-2021-41773. .
[0041] Lines 6, 4, and 8 contain multiple exploit strings (or, if the three components payload1, payload2, and payload3 are considered as one string (and sent together, for example, in a single message), that is, a payload sent from the attacking system to the target system to exploit the corresponding security vulnerability. The CVE number is simply an official name.
[0042] According to various implementation methods, the process is as follows: 1. For each of the multiple vulnerabilities, collect the CVE number and exploit code separately and link them together.
[0043] 2. (Optional): Scan the system that captures communication traffic (communication data) from the attacker (e.g., honeypot 106 or target systems 101-104 themselves) to filter out CVEs associated with that system.
[0044] 3. For each vulnerability (or any remaining related vulnerabilities after step 2), perform the following steps: a. Extract the exploit string from the exploit code.
[0045] b. Search for exploit strings in the attacker's communication traffic (i.e., messages arriving at the honeypot) to determine if the attacker has exploited a specific vulnerability in these vulnerabilities.
[0046] c. When one of the vulnerabilities is discovered to be exploited, the corresponding data traffic (i.e., message) is marked with the corresponding CVE number.
[0047] Figure 2 The architecture 200 illustrating the process is shown.
[0048] Architecture 200 includes the following as input data sources. • Security Vulnerability Database 201: The Security Vulnerability Database (CVE Database) is a public resource that publishes security vulnerabilities and provides unique CVE numbers. However, CVEs are typically only described in a rough textual form in this database (e.g., "Vulnerability in OpenSSH Key Exchange Method") to prevent easy copying.
[0049] • Exploit Code Database 202: An exploit code database is a publicly available resource that stores exploit code. A well-known example is the "Rapid7 Vulnerabilities and Exploitations Database," which stores exploit code used with the Metasploit penetration testing framework.
[0050] • Other Exploitation Code Sources 203: Exploitation code can also be obtained from other sources, such as hacker / penetration tester forums, deep web marketplaces, bug bounty programs, or public GitHub repositories. Since some sources may not be available through the application programming interface (API), web scraping tools can be used to search for keywords indicating a specific CVE or vulnerability in the target system.
[0051] • Cumulative Database 204: The cumulative database represents a local database (e.g., in honeypot 106 or on another computer (analysis data processing system) that analyzes communication data received by honeypot 106 according to the methods described above) containing entries with CVE numbers and device or service names linked to corresponding exploit codes. The corresponding exploit codes are security vulnerabilities found to exploit specific target systems (devices) or specific services. These entries can be retrieved from available public sources 201, 202, and 203.
[0052] Now, the data processing system (hereinafter referred to as the analytical data processing system; this can be the honeypot itself or other data processing systems) performs the above method, that is, analyzes whether there are messages in the communication data captured by the honeypot that exploit a specific (considered) security vulnerability.
[0053] The captured communication data can be real-time data (i.e., messages currently received by the honeypot) or logged data. Whether the throughput of the data processing system is high enough to analyze real-time data depends on the number of security vulnerabilities considered.
[0054] The analysis data processing system may optionally create a security vulnerability filter 205: Since the total number of known vulnerabilities is quite large, it makes sense to pre-filter vulnerabilities and only test those relevant to the target system (e.g., only entries for these vulnerabilities are logged in the cumulative database 204, or the cumulative database is filtered to ensure that exploit code for irrelevant vulnerabilities is not present in or removed from the cumulative database). Therefore, the analysis data processing system may filter security vulnerabilities from the security vulnerability database 201, for example, to consider only those vulnerabilities related to the target system (and, assuming, a honeypot configured for the target system) and the services used by the target system (and those simulated by the honeypot).
[0055] To create such filters 205, various methods are provided: A network scan can be performed to identify the operating system and running services of the target system or honeypot. Another possibility, if present, is the target system's or honeypot's Software Bill of Materials (SBOM). The SBOM contains all components of the software product and can be used to pre-filter related operating systems and services. The operating system and services running on the target system (or honeypot) are identified, and security vulnerabilities are filtered from a vulnerability database 201, also considering approximate matches to corresponding versions (e.g., if the target system is running OpenSSH 7.1, vulnerabilities in OpenSSH versions below 6 will be filtered out or not retrieved at all). The stringency of vulnerability filtering can be set differently, such as matching only service numbers, only service names, or the entire operating system.
[0056] The analysis data processing system can simply perform analysis (i.e. detection) based on all security vulnerabilities present in the security vulnerability database 201, but this would drastically increase the duration of the analysis and the computing resources required for the analysis.
[0057] The result of filter 205 is related security vulnerabilities 206: for example, the filtering is performed in such a way that the related security vulnerabilities, i.e. the security vulnerabilities under consideration, include all security vulnerabilities that can be exploited against the target system as described above (e.g., because they involve the correct version of a service or operating system running on the target system). All of these related security vulnerabilities 206 are accompanied by matching exploit code (e.g., from the cumulative database 204).
[0058] In section 207, the data processing system extracts the exploit string 208 for the considered security vulnerability. This string is the string sent to the attacked system in the exploit code belonging to the considered security vulnerability within a message (e.g., as packet content or command-line input). The exploit string is therefore the part of the exploit code specifically used on the attacked system and can thus be identified in the communication data collected (i.e., captured) by honeypot 106. A simple example is: CVE-XXX: The developer user for the HTTP login still exists.
[0059] connect→target:PORT80 If successful, then send→development_username send→development_password end if In this simple example of exploit code targeting CVE-XXX vulnerabilities, development_username and development_password are exploit strings (or exploit strings containing both components).
[0060] In order to identify messages used to exploit CVE-XXX vulnerabilities in the captured communication data, the analysis data processing system extracts exploit strings (i.e., developer username and developer password) from the exploit code and scans the captured (e.g., incoming) communication traffic at honeypot 106 to search for these login information.
[0061] Therefore, one possibility for extracting exploit strings is to perform pattern or keyword comparisons. Another possibility is to use machine learning or deep learning models to analyze the corresponding exploit code. An example of this is current large language models, which provide exploit code hints and should return exploit strings. Since a single extraction method or model often cannot provide the correct exploit string in every case (the exploit string may be difficult to identify or the programming language may differ), multiple extraction methods and / or models can be combined. As a result, in such cases of combination, the analytical data processing system selects, for example, one or more exploit strings extracted from the corresponding exploit code by most of the extraction methods and / or models.
[0062] The data analysis and processing system now searches the captured communication data for exploit strings extracted for the considered security vulnerability. To exploit a security vulnerability, attackers explicitly use corresponding exploit strings to attack the target system. Therefore, by searching the incoming communication data for corresponding exploit strings, attempts to exploit specific security vulnerabilities can be identified. The format of the exploit strings can be adapted based on their extraction from the exploit code. For example, simple string formats are suitable for extraction using large language models.
[0063] The captured communication data 209 (in the case of a honeypot, this is usually attack data) includes messages that may contain various types of data, especially depending on the optional inputs of the target system, such as inputs made by the attacker on the honeypot's command-line interface.
[0064] In 210, the data processing system analyzes and compares the exploit string 208 with the captured communication data 209, that is, it searches the captured communication data 209 for the exploit string 208 extracted for the security vulnerability under consideration.
[0065] For example, each extracted exploit string is compared to the entire communication data 209. Even partial matches can be used to determine the probability that a particular security vulnerability will be exploited in an attack (security vulnerabilities can also partially share the same exploit string).
[0066] Examples of algorithms used for comparison that can be used to search for exploit strings 208 in captured communication data 209 and can also identify partially matching (i.e., fuzzy search) strings are the Hamming distance algorithm and the Levenstein distance algorithm.
[0067] If, in step 211, an exploit string 208 is found in the captured communication data 209 (within a specific message), the data processing system in step 212 associates that message with the corresponding security vulnerability (for which the exploit string 208 has been extracted). For example, the corresponding message is labeled with the CVE number of the security vulnerability. An alert indicating that malicious communication traffic has been detected is then output. In the case of communication traffic captured by a honeypot, the urgency of the alert may be relatively low, and the alert may simply be: logging the corresponding message to a message list containing the detected exploit string.
[0068] If we consider matching a message with (partially) exploit strings for multiple security vulnerabilities, we can associate a message with multiple vulnerabilities (e.g., CVE numbers) and assign corresponding probabilities of matching. This helps to illustrate attacks, the identification of security vulnerabilities in subsequent analyses (e.g., by user analysis), and makes the data usable training data for machine learning to associate communication data with security vulnerabilities.
[0069] In summary, a method is provided according to various embodiments, such as... Figure 3 The method shown.
[0070] Figure 3 A flowchart 300 is shown illustrating a method for detecting (and identifying) attacks on a computer system (specifically for detecting communication traffic that exploits security vulnerabilities) according to one embodiment.
[0071] In 301, for each of one or more security vulnerabilities, at least one exploit string associated with the security vulnerability is extracted from the code of a program that exploits the security vulnerability (such code is also referred to herein as exploit code), wherein each extracted exploit string is a string sent by the corresponding program (i.e., the program from which the exploit string is extracted) to exploit the security vulnerability associated with the exploit string.
[0072] In 302, the computer system receives messages (i.e., captures communication traffic, i.e., communication data; the communication data can be recorded and stored for subsequent analysis, or analyzed directly as real-time traffic as follows).
[0073] In 303, the exploit string is searched for in the payload data of the received message (i.e., the payload itself) (e.g., by means of pattern comparison, especially character (string) search). It can also be user interface input, i.e., it is not necessary to search directly in the message (they may be encrypted), but only to monitor the command line interface.
[0074] In a 304 error, in response to finding one of the extracted exploit strings in one of the received messages, an alert (i.e., an alarm signal) is output. This alert indicates that an attack has occurred exploiting a security vulnerability associated with the found exploit string, and alert information describing the message and the security vulnerability is output. The alert signal may trigger security measures, for example.
[0075] Figure 3The methods can be performed by one or more computers having one or more data processing units. The term "data processing unit" can be understood as any type of entity capable of processing data or signals. For example, data or signals can be processed according to at least one (i.e., one or more) dedicated functions performed by the data processing unit. A data processing unit may include analog circuits, digital circuits, logic circuits, microprocessors, microcontrollers, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable gate arrays (FPGAs), integrated circuits, or any combination thereof, or may be formed from analog circuits, digital circuits, logic circuits, microprocessors, microcontrollers, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable gate arrays (FPGAs), integrated circuits, or any combination thereof. Any other means of implementing the corresponding functions described in more detail herein can also be understood as a data processing unit or logic circuit device. One or more method steps described in detail herein can be performed (e.g., implemented) by a data processing unit through one or more dedicated functions performed by that data processing unit.
[0076] Therefore, depending on the implementation, this method is particularly implemented by a computer.
Claims
1. A method for detecting attacks on a computer system (105), comprising: For each of one or more security vulnerabilities (206), extract (301) at least one exploit string (208) associated with the security vulnerability (206) from the code of the program that exploits the security vulnerability (206), wherein each extracted exploit string (208) is a string sent by the corresponding program to exploit the security vulnerability (206) associated with the exploit string (208); Message (302) is received via computer system (105); Search (303) for the extracted exploit string (208) in the payload data of the received message; and In response to finding one of the extracted exploit strings (208) in one of the received messages, output (304) indicates that an attack has occurred that exploits a security vulnerability (206) associated with the found exploit string (208), and provides alert information describing the message and the security vulnerability (206).
2. The method according to claim 1, wherein, The computer system (105) that receives the message implements a honeypot (106).
3. The method according to claim 1 or 2, further comprising: In response to finding one of the extracted exploit strings (208) in one of the received messages, security measures are established on the computer system (105) or other computer systems (101-104) for the security vulnerability (206) associated with the found exploit string (208).
4. The method according to any one of claims 1 to 3, comprising: The one or more security vulnerabilities are identified by filtering security vulnerabilities from a security vulnerability database (201), wherein security vulnerabilities existing in functions that the computer system does not have are filtered out.
5. The method according to any one of claims 1 to 4, comprising: Training data items are used to train a machine learning model for detecting malicious communication traffic. Each training data item consists of a message in which one of the extracted exploit strings (208) is found, and a description of a security vulnerability (206) associated with the exploit string (208) found in the message.
6. A computer system configured to perform the method according to any one of claims 1 to 5.
7. A computer program comprising instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 5.
8. A computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 6.