Command Inspection via Deobfuscation and Suspicious Degree Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional command inspection methods fail to accurately detect obfuscated commands, as attackers use grammatical functions to deform commands, making them unintelligible and evading traditional defense mechanisms.
Innovation Solution
A method and apparatus that inspect commands based on features of known obfuscated and normal service commands, determine target commands with suspicious features, obtain running state text, and calculate suspicious degree information to identify potential obfuscation, thereby improving inspection accuracy and detecting obfuscated commands effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional command inspection methods are used, then the inspection process is simple, but the inspection accuracy deteriorates due to command obfuscation
Solution Approach 1:
The patent introduces an intermediary deobfuscation module that translates obfuscated commands into their original forms before inspection. This mediator handles the complexity of detecting obfuscated commands, allowing the inspection system to maintain high accuracy without requiring complex obfuscation detection algorithms. The intermediary converts the problematic obfuscated input into a form that can be easily inspected using conventional methods.
2Reliability
If command obfuscation is used by attackers, then the ability to evade detection is improved, but the readability and understandability of commands deteriorates
Solution Approach 1:
The patent applies preliminary deobfuscation action to commands before they undergo inspection. By restoring the original form of obfuscated commands in advance, the system recovers the readability and understandability of commands while maintaining the ability to detect malicious intent. This preliminary action ensures that both defense reliability and command readability are preserved simultaneously.
3Ease of manufacture
If traditional matching against known malicious command sets is used, then the inspection method is easy to implement, but it fails when commands are deformed using grammatical functions
Solution Approach 1:
The patent segments the command inspection process into two distinct stages: deobfuscation and inspection. This segmentation allows the system to first restore obfuscated commands to their original forms, and then apply simple matching against known malicious command sets. The segmentation resolves the contradiction by handling the complex deobfuscation task separately, enabling the use of simple and easy-to-implement matching algorithms while maintaining high detection accuracy.
Data Source
AI summary
Provided is a command inspection method, including: inspecting a plurality of to-be-inspected commands based on a plurality of first features of known obfuscated commands and a plurality of second features of normal service commands, to determine a plurality of target commands, each of the target commands being a command having one or more of the first features but none of the second features; obtaining running state text of the plurality of target commands; obtaining suspicious degree information of the plurality of target commands based on the plurality of target commands and the corresponding running state text, the suspicious degree information being used for indicating a possibility that a command is an obfuscated command; and determining, when suspicious degree information of any target command satisfies a target condition, the target command as an obfuscated command.