A network protocol analysis method for malicious code

Abstract

The invention discloses a network protocol analysis method of a malicious code and belongs to the network security technical field. The network protocol analysis method of the malicious code comprises the following steps: (1), deploying the to-be-analyzed malicious code in a monitoring server, marking data which are received from a network by a malicious process as original stain source data; (2), recording all of operational orders of the malicious process to the stain data in a tracking mode; and recording application program interface (API) which is called in the process of implementing the malicious process and is relative to the security of an operational system; (3) starting grammatical division to the network protocol data of the malicious code based on the recorded operational orders and the operational characteristics of the malicious process; and (4), as to a grammatical character field which is regarded as API function parameters, and acquiring the final semanteme of the grammatical field based on the corresponding API function. The network protocol analysis method of the malicious code has generality and anti-interference performance on a protocol element recognition aspect, and enables a division result of a protocol element to be clear and accurate.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a malicious code network protocol analysis method based on dynamic stain analysis technology. Background technique [0002] Malicious codes emerging in an endless stream are increasingly becoming a serious threat to information security. As the role of network applications in economic and social life continues to deepen, worms (Worm), botnets (Botnet), Trojan horses (Trojan) and other network-based malicious codes have caused catastrophic effects and caused heavy losses. In order to limit the spread of network malicious codes, identify and defend against their attacks, and further analyze the working mechanism of network malicious codes, a key technical link is to reverse analyze the communication protocols used by network malicious codes. [0003] So far, the reverse analysis of malicious code network protocols mainly relies on manual static analysis. The ...

AI Technical Summary

Problems solved by technology

Although the above-mentioned solutions can divide the network data more accurately and have better anti-interference ability, they are still insufficient in the completeness and accuracy of identifying grammatical elements, especially the semantic understanding of protocol fields is relatively weak

Images