Method for mining unknown network protocol hidden behaviors through clustering instruction sequences

Abstract

The invention discloses an instruction sequence cluster mining method for concealed behavior of an unknown network protocol, which mainly solves the problem that the existing protocol reverse analysis method only analyzes the format of the protocol message, but cannot analyze the protocol behavior, especially the hidden behavior. The implementation steps are: (1) divide and mark all the instructions of the protocol program into three types of genetic instructions; (2) cluster the instruction sequence; (3) calculate the protocol behavior; (4) find the comparison instructions before all potential hidden behaviors , extract the constants involved in the comparison, use these constants to replace the relevant fields in the protocol message, generate new messages with triggering capabilities, and use the new messages to trigger potential hidden behaviors; (5) Calculate the three types of genes between hidden behaviors and known behaviors The absolute difference RS of the instruction distribution rate, if RS>0.3, the protocol operation is not safe, and the protocol has malicious behavior; otherwise, the protocol operation is safe, and the mining is over. The invention improves the speed and accuracy of excavation, and can serve more users and wider application fields.

Description

technical field [0001] The invention belongs to the field of network security, relates to network protocol reverse analysis and behavior analysis, and specifically refers to a method for mining unknown network protocol hidden behavior by clustering instruction sequences, which can be used for network security situation perception and threat location. Background technique [0002] Network protocols are the fundamental cornerstone of cyberspace and one of the most important infrastructures in the information age. In recent years, network security incidents have emerged one after another due to insufficient understanding of the behavior of unknown network protocols. The fundamental status of network protocols and the insufficiency of our research on their hidden behaviors have brought major hidden dangers to our information security, national defense security and national security. The losses already caused and potential losses are incalculable. The research and analysis of th...

AI Technical Summary

Problems solved by technology

[0006] Although these methods have solved the problem of reverse analysis of the protocol format, they have not solved the security problem of protocol operation from the perspective of protocol behavior. The protocol information obtained by these methods is very limited, and the reverse analysis of the protocol is far more than that. In fact, the behavior of the protocol has a more direct and fundamental impact on network security, so the mining and analysis technology of the behavior of the protocol, especially the hidden behavior, has important and extensive application prospects.

Images