Nested coding attack load detection method, system and device and storage medium

Abstract

The embodiment of the invention provides a nested coding attack load detection method, system and device, and a storage medium, and the method comprises the steps: scanning a decoder feature set through traversing a code of a to-be-detected load; and by utilizing the decoder feature set, a corresponding decoder can be called to automatically and intelligently decode the attack load of the multi-layer coding. By intelligently speculating nested codes, the attack load is restored, the number of attack detection rules is reduced, and the attack detection accuracy is improved. By adopting the embodiment of the invention, the rule number is equivalent to the original attack load number, about thousands of levels, the method can be effectively applied to the field of attack detection, and the potential possible attack variants can be effectively detected.

Description

technical field [0001] Embodiments of the present invention relate to the technical field of network security detection, and in particular, to a method, system, device and storage medium for detecting a nested coding attack load. Background technique [0002] The current industry network attack detection products, such as WAF, IPS, IDS, etc., mainly work by matching the network transmission data with the security detection rule set, and hitting the security detection rule is regarded as an attack / security event. [0003] When writing security detection rules, security researchers analyze attack detection use cases, extract attack feature payloads, and use a specific rule language to describe attack features (most of the industry use regular expressions to describe attack rules). [0004] With the continuous game of attack detection, the original attack payload is intercepted in most security detection devices. Therefore, hackers are constantly exploring various bypass method...

AI Technical Summary

Problems solved by technology

[0005] For this reason, the embodiment of the present invention provides a nested encoding attack load detection method, system, device and storage medium to solve the problem of the sharp increase in the number of existing rules when the traditional security detection is performed multiple times and multi-layer nested encoding attack loads. The technical problem of the attack bypass situation caused by incomplete enumeration

Images