本文選題：協(xié)議逆向分析 + 隱形攻擊行為　； 參考：《通信學(xué)報(bào)》2017年06期

【摘要】：深藏在網(wǎng)絡(luò)協(xié)議中的隱形攻擊行為日益成為網(wǎng)絡(luò)安全面臨的新挑戰(zhàn)。針對(duì)現(xiàn)有協(xié)議逆向分析方法在協(xié)議行為分析特別是隱形攻擊行為挖掘方面的不足,提出了一種新穎的指令聚類(lèi)感知挖掘方法。通過(guò)抽取協(xié)議的行為指令序列,利用指令聚類(lèi)算法對(duì)所有的行為指令序列進(jìn)行聚類(lèi)分析,根據(jù)行為距離的計(jì)算結(jié)果,從大量未知協(xié)議程序中快速準(zhǔn)確地挖掘出隱形攻擊行為指令序列。將動(dòng)態(tài)污點(diǎn)分析和指令聚類(lèi)分析相結(jié)合,在自主研發(fā)的虛擬分析平臺(tái)Hidden Disc上分析了1 297個(gè)協(xié)議樣本,成功挖掘出193個(gè)隱形攻擊行為,自動(dòng)分析和手動(dòng)分析的結(jié)果完全一致。實(shí)驗(yàn)結(jié)果表明,該方案在效率和準(zhǔn)確性方面對(duì)協(xié)議隱形攻擊行為的感知挖掘都是理想的。
[Abstract]:Stealth attacks in network protocols are increasingly becoming a new challenge for network security. In view of the shortcomings of the existing protocol reverse analysis methods in the analysis of protocol behavior analysis, especially stealth attacks, a novel method of instruction clustering perception mining is proposed. The clustering algorithm is used to cluster and analyze all the sequence of behavior instructions. According to the calculation results of the behavior distance, the stealth attack sequence is quickly and accurately excavated from a large number of unknown protocol programs. The dynamic blot analysis and instruction clustering analysis are combined to analyze the 1297 of the independent research platform on the virtual analysis platform of Hidden Disc. The protocol sample has successfully excavated 193 stealth attacks, and the results of automatic analysis and manual analysis are all the same. The experimental results show that the scheme is ideal for the efficiency and accuracy of the perceptive mining of the protocol stealth attack.

【作者單位】： 武警工程大學(xué)網(wǎng)絡(luò)與信息安全武警部隊(duì)重點(diǎn)實(shí)驗(yàn)室;西安電子科技大學(xué)綜合業(yè)務(wù)網(wǎng)理論及關(guān)鍵技術(shù)國(guó)家重點(diǎn)實(shí)驗(yàn)室;
【基金】：國(guó)家自然科學(xué)基金資助項(xiàng)目(No.61373170,No.61402530,No.61309022,No.61309008)~~
【分類(lèi)號(hào)】：TP311.13;TP393.08
，

本文編號(hào)：1810616