Mining and Utilizing Network Protocol's Stealth Attack Behaviors

The survivability, concealment and aggression of network protocol’s stealth attack behaviors are very strong, and they are not easy to be detected by the existing security measures. In order to compensate for the shortcomings of existing protocol analysis methods, starting from the instructions to implement the protocol program, the normal behavior instruction sequences of the protocol are captured by dynamic binary analysis. Then, the potential stealth attack behavior instruction sequences are mined by means of instruction clustering and feature distance computation. The mined stealth attack behavior instruction sequences are loaded into the general executing framework for inline assembly. Dynamic analysis is implemented on the self-developed virtual analysis platform HiddenDisc, and the securities of stealth attack behaviors are evaluated. Except to mining analysis and targeted defensive the stealth attack behaviors, the stealth attack behaviors are also formally transformed by the self-designed stealth transformation method, by using the stealth attack behaviors after transformation, the virtual target machine were successfully attacked and were not detected. Experimental results show that, the mining of protocol stealth attack behaviors is accurate, the transformation and use of them to increase our information offensive and defensive ability is also feasible.