Abstract:Since network systems have become increasingly large and complex, the limitations of traditional abnormal packet detection have gradually emerged. The existing detection methods mainly rely on the recognition of packet features, which lack the association of specific applications and result in hysteresis and inaccurate judgement. In this paper, a task-oriented abnormal packet behavior detection method is proposed, which creatively collects action identifications during the execution of network tasks and inserts security labels into communication packets. Specifically, this paper defines the network tasks as a collection of state and action sequences to achieve the fine-grained division of the execution of network tasks, performs Hash value matching based on random communication string and action identification sequence for packet authentication, and proposes a mechanism of action identification sequence matching and abnormal behavior decision-making based on a finite state machine, according to the fine-grained monitoring of task execution action sequence. Furthermore, to verify the validity of the anomaly detection method proposed in this paper, a prototype based on the FTP communication platform is constructed, on which the simulation experiments, including the DDOS attack and backdoor attack, are conducted. The experimental results show that the proposed task-oriented abnormal behavior detection method can effectively intercept network malicious data packets and realize the active security defense for network systems.

Network-based Malcode Detection Technology

K-Means Clustering Analysis Based On Adaptive Weights For Malicious Code Detection

A malware detection framework based on kolmogorov complexity

Study on Modern Malware Analysis System

Mechanism and Defense on Malicious Code

Design and Implementation of Dual Malware Detection System

An Efficient Malicious Code Detection System Based on Convolutional Neural Networks

Research on malcode detection based on P2P

Survey on Malicious Code Intelligent Detection Techniques

Homology Judgment Technology of Malicious Code

VDS : Malware Detection System

Key Technology Analysis of Malicious Code Emergency Response in Computer Communication Network Security

AMCAS: an Automatic Malicious Code Analysis System

An Effective Cloud-Based Active Defense System Against Malicious Codes

Malicious Code Detection Based on Software Fingerprint

Malicious software detection method and device

Artificial neural network for decision of software maliciousness

Malicious Code Detection Method Based on Static Features and Ensemble Learning

Malicious Code Detection Based on CNNs and Multi-Objective Algorithm

Task-Oriented Network Abnormal Behavior Detection Method

Method for Detecting the Obfuscated Malicious Code Based on Behavior Connection