神经网络检测Java溢出攻击

1.数据搜集和数据清洗

使用ADFA-LD数据集中与Java溢出攻击相关的数据。

ADFA-LD数据集中记录了系统调用序列，使用系统调用号标识每一个系统调用，这样就将一连串的系统调用转换成一连串的系统调用号了。

6 6 63 6 42 120 6 195 120 6 6 114 114 1 1 252 252 252 1 1 1 1 1 1 1 1 1 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 1 1 252 1 1 1 1 1 1 1 1 1 1 1 1 1 1 252 1 1 1 1 1 1 252 252 252 252 252 252 252 252 252 252 252 1 1 1 1 1 1 1 1 1 1 252 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 252 1 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 1 1 1 1 1 1 1 1 1 1 1 252 252 1 1 1 1 1 1 1 1 1 1 1 1 1 1 252 252 252 1 252 1 1 1 1 252 1 1 1 1 1 1 1 1 1 252 252 252 252 252 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 1 1 1 1 1 252 252 252 1 1 1 1 1 1 1 1 1 252 1 1 1 1 1 1 1 1 1 1 252 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 252 252 252 252 252 1 1 252 1 252 252 252 252 252 1 1 252 252 252 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 252 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 252 1 1 252 1 1 252 1 1 252 252 1 1 1 1 1 1 1 1 1 252 1 1 1 1 1 1 252 252 252 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 252 1 1 1 1 1 252 1 1 1 1 1 1 1 252 1 1 1 1 1 1 252 252 1 1 1 1 1 252 252 252 252 1 1 1 1 1 1 1 1 1 1 1 1 1 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 1 252 252 252 252 252 252 252 252 1 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 1 252 252 1 252 252 1 1 252 252 252 1 1 252 252 252 252 1 1 1 1 1 1 1 1 252 252 252 252 252 252 252 1 252 252 252 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 252 1 252 252 1 252 252 252 252 252 252 252 252 252 252 252 252 252 252 1 1 1 1 1 1 1 1 1 1 1 1 252 1 1 1 1 252 252 252 252 252 252 252 1 252 1 1 252 1 1 252 1 252 252 252 252 252 252 252 252 252 252 1 252 1 1 252 1 252 252 252 1 252 252 252 1 1 252 252 252 252 252 252 252 252 252 252 252 252 252 252 1 1 252

每个系统调用文件中都是一长串的系统调用号。

正常状态系统调用文件（833个样本）

Training_Data_Master/
├── UTD-0001.txt
├── ...
├── UTD-0833.txt

攻击状态系统调用文件（这里需要递归目录，找到所有文件）

Attack_Data_Master/
├── Adduser_1
│   ...
│   └── UAD-Adduser-1-2783.txt...
├── Hydra_FTP_1
│   ...
│   └── UAD-Hydra-FTP-1-9186.txt...
├── Hydra_SSH_1
│   ...
│   └── UAD-Hydra-SSH-1-6011.txt...
├── Java_Meterpreter_1（124个样本）
│   ...
│   └── UAD-Java-Meterpreter-1-961.txt...
├── Meterpreter_1
│   ...
│   └── UAD-Meterpreter-1-2783.txt...
├── Web_Shell_1（118个样本）
│   ...
│   └── UAD-WS1-961.txt...

2.特征化

每个文件都记录了一长串的系统调用号，每个文件中的系统调用号数量都不一样，并且有大量重复的系统调用号。对样本集合做词集处理，通俗的说就是统计总共有多少种数字，每一条样本中有词集中的数字就置位1，没有就置位0，这种处理方式会丢失上下文语义。

词集处理可参考：机器学习特征提取入门。

我们统计到正常系统调用样本833个，打上0标签，Java溢出攻击系统调用样本124个，打上1标签。

vectorizer = CountVectorizer(min_df=1)#词集处理
#将每一行个数不同的样本，处理成具有相同列数的特征向量
x=vectorizer.fit_transform(x)#将List数据转为二维数组
x=x.toarray()# 每一行转换成由01组成的一维向量

3.训练样本

实例化神经网络算法，构建2个隐藏层的神经网络：

mlp = MLPClassifier(hidden_layer_sizes=(130,70), #隐藏层，神经元个数max_iter=10, #最大迭代次数alpha=1e-4,#正则化项参数solver='sgd',#激活函数，随机梯度下降 verbose=10, #是否将输出打印到stdouttol=1e-4, #优化容忍度random_state=1,#随机数生成器的状态learning_rate_init=.1)#学习率，用于权重更新

4.效果验证

由于数据量较少，采用10折交叉验证：

score=cross_validation.cross_val_score(mlp, x, y, n_jobs=-1, cv=10)

准确率：87%

Iteration 1, loss = 11.38788075
Iteration 1, loss = 10.51482083
Iteration 1, loss = 10.39080226
Iteration 1, loss = 11.32852644
Iteration 2, loss = 32.20600360
Iteration 2, loss = 58.44084813
Iteration 2, loss = 7.32748794
Iteration 2, loss = 80.82413497
Iteration 3, loss = 7424.23267185
Iteration 3, loss = 9424.08875251
Iteration 3, loss = 22610434422.25117111
Iteration 3, loss = 2840272.43090724
Iteration 4, loss = 29906.60187593
Training loss did not improve more than tol=0.000100 for two consecutive epochs. Stopping.
Iteration 4, loss = 38487.24709705
Iteration 4, loss = 35603719231444562174143164348696901984344076821095036977977791348736.00000000
Training loss did not improve more than tol=0.000100 for two consecutive epochs. Stopping.
Iteration 4, loss = 8621248.96811235
Training loss did not improve more than tol=0.000100 for two consecutive epochs. Stopping.
Iteration 5, loss = 65955.57738497
Training loss did not improve more than tol=0.000100 for two consecutive epochs. Stopping.
Iteration 1, loss = 10.38922256
Iteration 1, loss = 10.79185274
Iteration 1, loss = 11.10184141
Iteration 2, loss = 6.79289521
Iteration 1, loss = 11.44750387
Iteration 2, loss = 30.92423419
Iteration 2, loss = 5.54195671
Iteration 3, loss = 1539.31127234
Iteration 2, loss = 174.99802016
Iteration 3, loss = 35192.88159551
Iteration 3, loss = 2.18754845
Iteration 4, loss = 6406.82346419
Iteration 3, loss = 4352716771914203.00000000
Iteration 4, loss = 6193158.71046004
Training loss did not improve more than tol=0.000100 for two consecutive epochs. Stopping.
Iteration 5, loss = 11052.63693957
Training loss did not improve more than tol=0.000100 for two consecutive epochs. Stopping.
Iteration 4, loss = 4.32418180
Iteration 4, loss = 67175089847701384.00000000
Training loss did not improve more than tol=0.000100 for two consecutive epochs. Stopping.
Iteration 5, loss = 5.74591940
Iteration 1, loss = 11.19351752
Iteration 1, loss = 10.34211713
Iteration 2, loss = 10.96010720
Iteration 6, loss = 6.81881415
Training loss did not improve more than tol=0.000100 for two consecutive epochs. Stopping.
Iteration 2, loss = 1450.04509096
Iteration 3, loss = 62382524.00523394
Iteration 4, loss = 973646103714251520.00000000
Iteration 3, loss = 4663025983327232851968.00000000
Iteration 4, loss = 1966014836005464769614914274924194047233373694149176820834764942345697615581775134720.00000000
Training loss did not improve more than tol=0.000100 for two consecutive epochs. Stopping.
Iteration 5, loss = 187847652662873026661827284709049461984939454363352667852600455282239475435256474409617063936.00000000
Training loss did not improve more than tol=0.000100 for two consecutive epochs. Stopping.
0.8735988650750587

5.完整代码

import re
import matplotlib.pyplot as plt
import os
from sklearn.feature_extraction.text import CountVectorizer
from sklearn import cross_validationimport numpy as np
from sklearn.neural_network import MLPClassifierdef load_one_flle(filename):x=[]with open(filename) as f:line=f.readline()line=line.strip('\n')return linedef load_adfa_training_files(rootdir):x=[]y=[]list = os.listdir(rootdir)for i in range(0, len(list)):path = os.path.join(rootdir, list[i])if os.path.isfile(path):x.append(load_one_flle(path))y.append(0)return x,ydef dirlist(path, allfile):filelist = os.listdir(path)for filename in filelist:filepath = os.path.join(path, filename)if os.path.isdir(filepath):dirlist(filepath, allfile)else:allfile.append(filepath)return allfiledef load_adfa_java_files(rootdir):x=[]y=[]allfile=dirlist(rootdir,[])for file in allfile:if re.match(r"../data/ADFA-LD/Attack_Data_Master/Java_Meterpreter_\d+/UAD-Java-Meterpreter*",file):x.append(load_one_flle(file))y.append(1)return x,yif __name__ == '__main__':x1,y1=load_adfa_training_files("../data/ADFA-LD/Training_Data_Master/")x2,y2=load_adfa_java_files("../data/ADFA-LD/Attack_Data_Master/")x=x1+x2y=y1+y2vectorizer = CountVectorizer(min_df=1)x=vectorizer.fit_transform(x)x=x.toarray()mlp = MLPClassifier(hidden_layer_sizes=(130,70), max_iter=10, alpha=1e-4,solver='sgd', verbose=10, tol=1e-4, random_state=1,learning_rate_init=.1)score=cross_validation.cross_val_score(mlp, x, y, n_jobs=-1, cv=10)print  np.mean(score)

神经网络检测Java溢出攻击相关推荐

利用深度神经网络检测ADS-B欺骗攻击
paper:Detecting ADS-B Spoofing Attacks using Deep Neural Networks 感觉一个是这个数据获取很有难度,文章是自己搭建一个类似接收站来获取A ...
html溢出攻击,溢出（漏洞）攻击的实现及防御
前言媒体上关于系统漏洞的话题一直不断,在我所接触的用一些朋友和用户中虽然也知道打系统补丁很重要,但却又一直不以为然总以为网络上的危险离自己很远,大部份人都认为进行一次远程攻击很困难甚至认为只要安装了 ...
java 缓冲区溢出_缓冲区溢出攻击_java教程_缓冲区溢出攻击漏洞
主题:[请教] 我想实现缓冲区溢出攻击.就是原程序读取一个字符串.我输入一个特殊的字符串,覆盖掉原返回地址,使其执行在栈里的代码. 但是当执行到栈里代码时,就会段错误而退出. 请问这个是不是现在 ...
java存在溢出攻击吗_缓冲区溢出攻击
缓冲区溢出漏洞(Buffer Overflow)是最早被发现也是最基础的软件安全漏洞技术类型之一.缓冲区溢出是一种非常普遍.非常危险的漏洞,在各种操作系统.应用软件中广泛存在.利用缓冲区溢出攻击,可以 ...
网络安全——缓冲区溢出攻击
1.缓冲区溢出概述什么是缓冲区?它是指程序运行期间,在内存中分配的一个连续的区域,用于保存包括字符数组在内的各种数据类型.所谓溢出,其实就是所填充的数据超出了原有的缓冲区边界,并非法占据了另一段内存 ...
【系统安全】C语言溢出攻击
文章目录前言 C语言的安全问题溢出攻击的危害防御手段方法一:避免程序出bug 方法二:使用工具辅助查找bug 方法三:用对内存安全的语言方法四:设置硬件电子栅栏方法五:加长指针方法六:影 ...
堆溢出攻击（XP SP2 - 2003）
微软在堆中也增加了一些安全校验操作,使得原本是不容易的堆溢出变得困难重重: * PEB Random:在 Windows XP SP2 之后,微软不再使用固定的 PEB 基址 0x7FFDF000,而 ...
论文阅读丨神经清洁：神经网络中的后门攻击识别与缓解
摘要:本文将带你了解深度神经网络的后门知识,作者提出了一种可靠且可推广的DNN后门攻击检测和缓解系统,这是了解对抗样本和神经网络后门攻击的深度解读. 本文分享自华为云社区<[论文阅读] (02) ...
缓冲区溢出攻击初学者手册（更新版）
译者:IDF_Lab 来源:缓冲区溢出攻击初学者手册(更新版) 说明 ‍‍之前版本翻译质量不佳,本人赵阳在这里对本文的读者表示深深的歉意.由于本人的疏忽和大意导致您不能很好的读完这篇文章,同时也对原文 ...