一种超椭球免疫理论启发的shellcode检测算法

Shellcode Detection Algorithm Inspired by Hyper-ellipsoids Immune Theory

为了解决特征码匹配技术对于未知或多态shellcode检测效率较低的问题,提出一种基于人工免疫系统的shellcode检测算法AIS-SDA.提取shellcode的静态和动态特征,通过反汇编获得汇编指令序列,通过模拟执行获得API函数调用序列,基于n-gram模型编码生成抗原.利用超椭球对免疫检测器编码提高非我空间覆盖率,检测器经历阴性选择算法的免疫耐受后成熟.对成熟检测器克隆和遗传变异,运用超椭球改变朝向、迁移中心和伸缩半轴等手段实现检测器的优化,生成更加优秀的抗体后代.最后,对收集的shellcode样本进行实验验证,结果表明,该方法对非编码和多态shellcode均具有较高的检测准确率.

To solve the problem that signature matching technology has low detection rate for unknown or polymorphic shellcode,a shellcode detection algorithm AIS-SDA based on artificial immune system was proposed. Both static and dynamic features of shellcode were extracted. The shellcode was disassembled to assembly instruction sequence,and the API function sequence of shellcode was obtained by simulation execution. These features were encoded to antigens based on n-gram model. To improve non-self space coverage rate,the immune detectors were encoded to hyper-ellipsoids. Immature detectors became mature after immune tolerance based on negative selection algorithm. To generate more excellent antibody offspring,the detectors were optimized through clone and genetic mutate,using center movement,stretch and reorient methods. Finally,shellcode samples were collected and tested,and result shows that the proposed method has higher detection accuracy for both non-encoded shellcode and polymorphic shellcode.