基于LSTM和TF-IDF的反弹Shell检测方法  

LSTM and TF-IDF based Intrusion Detection for Reverse Shell

作　　者：张宇涵 薛质[1] 施勇[1] 吴毅良 ZHANG Yu-han;XUE Zhi;SHI Yong;WU Yi-liang(Shanghai Jiaotong University,Shanghai 200240,China;Jiangmen Power Supply Bureau of Guangdong Power Grid Corporation,Jiangmen Guangdong 529099,China)

机构地区：[1]上海交通大学,上海200240 [2]广东电网公司江门供电局,广东江门529099

出　　处：《通信技术》2020年第12期3046-3050,共5页Communications Technology

基　　金：电力业务系统内的隐匿高危行为发现和精确预警技术研究和实现。

摘　　要：高级持续性威胁(APT)已成为网络空间所面临的主要安全威胁之一,而针对用户Shell的恶意命令检测近年来一直是研究的热点。本研究提出了一种基于LSTM的反弹Shell检测方法,通过检测用户储存在bash日志中的shell命令检测是否存在反弹Shell攻击行为。考虑到反弹Shell的隐蔽性、前后关联性和时序性,本研究利用TF-IDF实现特征提取并使用长短期记忆网络训练模型进行检测,区分正常行为和恶意行为。通过实验结果和对比表明,该方法具有很高的检测能力和泛化能力。Advanced persistent threat has become one of the main security threats faced by cyberspace,and the detection of malicious commands against user shells has been a hot research topic in recent years.A detection method for reverse shell based on LSTM is proposed,which detects whether there is a reverse shell by detecting shells stored in the user’s bash log.Considering the concealment,contextuality and serialization of the reverse shell,TF-IDF is applied to achieving feature extraction while a long-short-termmemory-network-training-model is used to detect and distinguish normal behavior from malicious behavior.The experimental results and comparison indicate that this method has very high detection ability and generalization ability.

关 键 词：反弹Shell 入侵检测 LSTM TF-IDF 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]