Attack Detection Technology for the Typical Communication Protocol AET in the Application Layer

In order to make up for the shortcomings of intrusion detection/defense systems (NIDS/IPS) in advanced evasion technique detection, this paper proposes an attack detection technique for application layer advanced evasion technique (AET). The method firstly extracts the payload of the SMB layer from a large number of conficker attack communication data streams superimposed with advanced evasion techniques, and then combines the statistical characteristics of the non-text data to form a feature sample set; and then constructs a neural network to complete the training on the training sample set, the first half of which consists of a number of layers of LSTM units connected in series and cascade, and the second half of which consists of linear fully connected layers and Softmax layers.