中图分类号：TP393
文献标识码：A
DOI:10.19358/j.issn.2097-1788.2023.06.011
引用格式：戚臻彦，孙永清.基于随机森林的命令混淆绕过检测研究［J］.网络安全与数据治理，2023，42（6）：66-70.

Research on command obfuscation bypass detection based on random forest algorithm

Abstract： The "command filtering" function in operation and maintenance security devices can only filter malicious code in the blacklist, and cannot effectively identify and prevent the use of special methods to bypass this function. To address this problem, this paper proposes an algorithm based on random forest, which can accurately identify command execution statements containing malicious code. Firstly, this paper introduces four methods of command obfuscation bypass, which are used to evade keywords in the blacklist and perform command execution. Then, in order to solve these risks, the command obfuscation code is taken into account in the feature selection stage of the model, and various features are used to train and adjust the weights of the random forest model, so as to improve the recognition rate and accuracy of the model detection for adding command obfuscation attacks. The experimental results show that the method proposed in this paper can timely identify and deal with command obfuscation attacks, thus better ensuring the secure operation of servers.

Key words : command obfuscation; operation and maintenance management equipment; random forest; network security