 |
There is format of Zero-Day Attack Packet Highlight Protocol.
ZAPHP is communication protocol for extracting raw data judged as security threat of zero-day packet and displaying the information to users.
ZAPHP consists of header which has fixed size of 40bytes and payload of unfixed size.
SID and TimeStamp field of ZAPHP mean same as those of ZAPDP.
Length field indicates payload size of ZAPHP and value is in bytes.
Packet Offset field indicates where Full Packet field begins.
Start Byte field indicates first location of raw data which matched with updated new rule.
Similarly, End Byte field indicates last location of raw data which matched with updated new rule.
Reserved field reserved for future use and it should be zero.
Matching Data field indicates raw data that matched with updated new rule in payload of full packet. Also, it must be hexadecimal value which can convert to ASCII.
Full Packet field indicates full packet that matched with updated new rule and must be hexadecimal value which can convert to ASCII.
|
IEEE/ICACT20210179 Slide.12
[Big Slide]