Agent user detection method based on communication behavior portrait

Abstract

The invention discloses an agent user detection method based on a communication behavior portrait. The method comprises the following steps: constructing a portrait model based on the communication behavior; preprocessing the input real traffic data, and aggregating the network traffic according to organized user IP attributes and time attributes in a specified time window to obtain traffic data of each user; extracting communication object stability characteristics and communication object quantity characteristics of a user in a specified time window based on the flow data, and then filteringand screening the two characteristics based on a threshold value to obtain IP information of a suspected proxy user; performing machine learning detection classification on the network flow of each suspected proxy user; and marking the IP of which the flow judgment result satisfies the threshold setting as the IP of the proxy user. The detection method provided by the invention is high in universality, can meet the data volume in the current big data network environment, adopts the portrait model based on the communication behavior, and is low in detection false alarm rate.

Description

Technical field [0001] The present invention relates to the field of network security technology, and in particular to a proxy user detection method based on communication behavior portraits. Background technique [0002] Network proxy is a special network service that allows indirect connections between clients and servers. It is a service that proxy hosts in the local network to obtain web pages or obtain information from the Internet. It can not only help users break through the organization's IP access restrictions and content filtering mechanisms to access banned websites, but also hide the client IP and cover the client's network activities to ensure the privacy or security of network terminals. However, while proxy services bring convenience to users, they also come with hidden threats. On the one hand, the unknown identity of the proxy server brings potential network threats to internal asset protection. Some proxies will monitor the data flow between the end user'...

AI Technical Summary

Problems solved by technology

[0004] The existing research difficulties mainly include: (1) Proxy detection based on data packet analysis has low versatility and is only suitable for Web proxies and PHP proxies with obvious marks in the data packets, and the established rule base cannot adapt to the requirements of proxy services. Dynamic update; (2) Proxy detection based on data packet analysis cannot meet the data scale in the current big data network environment, and packet-by-packet analysis at the network egress will cause a large amount of resource occupation and performance loss; (3) Based on The proxy detection method of network traffic files uses machine learning algorithms for automatic proxy traffic identification, which is highly dependent on the feature space. communication detection, but the detection false positive rate is high; (4) the current existing proxy detection method only detects proxy traffic, and does not care about the client and network users behind the traffic, but for the internal security defense of the organization, the proxy user It is particularly important to discover proxy users in a timely manner to eliminate potential threats within the organization and strengthen internal network asset protection and security supervision.

Images