C&C channel detection method and system

Abstract

The embodiment of the invention provides a C&C channel detection method and system. The method comprises the steps: filtering the normal network traffic in traffic to be tested based on a white list method; based on the traffic similarity and a preset clustering algorithm, classifying the traffic to be tested into network activities; labeling the C&C traffic through a heuristic rule to obtain a C&C traffic identification result and a first C&C channel set; and obtaining a C&C channel behavior detection model based on transfer learning, inputting the residual traffic part into the C&C channel behavior detection model to obtain a second C&C channel set, and comprehensively obtaining a C&C channel detection result. According to the embodiment of the invention,the C&C training data related to the to-be-detected target and the normal communication training data in the pre-detection environment do not need to be prepared, and the applicability is better.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a C&C channel detection method and system. Background technique [0002] In the field of network security, the C&C channel (Command&Control Channel) is an essential functional component of advanced network malicious programs such as botnet programs and Trojan horses. After successfully infecting hosts or devices, such network malicious programs need to establish a C&C channel link with the attacker's control server to continuously obtain the latest operation and attack commands, such as updating their own code, stealing data and transmitting, downloading attack codes and tools, and composing Botnets and coordinated large-scale cyber attacks. At the same time, the network malicious program also continuously feeds back information such as the status of the currently infected host and device, command execution results, etc. through the C&C channel, so that the attacker can...

AI Technical Summary

Problems solved by technology

However, in the detection scenario in the actual environment, on the one hand, there are various types of malicious programs currently flooding, and there may be certain behavioral differences among them in various aspects, and it is difficult to know in advance the malicious programs that intend to attack the target category and family, and prepare the C&C channel training data of corresponding or related family samples to build a targeted behavior detection model; C&C traffic training data

Furthermore, although normal traffic data related to specific detection scenarios are relatively easier to obtain than malicious data such as C&C traffic, the changing network environment of detection scenarios and a large number of normal network applications and programs make us It is difficult to construct a training data set that can cover all or most normal network communications

In short, the existing mainstream behavior analysis C&C channel detection methods are too dependent on C&C training data and normal training data sets related to feature detection scenarios, and cannot be directly used in real complex and changeable network environments. Detect C&C channel

Images