IP network attack group classification method based on behavior sequence

Abstract

The application discloses a kind of IP network attack group classification method based on behavior sequence, its steps are as follows: S101, obtain the malicious IP behavior data set of operator security protection platform;S102, data cleaning, and dictionary coding is carried out to behavior sequence, generate behavior sequence data;S103, to behavior sequence data, behavior frequent item calculation is carried out;S104, Levenshtein distance similarity calculation is carried out to behavior sequence, similarity range is divided into four intervals, for the IP value in the corresponding range in each interval, four intervals are used as characteristic field;S105, the appearance frequency of each instruction in all IP behavior sequences is counted as characteristic field;S106, all characteristic fields are handled by feature engineering, and are arranged into model input format;S107, using cluster analysis, obtain IP network attack group classification.The application realizes IP network attack group classification, and then solves the problem that existing technology cannot be applied to IP group classification scene without communication or associated attribute.

Description

Technical Field

[0001] This invention belongs to the fields of data security and data mining group classification technology, and relates to a method for classifying IP network attack groups based on behavioral sequences. Background Technology

[0002] There are many types of cyberattacks. Nowadays, with the interception and protection of most security platforms and devices, it is possible to accurately identify IPs with malicious behavior. However, because there is no communication or direct association between cyberattack IPs within the attacked platform, security devices or the victim platform itself cannot classify the identified malicious IPs into groups.

[0003] Classification methods typically involve constructing a classification model based on the inherent characteristics of an existing dataset, combined with data feature construction and mathematical classification algorithms. These algorithms can be categorized into supervised and unsupervised types. Unsupervised classification models include various clustering algorithms based on principles such as mean and density. For example, the K-means algorithm is based on Euclidean distance. It initializes the number of classes, calculates the distance between each point and the class centroid, then assigns the point to a new group, with the mean of the new group serving as the new centroid. This process iterates until the centroid positions remain almost unchanged, thus fulfilling the group classification requirement.

[0004] Most existing group classification methods based on behavioral sequences use basic attributes of behavioral sequences, behavioral trajectories of the analyzed objects, and attributes of social connections of the analyzed objects as features. Then, they add labels to the dataset in combination with business logic and use existing supervised machine learning algorithms for group classification. However, the important work of deep feature mining of the behavioral sequences themselves is often overlooked.

[0005] While the methods described above can achieve certain results in specific business scenarios, such as the invention application with application number 201911180128.X, which uses a social-based dataset of analytical objects, combines the behavioral trajectories of the analytical objects as features, and uses the LSTM algorithm for group classification of analytical objects, the social connection attributes of the analytical objects, the behavioral trajectories of the analytical objects, and the methods and processes for adding tags based on business are not applicable to all industry application scenarios. In scenarios where the analysis object group classification is performed on datasets of individual independent operational behaviors without communication, association attributes, unrelated operational behavior sequences, or business tags, the feature processing method of using behavioral sequence similarity interval value statistics can add the connection attributes between analytical objects that are missing due to the lack of communication or association attributes. Combined with the common habitual features of frequent behavioral command combinations of analytical objects, a group classification system for objects without communication or association attributes is finally formed, which uses a clustering algorithm as the classification model and constructs a classification system for groups of objects without communication or association attributes from the dimensions of statistical analysis of independent behavioral features of analytical objects, construction of behavioral similarity interval values ​​of all analytical objects, and analysis of frequent behavioral combinations of analytical objects.

[0006] In summary, IP operational behavior analysis is applicable to internal and external systems across various industries, such as platforms with massive IP access volumes, including those in telecommunications, e-commerce, public resource management, and information security management. While most security platforms and devices can accurately identify malicious IPs, the lack of communication or direct association between attacking IPs within the attacked platform makes it difficult for security devices or the victimized platform itself to categorize identified malicious IPs into groups. However, grouping attacks based on IP operational behavior characteristics can significantly aid victimized platforms in establishing attack group profiles, creating attack type databases, and focusing protection on vulnerable business modules. Therefore, classifying individual malicious IPs into groups is an extremely important task. Summary of the Invention

[0007] The purpose of this invention is to provide a method for classifying IP network attack groups based on behavioral sequences. By using association rule algorithms, similarity calculation methods, and unsupervised clustering algorithms in machine learning, and based on malicious IP behavior datasets from operator security protection platforms, an IP network attack group classification system is implemented, thereby solving the problem that existing technologies cannot be applied to IP group classification scenarios without communication or association attributes.

[0008] To achieve the above objectives, the technical solution adopted by this invention is: a method for classifying IP network attack groups based on behavioral sequences, the steps of which are as follows:

[0009] S101. Obtain the malicious IP behavior dataset from the operator's security protection platform, including IP, operation time, and behavior sequence;

[0010] S102. Data cleaning, and dictionary encoding of behavioral sequences to generate data with IP as the analysis object and its corresponding behavioral sequence data;

[0011] S103. Use association rule algorithm to calculate frequent behavior items for all IP behavior sequence data, and then use them as feature fields;

[0012] S104. Calculate the Lewinston distance similarity for all IP behavior sequences, divide the similarity range into four intervals, and count the IP values ​​in the corresponding range of each IP in each interval. The four intervals are used as feature fields.

[0013] S105. Calculate the frequency of occurrence of each instruction in the entire IP behavior sequence and use it as a feature field;

[0014] S106. Perform feature engineering on all feature fields and organize them into the model input format;

[0015] S107. Use cluster analysis to classify IP network attack groups;

[0016] Furthermore, in step S101, communication is conducted with the data management center of the operator's security protection platform and relevant business personnel to obtain a malicious IP behavior dataset. The data includes fields such as IP address, operation time, and behavior instructions.

[0017] Furthermore, in step S102, the acquired sample dataset is subjected to noise processing and behavioral instruction encoding to generate behavioral sequence data with IP as the analysis object and its corresponding behavior in chronological order.

[0018] Furthermore, in step S103, the apriori algorithm is used to extract frequent action command combinations from all IP behavior data to obtain a list of frequent command combinations of different lengths. Each command combination in the list is used as a feature field. The frequency of occurrence of the command combination is counted for each IP behavior sequence, resulting in a feature statistics table with IP and all command combinations in the list as field names.

[0019] Furthermore, step S104 specifically includes:

[0020] (1) For all IPs in the data, calculate the Lewinston distance of their behavioral sequences and convert it into a similarity value x, with a value range of 0-1;

[0021] (2) Divide the similarity value range into four statistical intervals, including: q1 (0≤x<0.25), q2 (0.25≤x<0.5), q3 (0.5≤x<0.75), and q4 (0.75≤x<1). Count the similarity interval range of all IPs for each IP based on the similarity values ​​calculated in step (1) above, and obtain a data table of IPs and features q1, q2, q3, and q4.

[0022] Furthermore, in step S105, all IP behavior sequences are merged into a list, and after deduplication, an instruction list containing all IP operation behaviors is obtained. Each instruction in the list is used as a feature field, and the frequency of occurrence of each IP behavior sequence is statistically analyzed to obtain a data table with IP and all instructions in the list as field names.

[0023] Furthermore, in step S106, the data obtained in the aforementioned steps are associated and merged according to IP to obtain a data table.

[0024] Furthermore, in step S107, the K-means clustering algorithm, an unsupervised classification algorithm in machine learning, is used to perform cluster analysis on the data obtained in step S106 to obtain IP groups with different categories.

[0025] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0026] Current group classification methods based on behavioral sequences mostly use basic attributes of behavioral sequences, IP behavioral trajectories, and IP social connections as features. They then add labels to the dataset based on business logic and use existing supervised machine learning algorithms for group classification. However, the crucial work of deep feature mining from the behavioral sequences themselves is often overlooked. Furthermore, the methods and processes for analyzing social connection attributes, analyzing behavioral trajectories, and adding labels based on business logic, which are emphasized in related inventions, are not applicable to all industry scenarios.

[0027] In summary, existing group classification methods based on behavior sequences are unsuitable for classifying IP groups from datasets of independent operational behaviors lacking communication, association attributes, unrelated operational sequence, and business tags. To address this, this invention employs a feature processing method based on behavior sequence similarity interval values. This method adds connection attributes between IPs that are missing due to the lack of communication or association attributes, uncovering potential connections between IPs. Simultaneously, an association rule algorithm is used to screen for frequent operational behavior combinations across all IP behaviors, thereby constructing shared behavioral habit attributes among IPs within the behavior sequences themselves. This achieves the ability to distinguish IP groups based on behavioral habits, even in scenarios without communication or association attributes, using IP behavior sequences as a foundation. Therefore, a classification system for IP network attack groups without communication or association attributes is formed, using clustering algorithms as the classification model and constructing a classification system from dimensions such as statistical analysis of independent IP behavior features, construction of similarity interval values ​​for all IP behaviors, and analysis of frequent IP behavior combinations. Attached Figure Description

[0028] Figure 1 This is a flowchart of a method for classifying IP network attack groups based on behavioral sequences, as described in an embodiment of the present invention.

[0029] Figure 2 This is a scatter plot of the clustering results in an embodiment of the present invention;

[0030] Figure 3 This is an example of a data table R after the original data has been processed in this invention.

[0031] Figure 4 This is an example of the characteristic statistics table D0 for IP and all frequent instruction combinations in this invention.

[0032] Figure 5 This is an example of the behavior sequence similarity interval counting feature table D1 between each IP and all IPs in this invention.

[0033] Figure 6 This is an example of Table D2, which shows the statistical characteristics of the total instruction frequency of each IP in this invention.

[0034] Figure 7 This is an example of clustering results in an embodiment of the present invention. Detailed Implementation

[0035] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0036] like Figure 1 As shown, a method for classifying IP network attack groups based on behavioral sequences is described, with the following specific steps:

[0037] S101, Obtain the malicious IP behavior dataset from the operator's security protection platform, including IP, operation time, and behavior sequence;

[0038] S102, data cleaning, and dictionary encoding of behavioral sequences to generate data with IP as the analysis object and its corresponding behavioral sequence data;

[0039] S103 uses an association rule algorithm to calculate frequent behavior items for all IP behavior sequence data, which are then used as feature fields.

[0040] S104, calculate the Lewinston distance similarity for all IP behavior sequences, divide the similarity range into four intervals, and count the IP values ​​in the corresponding range of each IP in each interval. The four intervals are used as feature fields.

[0041] S105, Count the frequency of occurrence of each instruction in the entire IP behavior sequence as a feature field;

[0042] S106, Perform feature engineering on all feature fields and organize them into the model input format;

[0043] S107, using cluster analysis, to derive the classification of IP network attack groups;

[0044] The details of each step are explained below:

[0045] The method in S101 is as follows:

[0046] We communicated with the data management center of the operator's security protection platform and relevant business personnel to obtain a dataset of malicious IP behavior. The data includes fields such as IP, operation time, and behavioral instructions.

[0047] The method in S102 is as follows:

[0048] For the acquired sample dataset, noise reduction and behavior instruction encoding are performed. Data R is then generated in chronological order, with IP addresses as the analysis object and their corresponding behavior sequences. The data format is as follows: Figure 3 ;

[0049] The method in S103 is as follows:

[0050] The Apriori algorithm is used to extract frequent action command combinations from all IP behavior data, resulting in lists of frequent command combinations of varying lengths, denoted as list C. Each command combination in this list is used as a feature field. The frequency of occurrence of each command combination is statistically analyzed for each IP's behavior sequence, yielding a feature statistics table denoted as data D0, where the IP and all command combinations in list C are used as field names. The table's content format is as follows: Figure 4 ;

[0051] The Apriori algorithm is the first and most classic association rule mining algorithm. It uses an iterative, layer-by-layer search method to find relationships between itemsets in a database to form rules. This process consists of joining (matrix-like operations) and pruning (removing unnecessary intermediate results). In this algorithm, an itemset is a set of items. A set containing K items is called a k-itemset. The frequency of an itemset is the number of transactions containing that itemset. If an itemset satisfies the minimum support requirement, it is called a frequent itemset.

[0052] The method in S104 is as follows:

[0053] S1041 calculates the Lewinston distance of the behavioral sequence for all IPs in data R and converts it into a similarity value x, with a value range of 0-1;

[0054] The Levenshtein distance, also known as edit distance, refers to the minimum number of edit operations required to transform one string into another. Permitted edit operations include replacing one character with another, inserting a character, and deleting a character.

[0055] S1042 divides the similarity value range into four statistical intervals, such as: q1 (0≤x<0.25), q2 (0.25≤x<0.5), q3 (0.5≤x<0.75), and q4 (0≤x<0.25). The similarity values ​​calculated in step S1041 are used to count the similarity interval ranges for each IP across all IPs, resulting in a data table of IPs and features q1, q2, q3, and q4, denoted as Data D1. Its content format is as follows: Figure 5 ;

[0056] The method in S105 is as follows:

[0057] All IP behavior sequences are merged into a list. After deduplication, a list of instructions containing all IP operation behaviors is obtained, denoted as list O. Each instruction in this list is used as a feature field. The frequency of occurrence of each IP behavior sequence is counted, resulting in a data table denoted as data D2, where IP and all instructions in list O are field names. Its content format is as follows: Figure 6 ;

[0058] The method in S106 is as follows:

[0059] The three sets of data D0, D1, and D2 obtained in the above steps are associated and merged according to IP to obtain data table Dx;

[0060] The method in S107 is as follows:

[0061] The K-means clustering algorithm, a machine learning unsupervised classification algorithm, was used to perform cluster analysis on the data table Dx obtained in step S106, resulting in IP groups with different categories. After multiple verification and comparison of the training dataset, it was found that setting the number of categories to 5 yielded the best model evaluation function and specific IP classification performance. The clustering effect is as follows: Figure 1 Display; clustering results in table format as follows Figure 7 ;

[0062] The K-means clustering algorithm is based on Euclidean distance. It initializes the number of clusters, calculates the distance between each point and the cluster centroid, and then assigns the point to a new group. The mean of the new group becomes the new centroid, and this process continues iteratively until the centroid positions remain almost unchanged. This fulfills the requirement for classifying IP network attack groups.

[0063] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the above embodiments do not limit the scope of protection of the present invention in any way, and all technical solutions obtained by equivalent substitution or other means fall within the scope of protection of the present invention.

[0064] All parts not covered in this invention are the same as or can be implemented using existing technologies.

Claims

1. A method for classifying IP network attack groups based on behavioral sequences, characterized in that, The steps are as follows: S101. Obtain the malicious IP behavior dataset from the operator's security protection platform, including IP, operation time, and behavior sequence; S102. Data cleaning and dictionary encoding of behavioral sequences to generate behavioral sequence data with IP as the analysis object; S103. Use association rule algorithm to calculate frequent behavior items for all IP behavior sequence data, and then use them as feature fields; Specifically, the apriori algorithm is used to extract frequent action command combinations from all IP behavior data, resulting in a list of frequent command combinations of different lengths. Each command combination in the list is used as a feature field. The frequency of occurrence of each command combination is counted for each IP's behavior sequence, resulting in a feature statistics table with IP and all command combinations in the list as field names. S104. Calculate the Lewinston distance similarity for all IP behavior sequences, divide the similarity range into four intervals, and count the IP values ​​in the corresponding range of each IP in each interval. The four intervals are used as feature fields. S105. Calculate the frequency of occurrence of each instruction in the entire IP behavior sequence and use it as a feature field; S106. Perform feature engineering on all feature fields and organize them into the model input format; S107. Use cluster analysis to classify IP network attack groups.

2. The method for classifying IP network attack groups based on behavioral sequences according to claim 1, characterized in that, In step S101, communication is conducted with the data management center of the operator's security protection platform and relevant business personnel to obtain a dataset of malicious IP behavior. The data includes fields such as IP, operation time, and behavior instructions.

3. The method for classifying IP network attack groups based on behavioral sequences according to claim 1, characterized in that, In step S102, the acquired sample dataset is subjected to noise processing and behavior instruction encoding to generate behavior sequence data with IP as the analysis object in chronological order.

4. The method for classifying IP network attack groups based on behavioral sequences according to claim 1, characterized in that, Step S104 specifically includes: (1) For all IPs in the data, calculate the Lewinston distance of their behavioral sequences and convert it into a similarity value x, with a value range of 0-1; (2) Divide the similarity value range into four statistical intervals, including: q1 (0≤x<0.25), q2 (0.25≤x<0.5), q3 (0.5≤x<0.75), and q4 (0.75≤x<1). Count the similarity interval range of all IPs for each IP based on the similarity values ​​calculated in step (1) above, and obtain the data table of IPs and features q1, q2, q3, and q4.

5. The method for classifying IP network attack groups based on behavioral sequences according to claim 1, characterized in that, In step S105, all IP behavior sequences are merged into a list. After deduplication, a list of instructions containing all IP operation behaviors is obtained. Each instruction in the list is used as a feature field. The frequency of occurrence of each IP behavior sequence is counted, resulting in a data table with IP and all instructions in the list as field names.

6. The method for classifying IP network attack groups based on behavioral sequences according to claim 1, characterized in that, In step S106, the data obtained in the previous steps are associated and merged according to IP to obtain a data table.

7. The method for classifying IP network attack groups based on behavioral sequences according to claim 1, characterized in that, In step S107, the K-means clustering algorithm, an unsupervised classification algorithm in machine learning, is used to perform cluster analysis on the data obtained in step S106 to obtain IP groups with different categories.

Images