Malicious traffic detection method, device and electronic equipment

Abstract

Embodiments of the present invention disclose a malicious traffic detection method, device, and electronic device, relating to the field of computer network security technology. The method comprises the following steps: obtaining a data stream to be detected belonging to the same network address; splitting the data stream to be detected into multiple TCP single streams; extracting single-stream features of each TCP single stream; generating multi-stream features of multiple TCP single streams based on the single-stream features of the multiple TCP single streams as flow features of the data stream to be detected, wherein the multi-stream features represent the correlation between the multiple TCP single streams; inputting the flow features of the data stream to be detected into a pre-trained malicious traffic detection model to obtain a detection result indicating the malicious threat level of the data stream to be detected, wherein the malicious traffic detection model is trained using a machine learning model based on multiple historical data streams with known malicious threat levels; and determining whether the data stream to be detected is a preset type of malicious traffic based on the detection result. This solution improves the efficiency and accuracy of malicious traffic detection.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and in particular to a malicious traffic detection method, device and electronic equipment. Background Art

[0002] A webshell is a code execution environment in the form of webpage files such as ASP, PHP, JSP, or CGI. It is primarily used for website management, server management, and permissions management. Webshells are simple to use; users simply upload a code file and access it via a URL to perform many daily operations, greatly facilitating website and server management. For this reason, a small number of people use webshell code as a backdoor program to gain control of website servers.

[0003] At present, with the development of webshells, the traffic in them will be encrypted during the use of webshells. For example, HTTP traffic is encrypted, resulting in all data in the traffic except the HTTP header becoming ciphertext, making the efficiency and accuracy of traditional malicious traffic detection methods based on rules increasingly poor. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a malicious traffic detection method, device, and electronic device to solve the problem of poor efficiency and accuracy in malicious traffic detection in the prior art.

[0005] In a first aspect, an embodiment of the present invention provides a method for detecting malicious traffic, including:

[0006] Obtain the data flow to be detected belonging to the same network address;

[0007] Splitting the data stream to be detected into multiple TCP single streams;

[0008] Extracting single-flow features of each of the TCP single flows;

[0009] generating, based on the single-flow features of the multiple TCP single-flows, multi-flow features of the multiple TCP single-flows as flow features of the data flow to be detected, wherein the multi-flow features represent the correlation between the multiple TCP single-flows;

[0010] Inputting the flow characteristics of the data flow to be detected into a pre-trained malicious traffic detection model to obtain a detection result indicating the malicious threat level of the data flow to be detected, wherein the malicious traffic detection model is obtained by training a machine learning model based on multiple historical data flows with known malicious threat levels, and the multiple historical data flows are data flows of preset types;

[0011] Based on the detection result, it is determined whether the data flow to be detected is malicious traffic of the preset type.

[0012] According to a specific implementation of an embodiment of the present invention, splitting the data stream to be detected into multiple TCP single streams includes:

[0013] Splitting the data flow to be detected into multiple TCP flows according to whether the traffic contained in the data flow belongs to the same TCP flow;

[0014] If there is a TCP flow with a traffic interval duration longer than a preset duration among the multiple TCP flows, split the TCP flow into multiple TCP single flows at each interval longer than the preset duration;

[0015] The TCP flows whose traffic interval durations among the multiple TCP flows are all not greater than the preset duration are determined as TCP single flows.

[0016] According to a specific implementation of the embodiment of the present invention, generating multi-flow features of the multiple TCP single flows based on the single-flow features of the multiple TCP single flows includes:

[0017] Obtaining the interval duration between each two adjacent TCP single flows in the multiple TCP single flows;

[0018] The multi-flow features of the multiple TCP single flows are generated based on the single-flow features of the multiple TCP single flows and the interval duration between every two adjacent TCP single flows.

[0019] According to a specific implementation of the embodiment of the present invention, before determining whether the data flow to be detected is malicious traffic of the preset type based on the detection result, the method further includes:

[0020] For each TCP single stream, when it is detected that the TCP single stream adopts the HTTP protocol and has decodable content, the TCP single stream is decoded to obtain decoded data;

[0021] Calculating a compression ratio of the decoded data;

[0022] generating a first threat weighted value indicating a malicious threat level of the TCP single stream based on a compression ratio of the decoded data;

[0023] Extract the http header features of the tcp single stream;

[0024] When it is detected that the http header feature of the tcp single stream meets a preset feature condition, a second threat weighted value indicating the maliciousness threat of the tcp single stream is generated;

[0025] When the TCP single stream adopts the HTTPS protocol, extract the certificate of the TCP single stream;

[0026] Extract the ja3 information of the certificate of the TCP single stream;

[0027] Based on the ja3 information, generating a third threat weighted value indicating a malicious threat level of the TCP single flow;

[0028] The determining, based on the detection result, whether the data flow to be detected is malicious traffic of the preset type includes:

[0029] Determining whether the data flow to be detected is malicious traffic of the preset type based on the detection result and the first threat weighted value and the second threat weighted value of each TCP single flow; or

[0030] Based on the detection result and the third threat weighted value of each TCP single flow, it is determined whether the data flow to be detected is malicious traffic of the preset type.

[0031] According to a specific implementation of the embodiment of the present invention, before determining whether the data flow to be detected is malicious traffic of the preset type based on the detection result, the method further includes:

[0032] Extracting IP information of the data stream to be detected;

[0033] querying the malicious threat level of the IP information to obtain a fourth threat weighted value representing the malicious threat level;

[0034] The determining, based on the detection result, whether the data flow to be detected is malicious traffic of the preset type includes:

[0035] Based on the detection result and the fourth threat weighted value, it is determined whether the data flow to be detected is malicious traffic of the preset type.

[0036] According to a specific implementation of the embodiment of the present invention, before determining whether the data flow to be detected is malicious traffic of the preset type based on the detection result, the method further includes:

[0037] Obtaining a time distribution characteristic of access of the network address to the server IP in the data flow to be detected;

[0038] Calculate the similarity between the access time distribution characteristics and the access time distribution characteristics of other non-malicious network addresses accessing the server IP address;

[0039] generating a fifth threat weighted value representing a malicious threat degree based on the similarity;

[0040] The determining, based on the detection result, whether the data flow to be detected is malicious traffic of the preset type includes:

[0041] Based on the detection result and the fifth threat weighted value, it is determined whether the data flow to be detected is malicious traffic of the preset type.

[0042] In a second aspect, an embodiment of the present invention provides a malicious traffic detection device, comprising:

[0043] A data flow acquisition module is used to acquire the data flow to be detected belonging to the same network address;

[0044] A data stream splitting module is used to split the data stream to be detected into multiple TCP single streams;

[0045] A feature extraction module, configured to extract single-flow features of each of the TCP single flows;

[0046] a feature generation module, configured to generate, based on the single-flow features of the multiple TCP single flows, multi-flow features of the multiple TCP single flows as flow features of the data flow to be detected, wherein the multi-flow features represent the correlation between the multiple TCP single flows;

[0047] a data flow detection module, configured to input flow characteristics of the data flow to be detected into a pre-trained malicious traffic detection model to obtain a detection result indicating the malicious threat level of the data flow to be detected, wherein the malicious traffic detection model is obtained by training a machine learning model based on multiple historical data flows with known malicious threat levels, wherein the multiple historical data flows are data flows of preset types;

[0048] The result determination module is used to determine whether the data flow to be detected is malicious traffic of the preset type based on the detection result.

[0049] According to a specific implementation method of an embodiment of the present invention, the data stream splitting module is specifically used to split the data stream to be detected into multiple TCP streams according to whether the traffic contained therein belongs to the same TCP stream; if there is a TCP stream with a traffic interval duration greater than a preset duration among the multiple TCP streams, then from each interval greater than the preset duration, the TCP stream is split into multiple TCP single streams; and the TCP streams with a traffic interval duration not greater than the preset duration among the multiple TCP streams are determined as TCP single streams.

[0050] According to a specific implementation method of an embodiment of the present invention, the feature generation module is specifically used to obtain the interval duration between each adjacent two TCP single flows in the multiple TCP single flows; based on the single-flow features of the multiple TCP single flows and the interval duration between each adjacent two TCP single flows, generate the multi-flow features of the multiple TCP single flows.

[0051] According to a specific implementation of the embodiment of the present invention, the method further includes:

[0052] A first threat detection module is configured to decode each TCP single stream, upon detecting that the TCP single stream uses the HTTP protocol and has decodable content, to obtain decoded data; calculate a compression ratio of the decoded data; and generate a first threat weighted value indicating a malicious threat level for the TCP single stream based on the compression ratio of the decoded data;

[0053] Extracting HTTP header features of the TCP single stream; when detecting that the HTTP header features of the TCP single stream meet a preset feature condition, generating a second threat weighted value representing the maliciousness threat of the TCP single stream;

[0054] When the TCP single stream adopts the HTTPS protocol, extracting the certificate of the TCP single stream; extracting the JA3 information of the certificate of the TCP single stream; and generating a third threat weighted value indicating the malicious threat level of the TCP single stream based on the JA3 information;

[0055] The result determination module is specifically configured to determine whether the data flow to be detected is malicious traffic of the preset type based on the detection result and the first threat weighted value and the second threat weighted value of each TCP single flow; or

[0056] Based on the detection result and the third threat weighted value of each TCP single flow, it is determined whether the data flow to be detected is malicious traffic of the preset type.

[0057] According to a specific implementation of the embodiment of the present invention, the method further includes:

[0058] A second threat detection module is configured to extract IP information of the data flow to be detected; query the malicious threat level of the IP information to obtain a fourth threat weighted value representing the malicious threat level;

[0059] The result determination module is specifically configured to determine whether the data flow to be detected is malicious traffic of the preset type based on the detection result and the fourth threat weighted value.

[0060] According to a specific implementation of the embodiment of the present invention, the method further includes:

[0061] a third threat detection module configured to obtain a time distribution characteristic of accesses to the server IP address by the network address in the data stream to be detected; calculate a similarity between the time distribution characteristic of accesses to the server IP address by other non-malicious network addresses; and generate a fifth threat weighted value indicating a degree of malicious threat based on the similarity;

[0062] The result determination module is specifically configured to determine whether the data flow to be detected is malicious traffic of the preset type based on the detection result and the fifth threat weighted value.

[0063] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method described in any of the aforementioned implementation methods.

[0064] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method described in any of the aforementioned embodiments.

[0065] In a fifth aspect, an embodiment of the present invention further provides an application program, which is executed to implement the method described in any embodiment of the present invention.

[0066] Embodiments of the present invention provide a malicious traffic detection method, device, and electronic device. These methods split a data stream to be detected into multiple TCP single streams, extract single-stream features from each TCP single stream, and then generate multi-stream features based on the multiple single-stream features. These features serve as flow features for the data stream to be detected. The flow features of the data stream to be detected are then input into a pre-trained malicious traffic detection model to obtain a detection result indicating the malicious threat level of the data stream to be detected. Based on the detection result, the method determines whether the data stream to be detected is malicious traffic. Because the multi-stream features can represent the correlation between multiple TCP single streams, they can more comprehensively reflect the characteristics of the data stream to be detected than single-stream features. Furthermore, the multiple historical data streams with known malicious threat levels used to train the malicious traffic detection model are of preset types. Therefore, the method can detect whether a data stream that meets these preset types contains malicious threats. Compared to conventional rule-based detection methods, this method can achieve rapid and accurate detection even if the data stream is of a type for which rules are difficult to obtain, thereby improving the efficiency and accuracy of malicious traffic detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0068] Figure 1 Flowchart of the malicious traffic detection method provided in Example 1 of the present invention;

[0069] Figure 2 Flowchart of a malicious traffic detection method provided in Example 2 of the present invention;

[0070] Figure 3 A schematic diagram of the structure of a malicious traffic detection device provided by an embodiment of the present invention;

[0071] Figure 4 A schematic structural diagram of a malicious traffic detection device provided by another embodiment of the present invention;

[0072] Figure 5 A schematic structural diagram of a malicious traffic detection device provided by another embodiment of the present invention;

[0073] Figure 6 A schematic structural diagram of a malicious traffic detection device provided by another embodiment of the present invention;

[0074] Figure 7 The figure is a schematic structural diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0075] The following describes embodiments of the present invention in detail with reference to the accompanying drawings. It should be understood that the embodiments described are only some of the embodiments of the present invention, and not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort are intended to fall within the scope of protection of the present invention.

[0076] Example 1

[0077] The first embodiment of the present invention provides a method for detecting malicious traffic. Figure 1 Shown, including:

[0078] Step 11: Obtain the data stream to be detected belonging to the same network address;

[0079] Step 12: Split the data stream to be detected into multiple TCP single streams;

[0080] Step 13: Extract the single flow features of each TCP single flow;

[0081] Step 14: Based on the single-flow features of the multiple TCP single flows, a multi-flow feature of the multiple TCP single flows is generated as the flow feature of the data flow to be detected. The multi-flow feature indicates the correlation between the multiple TCP single flows.

[0082] Step 15: Input the flow characteristics of the data flow to be detected into a pre-trained malicious traffic detection model to obtain a detection result indicating the malicious threat level of the data flow to be detected. The malicious traffic detection model is obtained by training a machine learning model based on multiple historical data flows with known malicious threat levels. The multiple historical data flows are data flows of preset types.

[0083] Step 16: Based on the detection result, determine whether the data flow to be detected is malicious traffic of a preset type.

[0084] By using the above-mentioned method provided by the embodiment of the present invention, since the multi-stream feature can represent the correlation between multiple TCP single streams, it can more comprehensively reflect the characteristics of the data stream to be detected compared with the single-stream feature. In addition, the multiple historical data streams with known malicious threat levels used to train the malicious traffic detection model are data streams of preset types. Therefore, it is possible to detect whether the data stream that meets the preset type contains malicious threats. Compared with the detection method based on rules in the prior art, even if the data stream is of a type for which it is difficult to obtain rules, fast and accurate detection can be achieved, which improves the efficiency and accuracy of malicious traffic detection.

[0085] The above method provided in the embodiment of the present application can train malicious traffic detection models for various preset types of data streams, and is used to detect data streams of corresponding preset types. For example, the malicious traffic detection model can be trained for webshell encrypted traffic, so as to determine whether the data stream to be detected is malicious traffic of the webshell encrypted type. Compared with the rule-based detection method in the prior art, the present method is used to detect webshell encrypted traffic, which is not affected by traffic encryption, thereby achieving faster and more accurate detection of webshell encrypted traffic. In addition, since the correlation between multiple TCP single streams is taken into account in the detection, the detection accuracy is further improved.

[0086] The method provided by the embodiment of the present invention is described in detail below with reference to the accompanying drawings.

[0087] Example 2

[0088] The second embodiment of the present invention provides a method for detecting malicious traffic. Figure 2 Shown, including:

[0089] Step 201: Acquire the data stream to be detected that belongs to the same network address.

[0090] The data stream to be detected at the same network address may be a data stream belonging to the same client, for example, may include data streams between the client and various servers, and the data stream may be sent by the client or received by the client.

[0091] Step 202: Split the data flow to be detected into multiple TCP flows according to whether the traffic contained in the data flow belongs to the same TCP flow.

[0092] Specifically, the data stream to be detected can be split into multiple TCP streams based on the IP addresses in the data stream to be detected, including the IP addresses of the sender and the receiver, and the characteristics of the TCP handshake when the TCP connection is established between the sender and the receiver. For example, after a TCP connection is established through three TCP handshakes, if the IP addresses of the sender and the receiver are the same, the traffic belongs to the same TCP stream; otherwise, it belongs to different TCP streams.

[0093] For each of the multiple TCP flows obtained by splitting, the following steps 203 to 205 are used to generate a TCP single flow belonging to the data flow to be detected.

[0094] Step 203: Determine whether there is a traffic interval greater than a preset time length in the TCP flow. If so, execute step 204; if not, execute step 205.

[0095] Step 204: Split the TCP stream at each interval greater than a preset duration to obtain multiple TCP single streams.

[0096] The number of the obtained multiple TCP single flows is related to the number of intervals greater than the preset time length, which is the number of intervals greater than the preset time length plus 1.

[0097] Step 205: If there is no traffic interval greater than a preset time length in the TCP flow, the TCP flow is determined to be a single TCP flow.

[0098] Step 206: Extract the single-flow features of each TCP single-flow included in the data flow to be detected.

[0099] In the embodiment of the present invention, the extracted single-flow features of the TCP single-flow can be flexibly selected based on the needs of the actual application. For example, the features shown in Table 1 below can be included:

[0100] Feature Name Feature Description Source Port Destination port Inflow The total number of bytes received during the session Outflow The total number of bytes sent during the session Number of incoming packets Total number of packets received during the session Number of outgoing packets Total number of packets sent during the session Duration Session duration Message length change matrix The packet length transition probability matrix of the first 20 packets with load during the connection process Message time change matrix The time transition probability matrix of the first 20 packets with load during the connection process Byte distribution Byte distribution in the payload

[0101] Table 1: Single-stream characteristics

[0102] Step 207: Obtain the interval duration between each two adjacent TCP single flows in the multiple TCP single flows.

[0103] Step 208: Generate multi-flow features of the multiple TCP single flows based on the single-flow features of the multiple TCP single flows and the interval duration between every two adjacent TCP single flows.

[0104] For example, the generated multi-flow features include the single-flow features of the multiple TCP single flows and the interval duration between every two adjacent TCP single flows.

[0105] In this step, the multi-stream feature can also be understood as the multi-stream feature of the data stream to be detected, which is called the stream feature of the data stream to be detected.

[0106] Since the multi-flow feature includes the interval duration between each two adjacent TCP single flows in the multiple TCP single flows, the multi-flow feature can represent the correlation between the multiple TCP single flows.

[0107] Step 209: Input the flow characteristics of the data flow to be detected into the pre-trained malicious traffic detection model to obtain a detection result indicating the malicious threat level of the data flow to be detected.

[0108] In an embodiment of the present invention, the malicious traffic detection model is obtained by training a machine learning model based on multiple historical data streams with known malicious threat levels, and the multiple historical data streams are data streams of preset types.

[0109] Specifically, the machine learning algorithm model adopted by the malicious traffic detection model can select various feasible types based on the needs of actual applications. For example, it can be a random forest or RNN (Recurrent Neural Network) algorithm. Based on the similarity between the calculated flow characteristics of the data flow to be detected and the flow characteristics of multiple historical data flows with known malicious threat levels, the detection result of the malicious threat level of the data flow to be detected is determined.

[0110] Step 210: Based on the obtained detection result, determine whether the data flow to be detected is malicious traffic of a preset type.

[0111] In the first embodiment of the present invention, the detection result indicating the malicious threat level may be compared with a threat level threshold. If the result is greater than the threat level threshold, the traffic is determined to be malicious traffic.

[0112] Example 3

[0113] In other embodiments of the present invention, after the flow characteristics of the data flow to be detected are input into the malicious traffic detection model and the detection result indicating the malicious threat level is obtained, if the detection result indicates that the malicious threat level of the data flow to be detected exceeds the alarm threshold, the data flow to be detected is determined to be a malicious data flow and an alarm is directly issued. If the detection result indicates that the malicious threat level of the data flow to be detected is lower than the normal threshold, the data flow to be detected is determined to be normal traffic. If the detection result indicates that the malicious threat level of the data flow to be detected is between the alarm threshold and the normal threshold, it indicates that the data flow to be detected may be a malicious data flow. In order to be able to further and more accurately determine whether it is malicious traffic, the detection results obtained by other detection methods can also be combined to jointly determine whether the data flow to be detected is malicious traffic.

[0114] In the embodiment of the present invention, the other detection methods combined may include at least one of the following detection methods:

[0115] The first detection method:

[0116] For a TCP single stream, when it is detected that the TCP single stream adopts the HTTP protocol and has decodable content, the TCP single stream is decoded to obtain decoded data;

[0117] Calculate the compression ratio of the decoded data;

[0118] A first threat weighted value indicating the maliciousness threat level of the TCP single flow is generated based on the compression ratio of the decoded data.

[0119] For webshell encrypted traffic, when it uses the HTTP protocol, the transmitted content will be encrypted using base64, base128, chr, or rsa. Taking base64 encryption as an example, in actual applications, the data of malicious webshell traffic after base64 decoding is generally encrypted data, while the data of non-malicious traffic after base64 decoding is generally plain text. Therefore, in the first detection method mentioned above, based on the compression ratio of the decoded data, if the compression ratio is high, the malicious threat level is high, and if the compression ratio is low, the malicious threat level is low.

[0120] The second detection method:

[0121] For a single TCP stream, when it is detected that the single TCP stream uses the HTTP protocol and has decodable content, the HTTP header features of the single TCP stream are extracted;

[0122] When it is detected that the http header feature of the tcp single stream meets a preset feature condition, a second threat weighted value representing the maliciousness threat of the tcp single stream is generated.

[0123] The second detection method performs threat detection on the HTTP header. For example, malware often uses unique HTTP header features, such as a special user-agent, etc. Therefore, a second threat weighted value representing the degree of malicious threat can be generated based on whether the HTTP header features of a single TCP stream meet preset feature conditions.

[0124] The third detection method:

[0125] For a single TCP stream, when the single TCP stream uses the HTTPS protocol, extract the certificate of the single TCP stream;

[0126] Extract the ja3 information of the certificate of the TCP single stream;

[0127] Based on the ja3 information, a third threat weighted value indicating the malicious threat level of the TCP single flow is generated.

[0128] Since encryption has been performed when the https protocol is used, it cannot be decoded. At this time, the ja3 information of the TCP single stream certificate can be extracted and the third threat weighted value representing the malicious threat degree can be obtained by calculation.

[0129] The fourth detection method:

[0130] Extract IP information of the data stream to be detected;

[0131] The malicious threat level of the IP information is queried to obtain a fourth threat weighted value representing the malicious threat level.

[0132] In the fourth detection method, various IP information contained in the data stream to be detected can be extracted, including the IP addresses of the sender and the receiver, that is, the IP addresses of the client and other servers interacting with the client, and queried in the statistical threat IP address database. If it exists, it indicates that the malicious threat level is high, and a fourth threat weighted value representing the malicious threat level is obtained.

[0133] The fifth detection method:

[0134] Obtain access time distribution characteristics of the network address accessing the server IP in the data flow to be detected;

[0135] Calculate the access time distribution characteristics and the similarity between them and the access time distribution characteristics of other non-malicious network addresses accessing the server IP address;

[0136] Based on the similarity, a fifth threat weighted value representing the malicious threat level is generated.

[0137] In the fifth detection method, the access time distribution characteristics may include the time interval between accesses, the number of accesses per unit time, etc. The algorithm for calculating the similarity may adopt various feasible algorithms, such as Euclidean distance similarity.

[0138] In the embodiment of the present invention, whether the data flow to be detected is malicious traffic can be determined based on the detection results output by the malicious traffic detection model and the threat weighted values ​​calculated by the above-mentioned various detection methods.

[0139] For example, the detection result and each threat weighted value may be weighted and summed to obtain a detection value that can indicate whether the data flow to be detected is malicious traffic.

[0140] When the detection result indicates that the malicious threat level of the data flow to be detected is high, it is also possible to further determine whether the malicious threat level of the data flow to be detected is high based on the threat weighted values ​​obtained by the above-mentioned detection methods. When the result also shows that the malicious threat level is high, the data flow to be detected is determined to be malicious traffic.

[0141] Based on the same inventive concept, correspondingly, according to the malicious traffic detection method provided by the embodiment of the present invention, the embodiment of the present invention provides a malicious traffic detection device, such as Figure 3 Shown, including:

[0142] The data flow acquisition module 31 is used to acquire the data flow to be detected belonging to the same network address;

[0143] The data stream splitting module 32 is used to split the data stream to be detected into multiple TCP single streams;

[0144] A feature extraction module 33 is used to extract the single flow features of each of the TCP single flows;

[0145] A feature generating module 34 is configured to generate, based on the single-flow features of the multiple TCP single flows, multi-flow features of the multiple TCP single flows as flow features of the data flow to be detected, wherein the multi-flow features represent the correlation between the multiple TCP single flows;

[0146] a data flow detection module 35 configured to input the flow characteristics of the data flow to be detected into a pre-trained malicious traffic detection model to obtain a detection result indicating the malicious threat level of the data flow to be detected, wherein the malicious traffic detection model is obtained by training a machine learning model based on multiple historical data flows with known malicious threat levels, wherein the multiple historical data flows are data flows of preset types;

[0147] The result determination module 36 is configured to determine, based on the detection result, whether the data flow to be detected is malicious traffic of the preset type.

[0148] According to a specific implementation method of an embodiment of the present invention, the data stream splitting module 32 is specifically used to split the data stream to be detected into multiple TCP streams according to whether the traffic contained therein belongs to the same TCP stream; if there is a TCP stream with a traffic interval duration greater than a preset duration among the multiple TCP streams, then from each interval greater than the preset duration, the TCP stream is split into multiple TCP single streams; and the TCP streams with a traffic interval duration not greater than the preset duration among the multiple TCP streams are determined as TCP single streams.

[0149] According to a specific implementation method of an embodiment of the present invention, the feature generation module 34 is specifically used to obtain the interval duration between each adjacent two TCP single flows in the multiple TCP single flows; based on the single-flow features of the multiple TCP single flows and the interval duration between each adjacent two TCP single flows, generate multi-flow features of the multiple TCP single flows.

[0150] According to a specific implementation of the embodiment of the present invention, Figure 4 As shown, it also includes:

[0151] The first threat detection module 37 is configured to decode each TCP single stream, when detecting that the TCP single stream uses the HTTP protocol and has decodable content, to obtain decoded data; calculate a compression ratio of the decoded data; and generate a first threat weighted value indicating a malicious threat level for the TCP single stream based on the compression ratio of the decoded data;

[0152] Extracting HTTP header features of the TCP single stream; when detecting that the HTTP header features of the TCP single stream meet a preset feature condition, generating a second threat weighted value representing the maliciousness threat of the TCP single stream;

[0153] When the TCP single stream adopts the HTTPS protocol, extracting the certificate of the TCP single stream; extracting the JA3 information of the certificate of the TCP single stream; and generating a third threat weighted value indicating the malicious threat level of the TCP single stream based on the JA3 information;

[0154] The result determination module 36 is specifically configured to determine whether the data flow to be detected is malicious traffic of the preset type based on the detection result and the first threat weighted value and the second threat weighted value of each TCP single flow; or

[0155] Based on the detection result and the third threat weighted value of each TCP single flow, it is determined whether the data flow to be detected is malicious traffic of the preset type.

[0156] According to a specific implementation of the embodiment of the present invention, Figure 5As shown, it also includes:

[0157] The second threat detection module 38 is configured to extract the IP information of the data flow to be detected; query the malicious threat level of the IP information to obtain a fourth threat weighted value representing the malicious threat level;

[0158] The result determination module 36 is specifically configured to determine whether the data flow to be detected is malicious traffic of the preset type based on the detection result and the fourth threat weighted value.

[0159] According to a specific implementation of the embodiment of the present invention, Figure 6 As shown, it also includes:

[0160] The third threat detection module 39 is configured to obtain a time distribution characteristic of accesses to the server IP address by the network address in the data stream to be detected; calculate the similarity between the time distribution characteristic of accesses to the server IP address by other non-malicious network addresses; and generate a fifth threat weighted value indicating the degree of malicious threat based on the similarity.

[0161] The result determination module 36 is specifically configured to determine whether the data flow to be detected is malicious traffic of the preset type based on the detection result and the fifth threat weighted value.

[0162] The device of this embodiment can be used to perform Figure 1-Figure 2 The technical solution of the method embodiment shown has similar implementation principles and technical effects, which will not be repeated here.

[0163] An embodiment of the present invention further provides an electronic device, which includes the device described in any of the above embodiments.

[0164] Figure 7 This is a schematic diagram of the structure of an embodiment of the electronic device of the present invention, which can realize the present invention. Figure 1-2 The process of the embodiment shown is as follows: Figure 7 As shown, the above-mentioned electronic device may include: a shell 71, a processor 72, a memory 73, a circuit board 74 and a power supply circuit 75, wherein the circuit board 74 is placed inside the space enclosed by the shell 71, and the processor 72 and the memory 73 are arranged on the circuit board 74; the power supply circuit 75 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 73 is used to store executable program code; the processor 72 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 73, so as to execute the malicious traffic detection method described in any of the above-mentioned embodiments.

[0165] For details on the specific execution process of the above steps by the processor 72 and the steps further executed by the processor 72 by running the executable program code, please refer to the present invention. Figure 1-2 The description of the illustrated embodiment will not be repeated here.

[0166] This electronic device exists in many forms, including but not limited to:

[0167] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and are primarily designed to provide voice and data communications. These terminals include smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones.

[0168] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0169] (3) Portable entertainment devices: These devices can display and play multimedia content. These devices include audio and video players (such as iPods), handheld game consoles, e-books, smart toys, and portable car navigation devices.

[0170] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0171] (5) Other electronic devices with data interaction functions.

[0172] An embodiment of the present invention further provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the method described in any of the aforementioned embodiments.

[0173] An embodiment of the present invention further provides an application program, which is executed to implement the method provided by any embodiment of the present invention.

[0174] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0175] Each embodiment in this specification is described in a related manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0176] In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0177] For the convenience of description, the above device is described as being divided into various units / modules based on their functions. Of course, when implementing the present invention, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.

[0178] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0179] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A malicious traffic detection method, characterized in that: include: Obtain the data flow to be detected belonging to the same network address; Splitting the data stream to be detected into multiple TCP single streams; Extracting single-flow features of each of the TCP single flows; generating, based on the single-flow features of the multiple TCP single-flows, multi-flow features of the multiple TCP single-flows as flow features of the data flow to be detected, wherein the multi-flow features represent the correlation between the multiple TCP single-flows; Inputting the flow characteristics of the data flow to be detected into a pre-trained malicious traffic detection model to obtain a detection result indicating the malicious threat level of the data flow to be detected, wherein the malicious traffic detection model is obtained by training a machine learning model based on multiple historical data flows with known malicious threat levels, and the multiple historical data flows are data flows of preset types; Based on the detection result, it is determined whether the data flow to be detected is malicious traffic of the preset type.

2. The malicious traffic detection method according to claim 1, characterized in that: The step of splitting the data stream to be detected into multiple TCP single streams includes: Splitting the data flow to be detected into multiple TCP flows according to whether the traffic contained in the data flow belongs to the same TCP flow; If there is a TCP flow with a traffic interval duration longer than a preset duration among the multiple TCP flows, split the TCP flow into multiple TCP single flows at each interval longer than the preset duration; The TCP flows whose traffic interval durations among the multiple TCP flows are all not greater than the preset duration are determined as TCP single flows.

3. The malicious traffic detection method according to claim 1, characterized in that: The generating, based on the single-stream features of the multiple TCP single-streams, the multi-stream features of the multiple TCP single-streams includes: Obtaining the interval duration between each two adjacent TCP single flows in the multiple TCP single flows; The multi-flow features of the multiple TCP single flows are generated based on the single-flow features of the multiple TCP single flows and the interval duration between every two adjacent TCP single flows.

4. The malicious traffic detection method according to claim 1, characterized in that: Before determining whether the data flow to be detected is malicious traffic of the preset type based on the detection result, the method further includes: For each TCP single stream, when it is detected that the TCP single stream adopts the HTTP protocol and has decodable content, the TCP single stream is decoded to obtain decoded data; Calculating a compression ratio of the decoded data; generating a first threat weighted value indicating a malicious threat level of the TCP single stream based on a compression ratio of the decoded data; Extract the http header features of the tcp single stream; When it is detected that the http header feature of the tcp single stream meets a preset feature condition, a second threat weighted value indicating the maliciousness threat of the tcp single stream is generated; When the TCP single stream adopts the HTTPS protocol, extract the certificate of the TCP single stream; Extract the ja3 information of the certificate of the TCP single stream; Based on the ja3 information, generating a third threat weighted value indicating a malicious threat level of the TCP single flow; The determining, based on the detection result, whether the data flow to be detected is malicious traffic of the preset type includes: Determining whether the data flow to be detected is malicious traffic of the preset type based on the detection result and the first threat weighted value and the second threat weighted value of each TCP single flow; or Based on the detection result and the third threat weighted value of each TCP single flow, it is determined whether the data flow to be detected is malicious traffic of the preset type.

5. The malicious traffic detection method according to claim 1, characterized in that: Before determining whether the data flow to be detected is malicious traffic of the preset type based on the detection result, the method further includes: Extracting IP information of the data stream to be detected; querying the malicious threat level of the IP information to obtain a fourth threat weighted value representing the malicious threat level; The determining, based on the detection result, whether the data flow to be detected is malicious traffic of the preset type includes: Based on the detection result and the fourth threat weighted value, it is determined whether the data flow to be detected is malicious traffic of the preset type.

6. The malicious traffic detection method according to claim 1, characterized in that: Before determining whether the data flow to be detected is malicious traffic of the preset type based on the detection result, the method further includes: Obtaining access time distribution characteristics of the network address in the data flow to be detected accessing the server IP; Calculate the similarity between the access time distribution characteristics and the access time distribution characteristics of other non-malicious network addresses accessing the server IP; generating a fifth threat weighted value indicating a malicious threat level based on the similarity; The determining, based on the detection result, whether the data flow to be detected is malicious traffic of the preset type includes: Based on the detection result and the fifth threat weighted value, it is determined whether the data flow to be detected is malicious traffic of the preset type.

7. A malicious traffic detection device, characterized in that: include: A data flow acquisition module is used to acquire the data flow to be detected belonging to the same network address; A data stream splitting module is used to split the data stream to be detected into multiple TCP single streams; A feature extraction module, configured to extract single-flow features of each of the TCP single flows; a feature generation module, configured to generate, based on the single-flow features of the multiple TCP single flows, multi-flow features of the multiple TCP single flows as flow features of the data flow to be detected, wherein the multi-flow features represent the correlation between the multiple TCP single flows; a data flow detection module, configured to input flow characteristics of the data flow to be detected into a pre-trained malicious traffic detection model to obtain a detection result indicating the malicious threat level of the data flow to be detected, wherein the malicious traffic detection model is obtained by training a machine learning model based on multiple historical data flows with known malicious threat levels, wherein the multiple historical data flows are data flows of preset types; The result determination module is used to determine whether the data flow to be detected is malicious traffic of the preset type based on the detection result.

8. The malicious traffic detection device according to claim 7, characterized in that: The data stream splitting module is specifically configured to split the data stream to be detected into multiple TCP streams according to whether the traffic contained therein belongs to the same TCP stream; if a TCP stream with a traffic interval duration greater than a preset duration exists among the multiple TCP streams, then split the TCP stream into multiple TCP single streams at each interval greater than the preset duration; and determine a TCP stream among the multiple TCP streams whose traffic interval duration is not greater than the preset duration as a TCP single stream.

9. An electronic device, characterized in that: The electronic device includes: a housing, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute any method described in claims 1-6.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method according to any one of claims 1 to 6.

Images