Model training method and device and vulnerability scanning traffic identification method and device

Abstract

The invention discloses a model training method and device and a vulnerability scanning flow identification method and device, and the method comprises the steps: scanning preset target network equipment through employing a plurality of vulnerability scanners, and capturing all network messages with the target network equipment as a destination address in a target time period; original network traffic is divided into scanning traffic and normal traffic, and corresponding scanner labels and normal labels are marked; extracting a network flow feature and a data load of each sample, and extracting a target character string which can best represent the content of the current sample from the data load of the sample to obtain a load feature; and taking the network flow feature and the load feature of each sample as training data, taking the scanner tag or the normal tag of the sample as tag data, and performing iterative training on a preset initial model to obtain a target model for identifying the abnormal network flow. According to the scheme, consumption of computing resources is reduced, deviation caused by a single point can be reduced, misinformation and missing report are reduced, and the recognition accuracy is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a model training method and device, and a vulnerability scanning traffic identification method and device. Background Art

[0002] With the rapid development and widespread application of network technology, the increasing number of network attacks and the lower cost of vulnerability exploitation, vulnerability scanning, as a means of actively detecting network asset weaknesses, is widely used by attackers in the reconnaissance, penetration and attack preparation stages. Vulnerability scanners can quickly and systematically detect whether the target system has known vulnerabilities, creating conditions for subsequent malicious exploitation. In the face of potential intrusion risks, accurately identifying and promptly blocking vulnerability scanning behaviors has become an important part of network security protection.

[0003] Early detection technologies mainly relied on signatures or statistical thresholds to identify such vulnerability scanning behaviors. However, such methods have obvious limitations when dealing with evolving scanning tools, customized scanning strategies, and advanced persistent threats, such as high false positive rates, high missed negative rates, difficulty in adapting to new threats, and lack of ability to identify complex behavior patterns. Summary of the invention

[0004] The present invention aims to at least solve the technical problems existing in the prior art. To this end, the first aspect of the present invention proposes a model training method, the method comprising: Use multiple vulnerability scanners to scan preset target network devices within a preset scanning time period, and use packet capture software to capture all network messages with the target network device as the destination address within the target time period to obtain original network traffic; the target time period is a time period within a preset time range centered on the scanning time period; According to the timestamp carried by the original network traffic and the scanning time period, the original network traffic is divided into scanning traffic and normal traffic, and a corresponding scanner tag is marked for the scanning traffic, and a normal tag is marked for the normal traffic; Segmenting the original network traffic according to a preset time interval to obtain a plurality of network traffic samples to form an original sample set; Extracting network flow features and data payloads of each sample in the original sample set, and extracting a target character string that best represents the current sample content from the data payload of the sample to obtain a payload feature; The network flow characteristics and the load characteristics of each sample are used as training data, and the scanner label or normal label of the sample is used as label data. The preset initial model is iteratively trained until the preset termination condition is met, and the training ends to obtain a target model for identifying abnormal network traffic.

[0005] Optionally, extracting the network flow features of each sample in the original sample set includes: Obtaining the number of network flows included in the sample; the network flow refers to a set of messages having the same five-tuple; Obtain the network layer protocol and the transport layer protocol carried by each of the network messages, and count the number of network messages corresponding to each of the network layer protocols and the number of network messages corresponding to each of the transport layer protocols in the sample respectively; Determine the network layer protocol with the largest number of network messages as the high-frequency network layer protocol of the sample, and determine the transport layer protocol with the largest number of network messages as the high-frequency transport layer protocol of the sample; Obtaining a target port corresponding to each of the network messages, and counting the number of network messages corresponding to each target port in the sample, and determining the target port with the largest number of network messages as the high-frequency target port of the sample; Among the network messages included in the sample, first characteristic data of each first network message with the target network device as the receiver is obtained, and second characteristic data of each second network message with the target network device as the sender is obtained; The number of the network flows, the number of network packets corresponding to each of the network layer protocols, the number of network packets corresponding to each of the transport layer protocols, the high-frequency network layer protocol, the high-frequency transport layer protocol, the high-frequency target port, the first characteristic data, and the second characteristic data are used as network flow features of each of the samples.

[0006] Optionally, extracting a target character string that best represents the current sample content from the data payload of the sample to obtain a payload feature includes: Performing word segmentation processing on the data load of the sample to obtain multiple word units; Counting the total number of word units in the sample and the number of occurrences of each word unit, and calculating the quotient of the number of occurrences of each word unit and the total number, to obtain the word frequency of each word unit in the data payload; Normalizing the word frequency to obtain a normalized word frequency; Calculating the quotient of the total number of samples in the original sample set and the number of samples containing the word unit, and taking the logarithm of the quotient to obtain the inverse load word frequency; Taking the product of the normalized word frequency and the inverse load word frequency as the importance value of the word unit; The first N words with the highest importance values ​​in the sample are obtained, the first N words are used as target strings that best represent the current sample content, and the target strings are used as load features.

[0007] Optionally, the acquiring first characteristic data of each first network message with the target network device as the recipient includes: Obtaining the total number of first network messages with the target network device as the recipient; Obtaining the total number of bytes of each of the first network messages, and determining the average packet length of the first network messages according to the quotient of the total number of bytes of each of the first network messages and the total number of packets; Obtaining an average window size for receiving data of each of the first network messages, an average survival time of the first network messages in the network, and an average packet sending interval of the first network messages; The total number of packets, the total number of bytes, the average packet length, the average window size, the average survival time, and the average packet sending interval of the first network message are used as the first characteristic data of the first network message.

[0008] A second aspect of the present invention provides a vulnerability scanning traffic identification method, the method comprising: After starting the VPP framework, a target model is loaded in the VPP framework, wherein the target model is generated according to any one of the methods of the first aspect; the VPP framework includes a packet capture plug-in and a data packet parsing plug-in; Utilize the packet capture plug-in to capture the current network message, and utilize the data packet parsing plug-in to parse the network message in multi-threaded manner to extract the source IP address of the network message; Classifying the network messages according to the source IP addresses to obtain multiple groups of network messages; For each group of network messages, extract the network flow features and load features of the network messages; the network flow features refer to features that can reflect and characterize the behavior patterns of network messages, and the load features refer to the target character string in the data load that best represents the current load content; The network flow characteristics and the load characteristics are input into the target model, and vulnerability scanning traffic identification processing is performed on the network flow characteristics and the load characteristics to obtain the identification result of the network message.

[0009] Optionally, the identification result includes scanner traffic and normal traffic. After obtaining the identification result of the network message, the following further includes: If the identification result is scanner traffic, an alarm message is generated, and / or the source IP address corresponding to the scanner traffic is blocked.

[0010] A third aspect of the present invention provides a model training device, the device comprising: The traffic capture module is used to use multiple vulnerability scanners to scan preset target network devices within a preset scanning time period, and use packet capture software to capture all network messages with the target network device as the destination address within the target time period to obtain the original network traffic; the target time period is a time period within a preset time range centered on the scanning time period; A labeling module, configured to divide the original network traffic into scanning traffic and normal traffic according to the timestamp carried by the original network traffic and the scanning time period, and label the scanning traffic with a corresponding scanner label and label the normal traffic with a normal label; A segmentation module, used to segment the original network traffic according to a preset time interval to obtain a plurality of network traffic samples to form an original sample set; An extraction module, used to extract network flow features and data payload of each sample in the original sample set, and extract a target string that best represents the content of the current sample from the data payload of the sample to obtain a payload feature; The training module is used to iteratively train the preset initial model using the network flow characteristics and the load characteristics of each sample as training data and the scanner label or normal label of the sample as label data until the preset termination condition is met, thereby obtaining a target model for identifying abnormal network traffic.

[0011] A fourth aspect of the present invention provides a vulnerability scanning traffic identification device, the device comprising: A loading module, used for loading a target model in the VPP framework after starting the VPP framework, wherein the target model is generated according to any one of the methods in the first aspect; the VPP framework includes a packet capture plug-in and a data packet parsing plug-in; The parsing module is used to capture the current network message by using the packet capture plug-in, and to parse the network message by multi-threading using the data packet parsing plug-in to extract the source IP address of the network message; A classification module, used for classifying the network messages according to the source IP addresses to obtain multiple groups of network messages; An extraction module, for extracting network flow features and load features of each group of network messages; the network flow features refer to features that can reflect and characterize the behavior pattern of the network messages, and the load features refer to target strings in the data payload that best represent the current load content; The identification module is used to input the network flow characteristics and the load characteristics into the target model, perform vulnerability scanning traffic identification processing on the network flow characteristics and the load characteristics, and obtain the identification result of the network message.

[0012] A fifth aspect of the present invention proposes an electronic device, comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the model training method described in the first aspect, and / or the vulnerability scanning traffic identification method described in the second aspect.

[0013] The sixth aspect of the present invention proposes a computer-readable storage medium, which stores at least one instruction, at least one program, a code set or an instruction set. The at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement the model training method described in the first aspect, and / or the vulnerability scanning traffic identification method described in the second aspect.

[0014] The embodiments of the present invention have the following beneficial effects: In an embodiment of the present invention, a plurality of vulnerability scanners are used to scan a preset target network device within a preset scanning time period, and a packet capture software is used to capture all network packets with the target network device as the destination address within the target time period to obtain the original network traffic; the target time period is a time period within a preset time range centered on the scanning time period; the original network traffic is divided into scanning traffic and normal traffic according to the timestamp carried by the original network traffic and the scanning time period, and the scanning traffic is labeled with a corresponding scanner label, and the normal traffic is labeled with a normal label; the original network traffic is segmented at preset time intervals to obtain multiple network traffic samples to form an original sample set; the network flow features and data payload of each sample in the original sample set are extracted, and the target string that best represents the current sample content is extracted from the data payload of the sample to obtain the payload feature; the network flow features and the payload features of each sample are used as training data, and the scanner label or normal label of the sample is used as label data, and the preset initial model is iteratively trained until the preset termination condition is met, and the training ends to obtain a target model for identifying abnormal network traffic. In this solution, by extracting and fusing network flow features and load features in the data set, the model can absorb a large number of multi-dimensional features. Through the feature selection process, the model automatically identifies the feature subset with the best value for vulnerability scanning behavior identification, avoiding the dimensionality disaster problem and reducing the consumption of computing resources. In addition, the recognition method based on machine learning has strong robustness and noise resistance, and does not rely solely on statistical time intervals, thresholds, signatures, etc. It can reduce the deviation caused by a single point, thereby reducing false positives and false negatives and improving recognition accuracy. Based on model training, incremental training or online learning can also be conveniently performed. With the continuous learning of new data sets, the model can be dynamically updated to adapt to the changing trend of vulnerability scanning behavior and maintain the timeliness and accuracy of the recognition effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A flowchart of the steps of a model training method provided by an embodiment of the present invention; Figure 2 A flowchart of a vulnerability scanning traffic identification method provided by an embodiment of the present invention; Figure 3 A structural block diagram of a model training device provided by an embodiment of the present invention; Figure 4 A structural block diagram of a vulnerability scanning traffic identification device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, "multiple" means two or more. In addition, the use of "based on" or "according to" means openness and inclusiveness, because the process, steps, calculations or other actions "based on" or "according to" one or more of the conditions or values ​​may be based on additional conditions or values ​​beyond the described values ​​in practice.

[0018] Vulnerability scanning is a necessary process for attackers to collect vulnerability information before exploiting the vulnerability. Currently, the industry's vulnerability scanning detection technology can be roughly divided into two categories. The first is based on statistical principles to count the scanning rate. This method mainly determines whether it exceeds a certain set threshold by counting the frequency of connection requests initiated by a single IP address in a short period of time, the distribution of the target ports visited, the distribution of the target IP addresses visited, the error code response, etc., and then it is regarded as a scanning behavior; the second is to match the message payload information based on the signature method. This method mainly uses the regular matching method to match whether the message payload information contains a certain rule through the maintained rule library (scanner unique identifier, message characteristics, data packet structure, etc.). If the rule is matched, it is regarded as a scanning behavior.

[0019] The inventors found in the process of studying related technologies that the vulnerability scanning behavior identification method based on statistical principles of scanning rate has the following disadvantages: (1) The processing of each message is time-consuming, especially when processing large flows of more than 10Gb, which results in serious performance loss.

[0020] (2) The statistical time interval is difficult to determine. If the statistical time is too short, it may lead to false positives (normal traffic is counted as scanning behavior) or missed positives (attackers can easily bypass it). If the statistical time is too long, the scanning behavior cannot be identified in time, resulting in the vulnerability information of the asset being detected by the attacker, causing more serious losses.

[0021] (3) The statistical threshold has poor adaptability. Different scanners have different scanning frequencies and techniques, and the statistical thresholds are also different. Attackers can avoid statistical detection by adjusting the scanning rate, randomizing port selection, imitating normal user behavior, etc.

[0022] The signature-based method matches the message payload information. This vulnerability scanning behavior identification method has the following disadvantages: (1) The processing of each message is time-consuming.

[0023] (2) It must rely on a rule base, which requires frequent updates and maintenance. If there are no corresponding rules in the rule base, the scanning behavior cannot be identified, and it is powerless against unknown new scanning tools or customized tools.

[0024] (3) It is relatively easy for attackers to evade. Attackers may bypass signature-based detection methods by modifying scanner features.

[0025] (4) The false positive and false negative rates are high. Overly strict signatures may lead to false negatives, while loose signatures may lead to false positives. The extraction accuracy and generalization ability of signatures are difficult to grasp.

[0026] With the continuous development and application of artificial intelligence, machine learning, big data and other technologies, more ideas are provided for vulnerability scanning behavior identification technology. The embodiment of the present invention uses a machine learning model to extract key features that can characterize scanning behavior from network traffic through feature engineering, such as network flow features: connection rate, target port distribution, target IP distribution, session duration, packet interval time, active word frequency, cycle, packet length, number of packets, etc., and load features: application protocol, URI, HTTP header, HTTP method distribution, load length, load keywords, etc.; with a rich feature data set, various machine learning algorithms (such as random forests) can be used for model training; finally, using these advanced models, vulnerability scanning behavior can be more accurately identified, false alarm rate and missed alarm rate can be reduced, and new vulnerability scanning behaviors can be discovered and responded to in a timely manner.

[0027] Figure 1 It is a step flow chart of a model training method provided by an embodiment of the present invention.

[0028] Step 101: Use multiple vulnerability scanners to scan a preset target network device within a preset scanning time period, and use packet capture software to capture all network messages with the target network device as the destination address within the target time period to obtain original network traffic; the target time period is a time period within a preset time range centered on the scanning time period.

[0029] In a network attack, a vulnerability scanner can quickly and systematically detect whether the target system has known vulnerabilities, creating conditions for subsequent malicious exploitation. The embodiment of the present invention trains a target model to identify vulnerability scanning behavior. Before model training, it is necessary to collect the scanning traffic of various vulnerability scanners and extract the characteristic information of the scanning traffic. At the same time, it is necessary to collect normal network traffic and extract the characteristic information of normal network traffic. The characteristic information of the scanning traffic and the characteristic information of the normal network traffic are input into the initial model so that the initial model can understand and learn.

[0030] Specifically, the various vulnerability scanners may include Nmap, Masscan, Goby, Nessus, AWVS, Nikto, etc. The preset target network devices may be set to three types: subnet, host, and web site. The packet capture software may use wireshark, tcpdump, etc.

[0031] It can be understood that the above-mentioned vulnerability scanner, target network device and packet capture software can be configured according to requirements, and the embodiment of the present invention does not specifically limit this.

[0032] The target time period is a time period within a preset time range centered on the scanning time period. For example, if the scanning time period is 13:00-13:30, the target time period is a time period within a range of 2 hours before and after the scanning time period, that is, the target time period is 11:00-15:30. It is understood that the time range of the target time period can be set according to demand and is not specifically limited here.

[0033] Use the above-mentioned vulnerability scanner to scan subnets, hosts, web sites and other target network devices within a preset time period, and use the above-mentioned packet capture software to capture all network packets with the above-mentioned target network devices as destination addresses within the target time period to obtain the original network traffic, and store the original network traffic in pcap format.

[0034] The pcap format is a file format widely used for network packet capture and analysis. It can efficiently store a large number of network packets for offline analysis.

[0035] Step 102: Divide the original network traffic into scanning traffic and normal traffic according to the timestamp carried by the original network traffic and the scanning time period, and mark the scanning traffic with a corresponding scanner tag and mark the normal traffic with a normal tag.

[0036] The original network traffic contains scanner traffic and normal traffic. According to the timestamps carried by the original network traffic, we can know which network traffic is in the scanning time period and which is normal traffic, so as to divide the original network traffic into scanning traffic and normal traffic. And further, according to the content of the traffic in the scanning traffic, we can identify which scanner the traffic belongs to and mark the corresponding scanner name as a label for the traffic.

[0037] At the same time, normal labels are given to normal traffic.

[0038] Step 103: Segment the original network traffic at preset time intervals to obtain multiple network traffic samples to form an original sample set.

[0039] In order to facilitate the feature extraction of network traffic, the original network traffic is divided into network traffic samples in pcap format according to preset time intervals, and all network traffic samples constitute the original sample set.

[0040] The preset time interval can be 30 seconds.

[0041] Step 104: extract the network flow features and data payload of each sample in the original sample set, and extract the target character string that best represents the current sample content from the data payload of the sample to obtain the payload features.

[0042] Feature engineering is the core step of data preprocessing. It extracts, selects, transforms and constructs features from raw data to make it easier for machine learning models to understand and learn. This process includes identifying features related to the target variable, evaluating and screening important features, mathematically transforming features to optimize their familiarity, and combining domain knowledge to construct composite features to reveal deep associations. Feature engineering is crucial to improving model prediction performance.

[0043] The embodiment of the present invention extracts network flow features of each sample. Network flow features refer to features that can reflect and characterize the behavior pattern of network flow, and can specifically be information in the header of a data packet, such as message length, transmission delay, network layer protocol, transport layer protocol, data packet length, etc.

[0044] The data payload may specifically be information of the data content part in the data packet. The data payload is composed of a character string, and the target character string that best represents the current sample content is extracted from the data payload to obtain the payload feature.

[0045] Among them, the target character string that best represents the content of the current sample is a character string that appears frequently in the current sample but has a low frequency in other samples.

[0046] The network flow features and load features extracted from each sample, as well as the label (scanner label or normal label) corresponding to the sample, are combined together to form the final feature vector of the sample. If a sample does not have a certain feature, it is replaced by 0, and the various features are combined together to form the target feature vector of each sample. Multiple samples form a feature vector table for machine learning model training and test verification.

[0047] Step 105, using the network flow characteristics and the load characteristics of each sample as training data, and the scanner label or normal label of the sample as label data, the preset initial model is iteratively trained until the preset termination condition is met, and the training is terminated to obtain a target model for identifying abnormal network traffic.

[0048] Divide the data set into two groups, for example, 70% of the data is in one group and 30% of the data is in another group. One group of data is used for model training, and the other group of data is used for model testing and verification.

[0049] During specific training, the network flow features and load features of each sample are used as training data, and the scanner label or normal label corresponding to the sample is used as label data. The initial model identifies the sample traffic based on the input network flow features and load features, predicts whether the traffic type of the sample is scanner traffic or normal traffic, and compares the predicted traffic type with the label data of the sample. According to the comparison results, the model parameters are adjusted to continue iterative training.

[0050] In some possible implementations, the initial model is a random forest model, and the preset termination condition is: the maximum depth of the decision tree generated by the random forest model is 10, and the maximum number of decision trees is 1000.

[0051] The random forest model is an integrated learning method that builds and combines multiple decision tree models for prediction. Each tree randomly extracts a subset of samples and a subset of features during training. Each tree is trained independently, and the final prediction result is a majority vote or average. Random forest has good anti-overfitting ability, can evaluate feature importance, handle a large number of features and missing values, and is suitable for classification and regression tasks. Its robustness and accuracy come from the idea of ​​integrating individual diversity.

[0052] The random forest model can automatically learn from a large number of flow features and load features and extract key influencing factors without manually defining complex rules or signatures. In addition, it can capture the complex relationships between features, improve recognition accuracy and generalization capabilities, and is not easily bypassed by attackers.

[0053] The random forest model can be easily trained incrementally or learned online. As new data sets are continuously learned, the model can be dynamically updated to adapt to the changing trends of vulnerability scanning behavior and maintain the timeliness and accuracy of the identification effect.

[0054] The random forest model ensemble learning constructs and integrates the prediction results of multiple decision trees, which can reduce the overfitting risk of individual decision trees. Even if some decision trees misidentify individual vulnerability scanning behaviors, the overall model can still make more accurate judgments through the majority voting mechanism.

[0055] In order to prevent overfitting, the maximum depth of the decision tree generated in the model training is set to 10 and the maximum number of decision trees is set to 1000. When the above termination conditions are met, the model training ends.

[0056] After the model training is completed, the model prediction results are verified using the training data and test data respectively. Specifically, the accuracy of the trained model can be evaluated and verified using the ROC curve (The Receiver Operating Characteristic Curve) and the confusion matrix (Confusion Matrix). The closer the ROC curve is to the upper left corner, the higher the model accuracy is. The higher the proportion of correct predictions is in the confusion matrix, the lower the proportion of incorrect predictions is, the higher the model accuracy is.

[0057] If the evaluation shows that the model accuracy does not reach the preset level, you can check the features that have the greatest impact on the model, fine-tune the model training parameters, repeat the above training and evaluation steps again, and gradually optimize the model.

[0058] In addition, you can also adjust the preset time interval, re-segment the original network traffic, re-prepare sample data, perform feature extraction and model training again, repeatedly adjust the segmentation time and compare the model prediction results to obtain the best model. For example, the preset time interval can be 1 minute, 30 minutes, 1 hour, etc.

[0059] When the model training meets the preset termination conditions, the training ends, and the model is exported and saved for use in subsequent message processing processes.

[0060] In addition to the random forest model, this solution can also use other algorithm models, such as clustering algorithm, support vector machine SVM, convolutional neural network CNN model, etc. The main differences are in feature extraction and model training methods, parameters, and model accuracy, and can be selected and used according to needs.

[0061] In summary, in an embodiment of the present invention, a plurality of vulnerability scanners are used to scan a preset target network device within a preset scanning time period, and a packet capture software is used to capture all network packets with the target network device as the destination address within the target time period to obtain the original network traffic; the target time period is a time period within a preset time range centered on the scanning time period; the original network traffic is divided into scanning traffic and normal traffic according to the timestamp carried by the original network traffic and the scanning time period, and the scanning traffic is labeled with a corresponding scanner label, and the normal traffic is labeled with a normal label; the original network traffic is segmented at preset time intervals to obtain multiple network traffic samples to form an original sample set; the network flow features and data payloads of each sample in the original sample set are extracted, and the target string that best represents the current sample content is extracted from the data payload of the sample to obtain the payload feature; the network flow features and the payload features of each sample are used as training data, and the scanner label or normal label of the sample is used as label data, and the preset initial model is iteratively trained until the preset termination condition is met, and the training ends to obtain a target model for identifying abnormal network traffic. In this solution, by extracting and fusing network flow features and load features in the data set, the model can absorb a large number of multi-dimensional features. Through the feature selection process, the model automatically identifies the feature subset with the best value for vulnerability scanning behavior identification, avoiding the dimensionality disaster problem and reducing the consumption of computing resources. In addition, the recognition method based on machine learning has strong robustness and noise resistance, and does not rely solely on statistical time intervals, thresholds, signatures, etc. It can reduce the deviation caused by a single point, thereby reducing false positives and false negatives and improving recognition accuracy. Based on model training, incremental training or online learning can also be conveniently performed. With the continuous learning of new data sets, the model can be dynamically updated to adapt to the changing trend of vulnerability scanning behavior and maintain the timeliness and accuracy of the recognition effect.

[0062] In some possible implementations, step 104 extracts the network flow features of each sample in the original sample set, including the following steps: Step 1041, obtaining the number of network flows included in the sample; the network flow refers to a collection of messages having the same five-tuple.

[0063] A network flow refers to the set of all messages with the same five-tuple that pass through a certain observation point in the network within a specific time interval.

[0064] The quintuple is the five basic attributes of a network message, including the source IP address, destination IP address, source port number, destination port number, and transport protocol. In network communications, each network message contains these five attributes, which together constitute the unique identifier of the network message.

[0065] Therefore, obtaining the number of network flows included in the sample is to obtain the number of network packets having the same five-tuple. Specifically, the number of network flows has a data type of numeric type.

[0066] Step 1042: Obtain the network layer protocol and transport layer protocol carried by each of the network messages, and count the number of network messages corresponding to each of the network layer protocols and the number of network messages corresponding to each of the transport layer protocols in the sample.

[0067] By parsing the network message, the network layer protocol and transport layer protocol carried by the network message can be obtained. The network layer protocol can specifically include IP protocol, ARP protocol, ICMP protocol, etc., and the transport layer protocol can specifically include TCP protocol, UDP protocol, etc.

[0068] The number of network packets of each network layer protocol and the number of network packets of each transport layer protocol are counted. Specifically, the data types are all classified.

[0069] Step 1043: determine the network layer protocol with the largest number of network messages as the high-frequency network layer protocol of the sample, and determine the transport layer protocol with the largest number of network messages as the high-frequency transport layer protocol of the sample.

[0070] For example, if the number of network messages complying with the IP protocol is the largest, it means that the IP protocol is the most commonly used, and the IP protocol is determined as a high-frequency network layer protocol. If the number of network messages complying with the TCP protocol is the largest, the TCP protocol is determined as a high-frequency transport layer protocol.

[0071] Specifically, the data types of the high-frequency network layer protocol and the high-frequency transport layer protocol are classified.

[0072] Step 1044: Obtain the target port corresponding to each of the network packets, count the number of network packets corresponding to each target port in the sample, and determine the target port with the largest number of network packets as the high-frequency target port of the sample.

[0073] The header of each network message includes a target port number, and the number of network messages corresponding to each target port is counted. The target port with the largest number of network messages is the most commonly used target port, and is determined as the high-frequency target port of the sample. The data type of the high-frequency target port is classified.

[0074] Step 1045: From the network messages included in the sample, obtain first characteristic data of each first network message with the target network device as the receiver, and obtain second characteristic data of each second network message with the target network device as the sender.

[0075] The first network message with the target network device as the receiver is the network message with the destination IP address being the target network device. The second network message with the target network device as the sender is the network message with the source IP address being the target network device.

[0076] The characteristic data of the first network message and the second network message are obtained respectively. The characteristic data may specifically include the total number of network messages, and the average packet length, average window size and other data obtained by parsing and processing part of the data packet header information.

[0077] Step 1046: Use the number of target traffic, the number of network packets corresponding to each of the network layer protocols, the number of network packets corresponding to each of the transport layer protocols, the high-frequency network layer protocol, the high-frequency transport layer protocol, the high-frequency target port, the first characteristic data, and the second characteristic data as network flow characteristics of each of the samples.

[0078] All the features obtained in the above steps constitute the network flow features of each sample.

[0079] Among them, the features with categorical data types are processed using the One-Hot Encoding method to convert limited categories into numerical features for easy use in subsequent model training.

[0080] The embodiment of the present invention extracts the number of network flows, the number of network packets corresponding to each of the network layer protocols, the number of network packets corresponding to each of the transport layer protocols, high-frequency network layer protocols, high-frequency transport layer protocols, high-frequency target ports, first feature data, and second feature data as network flow features of the sample. These features can comprehensively and representatively describe the behavioral characteristics of the sample. The above feature engineering process converts the original network packet data into meaningful features, so that the model can more easily grasp the rules in the data, thereby improving the accuracy and generalization ability of the model. In addition, the above features can help us better understand the decision-making process of the model and increase the interpretability of the model; the above feature engineering process reduces the dimension of the data by reducing irrelevant features and performing feature selection, which not only reduces the time of model training, but also improves the performance of the model.

[0081] In some possible implementations, extracting a target character string that best represents the current sample content from the data payload of the sample in step 104 to obtain a payload feature includes the following steps: Step 1047: perform word segmentation processing on the data payload of the sample to obtain multiple word units; Step 1048: Count the total number of word units in the sample and the number of occurrences of each word unit, and calculate the quotient of the number of occurrences of each word unit and the total number to obtain the word frequency of each word unit in the data payload; Step 1049: normalize the word frequency to obtain a normalized word frequency; Step 1050: Calculate the quotient of the total number of samples in the original sample set and the number of samples containing the word unit, and take the logarithm of the quotient to obtain the inverse load word frequency; Step 1051: taking the product of the normalized word frequency and the inverse load word frequency as the importance value of the word unit; Step 1052: Obtain the first N words with the highest importance values ​​in the sample, use the first N words as the target string that best represents the current sample content, and use the target string as the load feature.

[0082] In step 1047 to step 1052, tokenization is a basic operation in natural language processing, and its purpose is to segment continuous text into independent tokens.

[0083] After a sample is divided into multiple word units, it is necessary to extract the word unit that best represents the current sample content from the multiple word units. Specifically, the quotient of the number of occurrences of each word unit in the sample and the total number of word units in the sample is calculated to obtain the frequency of occurrence of each word unit in the sample, that is, the word frequency. In order to prevent the word frequency calculated for a word unit with a longer load from being too high, the normalization method is used to process each word frequency. Specifically, each word frequency is divided by the total number of word units to obtain the normalized word frequency.

[0084] Then, the reverse load word frequency is counted, that is, the total number of samples in the original sample set is divided by the number of samples containing the word, and the logarithm of the quotient is taken to obtain the reverse load word frequency of each word. The fewer samples containing the word, the greater the reverse load word frequency, indicating that the word has a good ability to distinguish categories.

[0085] The product of the normalized word frequency and the inverse load word frequency is used as the importance value of the word. The top N word-grams in the sample are extracted as the target string that best represents the current sample content. The target string can be used as the load feature of the current sample. The top N word-grams indicate that the word-gram has a high word frequency in a specific sample and that the word-gram has a low frequency of occurrence in the entire sample set. Therefore, the word-gram has a high importance in the current sample and can well represent the current sample content. The importance value tends to filter out common words and retain the most important words.

[0086] The embodiment of the present invention calculates the importance value of a word, and uses the top N words ranked by importance value as the load features of the current sample. This can screen out words that appear frequently in the current sample but less frequently in the entire sample set. This word can best represent the current sample content, accurately describe the load features of the current sample, and improve the accuracy of feature extraction.

[0087] In some possible implementations, obtaining the first characteristic data of each first network message with the target network device as the receiver in step 1046 includes the following steps: Step 10461, obtaining the total number of first network messages with the target network device as the receiver; A network flow refers to a collection of network messages with the same five-tuple, and a network message is a data packet. The total number of first network messages with the target network device as the receiver refers to the number of network messages with the same five-tuple with the target network device as the receiver.

[0088] Step 10462: Obtain the total number of bytes of each of the first network messages, and determine the average packet length of the first network messages according to the quotient of the total number of bytes of each of the first network messages and the total number of packets.

[0089] The total number of bytes of each first network message can be obtained by parsing the data packet.

[0090] The average packet length of the first network messages is obtained by dividing the total number of bytes of each first network message by the total number of packets of the first network messages.

[0091] Step 10463: Obtain an average window size for receiving data of each of the first network packets, an average survival time of the first network packets in the network, and an average packet sending interval of the first network packets.

[0092] The data receiving window refers to the amount of data that can be received each time, and its function is to limit the amount of data that the sender can send continuously, that is, to control the average rate at which the sender sends data. The average window size for receiving data of the first network message refers to the average amount of data that the first network message can receive each time.

[0093] The average survival time of network packets in the network, that is, the average TTL (Time To Live). This field specifies the maximum number of network segments that an IP packet is allowed to pass through before being discarded by a router. TTL is an 8-bit field in the IPv4 header.

[0094] The role of TTL is to limit the time that an IP packet exists in a computer network. The maximum value of TTL is 255, and a recommended value of TTL is 64.

[0095] The average packet sending interval of network messages refers to the waiting time between two consecutive packet sending.

[0096] Step 10464: Use the total number of packets, the total number of bytes, the average packet length, the average window size, the average survival time, and the average packet sending interval of the first network message as the first characteristic data of the first network message.

[0097] The characteristic data of the first network message in the receiving direction is used as the first characteristic data of the network traffic.

[0098] Similarly, second characteristic data of each second network message with the target network device as the sender is obtained, specifically including obtaining the total number of packets, total number of bytes, average packet length, average window size, average survival time, and average packet sending interval of the second network message.

[0099] Figure 2 A flowchart of a vulnerability scanning traffic identification method provided by an embodiment of the present invention. Figure 2 As shown, the method comprises the following steps: Step 201: After starting the VPP framework, a target model is loaded into the VPP framework. The target model is based on Figure 1 The VPP framework includes a packet capture plug-in and a data packet parsing plug-in.

[0100] VPP (Vector Packet Processing) is a high-performance, scalable, open source network packet processing framework. VPP uses CPU vectorization technology and user-mode data paths to achieve line-speed packet processing, providing low-latency, high-throughput forwarding capabilities. The framework contains a variety of network components and supports flexible plug-in expansion to meet the needs of diverse application scenarios.

[0101] The VPP framework includes packet capture plug-ins and data packet parsing plug-ins. The packet capture plug-in can be custom developed or open source. The packet capture plug-in is located after the ethernet-input node and can capture all packets entering the IP protocol stack, such as ARP packets, ICMP packets, IPv4 packets, and IPv6 packets.

[0102] When VPP is started, each plug-in will be initialized one by one. During the initialization of the packet capture plug-in, Figure 1 The target model generated by the model training and validation process.

[0103] Step 202: Use the packet capture plug-in to capture the current network message, and use the data packet parsing plug-in to multi-thread the network message to extract the source IP address of the network message.

[0104] The packet capture plug-in is used to capture all network packets. Since each thread is bound to a CPU core, the VPP framework has multi-threaded processing capabilities. The packet parsing plug-in is used to parse the received packets in parallel. Each thread processes a batch of packets at a time, and the cache pre-fetching mechanism is used to improve performance.

[0105] During the parsing process, the five-tuple information of the network message is extracted, including the source IP address.

[0106] Step 203: Classify the network messages according to the source IP addresses to obtain multiple groups of network messages.

[0107] The network messages are classified according to the source IP addresses, and the messages are inserted into the hash table according to the source IP addresses for subsequent processing.

[0108] Step 204: for each group of network messages, extract the network flow features and load features of the network messages; the network flow features refer to features that can reflect and characterize the behavior patterns of network messages, and the load features refer to the target character string in the data payload that best represents the current payload content.

[0109] For each group of network packets with the same source IP address, network flow features and load features are extracted. The network flow features and load features are the same as the packet feature types extracted during the model training process.

[0110] Specifically, the network flow characteristics include: the number of network flows, the number of network packets corresponding to each network layer protocol, the number of network packets corresponding to each transport layer protocol, high-frequency network layer protocols, high-frequency transport layer protocols, high-frequency target ports, first characteristic data, and second characteristic data.

[0111] The payload feature is a target character string that best represents the current sample content. The method for obtaining the payload feature is shown in steps 1047 to 1052 and will not be repeated here.

[0112] Step 205: input the network flow characteristics and the load characteristics into the target model, perform vulnerability scanning traffic identification processing on the network flow characteristics and the load characteristics, and obtain the identification result of the network message.

[0113] The network flow features and load features extracted above are input into the target model as feature data sets. The target model performs vulnerability scanning traffic identification processing based on the feature data sets to obtain the identification result of the network message, which is scanner traffic or normal traffic. Scanner traffic indicates that the message is vulnerability scanning traffic, and the model can further identify which type of scanner traffic it is.

[0114] The present invention uses the VPP framework to receive and process messages. It can be understood that other packet capture technologies (such as Libpcap, DPDK, Netmap, PF_RING, af-packet, XDP, etc.) can also receive and process messages.

[0115] In summary, after starting the VPP framework, the target model is loaded in the VPP framework, and the target model is based on Figure 1 The VPP framework includes a packet capture plug-in and a data packet parsing plug-in; the packet capture plug-in is used to capture the current network message, and the data packet parsing plug-in is used to multi-thread the network message to extract the source IP address of the network message; the network message is classified according to the source IP address to obtain multiple groups of network messages; for each group of network messages, the network flow features and load features of the network message are extracted; the network flow features and the load features are input into the target model, and the network flow features and the load features are processed for vulnerability scanning traffic identification to obtain the identification result of the network message. In this scheme, by extracting and fusing the network flow features and load features in the data set, the model can absorb a large number of multi-dimensional features. Through the feature selection process, the model automatically identifies the feature subset with the best value for vulnerability scanning behavior identification, avoiding the dimensional disaster problem and reducing the consumption of computing resources. In addition, the recognition method based on machine learning has strong robustness and noise resistance, does not rely solely on statistical time intervals, thresholds, signatures, etc., can reduce the deviation caused by a single point, thereby reducing false positives and false negatives, and improving recognition accuracy. Based on model training, incremental training or online learning can be easily performed. With the continuous learning of new data sets, the model can be dynamically updated to adapt to the changing trends of vulnerability scanning behaviors and maintain the timeliness and accuracy of the identification effect.

[0116] In some possible implementations, after obtaining the identification result of the network message, the method further includes: If the identification result is scanner traffic, an alarm message is generated, and / or the source IP address corresponding to the scanner traffic is blocked.

[0117] In the embodiment of the present invention, according to the model prediction result, if the identification result is scanner traffic, scanner traffic indicates that the message is vulnerability scanning traffic. Then further protection measures can be taken, such as generating an alarm message to notify the administrator to handle it, or automatically adding the source IP address corresponding to the scanner traffic to a blacklist for blocking.

[0118] Figure 3 is a structural block diagram of a model training device provided by an embodiment of the present invention. Figure 3 As shown, the model training device 300 includes: The traffic capture module 301 is used to scan a preset target network device using multiple vulnerability scanners within a preset scanning time period, and use packet capture software to capture all network messages with the target network device as the destination address within the target time period to obtain the original network traffic; the target time period is a time period within a preset time range centered on the scanning time period; A labeling module 302, configured to divide the original network traffic into scanning traffic and normal traffic according to the timestamp carried by the original network traffic and the scanning time period, and label the scanning traffic with a corresponding scanner label and label the normal traffic with a normal label; The segmentation module 303 is used to segment the original network traffic according to a preset time interval to obtain multiple network traffic samples to form an original sample set; An extraction module 304 is used to extract network flow features and data payloads of each sample in the original sample set, and extract a target string that best represents the current sample content from the data payload of the sample to obtain a payload feature; The training module 305 is used to iteratively train the preset initial model using the network flow characteristics and the load characteristics of each sample as training data and the scanner label or normal label of the sample as label data until the preset termination condition is met, thereby obtaining a target model for identifying abnormal network traffic.

[0119] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0120] Figure 4 1 is a structural block diagram of a vulnerability scanning flow identification device provided by an embodiment of the present invention. Figure 4As shown, the vulnerability scanning flow identification device 400 includes: A loading module 401 is used to load a target model in the VPP framework after starting the VPP framework, wherein the target model is generated according to any one of the methods in claims 1-4; the VPP framework includes a packet capture plug-in and a data packet parsing plug-in; The parsing module 402 is used to capture the current network message by using the packet capture plug-in, and to parse the network message by multi-threading using the data packet parsing plug-in to extract the source IP address of the network message; A classification module 403, used to classify the network messages according to the source IP addresses to obtain multiple groups of network messages; The extraction module 404 is used to extract the network flow features and load features of the network messages for each group of the network messages; the network flow features refer to the features that can reflect and characterize the behavior patterns of the network messages, and the load features refer to the target character string in the data payload that can best represent the current load content; The identification module 405 is used to input the network flow characteristics and the load characteristics into the target model, perform vulnerability scanning traffic identification processing on the network flow characteristics and the load characteristics, and obtain the identification result of the network message.

[0121] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0122] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that comply with the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0123] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A model training method, characterized in that: The method comprises: Use multiple vulnerability scanners to scan preset target network devices within a preset scanning time period, and use packet capture software to capture all network messages with the target network device as the destination address within the target time period to obtain original network traffic; the target time period is a time period within a preset time range centered on the scanning time period; According to the timestamp carried by the original network traffic and the scanning time period, the original network traffic is divided into scanning traffic and normal traffic, and a corresponding scanner tag is marked for the scanning traffic, and a normal tag is marked for the normal traffic; Segmenting the original network traffic according to a preset time interval to obtain a plurality of network traffic samples to form an original sample set; Extracting network flow features and data payloads of each sample in the original sample set, and extracting a target character string that best represents the current sample content from the data payload of the sample to obtain a payload feature; The network flow characteristics and the load characteristics of each sample are used as training data, and the scanner label or normal label of the sample is used as label data. The preset initial model is iteratively trained until the preset termination condition is met, and the training ends to obtain a target model for identifying abnormal network traffic.

2. The method according to claim 1, characterized in that The extracting the network flow features of each sample in the original sample set includes: Obtaining the number of network flows included in the sample; the network flow refers to a set of messages having the same five-tuple; Obtain the network layer protocol and the transport layer protocol carried by each of the network messages, and count the number of network messages corresponding to each of the network layer protocols and the number of network messages corresponding to each of the transport layer protocols in the sample respectively; Determine the network layer protocol with the largest number of network messages as the high-frequency network layer protocol of the sample, and determine the transport layer protocol with the largest number of network messages as the high-frequency transport layer protocol of the sample; Obtaining a target port corresponding to each of the network messages, and counting the number of network messages corresponding to each target port in the sample, and determining the target port with the largest number of network messages as the high-frequency target port of the sample; Among the network messages included in the sample, first characteristic data of each first network message with the target network device as the receiver is obtained, and second characteristic data of each second network message with the target network device as the sender is obtained; The number of the network flows, the number of network packets corresponding to each of the network layer protocols, the number of network packets corresponding to each of the transport layer protocols, the high-frequency network layer protocol, the high-frequency transport layer protocol, the high-frequency target port, the first characteristic data, and the second characteristic data are used as network flow features of each of the samples.

3. The method according to claim 2, characterized in that The step of extracting a target character string that best represents the current sample content from the data payload of the sample to obtain a payload feature includes: Performing word segmentation processing on the data load of the sample to obtain multiple word units; Counting the total number of word units in the sample and the number of occurrences of each word unit, and calculating the quotient of the number of occurrences of each word unit and the total number, to obtain the word frequency of each word unit in the data payload; Normalizing the word frequency to obtain a normalized word frequency; Calculating the quotient of the total number of samples in the original sample set and the number of samples containing the word unit, and taking the logarithm of the quotient to obtain the inverse load word frequency; Taking the product of the normalized word frequency and the inverse load word frequency as the importance value of the word unit; The first N words with the highest importance values ​​in the sample are obtained, the first N words are used as target strings that best represent the current sample content, and the target strings are used as load features.

4. The method according to claim 2, characterized in that: The obtaining of first characteristic data of each first network message with the target network device as the receiver includes: Obtaining the total number of first network messages with the target network device as the recipient; Obtaining the total number of bytes of each of the first network messages, and determining the average packet length of the first network messages according to the quotient of the total number of bytes of each of the first network messages and the total number of packets; Obtaining an average window size for receiving data of each of the first network messages, an average survival time of the first network messages in the network, and an average packet sending interval of the first network messages; The total number of packets, the total number of bytes, the average packet length, the average window size, the average survival time, and the average packet sending interval of the first network message are used as the first characteristic data of the first network message.

5. A vulnerability scanning traffic identification method, characterized in that: The method comprises: After starting the VPP framework, a target model is loaded in the VPP framework, wherein the target model is generated according to any one of the methods in claims 1-4; the VPP framework includes a packet capture plug-in and a data packet parsing plug-in; Utilize the packet capture plug-in to capture the current network message, and utilize the data packet parsing plug-in to parse the network message in multi-threaded manner to extract the source IP address of the network message; Classifying the network messages according to the source IP addresses to obtain multiple groups of network messages; For each group of network messages, extract the network flow features and load features of the network messages; the network flow features refer to features that can reflect and characterize the behavior patterns of network messages, and the load features refer to the target character string in the data load that best represents the current load content; The network flow characteristics and the load characteristics are input into the target model, and vulnerability scanning traffic identification processing is performed on the network flow characteristics and the load characteristics to obtain the identification result of the network message.

6. The method according to claim 5, characterized in that The identification result includes scanner traffic and normal traffic. After obtaining the identification result of the network message, the following is also included: If the identification result is scanner traffic, an alarm message is generated, and / or the source IP address corresponding to the scanner traffic is blocked.

7. A model training device, characterized in that: The device comprises: The traffic capture module is used to use multiple vulnerability scanners to scan preset target network devices within a preset scanning time period, and use packet capture software to capture all network messages with the target network device as the destination address within the target time period to obtain the original network traffic; the target time period is a time period within a preset time range centered on the scanning time period; A labeling module, configured to divide the original network traffic into scanning traffic and normal traffic according to the timestamp carried by the original network traffic and the scanning time period, and label the scanning traffic with a corresponding scanner label and label the normal traffic with a normal label; A segmentation module, used to segment the original network traffic according to a preset time interval to obtain a plurality of network traffic samples to form an original sample set; An extraction module, used to extract network flow features and data payload of each sample in the original sample set, and extract a target string that best represents the content of the current sample from the data payload of the sample to obtain a payload feature; The training module is used to iteratively train the preset initial model using the network flow characteristics and the load characteristics of each sample as training data and the scanner label or normal label of the sample as label data until the preset termination condition is met, thereby obtaining a target model for identifying abnormal network traffic.

8. A vulnerability scanning flow identification device, characterized in that: The device comprises: A loading module, used for loading a target model in the VPP framework after starting the VPP framework, wherein the target model is generated according to any one of the methods in claims 1-4; the VPP framework includes a packet capture plug-in and a data packet parsing plug-in; The parsing module is used to capture the current network message by using the packet capture plug-in, and to parse the network message by multi-threading using the data packet parsing plug-in to extract the source IP address of the network message; A classification module, used for classifying the network messages according to the source IP addresses to obtain multiple groups of network messages; An extraction module, for extracting network flow features and load features of each group of network messages; the network flow features refer to features that can reflect and characterize the behavior pattern of the network messages, and the load features refer to target strings in the data payload that best represent the current load content; The identification module is used to input the network flow characteristics and the load characteristics into the target model, perform vulnerability scanning traffic identification processing on the network flow characteristics and the load characteristics, and obtain the identification result of the network message.

9. An electronic device, characterized in that: The electronic device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the model training method as described in any one of claims 1-4, and / or the vulnerability scanning traffic identification method as described in any one of claims 5-6.

10. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set are loaded and executed by the processor to implement the model training method as described in any one of claims 1-4, and / or the vulnerability scanning traffic identification method as described in any one of claims 5-6.

Images