Encrypted communication threat real-time sensing and authentication traceability method and system

Abstract

The invention discloses an encrypted communication threat real-time sensing and authentication traceability method and system, and relates to the technical field of communication threat sensing, and the method comprises the steps: collecting and analyzing malicious encrypted traffic behavior characteristics; threat events are analyzed based on the semantic analysis ability, and the homology of threat multi-source multi-dimensional intelligence data is analyzed; and testing the advanced threat dynamic defense capability based on mimicry defense, and displaying a threat linkage disposal and attack link diagram of malicious encrypted traffic. According to the encryption communication threat real-time perception and authentication traceability method provided by the invention, encryption hidden traffic is comprehensively identified, monitored, detected and analyzed through threat event analysis based on semantic analysis capability, the capability of coping with advanced threat means is enhanced, threat multi-source and multi-dimensional intelligence data homology analysis is carried out, and the intelligence fineness and effectiveness are improved. The method has better effects in the aspects of applicability, accuracy and effectiveness.

Description

Technical Field

[0001] The present invention relates to the field of communication threat perception technology, and in particular to a method and system for real-time perception and authentication tracing of encrypted communication threats. Background Art

[0002] At present, the hidden malicious attack behaviors and attack payloads in encrypted traffic are the key research directions of the industry and academia. Cryptographic analysis of encrypted traffic or traffic identification and detection based on intelligent analysis features, combined with technical analysis of threat intelligence, can greatly improve the feasibility of malicious traffic detection and provide good application scenarios, which helps to clearly grasp the stage of the attack chain and the probability of successful tracing. At present, China Southern Power Grid still has problems such as difficulty in malicious traffic analysis and identification, asynchronous tracking and tracing countermeasure technology, and low degree of integration with threat intelligence for encrypted traffic and tracking and tracing countermeasure technology.

[0003] The key to threat detection and response based on attack traces is the depth and breadth of data collection. The relevant technologies are currently relatively mature in the field of digital forensics applications at home and abroad, and have been widely used in judicial evidence collection. Research on new and unknown threat protection technologies at home and abroad mainly focuses on identifying attacks and responses based on signature features and behavior detection models, and combines the ATT&CK framework to annotate attack stages and technologies, providing a better solution for real-time protection against advanced threats. However, there are few studies on detection of attack traces residing in the host. The difficulty in this field is that researchers need to have a deeper understanding of advanced threat attack methods and the principles of operation of different systems, and further explore the principles and methods of effectively identifying attack traces from the attacker's perspective. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is that the existing real-time perception method of encrypted communication threats lacks the problem of advanced threat techniques and how to adapt to different systems.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: a method for real-time perception and authentication tracing of encrypted communication threats, including collecting and parsing malicious encrypted traffic behavior characteristics; analyzing threat events based on semantic analysis capabilities, and analyzing the homology of threat multi-source and multi-dimensional intelligence data; and testing the advanced threat dynamic defense capability based on mimicry defense, showing the threat linkage disposal and attack chain diagram of malicious encrypted traffic.

[0007] As a preferred solution of the method for real-time perception and authentication tracing of encrypted communication threats described in the present invention, wherein: the collection and analysis of malicious encrypted traffic behavior characteristics are included in the existing encrypted traffic identification model, and the malicious encrypted traffic behavior characteristic model is experimentally tested using a machine learning algorithm model. According to the test results, the malicious encrypted traffic behavior characteristic model is experimentally tuned and trained.

[0008] As a preferred solution of the method for real-time perception and authentication tracing of encrypted communication threats described in the present invention, the threat event analysis based on semantic analysis capability includes extracting and analyzing encrypted traffic behavior characteristics, combining intelligent semantic analysis technology to perform threat analysis and detection.

[0009] As a preferred solution of the method for real-time perception and authentication tracing of encrypted communication threats described in the present invention, the analysis of the homology of multi-source and multi-dimensional intelligence data of threats includes data processing and intelligence mining testing of multi-source and multi-dimensional intelligence data sources, including data integration, data standardization, data conversion and integration, and data correlation analysis, and deep information mining of multi-dimensional intelligence.

[0010] As a preferred solution of the method for real-time perception and authentication tracing of encrypted communication threats described in the present invention, the advanced threat dynamic defense capability test based on mimicry defense includes optimizing the mimicry protection capability for business scenarios, including web traffic identification and analysis, and network threat encrypted malicious traffic extraction and pre-processing.

[0011] As a preferred solution of the method for real-time perception and authentication tracing of encrypted communication threats described in the present invention, the threat linkage disposal and attack link diagram of malicious encrypted traffic is displayed, including testing the threat linkage disposal of encrypted traffic, including identification, aggregation analysis, extraction, data cutting, threat identification model training, threat behavior perception, and automatic tracking and tracing of encrypted traffic, and threat disposal is performed on the orchestrated traffic gateway through policy issuance.

[0012] As a preferred solution of the method for real-time perception and authentication tracing of encrypted communication threats described in the present invention, the threat linkage disposal and attack link diagram displaying malicious encrypted traffic also includes forming a graphical and visual malicious encrypted traffic attack portrait.

[0013] Another object of the present invention is to provide a real-time perception and authentication tracing system for encrypted communication threats, which can comprehensively identify, monitor, detect and analyze encrypted covert traffic through threat event analysis based on semantic analysis capabilities, thereby solving the problem that the current real-time perception technology for encrypted communication threats lacks the means to deal with advanced threats.

[0014] As a preferred solution of the encrypted communication threat real-time perception and authentication tracing system described in the present invention, it includes: a feature collection module, an analysis module, and a linkage disposal module; the feature collection module is used to collect and parse the behavior characteristics of malicious encrypted traffic; the analysis module is used to analyze threat events based on semantic analysis capabilities, and analyze the homology of threat multi-source and multi-dimensional intelligence data; the linkage disposal module is used to test the advanced threat dynamic defense capability based on mimicry defense, and display the threat linkage disposal and attack link diagram of malicious encrypted traffic.

[0015] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement a method for real-time perception and authentication tracing of encrypted communication threats.

[0016] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a method for real-time perception and authentication tracing of encrypted communication threats.

[0017] Beneficial effects of the present invention: The encrypted communication threat real-time perception and authentication tracing method provided by the present invention can comprehensively identify, monitor, detect and analyze encrypted hidden traffic through threat event analysis based on semantic analysis capability, enhance the ability to respond to advanced threat means, conduct homology analysis of threat multi-source and multi-dimensional intelligence data, and improve the precision and effectiveness of intelligence. The present invention has achieved better results in terms of applicability, accuracy and effectiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0019] Figure 1 An overall flow chart of a method for real-time perception and authentication tracing of encrypted communication threats provided in the first embodiment of the present invention.

[0020] Figure 2 A schematic diagram of encrypted traffic decryption of a method for real-time perception and authentication tracing of encrypted communication threats provided in a second embodiment of the present invention.

[0021] Figure 3 A schematic diagram of AILab data collection for a method for real-time perception and authentication tracing of encrypted communication threats provided in the second embodiment of the present invention.

[0022] Figure 4A multi-source threat intelligence analysis diagram of a method for real-time perception and authentication tracing of encrypted communication threats provided in the second embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0024] Example 1, reference Figure 1-Figure 4 , is an embodiment of the present invention, and provides a method for real-time perception and authentication tracing of encrypted communication threats, including:

[0025] S1: Collect and analyze malicious encrypted traffic behavior characteristics.

[0026] Furthermore, collecting and parsing malicious encrypted traffic behavior characteristics is included in the existing encrypted traffic identification model, and the malicious encrypted traffic behavior characteristic model is tested using a machine learning algorithm model. According to the test results, the malicious encrypted traffic behavior characteristic model is experimentally tuned and trained.

[0027] It should be noted that encrypted data packets are extracted from network traffic, and redundant and noisy information is removed to make the data format unified and meet the input requirements of the machine learning model.

[0028] Extract the behavioral characteristics of encrypted traffic, including data packet size, traffic direction, transmission rate, packet interval, encryption protocol type, etc. Mark the characteristics that may be exhibited by malicious behavior (such as abnormal transmission rate, abnormal data packet size).

[0029] Use labeled datasets to train machine learning models and test their accuracy in identifying malicious encrypted traffic features. Commonly used models include decision trees, random forests, support vector machines, and deep learning.

[0030] Based on the test results, the model parameters are optimized and continuously tuned to improve the recognition rate and accuracy of malicious encrypted traffic. Tuning methods may include adjusting hyperparameters, adjusting feature weights, etc.

[0031] S2: Analyze threat events based on semantic analysis capabilities, and analyze the homology of multi-source and multi-dimensional threat intelligence data.

[0032] Furthermore, threat event analysis based on semantic analysis capabilities includes extracting and analyzing encrypted traffic behavior characteristics, combined with intelligent semantic analysis technology, to conduct threat analysis and detection.

[0033] It should be noted that by analyzing the behavioral characteristics of encrypted traffic, keywords or key content of potential threat behaviors, such as access frequency, target address, abnormal instructions, etc., are extracted. A model based on natural language processing (NLP) or intelligent semantic analysis is established and trained through big data to enable it to understand potential malicious behaviors in encrypted traffic. The extracted semantic features are matched with known threat behavior patterns to determine whether there are abnormal behaviors in the encrypted traffic. Pattern matching can be based on similarity calculation or rule matching algorithm. Once semantic features that match malicious behavior are detected, the system automatically marks the traffic and generates warning information to remind security managers to conduct further analysis.

[0034] It should also be noted that the analysis of the homology of threat multi-source and multi-dimensional intelligence data includes data processing and intelligence mining tests on multi-source and multi-dimensional intelligence data sources, including data integration, data standardization, data conversion and integration, and data correlation analysis, and deep information mining of multi-dimensional intelligence. Collect multi-source data from different sources (such as network logs, attack IP address libraries, and known malware information libraries). Clean the data from different data sources to remove redundant or inconsistent content, and unify the data format for subsequent processing. Integrate the cleaned multi-source data to identify the correlation between the data, such as whether the same IP address appears in multiple attack events, or whether the same domain name is associated with malicious traffic multiple times. Use data mining technology to analyze multi-dimensional intelligence and discover potential attack patterns and similarities. For example, find similar attack paths through cluster analysis or mine the intrinsic connections between different attack behaviors through association rule analysis.

[0035] S3: Advanced threat dynamic defense capability test based on mimicry defense, showing the threat linkage disposal and attack chain diagram of malicious encrypted traffic.

[0036] Furthermore, the advanced threat dynamic defense capability test based on mimetic defense includes optimization tests of mimetic protection capabilities for business scenarios, including web traffic identification and analysis, network threat encryption, malicious traffic extraction and pre-processing. Develop mimetic defense strategies based on business scenario requirements, such as disguising malicious traffic as normal business traffic, or simulating real business access. Perform identification and isolation tests for known malicious traffic types. Identify malicious behavior in Web traffic and identify suspicious traffic through pattern matching or anomaly detection. Pre-process malicious traffic, such as extracting key fields and parsing traffic content of specific protocols to ensure more accurate identification of malicious behavior in defense strategies. Adjust the mimetic defense strategy based on the test results to enhance the defense system's anti-interference and camouflage identification capabilities for malicious traffic.

[0037] It should be noted that the display of threat linkage disposal and attack chain diagram of malicious encrypted traffic includes testing the threat linkage disposal of encrypted traffic, including identification, aggregation analysis, extraction, data cutting, threat identification model training, threat behavior perception, automatic tracking and tracing of encrypted traffic, and threat disposal of orchestrated traffic gateway through policy delivery. When malicious traffic is detected, the linkage disposal mechanism is started to identify, aggregate and analyze the traffic, and divide it into multiple threat event modules, such as traffic identification, behavior analysis, data extraction, etc. An attack chain diagram is generated based on the threat event module to visualize each step of the attack process from the beginning to the end. Based on the extracted threat behavior, the threat identification model is trained to enhance the system's defense capabilities against future attacks. Using the policy delivery mechanism, the automated disposal of attacks is achieved by controlling the traffic gateway, blocking the malicious traffic path and blocking the attack behavior.

[0038] It should also be noted that displaying the threat linkage disposal and attack link diagram of malicious encrypted traffic also includes forming a graphical and visual malicious encrypted traffic attack portrait. Generate a visual portrait containing information such as attack path, threat type, and attack target, so that analysts can quickly understand the full picture of the attack. Present each link of the attack event in a graphical way, analyze the attack path in a situational manner, and clarify the role and connection of each attack behavior. Compare the portraits of different attacks to establish a more comprehensive threat perception system to ensure that similar attacks can be quickly discovered and responded to. Through graphical display, provide more guiding decision support for the security team to help them formulate targeted defense strategies.

[0039] Example 2, an embodiment of the present invention, provides a method for real-time perception and authentication tracing of encrypted communication threats. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0040] First, based on the encrypted network traffic in different business scenarios, the experiment identified, analyzed, traced the malicious encrypted traffic and implemented dynamic defense, thereby verifying the effectiveness of the method of the present invention in encryption threat identification, semantic analysis, multi-source intelligence data integration and mimicry defense.

[0041] Establish an experimental environment, set up infrastructure including network traffic gateway, data packet analysis tools, threat modeling analysis system and mimic defense system, and deploy a standard encrypted traffic identification model as a comparative reference. The selected test data includes normal encrypted traffic (traffic A) generated by actual business and simulated malicious encrypted traffic (traffic B and traffic C), where traffic B is a common malicious traffic behavior pattern and traffic C is a complex multi-segment chain attack pattern. The packet size, transmission rate, destination address and behavior characteristics of each type of traffic are mixed tested to ensure the integrity and authenticity of the test coverage.

[0042] Table 1 Experimental data comparison table

[0043]

[0044]

[0045] By analyzing the experimental data in Table 1, it can be clearly seen that the encrypted communication threat perception and tracing method of the present invention has significant advantages in detecting, handling and defending against encrypted malicious traffic. In the tests of traffic B (conventional malicious) and traffic C (chain attack), the false alarm rate of the encrypted traffic identification model designed by the present invention is significantly lower than that of the traditional model, reaching between 0.4% and 0.8%, indicating that the system has a high recognition accuracy between normal business and malicious traffic. In addition, the model false alarm rate is controlled below 2.5%, which is significantly better than the traditional method, and can more effectively detect malicious behavior and reduce the risk of missed detection.

[0046] In the threat event analysis based on semantic analysis, the system can detect more threat behavior characteristics and improve the comprehensiveness of attack link analysis by deeply mining the behavior characteristics and homology data sources of flows B and C. For example, the number of behavior characteristics and homology matches of flow C are significantly higher than those of flow B, reaching 30 and 20 respectively, which shows that the system can extract more attack characteristics when dealing with complex attack chain structures, thereby enhancing the ability to trace chain attacks.

[0047] The experimental results also show that the mimicry defense technology in the present invention has a high defense success rate when dealing with malicious encrypted traffic, with a success rate between 88% and 94%. By disguising Web traffic and issuing automated policies, it is difficult for malicious attacks to identify normal traffic characteristics, further improving the defense effect. At the same time, the average response time in the experiment was maintained at around 100ms, proving that the system's real-time response capability meets business needs and can complete dynamic linkage disposal of malicious traffic with rapid response.

[0048] Embodiment 3, an embodiment of the present invention, provides a real-time perception and authentication tracing system for encrypted communication threats, including a feature collection module, an analysis module, and a linkage disposal module.

[0049] Among them, the feature collection module is used to collect and parse the behavioral characteristics of malicious encrypted traffic; the analysis module is used to analyze threat events based on semantic analysis capabilities, and analyze the homology of multi-source and multi-dimensional threat intelligence data; the linkage disposal module is used to test the dynamic defense capabilities of advanced threats based on mimicry defense, and display the threat linkage disposal and attack link diagram of malicious encrypted traffic.

[0050] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0051] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0052] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0053] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc. It should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limited. Although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

[0054] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for real-time perception and authentication tracing of encrypted communication threats, characterized in that: include: Collect and analyze malicious encrypted traffic behavior characteristics; Analyze threat events based on semantic analysis capabilities, and analyze the homology of threat multi-source and multi-dimensional intelligence data; Advanced threat dynamic defense capability test based on mimicry defense, showing the threat linkage disposal and attack chain diagram of malicious encrypted traffic.

2. The method for real-time perception and authentication tracing of encrypted communication threats according to claim 1, characterized in that: The collecting and parsing of malicious encrypted traffic behavior characteristics includes using a machine learning algorithm model in an existing encrypted traffic identification model to test the malicious encrypted traffic behavior characteristic model, and experimentally tuning and training the malicious encrypted traffic behavior characteristic model based on the test results.

3. The method for real-time perception and authentication tracing of encrypted communication threats according to claim 2, characterized in that: The threat event analysis based on semantic analysis capability includes extracting and analyzing encrypted traffic behavior characteristics, combining intelligent semantic analysis technology, and performing threat analysis and detection.

4. The method for real-time perception and authentication tracing of encrypted communication threats according to claim 3, characterized in that: The analysis of threat multi-source and multi-dimensional intelligence data homology includes data processing and intelligence mining testing of multi-source and multi-dimensional intelligence data sources, including data integration, data standardization, data conversion and integration, and data correlation analysis, and deep information mining of multi-dimensional intelligence.

5. The method for real-time perception and authentication tracing of encrypted communication threats according to claim 4, characterized in that: The advanced threat dynamic defense capability test based on mimicry defense includes optimization tests of mimicry protection capabilities for business scenarios, including web traffic identification and analysis, network threat encryption, and malicious traffic extraction pre-processing.

6. The method for real-time perception and authentication tracing of encrypted communication threats according to claim 5, characterized in that: The display of threat linkage disposal and attack link diagram of malicious encrypted traffic includes testing threat linkage disposal of encrypted traffic, including identification, aggregation analysis, extraction, data cutting, threat identification model training, threat behavior perception, and automatic tracking and tracing of encrypted traffic, and threat disposal of orchestrated traffic gateways through policy issuance.

7. The method for real-time perception and authentication tracing of encrypted communication threats according to claim 6, characterized in that: The threat linkage disposal and attack link diagram displaying malicious encrypted traffic also includes forming a graphical and visual malicious encrypted traffic attack portrait.

8. A system using the method for real-time perception and authentication tracing of encrypted communication threats as claimed in any one of claims 1 to 7, characterized in that: It includes feature collection module, analysis module and linkage disposal module; The feature collection module is used to collect and analyze malicious encrypted traffic behavior features; The analysis module is used to analyze threat events based on semantic analysis capabilities and analyze the homology of threat multi-source and multi-dimensional intelligence data; The linkage handling module is used to test the dynamic defense capability of advanced threats based on mimicry defense, and displays the threat linkage handling and attack link diagram of malicious encrypted traffic.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for real-time perception and authentication tracing of encrypted communication threats described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for real-time perception and authentication tracing of encrypted communication threats described in any one of claims 1 to 7 are implemented.

Images