A network attack scenario reconstruction method based on device fingerprint in 5G private network scenario

Abstract

The present invention relates to the technical field of digital information transmission, and in particular to a method for reconstructing a network attack scenario based on device fingerprints in a 5G private network scenario, which includes the following steps: capturing the traffic that triggers the alarm and storing it as a pcap package, generating a list of data packets corresponding to each IP address and traffic; marking the network flow through a five-tuple of <source address, destination address, source port, destination port, timestamp>; extracting the direction and length of the traffic in the network flow as a temporary fingerprint; extracting temporary fingerprints with similar time from a fingerprint database, determining the twin IP, and thus outputting a twin IP list of the attacked IP address; searching for related attack fragments based on the twin IP list, associating multiple attack fragments, and reconstructing the attack scenario. The present invention can associate multiple attack fragments and restore the complete attack scenario without relying on the access rights of the control plane network element, thereby helping analysts to carry out analysis activities such as attack classification and attack prediction.

Description

Technical Field

[0001] The present invention relates to the technical field of digital information transmission, and in particular to a method for reconstructing a network attack scenario based on device fingerprints in a 5G private network scenario. Background Art

[0002] Multi-step attacks, where attackers deploy multiple, interconnected attack steps to achieve their objectives, are typical examples of such attacks. These complex attacks require attack detection systems to correlate multiple, interconnected attack steps and reconstruct attack activity. This helps understand the attack target and process, allowing for the development of targeted defenses. This process is also known as attack scenario reconstruction.

[0003] The security of 5G private networks is crucial to social production. Therefore, in the face of complex attacks, reconstructing attack scenarios is a crucial issue for 5G private network threat detection. 5G private network threat detection typically involves deploying an intrusion detection system (IDS) within the network using a threat detection model. This system detects attack behaviors within mobile network traffic, generates alerts, and sends them to a security incident analysis center. The center aggregates and verifies these alerts, then correlates multiple related alerts to reconstruct the attack scenario, supporting attack type determination and further attack analysis.

[0004] Existing common attack scenario reconstruction technologies generally use IP address-based attack scenario reconstruction technology and IP address and Dynamic Host Configuration Protocol (DHCP) log-based attack scenario reconstruction technology. However, in 5G private networks, network switching can cause IP address changes. Network switching can be triggered by multiple scenarios, such as a mobile device temporarily leaving the network coverage area, a device restart, or switching between Long Term Evolution (LTE) and 5G in a mobile network that does not support the N26 interface (the interface between the AMF (Access and Mobility Management Function) and the Mobility Management Entity (MME)). If the IP address of an infected device changes, security analysts cannot associate the IP address with the infected device, and therefore cannot track the complete attack activity associated with a specific device.

[0005] In 5G private networks, operators can also associate the IP address of the user entity (User Equipment, UE) with the unique identifier of the UE, namely the Subscription Permanent Identity (SUPI) or the Subscription Concealed Identifier (SUCI), by mining the logs of the core network elements. However, considering the construction cost, the 5G private network control plane is a more widely used deployment model. In this type of deployment model, the 5G private network operator does not have sufficient authority to access the logs and API interfaces of the control plane network elements, so the UE identifier is invisible to the 5G private network. Therefore, 5G operators cannot associate the IP address with the unique identifier of the mobile device through log mining.

[0006] In summary, neither of the two methods above can fully reconstruct the attack scenario. This presents two challenges for attack detection. 1) Increased workload. Analysts need to process more attack activity. For analysts, incomplete attack activity often means there may be missed alerts, which requires additional verification. 2) Bias in attack analysis. Since attack analysis typically relies on time-series alert sequences, incomplete sequences can lead to biased analysis results. Summary of the Invention

[0007] In order to solve the association problem caused by the fragmentation of attack activities, the present invention provides a network attack scenario reconstruction method based on device fingerprints in a 5G private network scenario.

[0008] The present invention provides a method for reconstructing network attack scenarios based on device fingerprints in a 5G private network scenario, which adopts the following technical solutions:

[0009] A network attack scenario reconstruction method based on device fingerprint in a 5G private network scenario includes the following steps:

[0010] Capture the traffic that triggers the alarm and store it as pcap packets, generating a list of data packets corresponding to each IP address and traffic;

[0011] The network flow is marked by the five-tuple of <source address, destination address, source port, destination port, timestamp>;

[0012] Extract the direction and length of traffic in the network flow as a temporary fingerprint, and write the temporary fingerprint into the fingerprint database;

[0013] Extract temporary fingerprints with similar time from the fingerprint database, determine the twin IP, and then output the twin IP list of the attacked IP address;

[0014] Based on the twin IP list, find related attack fragments, associate multiple attack fragments, and reconstruct the attack scenario.

[0015] In a specific possible implementation plan, before capturing the traffic that triggers the alarm, the network traffic is obtained through a network intrusion detection device, potential attack behaviors in the network traffic are detected, alarms and monitoring logs are generated, and the alarms and monitoring logs are written into the alarm database;

[0016] Correlate the infected IP with the alert to get the attack snippet.

[0017] In a specific feasible implementation, when extracting the direction and length of traffic in a network flow, for each IP address, the busiest K network flows are screened; and the direction and length of traffic in the K network flows are extracted.

[0018] In a specific implementation scheme, the network characteristics of the flow k of a single network flow are expressed as f k =<±length i >, where k = 1, 2, ..., K, length i It represents the length of the i-th flow in the network flow, and the sign indicates the direction, with communication from UE to dedicated service being positive and communication from dedicated service to user being negative.

[0019] In a specific possible implementation, when extracting the direction and length of traffic in the network flow, the traffic captured in the time window after the rising edge and the traffic captured in the time window before the falling edge are filtered;

[0020] Only the network features of the traffic within the time window after the rising edge and the time window before the falling edge are extracted as the temporary fingerprint of the device.

[0021] In a specific implementation scheme, the timestamp when the IP appears in the network is the rising edge, denoted as t0; the timestamp when the IP disappears is the falling edge, denoted as t m

[0022] After filtering the traffic captured in the time window after the rising edge and the traffic captured in the time window before the falling edge, if the traffic does not belong to these two time windows and the timestamp is earlier than t0 or later than t m , then t0 or t m Updated to the timestamp of the traffic.

[0023] In a specific implementation scheme, before extracting temporary fingerprints with similar time from the fingerprint database, model training is performed:

[0024] Using Triplet network;

[0025] Take the anchor points, positive examples, and negative examples as input samples and embed the input samples into the vector space;

[0026] Calculate the Euler distance between (anchor point, positive example) and (anchor point, negative example), and use the Euler distance as a measure of temporary fingerprint similarity;

[0027] The training goal is to make the distance between the same category as small as possible and the distance between different categories as large as possible.

[0028] In a specific feasible implementation scheme, the output result of the Triplet network is optimized by a loss function L, and the formula of the loss function L is: L=J(F(a, p), 0)+J(F(a, n), 1).

[0029] In a specific implementation scheme, outputting a twin IP list of the attacked IP address includes the following steps:

[0030] According to the current alarm IP address F x , the rising edge timestamp w of the IP address r1 , and the preset time window width q, calculate the start time and end time of the time window under different ranges;

[0031] Find the value of F in each time window x Matching twin IP address F y , if there exists F y , then F y Write into the twin IP list and put F x Updated to F y , put F x Timestamp w r1 Updated to F y Timestamp w r2 , then repeat the above steps to search for twin IP addresses until no twin IP addresses can be found, and write all the found twin IP addresses into the twin IP list;

[0032] If there is no F in the time window y , then extract F x The temporary fingerprint of F x The temporary fingerprint, rising edge timestamp and falling edge timestamp of the fingerprint database are used to extract a group of possible reference IP addresses;

[0033] Calculate the reference IP address F z With F x Similarity, according to the preset similarity threshold, if the comparison IP address F z With F x The similarity is greater than or equal to the similarity threshold, indicating that the control IP address F z Fx The twin IP address is written into the twin IP list, and F x Updated to F z , and put F x Timestamp w r1 Updated to F y Timestamp w r3 , then repeat the similarity calculation process, search for twin IP addresses from the control IP addresses until no twin IP addresses can be found, and write all the found twin IP addresses into the twin IP list.

[0034] In summary, the present invention has the following beneficial effects:

[0035] 1. Accurately identify whether two communicating entities are the same device based on network fingerprints, with low computational and storage overhead, minimal changes to the existing network system, and high versatility.

[0036] 2. It can effectively reduce the impact of IP switching on attack scenario construction by correlating attack events through fingerprints rather than simply performing correlation analysis based on IP addresses. Therefore, while improving analysis accuracy, it greatly reduces the burden on analysts. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a schematic diagram of the attack fragment.

[0038] Figure 2 This is a diagram of the Curiosity attack scenario.

[0039] Figure 3 This is a flowchart of the network attack scenario reconstruction method based on device fingerprint in the 5G private network scenario.

[0040] Figure 4 This is the schematic diagram of temporary fingerprint comparison. DETAILED DESCRIPTION

[0041] The following is combined with Figure 1-4 The present invention is described in further detail.

[0042] Reference Figure 1 and Figure 2 A represents a complete attack activity. If the IP address remains unchanged, analysts can reconstruct the entire attack scenario using attack scenario reconstruction techniques. However, due to the change in the IP address, the entire attack activity is fragmented into three independent segments, A1-A3, known as attack fragments. This can lead to a distorted understanding of the attack activity, causing analysts to mistakenly believe that each attack fragment represents a complete attack activity, when in reality, it is only a partial fragment of an attack activity.

[0043] To further illustrate, let's take the typical Android worm "Curiosity" as an example to explain the principles and impact of attack activity fragmentation.

[0044] The attack process can be summarized into 5 steps:

[0045] Event 1: Victim Bob (10.238.53.59) receives a text message containing a download link for the Curiosity malware.

[0046] Event 2: Out of curiosity, Bob opens the link, and the virus is downloaded from the FTP server (110.232.4.23) and installed on the phone.

[0047] Event 3: The malware continuously sends Bob’s private information to the control server (communication & command, CC) (10.232.4.78), including IMEI, version number, text messages, and contact list.

[0048] Event 4: The CC server sends a command to Bob's phone through Google's Android Cloud to Device Messaging (C2DM) server (7.34.212.5), requesting that Bob's phone send a multicast SMS message. (C2DM is a service that helps developers send data from a server to Android applications.)

[0049] Event 5: Bob sends a group text message containing a download link for the Curiosity malware.

[0050] Assume that a network intrusion detection system (NIDS) can correctly detect all abnormal behaviors. Using traditional attack correlation methods, attack events 2, 3, and 4 can be correlated based on Bob's identical IP address: 10.238.53.59, thereby reconstructing the attack scenario. In wireless networks, many scenarios can cause IP addresses to change, such as getting on or off a highway, a UE losing connection in an elevator, or a user leaving 5G coverage and reconnecting to LTE in a mobile network that doesn't support the N26 interface. Assume that Bob leaves the coverage area and re-enters at time t2. The IP address changes to 10.241.36.7, and the Curiosity malware continues to leak Bob's private information to the C2DM server. At time t3, the IP address changes again to 10.217.65.78, and commands are received through the Google C2DM service.

[0051] Analysts used the same method to reconstruct the attack scenario, from which they obtained the following attack activity information:

[0052] Activity 1: 10.238.53.59 downloaded a malware file and sent the user's private data to the C&C server. However, analysts do not know the complete set of information stolen by the malware and the commands sent by the C&C server to 10.238.53.59.

[0053] Activity 2: 10.241.36.7 sent some private information to the C&C server. However, analysts do not know why it contacted the C&C server or what the next attack action will be.

[0054] Activity 3: 10.217.65.78 communicates with Google C2DM servers. Without context, it is difficult to determine whether this is an attack.

[0055] The IP switching makes it difficult for analysts to understand the relationship between the three activities. The victim IP addresses of the different activities are different, making them appear to be independent attack activities. Therefore, in this example, the fragmentation of attack activities in the 5G private network scenario poses two challenges to attack detection. First, it misleads analysts' understanding of the attack activities, including the cause, intent, and impact. For example, in Activity 1, UE 10.238.53.59 did not receive any control commands, so analysts did not know whether the attack activity had propagation characteristics. In Activity 2, analysts observed a fragmented attack fragment where UE 10.217.65.78 contacted the C&C server without downloading malware. Analysts did not know the UE's next action after receiving the command from the C&C server. Furthermore, the incomplete alarm sequence hinders further attack analysis, such as attack event prediction. For example, it is difficult to accurately predict the next action in Activity 1. Without additional information (such as code analysis), the event prediction lacks evidence. Analysts must expend additional effort to uncover contextual attack information.

[0056] Reference Figure 3 In order to solve the above problems, the present invention discloses a network attack scenario reconstruction method based on device fingerprint in a 5G private network scenario, which includes the following steps:

[0057] S100, obtain network traffic.

[0058] Network intrusion detection devices (such as NIDS) capture network traffic within the 5G private network, detect potential attacks within the traffic, generate alerts and monitoring logs, and write these alerts and monitoring logs to the alert database. Alerts are associated with infected IP addresses to generate attack fragments. Network intrusion detection devices are deployed in a bypass mode within the 5G private network.

[0059] S200, device fingerprint extraction.

[0060] Capture the traffic that triggers the alarm and store it as a pcap packet. Parse the pcap packet to generate a list of packets corresponding to each IP address and traffic flow. Based on the generated packet list, identify the network flow using a five-tuple consisting of <source address, destination address, source port, destination port, and timestamp>.

[0061] For each IP address, we prioritize the K busiest network flows and the communication sessions to which these K network flows belong, meaning that most of the traffic is in this communication session. Busiest means that this communication session has the most traffic. The traffic in these network flows indicates the applications running on the device and represents the temporary fingerprint of the device. By extracting the direction and length of the traffic in these K network flows as the network features of the network flows, we can obtain the temporary fingerprint of the device. The network feature of the traffic k of a single network flow is expressed as f k =<±length i >, where k = 1, 2, ..., K, length i represents the length of the i-th flow in the network flow, and the sign represents the direction, with communication from UE to dedicated service being positive and communication from dedicated service to user being negative. For each IP address, the flow feature is the set of network features of all network flows under the IP address, which can be expressed as: T = {f1, f2, ..., f K}.

[0062] Since a communication session may contain a large amount of traffic, this will bring storage and computational overhead and introduce additional noise to fingerprint extraction. Therefore, a sampling mechanism is adopted to reduce the scale of features. Specifically:

[0063] The timestamp when the IP appears in the network is defined as the rising edge, denoted as t0; the timestamp when the IP disappears is defined as the falling edge, denoted as t m .

[0064] Filter the traffic captured in the time window after the rising edge, denoted as: w r =[t0, t0+δ], δ is the observation time window; the flow captured in the time window before the falling edge is recorded as: W d =[t m -δ,t m ]; extract only w r and w d The network features of the traffic within the two windows are used as the temporary fingerprint F of the device. That is, for the traffic arriving in the network flow, the five-tuple in the traffic is extracted and it is determined whether it belongs to w r and w d If the traffic does not belong to the two windows, it is directly released. Furthermore, if the timestamp of the traffic is earlier than t0 or later than t m, then t0 or t m Update to the timestamp of the traffic; if it belongs to w r or w d Window, the temporary fingerprint F of the device is updated. Furthermore, a time threshold is set. If the idle time of the current IP address exceeds the time threshold, it means that the temporary fingerprint F of the IP address is extracted. Then, the temporary fingerprint F of the IP address is written into the fingerprint database.

[0065] Combine Figure 4 ,S300, extracts temporary fingerprints with similar time from the fingerprint database, determines the twin IP, and outputs the twin IP list of the attacked IP address.

[0066] The Triplet network is used to find paired IP addresses. The Triplet network is a distance metric learning method for scenarios with a small number of samples. During the offline model training phase, three samples (anchor, positive example, and negative example) are received as input samples and embedded into a vector space. The distance between (anchor, positive example) and (anchor, negative example) is used to determine whether the input samples belong to the same type. Using the Euler distance l as a measure of temporary fingerprint similarity, the calculation formula is: in, represents the jth feature of sample a, Represents the j-th feature of sample b, j = 1, 2, ..., n.

[0067] Three convolutional neural networks are used as embedding layers to extract features from the three samples. Each convolutional neural network corresponds to one sample, meaning one convolutional neural network is used to extract features from each sample. The convolutional neural network consists of convolutional layers, pooling layers, and fully connected layers, and the three convolutional neural networks share network parameters.

[0068] K*100 temporary fingerprints are mapped into a two-dimensional space. Through the neural network embedding process, three low-dimensional vectors are obtained. The Euler distance between the low-dimensional vectors is calculated, and the similarity between the samples is measured using the Euler distance. Furthermore, since identifying paired IP addresses is a binary classification problem, the activation function tanh() is used to scale the Euler distance to the interval [0, 1]. The calculation result of the activation function tanh() is then binary processed. That is, if the calculation result of the activation function tanh() is less than 0.5, the output is 0; if the calculation result of the activation function tanh() is greater than or equal to 0.5, the output is 1. When the output result is 0, it indicates that the two temporary fingerprints identify the same device. When the output result is 1, it indicates that the two temporary fingerprints identify different devices.

[0069] The goal of training is to minimize the Euler distance between classes within the same category and maximize the Euler distance between classes of different categories. Therefore, the output is optimized using a loss function, L. The formula for the loss function L is: L = j(F(a, p), 0) + j(F(a, n), 1), where F(·, ·) represents the Triplet network, F(a, p) represents the Euler distance between the anchor point sample a and the positive sample p in the Triplet network, F(a, n) represents the Euler distance between the anchor point sample a and the negative sample n in the Triplet network, and j(·, ·) represents the cross-entropy loss function.

[0070] The generation process of the twin IP list is as follows: Based on the IP address F of the current alarm x , the rising edge timestamp w of the IP address r1 , and the preset time window width q, calculate the start time and end time of the time window under different ranges. In each time window, directly find the time window with F x Matching twin IP address F y , if there exists F y , then F y Write into the twin IP list and put F x Updated to F y , and put F x Timestamp w r1 Updated to F y Timestamp w r2 , then repeat the above steps to search for twin IP addresses until no twin IP addresses can be found, and write all the found twin IP addresses into the twin IP list.

[0071] If there is no F in the time window y , then extract F x The temporary fingerprint of F x The temporary fingerprint, rising edge timestamp and falling edge timestamp of the fingerprint database are used to extract a set of possible reference IP addresses. The reference IP address F is calculated through the Triplet network. z With F x Similarity, according to the preset similarity threshold, if the comparison IP address F z With F x The similarity is greater than or equal to the similarity threshold, indicating that the control IP address F z F x The twin IP address is written into the twin IP list, and F x Updated to F z , and put F x Timestamp w r1 Updated to F y Timestamp w r3, then repeat the similarity calculation process, search for twin IP addresses from the control IP addresses until no twin IP addresses can be found, and write all the found twin IP addresses into the twin IP list.

[0072] S400, reconstruct the attack scenario.

[0073] For the first appearance of a victim or attacker IP, a temporary fingerprint is compared and queried based on the IP address and timestamp. If a list of twin IPs is obtained, the attack fragments associated with the twin IPs are iteratively searched and a connection is established between the two attack fragments. This method can be used to associate multiple attack fragments caused by IP address switching, thereby reconstructing the attack scenario.

[0074] The above are all preferred embodiments of the present invention, and are not intended to limit the scope of protection of the present invention. Therefore, any equivalent changes made based on the structure, shape, and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network attack scenario reconstruction method based on device fingerprint in a 5G private network scenario, characterized by: The steps include: Capture the traffic that triggers the alarm and store it as pcap packets, generating a list of data packets corresponding to each IP address and traffic; The network flow is marked by the five-tuple of <source address, destination address, source port, destination port, timestamp>; Extract the direction and length of traffic in the network flow as a temporary fingerprint, and write the temporary fingerprint into the fingerprint database; Extract temporary fingerprints with similar time from the fingerprint database, determine the twin IP, and then output the twin IP list of the attacked IP address; Based on the twin IP list, find related attack fragments, associate multiple attack fragments, and reconstruct the attack scenario; Among them, when extracting the direction and length of traffic in the network flow, for each IP address, filter the busiest A network stream; extract the The direction and length of traffic in a network flow; when extracting the direction and length of traffic in a network flow, filter the traffic captured in the time window after the rising edge and the traffic captured in the time window before the falling edge; Only the network features of the traffic within the time window after the rising edge and the time window before the falling edge are extracted as the temporary fingerprint of the device.

2. The network attack scenario reconstruction method based on device fingerprint in the 5G private network scenario according to claim 1 is characterized by: Before capturing traffic that triggers an alarm, the system obtains network traffic through network intrusion detection devices, detects potential attack behaviors in the network traffic, generates alarms and monitoring logs, and writes the alarms and monitoring logs to the alarm database; Correlate the infected IP with the alert to get the attack snippet.

3. The method for reconstructing network attack scenarios based on device fingerprints in a 5G private network scenario according to claim 1 is characterized by: Traffic volume of a single network flow The network characteristics are expressed as ,in , Indicates the first The length of the traffic flow, the sign indicates the direction, the communication from the UE to the dedicated service is positive, and the communication from the dedicated service to the user is negative.

4. The method for reconstructing network attack scenarios based on device fingerprints in a 5G private network scenario according to claim 1 is characterized by: The timestamp when the IP appears on the network is the rising edge, which is expressed as ; The timestamp when the IP disappears is the falling edge, expressed as After filtering the traffic captured in the time window after the rising edge and the traffic captured in the time window before the falling edge, if the traffic does not belong to these two time windows and the timestamp is earlier than or later than , then or Updated to the timestamp of the traffic.

5. The method for reconstructing network attack scenarios based on device fingerprints in a 5G private network scenario according to claim 1 is characterized by: Before extracting temporary fingerprints with similar time from the fingerprint database, perform model training: Using Triplet network; Take the anchor points, positive examples, and negative examples as input samples and embed the input samples into the vector space; Calculate the Euler distance between (anchor point, positive example) and (anchor point, negative example), and use the Euler distance as a measure of temporary fingerprint similarity; The training goal is to make the distance between the same category as small as possible and the distance between different categories as large as possible.

6. The method for reconstructing network attack scenarios based on device fingerprints in a 5G private network scenario according to claim 5 is characterized by: The output of the Triplet network is optimized by the loss function L. The formula of the loss function L is: L=J(F(a,p),0)+J(F(a,n),1), where F(·,·) represents the Triplet network, F(a,p) represents the Euler distance between the anchor sample a and the positive sample p in the Triplet network; F(a,n) represents the Euler distance between the anchor sample a and the negative sample n in the Triplet network; and J(·,·) represents the cross-entropy loss function.

7. The method for reconstructing network attack scenarios based on device fingerprints in a 5G private network scenario according to claim 1 is characterized by: Outputting a list of twin IP addresses of the attacked IP address includes the following steps: Based on the IP address of the current alarm , the rising edge timestamp of the IP address , and the preset time window width , calculate the start and end time of time windows under different ranges; In each time window, find Matching twin IP addresses , if exists , then Write into the twin IP list and Updated to ,Bundle Timestamp Updated to Timestamp , then repeat the above steps to search for twin IP addresses until no twin IP addresses can be found, and write all the found twin IP addresses into the twin IP list; If it does not exist in the time window , then extract Temporary fingerprint, according to The temporary fingerprint, rising edge timestamp and falling edge timestamp of the fingerprint database are used to extract a set of control IP addresses; Calculate the reference IP address and Similarity, according to the preset similarity threshold, if the comparison IP address and The similarity is greater than or equal to the similarity threshold, indicating that the control IP address for The twin IP address is written into the twin IP list, and Updated to , and put Timestamp Updated to Timestamp , then repeat the similarity calculation process, search for twin IP addresses from the control IP addresses until no twin IP addresses can be found, and write all the found twin IP addresses into the twin IP list.

Images