IPSecVPN encrypted traffic security detection method based on FPGA

Abstract

The invention provides an IPSecVPN encrypted traffic security detection method based on an FPGA, and the method comprises the following steps: S1, hardware analysis, S2, model construction, S3, rule updating, S4, intelligent recognition, S5, hardware acceleration, S6, dynamic encryption, and S7, joint defense and joint control. Through combined training of supervised learning, unsupervised learning and semi-supervised learning, the connection Camp can be identified; the C server hides malicious scenes such as heartbeat packets and host networking environment anomalies, can also dynamically trigger strategies according to attack types, and meanwhile utilizes a special hardware assembly line in FPGA hardware to map CNN reasoning layer convolution kernel calculation into a parallel logic unit, after acceleration, rule matching engine SPI blacklist retrieval delay is shortened, packet length distribution histogram generation speed is increased, and data transmission efficiency is improved. Threat score calculation and flow feature extraction are synchronized.

Description

Technical Field

[0001] The invention belongs to the field of traffic security detection, and in particular to an FPGA-based IPSecVPN encrypted traffic security detection method. Background Art

[0002] Encrypted traffic security detection is a crucial technology for ensuring network security, used to identify malicious activity within encrypted traffic. Traditional detection methods have significant shortcomings. They often require converting non-numeric data into numerical data, which not only increases model storage space but also easily leads to information loss. Furthermore, the limited detection features make it difficult to fully describe the complex characteristics of malicious encrypted traffic, resulting in reduced detection accuracy and efficiency.

[0003] Publication number CN110598774B, this encrypted traffic detection method and device, computer-readable storage medium, and electronic device use an algorithm that can directly identify and process numerical and non-numerical data to construct an encrypted traffic detection model, avoiding the conversion of non-numerical data to numerical data, reducing the model storage space occupancy, and at the same time extracting non-numerical feature data to construct a relatively complete detection feature, which can more comprehensively describe malicious encrypted traffic and improve detection accuracy.

[0004] However, it does not utilize a multimodal convolutional neural network model for joint training of supervised learning, unsupervised learning, and semi-supervised learning. It is not capable of identifying complex malicious scenarios, nor can it dynamically trigger differentiated protection strategies based on attack types, making it difficult to cope with complex and changing network security challenges. Summary of the Invention

[0005] In order to solve the above technical problems, the present invention provides an FPGA-based IPSecVPN encrypted traffic security detection method for solving the problems raised in the background technology.

[0006] An FPGA-based IPSecVPN encrypted traffic security detection method includes the following steps: Hardware parsing S1: The FPGA hardware can parse the IPSec protocol header field, and the FPGA hardware can extract corresponding feature parameters as metadata; Model building S2: The metadata extracted by the FPGA hardware is used to build a traffic behavior model, and the traffic behavior model can be used to execute corresponding measures in parallel through a multi-dimensional threat analysis engine to identify threats in encrypted traffic; Rule update S3: A dynamic interface module is provided at the interface of the FPGA hardware. The dynamic interface module can load the threat signature library and update the rule matching engine in real time to adapt to new attack patterns. Intelligent Identification S4: The metadata, traffic timing characteristics, and packet length distribution can be input into a multimodal convolutional neural network model. This multimodal convolutional neural network model can be trained through a combination of supervised, unsupervised, and semi-supervised learning to identify malicious scenarios. Hardware acceleration S5: The FPGA hardware is internally provided with a dedicated hardware pipeline that can map the convolution kernel calculation of the CNN inference layer into parallel logic units; Dynamic encryption S6: When malicious traffic is detected, the PSec gateway can establish multiple independent encrypted tunnels or matrix channels within 100ms, and each tunnel can be assigned a different SPI and encryption algorithm; Joint Defense and Control S7: The detected attack traffic can be stored outside the FPGA hardware and cached. At the same time, a malicious traffic pool is built according to the type, protocol characteristics and timestamp of the attack traffic. The generative adversarial network can simulate new attack traffic from the traffic pool, and the generative adversarial network can also deploy traffic features to edge monitoring points through transfer learning.

[0007] Preferably, the metadata in step S1 may include security parameter index, sequence number, protocol type and traffic timing characteristics.

[0008] Preferably, the corresponding means in step S2 include rule matching, statistical learning and anomaly scoring.

[0009] Preferably, the characteristic parameters in the matching engine in step S3 are the SPI blacklist, the packet length threshold and the anomaly score.

[0010] Preferably, the malicious scenarios in step S4 include hidden heartbeat packets connecting to the C&C server, abnormal host networking environment, mother program communication disguise, hidden relay of white sites, and worm propagation communication. At the same time, differentiated protection strategies can be dynamically triggered according to the attack type. The protection strategies include C&C communication to blocking SPI and isolating the host, hidden relay to redirecting traffic to the sandbox, and worm propagation to enabling traffic cleaning and session rate limiting.

[0011] Preferably, the FPGA hardware acceleration in step S5 can reduce the SPI blacklist retrieval delay of the rule matching engine to ≤10μs, increase the packet length distribution histogram generation speed by 20 times, and synchronize threat score calculation and traffic feature extraction. When the FPGA hardware acceleration is achieved, the detection path can be dynamically reconfigured according to the threat type, and the logic unit can be optimized through the hardware description language to generate the shortest detection link. Preferably, the generative adversarial network in step S5 can enhance the robustness of the CNN model; Preferably, the closed-loop protection means implemented in step S5 may include updating the SPI blacklist on the firewall, loading new attack features on the IDS, and implementing micro-isolation strategies on the terminal; Preferably, the terminal implements a micro-isolation strategy to restrict IP access bound to high-risk SPIs.

[0012] Compared with the prior art, the present invention has the following beneficial effects: 1. During use, the present invention utilizes a multimodal convolutional neural network model to input metadata, traffic timing characteristics, and packet length distribution. Through joint training using supervised, unsupervised, and semi-supervised learning, it can identify malicious scenarios such as hidden heartbeat packets connecting to the C&C server and abnormal host networking environments. It can also dynamically trigger strategies based on the type of attack, such as blocking the C&C communication SPI and isolating the host, redirecting hidden transit traffic to a sandbox, and enabling traffic cleaning and session rate limiting for worm propagation, thereby achieving accurate identification and protection.

[0013] 2. During use, the present invention utilizes a dedicated hardware pipeline within the FPGA hardware to map the CNN inference layer convolution kernel calculation to a parallel logic unit. After acceleration, the rule matching engine SPI blacklist retrieval delay is shortened, the packet length distribution histogram generation speed is increased, the threat score calculation is synchronized with the traffic feature extraction, the detection path can be dynamically reconstructed according to the threat type, and the hardware description language is used to optimize the logic unit to generate the shortest detection link, thereby improving detection efficiency and system performance.

[0014] 3. When malicious traffic is detected during use, the present invention establishes multiple independent encrypted tunnels or matrix channels, each tunnel is assigned a different SPI and encryption algorithm, and the malicious traffic is dynamically encrypted. Different tunnels use different encryption configurations to increase encryption complexity and security, prevent malicious traffic from being leaked or cracked, and ensure the security of data transmission.

[0015] 4. When the present invention is in use, the detected attack traffic is stored outside the FPGA hardware and cached, a malicious traffic pool is constructed according to type, protocol characteristics and timestamp, new attack traffic is simulated from the pool based on the generative adversarial network, and the traffic characteristics are deployed to the edge monitoring point through transfer learning to realize attack traffic storage analysis and new attack simulation. The edge monitoring point obtains characteristics to improve monitoring capabilities and enhance the effectiveness of the overall security protection system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a schematic diagram of the FPGA hardware acceleration CNN reasoning layer convolution kernel calculation mapping of the present invention; Figure 2 It is a scatter plot of the C&C communication recognition accuracy, false alarm rate, traffic timing interval and packet length under different detection rounds of the present invention; Figure 3It is a kernel density map of relevant indicators in the hardware acceleration optimization stage of the present invention; Figure 4 It is a histogram of dynamic encryption related indicators under different encryption cycles of the present invention; Figure 5 It is a stacked bar chart of relevant indicators at different defense stages of the joint prevention and control of the present invention; Figure 6 This is a diagram showing the function codes of the first part of the first embodiment of the present invention; Figure 7 This is a diagram showing the function codes of the second part of the first embodiment of the present invention; Figure 8 This is a diagram showing the function codes of the third part of the first embodiment of the present invention; Figure 9 This is a diagram showing the function codes of the fourth part of the first embodiment of the present invention; Figure 10 This is a diagram showing the function codes in the fifth part of the first embodiment of the present invention; Figure 11 This is a diagram showing the function codes of the sixth part of the first embodiment of the present invention; Figure 12 This is a diagram showing the function codes of the first part of the second embodiment of the present invention; Figure 13 This is a diagram showing the function codes of the second part of the second embodiment of the present invention; Figure 14 This is a diagram showing the function codes of the third part of the second embodiment of the present invention; Figure 15 This is a diagram showing the function codes of the fourth part of the second embodiment of the present invention; Figure 16 This is a diagram showing the function codes of the fifth part of the second embodiment of the present invention; Figure 17 This is a diagram showing the function codes of the first part of the third embodiment of the present invention; Figure 18 This is a diagram showing the function codes of the second part of the third embodiment of the present invention; Figure 19 This is a diagram showing the function codes of the third part of the third embodiment of the present invention; Figure 20 This is a diagram showing the function codes of the fourth part of the third embodiment of the present invention; Figure 21 This is a diagram showing the function codes of the first part of the fourth embodiment of the present invention; Figure 22 This is a functional code display diagram of the second part of embodiment 4 of the present invention. DETAILED DESCRIPTION

[0017] The following embodiments of the present invention are described in further detail with reference to the accompanying drawings and examples. The following examples are used to illustrate the present invention but are not intended to limit the scope of the present invention.

[0018] An FPGA-based IPSecVPN encrypted traffic security detection method includes the following steps: Hardware parsing S1: The FPGA hardware can parse the IPSec protocol header field, and the FPGA hardware can extract corresponding feature parameters as metadata; Model building S2: The metadata extracted by the FPGA hardware is used to build a traffic behavior model, and the traffic behavior model can be used to execute corresponding measures in parallel through a multi-dimensional threat analysis engine to identify threats in encrypted traffic; Rule update S3: A dynamic interface module is provided at the interface of the FPGA hardware. The dynamic interface module can load the threat signature library and update the rule matching engine in real time to adapt to new attack patterns. Intelligent Identification S4: The metadata, traffic timing characteristics, and packet length distribution can be input into a multimodal convolutional neural network model. This multimodal convolutional neural network model can be trained through a combination of supervised, unsupervised, and semi-supervised learning to identify malicious scenarios. Hardware acceleration S5: The FPGA hardware is internally provided with a dedicated hardware pipeline that can map the convolution kernel calculation of the CNN inference layer into parallel logic units; Dynamic encryption S6: When malicious traffic is detected, the PSec gateway can establish multiple independent encrypted tunnels or matrix channels within 100ms, and each tunnel can be assigned a different SPI and encryption algorithm; Joint Defense and Control S7: The detected attack traffic can be stored outside the FPGA hardware and cached. At the same time, a malicious traffic pool is built according to the type, protocol characteristics and timestamp of the attack traffic. The generative adversarial network can simulate new attack traffic from the traffic pool, and the generative adversarial network can also deploy traffic features to edge monitoring points through transfer learning.

[0019] Example 1: According to the above step S4: intelligent identification.

[0020] Application Environment: Financial institution VPN gateway, which requires real-time detection of covert C&C communications in employee remote access traffic.

[0021] Purpose: To identify C&C heartbeat packets disguised as legitimate services within encrypted traffic.

[0022] Function: Input IPSec metadata (SPI, sequence number), traffic timing (fixed interval every 30 seconds), and packet length (fixed 128 bytes) into the multimodal CNN model.

[0023] The model distinguishes normal OA access from C&C communication through semi-supervised learning.

[0024] Effect: Detects abnormal SPI periodic heartbeat packets, triggers SPI blocking and isolates the host; The accuracy rate of C&C communication identification was 90.7%, with a false alarm rate of 0.3%; Advantages: No need to decrypt traffic, protecting user privacy.

[0025] Example construction code such as Figures 6 to 11 .

[0026] The specific parameters are as follows: Table 1: Intelligent recognition feature table

[0027] The above table parameters are formed into a chart, please see Figure 2 .

[0028] Example 2: According to the above step S5: hardware acceleration Usage environment: Cloud computing center IPSec gateway, which needs to handle 100,000+ concurrent encrypted sessions.

[0029] Purpose: Reduce threat detection latency and meet high throughput requirements.

[0030] Function: The hardware pipeline in the FPGA decomposes the CNN convolution calculation into 16 parallel logic units; The dynamic path generation module optimizes the detection link and prioritizes packet length analysis.

[0031] Effect: Single-packet processing latency reduced from 2ms to 0.1ms; System throughput increased from 50Gbps to 200Gbps; Advantages: Avoids packet loss caused by CPU overload.

[0032] Example construction code such as Figures 12 to 16 .

[0033] The specific parameters are as follows: Table 2: Hardware acceleration feature table

[0034] The above table parameters are formed into a chart, please see Figure 3 .

[0035] Embodiment 3: According to the above step S6: dynamic encryption.

[0036] Usage environment: Government inter-departmental IPSecVPN, transmission of confidential archival data.

[0037] Purpose: Prevent advanced persistent threats (APTs) from breaking into a single encrypted tunnel.

[0038] Function: After detecting abnormal traffic, the IPSec gateway establishes three independent tunnels (SPI_1 / AES-256, SPI_2 / ChaCha20, SPI_3 / SM4) within 100ms; The active tunnel is switched every 5 seconds, and the abandoned tunnel sends bait data.

[0039] Effect: The time cost for an attacker to crack a single tunnel increases by 300%; There is zero service interruption during the tunnel switching process.

[0040] Advantages: Improves defense in depth through encryption nesting.

[0041] Example construction code such as Figures 17 to 20 .

[0042] The specific parameters are as follows: Table 3: Dynamic encryption feature table

[0043] The above table parameters are formed into a chart, please see Figure 4 .

[0044] Example 4: According to the above step S7: joint prevention and control.

[0045] Usage environment: Multinational enterprise branch network that requires unified defense against ransomware spread.

[0046] Purpose: To achieve network-wide collaboration to block the spread of ransomware in encrypted traffic.

[0047] Function: Attack traffic is stored in the FPGA off-chip cache and marked as "ransomware communication" type; GAN generates simulated ransomware traffic to train edge firewall recognition models; The SDN controller pushes the SPI blacklist to upstream firewalls across the entire network.

[0048] Results: The detection time for similar attacks at new branches was reduced from 24 hours to 5 minutes; The success rate of lateral ransomware spread decreased by 92%.

[0049] Advantages: Defense strategy synchronization is achieved through traffic pool sharing.

[0050] Example construction code such as Figures 21 to 22 . The specific parameters are as follows: Table 4: Characteristics of joint prevention and control

[0051] The above table parameters are formed into a chart, please see Figure 5 .

[0052] The above four embodiments and Figure 2 、 Figure 3 、 Figure 4 and Figure 5 It can be concluded that: The intelligent identification step inputs IPSec metadata, traffic timing features, and packet length distribution into a multimodal convolutional neural network model, identifying malicious scenarios through joint training using supervised, unsupervised, and semi-supervised learning. The goal is to detect malicious activities disguised as legitimate business in encrypted traffic, such as C&C communications, without decrypting the traffic. The technology is summarized as fusing multi-dimensional features (metadata, timing, packet length) and using semi-supervised learning to distinguish between normal and malicious traffic. Its innovation lies in the use of multimodal feature input and semi-supervised learning, breaking the limitation of traditional detection requiring decrypted traffic to protect user privacy. Its practicality lies in its application to financial institutions' VPN gateways, detecting employee remote access traffic in real time. The C&C communication identification accuracy rate reached 90.7% and the false alarm rate was 0.3%, creatively resolving the contradiction between privacy protection and detection accuracy in encrypted traffic detection, providing efficient and secure detection solutions for fields such as finance. The hardware acceleration step decomposes CNN convolution calculations into parallel logic units through the FPGA hardware pipeline. The dynamic path generation module optimizes the detection link to reduce threat detection latency and increase system throughput to meet the high-concurrency encrypted session processing needs of cloud computing centers. Technically, the FPGA's parallel processing capabilities are utilized to map convolution kernel calculations into parallel logic units and prioritize key feature analysis. Innovative FPGA-based hardware-level acceleration avoids packet loss caused by CPU overload, reducing single-packet processing latency from 2ms to 0.1ms and increasing throughput from 50Gbps to 200Gbps. This is practical for cloud computing centers to efficiently handle more than 100,000 concurrent encrypted sessions, ensuring business continuity. Through creative hardware architecture optimization, detection efficiency is significantly improved, performance bottlenecks in high-concurrency scenarios are resolved, and support is provided for large-scale network security detection. The dynamic encryption step, upon detecting abnormal traffic, enables the IPSec gateway to establish multiple independent encrypted tunnels (such as SPI_1 / AES-256, SPI_2 / ChaCha20, and SPI_3 / SM4) within 100ms. It switches active tunnels and sends decoy data every 5 seconds. This prevents advanced persistent threats (APTs) from cracking a single encrypted tunnel and enhances defense in depth. Technically, this approach rapidly creates multiple tunnels and dynamically switches them, using decoy data to confuse attackers. The innovative use of dynamic multi-tunnel encryption and decoy data strategies increases the time it takes for attackers to crack a single tunnel by 300%, while ensuring zero service interruption during tunnel switching. This approach has been practically applied to government cross-departmental IPSec VPNs to protect the security of confidential archival data transmission. Through innovative encryption algorithm switching and dynamic tunnel management, a multi-layered defense system is constructed to effectively combat advanced threats. The function of the joint defense and control step is to store attack traffic in the FPGA off-chip cache, use GAN to generate simulated attack traffic, and push policies to edge nodes through the SDN controller. The purpose is to achieve full network collaboration to block the spread of ransomware in encrypted traffic and improve overall defense capabilities. Technically, a malicious traffic pool is constructed, and simulated traffic is generated based on GAN to train the edge firewall model. Rapid policy synchronization is achieved through SDN. Innovative use of traffic pool sharing and generative adversarial networks has shortened the detection time of similar attacks in new branches from 24 hours to 5 minutes, and the success rate of ransomware propagation has dropped by 92%. It is practical and suitable for branch networks of multinational enterprises, unified defense against threats such as ransomware, and creatively forms an active defense system through cross-node collaboration and model sharing, improving the overall response speed and blocking efficiency of network security.

[0053] All aspects of the present invention are within the scope of protection of this patent.

[0054] The embodiments of the present invention are provided for the purpose of illustration and description. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations of the present invention. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A FPGA-based IPSecVPN encrypted traffic security detection method, characterized in that: The following steps are involved: Hardware parsing S1: The FPGA hardware can parse the IPSec protocol header field, and the FPGA hardware can extract corresponding feature parameters as metadata; Model building S2: The metadata extracted by the FPGA hardware is used to build a traffic behavior model, and the traffic behavior model can be used to execute corresponding measures in parallel through a multi-dimensional threat analysis engine to identify threats in encrypted traffic; Rule update S3: A dynamic interface module is provided at the interface of the FPGA hardware. The dynamic interface module can load the threat signature library and update the rule matching engine in real time to adapt to new attack patterns. Intelligent Identification S4: The metadata, traffic timing characteristics, and packet length distribution can be input into a multimodal convolutional neural network model. This multimodal convolutional neural network model can be trained through a combination of supervised, unsupervised, and semi-supervised learning to identify malicious scenarios. Hardware acceleration S5: The FPGA hardware is internally provided with a dedicated hardware pipeline that can map the convolution kernel calculation of the CNN inference layer into parallel logic units; Dynamic encryption S6: When malicious traffic is detected, the PSec gateway can establish multiple independent encrypted tunnels or matrix channels within 100ms, and each tunnel can be assigned a different SPI and encryption algorithm; Joint Defense and Control S7: The detected attack traffic can be stored outside the FPGA hardware and cached. At the same time, a malicious traffic pool is built according to the type, protocol characteristics and timestamp of the attack traffic. The generative adversarial network can simulate new attack traffic from the traffic pool, and the generative adversarial network can also deploy traffic features to edge monitoring points through transfer learning.

2. The FPGA-based IPSecVPN encrypted traffic security detection method according to claim 1, characterized in that: The metadata in step S1 may include security parameter index, sequence number, protocol type and traffic timing characteristics.

3. The FPGA-based IPSecVPN encrypted traffic security detection method according to claim 1, characterized in that: The corresponding means in step S2 include rule matching, statistical learning and anomaly scoring.

4. The FPGA-based IPSecVPN encrypted traffic security detection method according to claim 1, characterized in that: The characteristic parameters in the matching engine in step S3 are the SPI blacklist, the packet length threshold and the anomaly score.

5. The FPGA-based IPSecVPN encrypted traffic security detection method according to claim 1, characterized in that: The malicious scenarios in step S4 include hidden heartbeat packets connecting to the C&C server, abnormal host network environment, mother program communication disguise, hidden transit of white sites, and worm propagation communication. At the same time, differentiated protection strategies can be dynamically triggered according to the attack type. The protection strategies include C&C communication to block SPI and isolate the host, hidden transit to redirect traffic to the sandbox, and worm propagation to enable traffic cleaning and session rate limiting.

6. The FPGA-based IPSecVPN encrypted traffic security detection method according to claim 1, characterized in that: After the FPGA hardware acceleration in step S5, the SPI blacklist retrieval delay of the rule matching engine can be reduced to ≤10μs, the packet length distribution histogram generation speed can be increased by 20 times, and the threat score calculation and traffic feature extraction can be completed simultaneously. When the purpose of the FPGA hardware acceleration is achieved, the detection path can be dynamically reconstructed according to the threat type, and the logic unit can be optimized through the hardware description language to generate the shortest detection link.

7. The FPGA-based IPSecVPN encrypted traffic security detection method according to claim 1, characterized in that: The generative adversarial network in step S5 can enhance the robustness of the CNN model.

8. The FPGA-based IPSecVPN encrypted traffic security detection method according to claim 1, characterized in that: The closed-loop protection measures implemented in step S5 may include updating the SPI blacklist on the firewall, loading new attack features on the IDS, and implementing micro-isolation strategies on the terminal.

9. The FPGA-based IPSecVPN encrypted traffic security detection method according to claim 8, characterized in that: The terminal implements a micro-isolation strategy to limit IP access bound to high-risk SPIs.

Images