Communication anomaly detection method and device, equipment and medium

Abstract

The invention relates to the technical field of computer information security, and discloses a communication anomaly detection method, which comprises the following steps: acquiring historical session data of a target application; constructing a traffic fingerprint model according to the historical session data; monitoring the target application in real time, and obtaining target session data of the target application; performing analysis processing on the target session data, and extracting a target feature vector of the target session data; judging whether the target session data is an abnormal communication behavior or not according to the target feature vector, a traffic fingerprint model and an abnormal threshold; and when the target session data is an abnormal communication behavior, triggering an alarm mechanism. According to the method, the traffic fingerprint model is constructed by acquiring the historical session data of the target application, the session data of the target application is monitored and analyzed in real time, and whether the communication is abnormal or not is judged by combining the model and the abnormal threshold value. The encryption traffic and application behavior diversity are effectively handled, the false alarm rate is reduced, and the intranet application security and monitoring efficiency are improved.

Description

Technical Field

[0001] This invention relates to the field of computer information security technology, and in particular to a method, apparatus, device, and storage medium for detecting communication anomalies. Background Technology

[0002] Currently, enterprise internal application systems carry core business data and processes, making their security paramount. However, detecting anomalous behavior in these specific internal applications faces numerous challenges. First, general-purpose detection tools have limitations. Traditional Intrusion Detection Systems (IDS) or Network Traffic Analysis (NTA) tools primarily focus on detecting known attack signatures or general network / transport layer anomalies, but their detection capabilities are limited for policy violations using legitimate application protocols, insider misoperation, or covert communication using trusted applications in Advanced Persistent Threats (APTs). Second, with the widespread adoption of encryption protocols such as TLS / SSL, methods relying on Deep Packet Inspection (DPI) to analyze application layer payloads have become ineffective, making it difficult to identify anomalous behavior in encrypted traffic. Most solutions can only analyze handshake information or connection metadata, lacking sufficient information dimensions. Furthermore, the communication patterns of enterprise internal applications may dynamically evolve with business changes, version upgrades, user habits, and other factors, making detection methods based on fixed rules or simple thresholds prone to high false positives or false negatives. Furthermore, building accurate application behavior models typically requires large amounts of labeled data and complex machine learning algorithms, making efficient and adaptive deployment on resource-constrained network monitoring hardware a technical challenge. Finally, existing technologies often lack mechanisms for independently modeling and fine-grained monitoring of specific internal applications, making it difficult to distinguish subtle differences in behavioral patterns between different applications. Summary of the Invention

[0003] The main objective of this invention is to provide a method, apparatus, device, and storage medium for detecting communication anomalies, which aims to overcome the limitations of traditional detection tools when facing encrypted traffic and the diversity of internal application behaviors, thereby improving the security and visibility of enterprise internal applications.

[0004] To achieve the above objectives, the present invention provides a method for detecting communication anomalies, comprising: Obtain historical session data for the target application; Construct a traffic fingerprint model based on the historical session data; Real-time monitoring of the target application to obtain target session data of the target application; The target session data is parsed and processed to extract the target feature vector of the target session data; Based on the target feature vector, traffic fingerprint model, and anomaly threshold, determine whether the target session data represents abnormal communication behavior; An alarm mechanism is triggered when the target session data exhibits abnormal communication behavior.

[0005] In one embodiment, obtaining the historical session data of the target application specifically includes: Obtain the target application to be detected, configure the target application, and generate configuration rules; Capture historical session data packets of the target application in network traffic according to the configuration rules; Obtain historical session data packets of the target application, and set an abnormal threshold for communication based on the historical session data packets.

[0006] In one embodiment, constructing a traffic fingerprint model based on the historical session data includes: The historical session data packets are classified according to element type, and historical session data packets of the same type are associated and reassembled to obtain a historical session data stream; The historical session data stream is parsed and processed to extract multi-dimensional feature vectors from the historical session data stream; A multi-dimensional feature vector is collected through a fingerprint learning module, and a traffic fingerprint model is constructed based on the multi-dimensional feature vector.

[0007] In one embodiment, parsing the target session data and extracting the target feature vector of the target session data includes: Real-time monitoring of target applications and capture of target session data according to configured rules; The target session data is classified according to the element class, and the target session data of the same type are associated and reorganized to obtain the target session data stream; The target session data stream is parsed and processed to extract the target feature vector of the target session data stream.

[0008] In one embodiment, determining whether the target session data constitutes abnormal communication behavior based on the target feature vector, traffic fingerprint model, and anomaly threshold includes: The deviation score is calculated based on the target feature vector and the traffic fingerprint model; The deviation score is compared with the abnormal threshold. If the deviation score is greater than the abnormal threshold, the target session data is considered to be abnormal communication behavior.

[0009] In one embodiment, triggering an alarm mechanism when the target session data exhibits abnormal communication behavior includes: When the target session data exhibits abnormal communication behavior, a detailed log is generated, and the target session data is identified as an alarm event. An alarm signal is issued, and the detailed logs and alarm events are recorded in the security log storage area.

[0010] In one embodiment, the alarm event includes timestamps, application identifiers, deviation scores, anomaly feature dimensions, and metadata of the target session data.

[0011] In one embodiment, to achieve the above objective, the present invention provides a communication anomaly detection device, comprising: The historical session data module is used to obtain historical session data of the target application; The traffic fingerprint model module is used to construct a traffic fingerprint model based on the historical session data; The target session data module is used to monitor the target application in real time and obtain the target session data of the target application. The target feature vector module is used to parse and process the target session data and extract the target feature vector of the target session data; The communication behavior judgment module is used to determine whether the target session data is an abnormal communication behavior based on the target feature vector, traffic fingerprint model and abnormal threshold. The alarm mechanism module is used to trigger an alarm mechanism when the target session data exhibits abnormal communication behavior.

[0012] In one embodiment, to achieve the above objective, the present invention also provides a computer device, the computer device including a memory, a processor, and a communication anomaly detection program stored in the memory and executable on the processor, wherein when the communication anomaly detection program is executed by the processor, it implements the steps of the communication anomaly detection method as described above.

[0013] In one embodiment, to achieve the above objective, the present invention also provides a computer-readable storage medium storing a communication anomaly detection program, which, when executed by a processor, implements the steps of a communication anomaly detection method as described above.

[0014] Beneficial Effects: This invention relates to the field of computer information security technology and discloses a method for detecting communication anomalies, comprising: acquiring historical session data of a target application; constructing a traffic fingerprint model based on the historical session data; monitoring the target application in real time and acquiring target session data of the target application; parsing the target session data and extracting target feature vectors from the target session data; determining whether the target session data constitutes abnormal communication behavior based on the target feature vectors, the traffic fingerprint model, and an anomaly threshold; and triggering an alarm mechanism when the target session data constitutes abnormal communication behavior. This invention constructs a traffic fingerprint model by acquiring historical session data of the target application, monitors the target application in real time, acquires target session data and extracts feature vectors, and combines the traffic fingerprint model and anomaly threshold to determine whether it constitutes abnormal communication behavior. If an anomaly is detected, an alarm mechanism is triggered. This method solves the limitations of traditional detection tools when facing encrypted traffic and the diversity and dynamism of application behavior, such as difficulty in identifying anomalies in encrypted traffic and the tendency to generate false positives and false negatives based on fixed rules. It effectively improves the security and monitoring efficiency of intranet applications and ensures the security of core business data and processes of enterprises. Attached Figure Description

[0015] The present invention will be further described below with reference to the accompanying drawings and embodiments. In the accompanying drawings: Figure 1 This is a schematic diagram of an application environment for a communication anomaly detection method according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating an embodiment of a communication anomaly detection method according to the present invention; Figure 3 This is a schematic diagram of the functional modules of a preferred embodiment of the communication anomaly detection device of the present invention; Figure 4 This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention; Figure 5 This is another structural schematic diagram of a computer device according to one embodiment of the present invention. Detailed Implementation

[0016] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0017] The communication anomaly detection method provided in this embodiment of the invention can be applied to, for example... Figure 1In this application environment, the user terminal communicates with the server via a network. The server can obtain historical session data of the target application through the client; construct a traffic fingerprint model based on the historical session data; monitor the target application in real time and obtain the target session data of the target application; parse and process the target session data to extract the target feature vector of the target session data; determine whether the target session data is abnormal communication behavior based on the target feature vector, the traffic fingerprint model, and anomaly threshold; and trigger an alarm mechanism when the target session data is abnormal communication behavior. This invention constructs a traffic fingerprint model by obtaining historical session data of the target application, monitors the target application in real time, obtains the target session data and extracts feature vectors, and combines the traffic fingerprint model and anomaly threshold to determine whether it is abnormal communication behavior. If an anomaly is detected, an alarm mechanism is triggered. This method solves the limitations of traditional detection tools when facing encrypted traffic and the diversity and dynamism of application behavior, such as difficulty in identifying anomalies in encrypted traffic and the tendency to generate false positives and false negatives based on fixed rules. It effectively improves the security and monitoring efficiency of intranet applications and ensures the security of core business data and processes of enterprises. The user terminal can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. The server can be implemented using a standalone server or a server cluster consisting of multiple servers. The invention will be described in detail below through specific embodiments.

[0018] Please see Figure 2 , Figure 2 This is a flowchart illustrating an embodiment of a communication anomaly detection method provided by the present invention. It should be noted that although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0019] like Figure 2 As shown, the communication anomaly detection method proposed in this invention includes the following steps: S100: Obtain historical session data of the target application; S200. Construct a traffic fingerprint model based on the historical session data; S300: Real-time monitoring of target applications to obtain target session data of target applications; S400: Parse the target session data and extract the target feature vector of the target session data; S500: Determine whether the target session data is an abnormal communication behavior based on the target feature vector, traffic fingerprint model and abnormal threshold; S600. When the target session data exhibits abnormal communication behavior, an alarm mechanism is triggered.

[0020] In this embodiment, the system implements precise monitoring of specific internal application communication sessions through a series of configuration steps to ensure the security and stability of enterprise internal applications.

[0021] Administrators first need to identify which internal applications need to be monitored. These applications are typically critical business systems within the enterprise, such as Enterprise Resource Planning (ERP) systems, Office Automation (OA) systems, and code version control systems. To enable the system to accurately identify the traffic of these applications, administrators need to specify network identification information for each application. This usually includes the server's IP address range and port number. For example, when monitoring the company's OA system, the server's IP address range can be specified as `192.168.1.10-192.168.1.12`, and the port numbers as `TCP / 80` and `TCP / 443`. This information will be used by the traffic identification module to filter communication sessions belonging to the target application from network traffic.

[0022] The initial learning period is designed to allow the system sufficient time to collect and analyze the normal traffic characteristics of the target application, thereby establishing an accurate traffic fingerprint model. This model will serve as the benchmark for subsequent detection phases to identify abnormal communication behavior. Administrators need to set an appropriate learning period based on the application's usage frequency and business characteristics. If the application's usage pattern is relatively stable, the learning period can be set shorter, such as 7 days; if the application's usage pattern is more complex or exhibits periodic changes, a longer learning period may be necessary, such as 30 days. During the learning period, the system will collect a large amount of traffic data to build the traffic fingerprint model.

[0023] During the detection phase, the system calculates the deviation score between real-time traffic characteristics and the learned traffic fingerprint model. If the deviation score exceeds a set threshold, it is identified as abnormal communication behavior. Administrators can set initial anomaly thresholds based on historical data or experience. For example, if the deviation scores of normal traffic characteristics collected by the system during the learning phase mostly fall within a certain range, the threshold can be set to the upper limit of that range. Furthermore, the system provides a dynamic adjustment mechanism, allowing administrators to fine-tune the thresholds according to actual conditions to improve the accuracy and reliability of detection. In actual operation, the normal behavior patterns of applications may change, thus requiring periodic evaluation and adjustment of the anomaly thresholds. The system can automatically adjust the thresholds by analyzing recent normal traffic data to adapt to the slow evolution of application behavior, thereby reducing the false alarm rate.

[0024] Administrators configure the system via the device management interface, which typically provides a user-friendly interface that allows administrators to input information such as the target application's IP address range, port number, learning period, and anomaly threshold. Once the administrator completes the configuration, the system saves these settings and uses this configuration information in subsequent traffic identification, feature extraction, learning modeling, and detection processes. For example, the traffic identification module will filter the target application's traffic based on the specified IP address range and port number; the learning modeling module will collect traffic data and build a traffic fingerprint model according to the set learning period; and the detection module will determine whether real-time communication behavior is abnormal based on the set anomaly threshold.

[0025] Through the above configuration steps, the system can clearly identify the monitoring target, providing accurate parameters and benchmarks for the subsequent learning and detection phases, thereby effectively identifying and warning of abnormal communication behavior of the target application.

[0026] In one embodiment, step S100 specifically includes: S101 acquires the target application to be detected, configures the target application, and generates configuration rules; S102 captures historical session data packets of the target application in network traffic according to the configuration rules; S103 Obtains historical session data packets of the target application and sets an abnormal threshold for communication based on the historical session data packets.

[0027] In this embodiment, the system achieves precise monitoring of specific internal application communication sessions through a series of configuration steps to ensure the security and stability of enterprise internal applications.

[0028] Administrators first need to identify which internal applications need to be monitored. These applications are typically critical business systems within the enterprise, such as Enterprise Resource Planning (ERP) systems, Office Automation (OA) systems, and code version control systems. To enable the system to accurately identify the traffic of these applications, administrators need to specify network identification information for each application. This usually includes the server's IP address range and port number. For example, when monitoring the company's OA system, the server's IP address range can be specified as `192.168.1.10-192.168.1.12`, and the port numbers as `TCP / 80` and `TCP / 443`. This information will be used by the traffic identification module to filter communication sessions belonging to the target application from network traffic.

[0029] The initial learning period is designed to allow the system sufficient time to collect and analyze the normal traffic characteristics of the target application, thereby establishing an accurate traffic fingerprint model. This model will serve as the benchmark for subsequent detection phases to identify abnormal communication behavior. Administrators need to set an appropriate learning period based on the application's usage frequency and business characteristics. If the application's usage pattern is relatively stable, the learning period can be set shorter, such as 7 days; if the application's usage pattern is more complex or exhibits periodic changes, a longer learning period may be necessary, such as 30 days. During the learning period, the system will collect a large amount of traffic data to build the traffic fingerprint model.

[0030] Anomaly thresholds are key parameters used to determine whether real-time communication behavior is abnormal. During the detection phase, the system calculates the deviation score between real-time traffic characteristics and the learned traffic fingerprint model. If the deviation score exceeds a set threshold, it is considered abnormal communication behavior. Administrators can set initial anomaly thresholds based on historical data or experience. For example, if the deviation scores of normal traffic characteristics collected by the system during the learning phase are mostly within a certain range, the threshold can be set to the upper limit of that range. Furthermore, the system provides a dynamic adjustment mechanism, allowing administrators to fine-tune the thresholds according to actual conditions to improve the accuracy and reliability of detection. In actual operation, the normal behavior patterns of applications may change, therefore, it is necessary to periodically evaluate and adjust the anomaly thresholds. The system can automatically adjust the thresholds by analyzing recent normal traffic data to adapt to the slow evolution of application behavior, thereby reducing the false alarm rate.

[0031] Administrators configure the system via the device management interface, which typically provides a user-friendly interface that allows administrators to input information such as the target application's IP address range, port number, learning period, and anomaly threshold. Once the administrator completes the configuration, the system saves these settings and uses this configuration information in subsequent traffic identification, feature extraction, learning modeling, and detection processes. For example, the traffic identification module will filter the target application's traffic based on the specified IP address range and port number; the learning modeling module will collect traffic data and build a traffic fingerprint model according to the set learning period; and the detection module will determine whether real-time communication behavior is abnormal based on the set anomaly threshold.

[0032] Through the above configuration steps, the system can clearly define the monitoring target, providing accurate parameters and benchmarks for subsequent learning and detection phases, thereby effectively identifying and issuing early warnings of abnormal communication behavior of the target application. In one embodiment, step S200 includes: S201 classifies the historical session data packets according to element type, associates and reassembles historical session data packets of the same type to obtain a historical session data stream; S202 performs parsing processing on the historical session data stream and extracts the multi-dimensional feature vector of the historical session data stream; S203 collects multi-dimensional feature vectors through the fingerprint learning module and constructs a traffic fingerprint model based on the multi-dimensional feature vectors.

[0033] In this embodiment, for each monitored specific internal application, the system collects its multi-dimensional feature data over a period of time, and builds and continuously updates a statistical baseline model (traffic fingerprint) representing the "normal" communication behavior of the application locally. The system aggregates feature data by application identifier, calculates its statistical parameters (such as mean, standard deviation, etc.) for each feature dimension or feature combination, or trains the model using unsupervised machine learning algorithms (such as single-class support vector machine, isolated forest, etc.). To enable the model to adapt to the slow changes in application behavior and avoid baseline solidification, the system adopts mechanisms such as sliding time windows, incremental learning, or periodic retraining. The device maintains an independent traffic fingerprint model for each monitored application.

[0034] During the learning phase, the system's main task is to capture session data of the target application through the traffic identification module, then extract feature vectors from this session data using the feature extraction engine, and finally collect these feature vectors and establish a baseline model for the application using the fingerprint learning module. The core function of the traffic identification module is to accurately identify and capture communication sessions belonging to the monitored target application from network traffic. This requires filtering traffic based on rules set by the administrator during the configuration phase (such as target server IP address ranges, port numbers, etc.). An efficient network packet filtering engine (such as BPF-based or hardware-accelerated filtering technology) is used to filter out packets that match the configured rules. For example, if the IP address range `192.168.1.10-192.168.1.12` and port numbers `TCP / 80, TCP / 443` are configured, the filtering engine will capture all TCP packets flowing to or from these IP addresses and ports. Packets belonging to the same session (based on the five-tuple: source IP, destination IP, source port, destination port, protocol type) are associated and reassembled to form a structured session data stream. This step ensures that subsequent modules can process complete session data, rather than fragmented data packets.

[0035] The core function of the feature extraction engine is to extract a set of predefined multi-dimensional feature vectors from the captured session data stream in real time. These feature vectors can reflect the communication behavior patterns of the target application and are largely observable even when the transport layer is encrypted. Specifically, they include the following types of features: connection metadata, such as source IP, destination IP, source port, destination port, protocol type, etc.; connection statistical features, such as session duration, total number of bytes transmitted (uplink / downlink), total number of packets (uplink / downlink), etc.; packet size distribution features, such as the statistical distribution of uplink / downlink packet length (mean, variance, specific quantiles, or histogram); inter-packet timing features, such as the statistical distribution of uplink / downlink packet arrival time intervals (mean, variance, jitter, etc.); payload-related features (encryption-friendly), calculating information entropy or performing compression ratio analysis on the application layer payload (even when encrypted) to capture changes in its statistical characteristics; connection pattern features, such as the number of concurrent connections related to a specific application, connection establishment / closure frequency, etc.; and TLS / SSL handshake features, such as the cipher suites used, certificate information, handshake duration, etc.

[0036] The core function of the fingerprint learning module is to collect multi-dimensional feature data generated by the feature extraction engine and build and continuously update a statistical baseline model (traffic fingerprint) representing the "normal" communication behavior of the target application locally. For data aggregation, feature data is aggregated by application identifier, ensuring that the feature data of each application is processed independently. In model construction, on the one hand, statistical parameters for each feature dimension or feature combination are calculated, such as mean, standard deviation, confidence interval, probability density function estimation, or feature distribution histogram construction. On the other hand, unsupervised machine learning algorithms (such as One-Class SVM, Isolation Forest, Autoencoder, etc.) can be optionally used to train a model capable of describing normal feature data clusters. For adaptive adjustment, mechanisms such as sliding time windows, incremental learning, or periodic retraining are employed to enable the model to adapt to slow changes in application behavior, avoiding baseline solidification. Regarding multi-model storage, the device maintains an independent traffic fingerprint model for each monitored application, ensuring that models from different applications do not interfere with each other.

[0037] After the learning period set during the configuration phase, the fingerprint learning module will complete the construction of the baseline model. This model will serve as a benchmark for subsequent detection phases to identify abnormal communication behavior. For example, if the learning period is 7 days, the system will collect a large number of feature vectors over those 7 days and construct a traffic fingerprint model of the target application through statistical analysis or machine learning algorithms. This model may be a multidimensional normal distribution model, where the mean and standard deviation of each feature are calculated to describe the normal communication behavior of the target application.

[0038] After the network monitoring equipment starts up, the traffic identification module begins working, capturing session data of the target application according to the configured rules. The traffic identification module uses a network packet filtering engine to capture TCP session data flowing to or from the target application server, and associates and reassembles packets belonging to the same session to form a structured session data stream. The feature extraction engine extracts feature vectors for each captured session data stream in real time. For example, for a session, the extracted feature vectors may include: session duration, total uplink bytes, total downlink bytes, mean uplink packet length, mean downlink packet length, mean uplink packet arrival time interval, mean downlink packet arrival time interval, and information entropy. The fingerprint learning module collects all extracted feature vectors and aggregates them by application identifier. After the learning cycle ends, the fingerprint learning module performs statistical analysis or machine learning training on the collected feature vectors to construct a traffic fingerprint model of the target application. For example, it calculates the mean and standard deviation of each feature to form a multidimensional normal distribution model. The completed traffic fingerprint model is stored locally on the device, providing a benchmark for subsequent detection phases.

[0039] Through the above steps, the system successfully established a traffic fingerprint model of the target application during the learning phase, providing a solid foundation for subsequent real-time detection and abnormal communication behavior identification.

[0040] In one embodiment, step S400 includes: S401 monitors the target application in real time and captures target session data according to the configured rules; S402 classifies the target session data according to the element class, associates and reorganizes the target session data of the same type, and obtains the target session data stream; S403 performs parsing processing on the target session data stream and extracts the target feature vector of the target session data stream.

[0041] In this embodiment, after system startup, the traffic identification module enters real-time monitoring mode, continuously monitoring network traffic to promptly capture session data of the target application. Based on the rules set by the administrator during the configuration phase (such as the target server IP address range, port number, etc.), the traffic identification module filters out session data belonging to the target application. Using an efficient network packet filtering engine (such as BPF-based or hardware-accelerated filtering technology), it filters data packets that match the configured rules from the network traffic. These data packets will be further processed to extract useful information.

[0042] The captured data packets are categorized according to element types (such as IP address, port number, protocol type, etc.). This step ensures that packets belonging to the same session are identified and associated together. Packets belonging to the same session are then associated and reassembled to form a complete session data stream. This step is crucial for subsequent feature extraction and analysis because it ensures the integrity and continuity of the data. The reassembled session data stream contains all relevant information about the session, such as the start and end times of the session and the transmission order of data packets, providing a foundation for subsequent feature extraction.

[0043] The session data stream is parsed to extract key information. This may include session duration, packet size and number, and packet arrival time intervals. Multi-dimensional feature vectors are extracted from the parsed session data stream. These feature vectors reflect the communication behavior patterns of the session and are largely observable even with transport layer encryption. Feature vectors may include connection metadata, connection statistics, packet size distribution characteristics, and inter-packet timing characteristics. The extracted target feature vectors will be used for subsequent deviation detection and anomaly assessment. These feature vectors provide the system with a basis for evaluating whether a session is abnormal.

[0044] Through the above steps, the system can capture and process the session data of the target application in real time, extract feature vectors that reflect communication behavior patterns, and provide a solid foundation for subsequent anomaly detection.

[0045] In one embodiment, step S500 includes: S501 calculates the deviation score based on the target feature vector and the traffic fingerprint model; S502 compares the deviation score with the abnormal threshold. If the deviation score is greater than the abnormal threshold, the target session data is considered to be abnormal communication behavior.

[0046] In this embodiment, during the detection phase, the system's main task is to utilize the traffic fingerprint model established during the learning phase to perform real-time detection of new target application sessions. For a new session of a target application captured in real time, the system first extracts its multi-dimensional traffic features and quantitatively compares them with the traffic fingerprint model already learned by the application, calculating a deviation score. Specifically, the features of the real-time session are organized into a feature vector, which is then compared with the stored fingerprint model. The comparison method depends on the model type. If the model is a statistical parametric model, the degree to which each feature deviates from its normal range (e.g., mean + / - N times standard deviation) is calculated and a weighted sum is performed, or the Mahalanobis distance between the feature vector and the center of the normal distribution is calculated. If the model is a distribution model (e.g., histogram), a measure of the difference between the real-time feature distribution and the baseline distribution (e.g., KL divergence, Bach distance) is calculated. If the model is a machine learning model, the feature vector is input into the model to obtain a score representing its "abnormality" (e.g., distance from the decision boundary, reconstruction error).

[0047] The deviation detection module compares the real-time calculated feature vector with the learned traffic fingerprint model to calculate a deviation score. The anomaly determination module compares the real-time calculated deviation score with an anomaly threshold set for the specific application. If the score exceeds the threshold, it is determined to be abnormal communication behavior. The system allows administrators to configure an alarm threshold for the deviation score for each application. This threshold can be set based on historical data or experience, or it can be dynamically adjusted.

[0048] Through the above steps, the system can identify abnormal communication behavior of the target application in real time during the detection phase and generate alarm events, thereby helping administrators to discover and deal with potential security risks in a timely manner.

[0049] In one embodiment, step S600 includes: S601 When the target session data is an abnormal communication behavior, a detailed log is generated and the target session data is marked as an alarm event; S602 issues an alarm signal and records the detailed logs and alarm events to the security log storage area.

[0050] In this embodiment, the anomaly detection and alarm log module is responsible for evaluating the deviation score calculated in real time and generating alarm events and detailed logs when abnormal communication behavior is detected. When the deviation score exceeds the anomaly threshold set for this specific application, it is determined to be abnormal communication behavior, and a series of operations are triggered.

[0051] Generate structured alarm events, which include the following key information: timestamp, recording the time the alarm event occurred; application identifier, identifying the name or ID of the application that triggered the alarm; involved IP / port, recording the source IP, destination IP, source port, and destination port involved in the session that triggered the alarm; deviation score, recording the deviation score calculated in real time; anomaly feature dimension, recording the anomaly feature dimension that contributed the most, which helps to explain the cause of the anomaly; and partial metadata of the original session, recording partial metadata of the original session for further analysis.

[0052] Summary information of alarm events and (optionally) normal sessions is logged to the local security log storage area. These logs can be used for subsequent auditing and analysis. Simultaneously, the system supports reporting alarm events to a central security management platform (such as SIEM) according to configuration. Reporting can be achieved via network protocols (such as Syslog, SNMP, HTTP, etc.).

[0053] The system allows administrators to configure alarm thresholds for deviation scores for each application. These thresholds can be set based on historical data or experience, or fine-tuned through the system's dynamic adjustment mechanism. The deviation score is calculated in real time and compared with the set threshold. If the deviation score exceeds the threshold, the anomaly detection logic is triggered.

[0054] For example, the administrator configures an alarm threshold for deviation scores for each application in the device management interface, such as setting the threshold for the company's OA system to 6. When a new target application session occurs, the feature extraction engine calculates its feature vector in real time. The deviation detection module compares the real-time feature vector with the learned fingerprint model to calculate the deviation score. The anomaly judgment module compares the real-time calculated deviation score with the set threshold. If the deviation score exceeds the threshold (e.g., 8.2 > 6), it is judged as abnormal communication behavior. At this time, a structured alarm event is generated, including information such as timestamp, application identifier, involved IP / port, deviation score, and abnormal feature dimension. Finally, the alarm event is recorded in the local security log storage area and reported to the central security management platform according to the configuration.

[0055] Through the above steps, the system can promptly detect abnormal communication behavior of target applications during the detection phase and generate detailed alarm events and logs to help administrators respond quickly and handle potential security threats.

[0056] In one embodiment, a communication anomaly detection apparatus is provided, which corresponds one-to-one with the communication anomaly detection method described in the above embodiments. (Refer to...) Figure 3 , Figure 3This is a schematic diagram of the functional modules of a preferred embodiment of a communication anomaly detection device according to the present invention. The modules include a historical session data module 10, a traffic fingerprint model module 20, a target session data module 30, a target feature vector module 40, a communication behavior judgment module 50, and an alarm mechanism module 60. Detailed descriptions of each functional module are as follows: In one embodiment, to achieve the above objective, the present invention provides a communication anomaly detection device, comprising: Historical session data module 10 is used to obtain historical session data of the target application; Traffic fingerprint model module 20 is used to construct a traffic fingerprint model based on the historical session data; The target session data module 30 is used to monitor the target application in real time and obtain the target session data of the target application. The target feature vector module 40 is used to parse and process the target session data and extract the target feature vector of the target session data; The communication behavior judgment module 50 is used to determine whether the target session data is an abnormal communication behavior based on the target feature vector, traffic fingerprint model and abnormal threshold. The alarm mechanism module 60 is used to trigger an alarm mechanism when the target session data exhibits abnormal communication behavior.

[0057] In one embodiment, the historical session data module 10 specifically includes: The configuration rule unit is used to obtain the target application to be detected, configure the target application, and generate configuration rules; The historical session data packet unit is used to capture historical session data packets of the target application in network traffic according to the configuration rules. An anomaly threshold unit is used to acquire historical session data packets of the target application and set an anomaly threshold for communication based on the historical session data packets.

[0058] In one embodiment, the traffic fingerprint model module 20 includes: The historical session data stream unit is used to classify the historical session data packets according to the element type, associate and reassemble historical session data packets of the same type to obtain a historical session data stream; A multi-dimensional feature vector unit is used to parse and process the historical session data stream and extract the multi-dimensional feature vector of the historical session data stream; The fingerprint model unit is used to collect multi-dimensional feature vectors through the fingerprint learning module and construct a traffic fingerprint model based on the multi-dimensional feature vectors.

[0059] In one embodiment, the target feature vector module 40 includes: The target session data unit is used to monitor the target application in real time and capture target session data according to the configured rules. The target session data stream unit is used to classify target session data according to element class, associate and reorganize target session data of the same type to obtain the target session data stream; The target feature vector unit is used to parse and process the target session data stream and extract the target feature vector of the target session data stream.

[0060] In one embodiment, the communication behavior determination module 50 includes: The deviation score unit is used to calculate the deviation score based on the target feature vector and the traffic fingerprint model. An abnormal communication behavior unit is used to compare the deviation score with an abnormal threshold. If the deviation score is greater than the abnormal threshold, the target session data is considered to be abnormal communication behavior.

[0061] In one embodiment, the alarm mechanism module 60 includes: The alarm event unit is used to generate a detailed log and identify the target session data as an alarm event when the target session data is an abnormal communication behavior. An alarm signal unit is used to issue alarm signals and record the detailed logs and alarm events in the security log storage area.

[0062] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used for communication with external user terminals via a network connection. When the computer program is executed by the processor, it implements a communication anomaly detection method, server-side functions, or steps.

[0063] In one embodiment, a computer device is provided, which may be a user terminal, and its internal structure diagram may be as follows: Figure 5As shown. The computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements a communication anomaly detection method, user-side functions, or steps. In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps: The client periodically probes the management hardware device to obtain raw indicators of network status; Obtain historical session data for the target application; Construct a traffic fingerprint model based on the historical session data; Real-time monitoring of the target application to obtain target session data of the target application; The target session data is parsed and processed to extract the target feature vector of the target session data; Based on the target feature vector, traffic fingerprint model, and anomaly threshold, determine whether the target session data represents abnormal communication behavior; An alarm mechanism is triggered when the target session data exhibits abnormal communication behavior.

[0064] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor: Obtain historical session data for the target application; Construct a traffic fingerprint model based on the historical session data; Real-time monitoring of the target application to obtain target session data of the target application; The target session data is parsed and processed to extract the target feature vector of the target session data; Based on the target feature vector, traffic fingerprint model, and anomaly threshold, determine whether the target session data represents abnormal communication behavior; An alarm mechanism is triggered when the target session data exhibits abnormal communication behavior.

[0065] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions on the server side and user side in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0066] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0067] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0068] It should be noted that if any software tools or components not belonging to this company appear in the embodiments of this application, they are merely illustrative examples and do not represent actual use. The embodiments described above are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for detecting communication anomalies, characterized in that, Includes the following steps: Obtain historical session data for the target application; Construct a traffic fingerprint model based on the historical session data; Real-time monitoring of the target application to obtain target session data of the target application; The target session data is parsed and processed to extract the target feature vector of the target session data; Based on the target feature vector, traffic fingerprint model, and anomaly threshold, determine whether the target session data represents abnormal communication behavior; An alarm mechanism is triggered when the target session data exhibits abnormal communication behavior.

2. The method for detecting communication anomalies as described in claim 1, characterized in that, The acquisition of historical session data of the target application specifically includes: Obtain the target application to be detected, configure the target application, and generate configuration rules; Capture historical session data packets of the target application in network traffic according to the configuration rules; Obtain historical session data packets of the target application, and set an abnormal threshold for communication based on the historical session data packets.

3. The method for detecting communication anomalies as described in claim 1, characterized in that, The step of constructing a traffic fingerprint model based on the historical session data includes: The historical session data packets are classified according to element type, and historical session data packets of the same type are associated and reassembled to obtain a historical session data stream; The historical session data stream is parsed and processed to extract multi-dimensional feature vectors from the historical session data stream; A multi-dimensional feature vector is collected through a fingerprint learning module, and a traffic fingerprint model is constructed based on the multi-dimensional feature vector.

4. The method for detecting communication anomalies as described in claim 1, characterized in that, The step of parsing and processing the target session data to extract the target feature vector of the target session data includes: Real-time monitoring of target applications and capture of target session data according to configured rules; The target session data is classified according to the element class, and the target session data of the same type are associated and reorganized to obtain the target session data stream; The target session data stream is parsed and processed to extract the target feature vector of the target session data stream.

5. The method for detecting communication anomalies as described in claim 1, characterized in that, The step of determining whether the target session data constitutes abnormal communication behavior based on the target feature vector, traffic fingerprint model, and anomaly threshold includes: The deviation score is calculated based on the target feature vector and the traffic fingerprint model; The deviation score is compared with the anomaly threshold. If the deviation score is greater than the anomaly threshold, the target session data is considered to be abnormal communication behavior.

6. The method for detecting communication anomalies as described in claim 1, characterized in that, When the target session data exhibits abnormal communication behavior, an alarm mechanism is triggered, including: When the target session data exhibits abnormal communication behavior, a detailed log is generated, and the target session data is identified as an alarm event. An alarm signal is issued, and the detailed logs and alarm events are recorded in the security log storage area.

7. The method for detecting communication anomalies as described in claim 6, characterized in that, The alarm event includes timestamps, application identifiers, deviation scores, anomaly feature dimensions, and metadata of the target session data.

8. A device for detecting communication anomalies, characterized in that, The communication anomaly detection device includes: The historical session data module is used to obtain historical session data of the target application; The traffic fingerprint model module is used to construct a traffic fingerprint model based on the historical session data; The target session data module is used to monitor the target application in real time and obtain the target session data of the target application. The target feature vector module is used to parse and process the target session data and extract the target feature vector of the target session data; The communication behavior judgment module is used to determine whether the target session data is an abnormal communication behavior based on the target feature vector, traffic fingerprint model and abnormal threshold. The alarm mechanism module is used to trigger an alarm mechanism when the target session data exhibits abnormal communication behavior.

9. A computer device, characterized in that, The computer device includes a memory, a processor, and a communication anomaly detection program stored in the memory and executable on the processor. When executed by the processor, the communication anomaly detection program implements the steps of a communication anomaly detection method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The storage medium stores a communication anomaly detection program, which, when executed by a processor, implements the steps of a communication anomaly detection method as described in any one of claims 1-7.

Images