Statistical behavior sequence-based encrypted malicious traffic characterization method and device

Abstract

This application provides a method and apparatus for characterizing encrypted malicious traffic based on statistical behavior sequences. The method includes: acquiring and preprocessing a network traffic capture file containing encrypted malicious traffic to obtain an encrypted bidirectional stream with an unparseable payload and anomaly-removed data; extracting flow-level statistical features based on the stream, constructing a standardized behavior sequence through channel clustering and sequence length standardization; performing self-supervised joint training on the encoding and decoding models, optimizing the parameters, and then determining the encoding model as the feature extraction model; constructing the standardized behavior sequence of the traffic to be detected, inputting it into the model to output a behavior representation vector, then inputting it into a machine learning model to output the identification result representing the malicious attributes, category, or abnormal state of the traffic to be detected. This method eliminates the need to parse the packet payload, accurately characterizes the overall behavior pattern of encrypted traffic, improves the stability and generalization of the representation vector, reduces sample labeling dependence, and efficiently adapts to downstream encrypted traffic analysis and detection tasks.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and apparatus for characterizing encrypted malicious traffic based on statistical behavior sequences. Background Technology

[0002] Currently, encryption protocols are widely used in various network communication scenarios due to their security and confidentiality in data transmission. Encrypted malicious traffic characterization is a core technical means to achieve malicious traffic detection, anomaly identification, and family classification. Specifically, it refers to network traffic in which attackers use encryption protocols to encapsulate malicious data such as remote control commands, data theft, mining requests, and ransomware communications. Its core purpose is to circumvent traditional detection methods based on plaintext content.

[0003] However, traditional methods for characterizing encrypted malicious traffic have significant limitations. Specifically, they often rely on manually designed single statistical features or simple feature concatenation, offering limited ability to depict the overall communication behavior structure of encrypted traffic and failing to reflect the relationships between behavioral units and overall behavioral patterns. Furthermore, while some methods incorporate sequence modeling or vector embedding, they focus on the temporal dimension or local feature representation, lacking constraints on the overall structure of the behavioral sequence. This results in insufficient stability and expressive power of the generated feature representations. Additionally, many characterization models employ direct supervised training, making feature representations dependent on specific classification tasks. When sample labeling is insufficient or the category distribution changes, the characterization ability easily declines, and generalization ability is limited. These problems make it difficult for traditional solutions to balance the completeness, stability, and generalization of feature representations, failing to meet the practical needs of the cybersecurity field for accurate detection and in-depth analysis of encrypted malicious traffic. Summary of the Invention

[0004] This application proposes a method and apparatus for characterizing encrypted malicious traffic based on statistical behavior sequences. The aim is to achieve accurate modeling of the overall communication behavior of encrypted malicious traffic by constructing standardized statistical behavior sequences. Combined with self-supervised joint training of encoding and decoding to optimize feature representation, the method eliminates the dependence on packet payload parsing and sample labeling, significantly improving the stability, completeness and generalization of behavior representation vectors. It can be efficiently adapted to various downstream encrypted traffic analysis and detection tasks.

[0005] In a first aspect, embodiments of this application provide a method for characterizing encrypted malicious traffic based on statistical behavior sequences, including: Obtain a network traffic capture file containing encrypted malicious traffic and perform preprocessing operations to obtain an encrypted bidirectional stream. The encrypted bidirectional stream is a bidirectional communication stream record that cannot be directly parsed and has been anomaly-removed. Based on the extraction of stream-level statistical features from encrypted bidirectional streams, a standardized behavior sequence is constructed through channel clustering and concatenation and sequence length standardization. Based on standardized behavior sequences, pre-defined encoding and decoding models are jointly trained under self-supervised conditions. Model parameters are optimized through global feature extraction, sequence reconstruction, and error backpropagation to obtain and determine the trained encoding model as the feature extraction model. Construct a standardized sequence of behaviors to be detected corresponding to the traffic to be detected and input it into the feature extraction model to output a behavior representation vector; The behavioral representation vector is input into a pre-defined encrypted traffic analysis machine learning model, and the output traffic identification result is used to characterize the malicious attributes, traffic category, or abnormal communication status of the traffic to be detected.

[0006] Secondly, embodiments of this application provide an encrypted malicious traffic characterization device based on statistical behavior sequences, comprising: The preprocessing unit is used to acquire network traffic capture files containing encrypted malicious traffic and perform preprocessing operations to obtain encrypted bidirectional streams. The encrypted bidirectional streams are bidirectional communication stream records that cannot be directly parsed and have been anomaly-removed. The sequence construction unit is used to extract stream-level statistical features based on encrypted bidirectional streams, and construct a standardized behavior sequence through channel clustering splicing and sequence length standardization; The model training unit is used to perform self-supervised joint training of the pre-set encoding and decoding models based on standardized behavior sequences. It optimizes the model parameters through global feature extraction, sequence reconstruction and error backpropagation to obtain and determine the trained encoding model as the feature extraction model. The feature representation unit is used to construct the standardized behavior sequence corresponding to the traffic to be detected and input it into the feature extraction model, and output the behavior representation vector. The traffic identification unit is used to input the behavior representation vector into a preset encrypted traffic analysis machine learning model and output the traffic identification result. The traffic identification result is used to characterize the malicious attributes, traffic category or abnormal communication status of the traffic to be detected.

[0007] Thirdly, embodiments of this application provide a server including a processor, a memory, and one or more programs, the one or more programs being stored in the memory and configured to be executed by the processor, the programs including instructions for performing the steps as described in the first aspect of embodiments of this application.

[0008] Fourthly, embodiments of this application provide a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implement the steps in the first aspect of embodiments of this application.

[0009] Fifthly, embodiments of this application provide a computer program product, including a computer program / instructions, which, when executed by a processor, implement some or all of the steps described in the first aspect of embodiments of this application.

[0010] As can be seen from the embodiments of this application, the network traffic capture file is first preprocessed to obtain an encrypted bidirectional stream. Then, based on the stream-level statistical features, a structured standardized behavior sequence is constructed through channel clustering and sequence length standardization. This breaks the limitations of manually designing single statistical features and simple feature splicing, accurately depicting the overall communication behavior pattern of encrypted traffic, and effectively reflecting the correlation between behavioral units and global behavioral features. At the same time, self-supervised joint training of encoding and decoding is carried out based on the standardized behavior sequence. The model parameters are optimized through global feature extraction, sequence reconstruction, and error backpropagation. This eliminates the strong dependence on sample labeling in traditional direct supervised training and solves the problem that traditional sequence modeling focuses on local features and lacks overall structural constraints. The generated behavior representation vector has both local communication features of encrypted bidirectional streams and cross-stream global aggregation behavior features, which greatly improves the stability and generalization of feature representation. Finally, a standardized behavior sequence of the traffic to be detected is constructed through a unified process, and feature extraction and traffic identification are completed. This can be efficiently adapted to downstream tasks such as encrypted malicious traffic detection, category classification, and abnormal state identification. It solves the pain point of traditional solutions that are difficult to balance the integrity, stability, and generalization of feature representation, and meets the actual needs of the network security field for accurate detection and in-depth analysis of encrypted malicious traffic. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a schematic diagram of the structure of an encrypted malicious traffic characterization system based on statistical behavior sequences provided in an embodiment of this application; Figure 2 This is a flowchart illustrating a method for characterizing encrypted malicious traffic based on statistical behavior sequences provided in an embodiment of this application. Figure 3 This is a functional unit block diagram of an encrypted malicious traffic characterization device based on statistical behavior sequences provided in an embodiment of this application; Figure 4 This is a block diagram of the functional units of another encrypted malicious traffic characterization device based on statistical behavior sequences provided in this application embodiment; Figure 5This is a structural block diagram of a server provided in an embodiment of this application. Detailed Implementation

[0013] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0014] The terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or apparatuses.

[0015] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0016] Please see Figure 1 , Figure 1 This is a schematic diagram of the structure of an encrypted malicious traffic characterization system based on statistical behavior sequences provided in an embodiment of this application. Figure 1 As shown, the encrypted malicious traffic characterization system 10 includes a server 110 and a user device 120. The user device 120 is a network device with network traffic collection, preliminary preprocessing and labeling functions, including network probes, firewalls, intrusion detection systems, network security auditing devices, etc. It can obtain encrypted malicious traffic capture files in a specific format and complete local preliminary processing such as file format standardization, invalid data removal, and malicious traffic attribute / family labeling.

[0017] Specifically, server 110 is a computing device integrating data reception, core processing, model training, feature representation, traffic identification, and data storage. It can be deployed in a local data center, network security management center, or cloud node. As the core execution unit for encrypted malicious traffic representation, it is responsible for storing the trained feature extraction model, standardized behavior sequences, behavior representation vectors, and traffic identification results, without the need for additional independent storage and inference nodes. Server 110 establishes a communication connection with user device 120 through wired or wireless networks, forming a closed-loop network security analysis system encompassing traffic acquisition, data processing, model training, feature representation, and traffic identification, enabling efficient processing and engineered deployment of encrypted malicious traffic representation.

[0018] In the encrypted malicious traffic characterization system 10, the user equipment 120 is responsible for collecting, organizing, and performing preliminary local preprocessing of network traffic capture files, and then transmitting the processed capture files and corresponding tag information to the server 110. The server 110 undertakes the core processing tasks of the entire process, including deep traffic preprocessing, flow-level statistical feature extraction, standardized behavior sequence construction, self-supervised joint training of encoding and decoding models, feature extraction model determination, feature characterization of traffic to be detected, and malicious attribute identification. At the same time, it saves various core data and identification results through a built-in storage module for direct access in authorized scenarios such as network security detection, malicious traffic tracing, and abnormal communication monitoring.

[0019] Furthermore, after the user equipment 120 uploads the labeled traffic capture file to the server 110 according to the preset format, the server 110 first performs deep preprocessing on the file, parsing it into bidirectional communication stream records. After protocol filtering and anomaly cleaning, an encrypted bidirectional stream is obtained. Then, through time segmentation, channel division, and feature extraction, combined with channel clustering and sequence length standardization, a unified standardized behavior sequence is constructed. Subsequently, self-supervised joint training is carried out on the encoding and decoding models. Through global feature extraction, sequence reconstruction, and error backpropagation, the parameters are optimized, and the trained encoding model is determined as the feature extraction model. For the traffic to be detected, a standardized behavior sequence is constructed according to the same rules, input into the feature extraction model, and the output behavior representation vector is then input into the encrypted traffic analysis machine learning model to output the identification results representing the malicious attributes, categories, or abnormal states of the traffic to be detected. At the same time, the storage of various core data is completed.

[0020] Typically, the encrypted malicious traffic characterization system 10 may include one or more servers 110, each server 110 can connect to multiple user devices 120, supporting parallel processing of traffic files from multiple batches and multiple network nodes, and adapting to the encrypted traffic analysis needs of different scenarios such as enterprise intranets, public network exits, and industrial control networks. The system adopts an integrated server design, simplifying the network security protection deployment architecture, enabling lightweight data collection and processing for user devices, and reducing front-end resource consumption. Simultaneously, through standardized processing throughout the entire process and self-supervised model training, it eliminates the strong dependence on sample labeling, improving the stability and generalization of behavioral characterization vectors. While ensuring accurate and efficient encrypted malicious traffic characterization, it reduces data transmission risks and overall deployment costs, fully meeting the actual needs of the network security field for accurate detection, in-depth analysis, and anomaly warning of encrypted malicious traffic.

[0021] Based on this, the embodiments of this application provide a method for characterizing encrypted malicious traffic based on statistical behavior sequences. The embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0022] Please see Figure 2 , Figure 2 This is a flowchart illustrating a method for characterizing encrypted malicious traffic based on statistical behavior sequences, provided in an embodiment of this application. The method includes: Step S201: Obtain a network traffic capture file containing encrypted malicious traffic and perform preprocessing operations to obtain an encrypted bidirectional stream.

[0023] The encrypted bidirectional stream is a record of bidirectional communication streams that cannot be directly parsed and have undergone anomaly removal. In this step, a network traffic capture file containing encrypted malicious traffic is first obtained. This network traffic capture file is then subjected to preprocessing operations such as parsing, protocol filtering, and anomaly cleaning in sequence to finally obtain the encrypted bidirectional stream.

[0024] In one possible embodiment, a network traffic capture file containing encrypted malicious traffic is obtained, and a preprocessing operation is performed to obtain an encrypted bidirectional stream, including: parsing the network traffic capture file into bidirectional communication stream records that are uniquely identified by a 5-tuple of information and a timestamp; performing a protocol filtering operation on the bidirectional communication stream records to retain encrypted communication stream records that use encrypted transmission protocols and whose payload content cannot be directly parsed; and performing an anomaly cleaning operation on the filtered encrypted communication stream records to remove invalid and abnormal stream records to obtain an encrypted bidirectional stream.

[0025] The common format for network traffic capture files is usually pcap (packet capture file format) / pcapng (next-generation packet capture file format), which is the carrier for storing encrypted malicious traffic in this embodiment. The five-tuple information includes the source IP address, destination IP address, source port, destination port, and transport layer protocol. This is core network information used to uniquely identify bidirectional communication flows in the network, and, in conjunction with a timestamp, it enables accurate differentiation of different bidirectional communication flow records. The encrypted transport protocol can specifically include SSH (Secure Shell), TLS (Transport Layer Security), HTTPS (Hypertext Transfer Protocol Secure), SSL (Secure Sockets Layer), QUIC (Quick UDP Internet Connections), or other network transport protocols whose payload content cannot be directly parsed. The annotation information of the network traffic capture file can be matched with the corresponding flow tags. The flow tags include two types of core tags: (1) malicious / benign binary tags; (2) specific malicious traffic family tags. The flow tags are generated based on the original annotation information of the pcap / pcapng format network traffic capture file.

[0026] Furthermore, invalid abnormal flow records are bidirectional communication flow records that at least have incomplete packet captures, missing timestamps, missing key statistical fields, zero duration, zero data packet count, or corrupted format. They are invalid flow records that cannot provide effective data support for subsequent characterization of encrypted malicious traffic.

[0027] In this embodiment, the preprocessing operation follows the serial processing principle of parsing-protocol filtering-anomaly cleaning. Taking network traffic capture files in pcap / pcapng format as the processing object, the parsing operation first restores the basic unit of network communication, the bidirectional communication flow record. Then, the protocol filtering operation achieves accurate separation of encrypted communication flow and unencrypted plaintext flow. Finally, the anomaly cleaning operation removes various invalid and abnormal flow records. The entire processing does not rely on parsing the packet payload content. It only extracts encrypted bidirectional flow that meets the requirements of subsequent encrypted malicious traffic characterization from the original traffic file by filtering the basic identification information of network communication and basic traffic attributes. This provides standardized basic data units for subsequent operations such as flow-level statistical feature extraction and behavior sequence construction.

[0028] As can be seen in this example, through preprocessing operations such as parsing, protocol filtering, and anomaly cleaning, encrypted bidirectional streams that cannot be directly parsed and have undergone anomaly removal were successfully filtered out from network traffic capture files containing encrypted malicious traffic in pcap / pcapng format. This effectively removed unencrypted plaintext traffic records and various invalid and abnormal flow records, avoiding interference from invalid data to subsequent encrypted malicious traffic characterization processing. At the same time, relying on the annotation information of the network traffic capture file, the corresponding flow tags can be matched, ensuring that the traffic data on which subsequent processing is based is a valid encrypted bidirectional stream that meets the requirements of encrypted traffic analysis. This lays an effective and standardized data foundation for subsequent operations such as flow-level statistical feature extraction and standardized behavior sequence construction.

[0029] Step S202: Based on the encrypted bidirectional stream, extract the stream-level statistical features, and construct a standardized behavior sequence through channel clustering and sequence length standardization.

[0030] The standardized behavior sequence consists of multiple behavior units arranged in chronological order. Each behavior unit corresponds to a single encrypted bidirectional stream, and each behavior unit contains the stream-level statistical feature information of the corresponding encrypted bidirectional stream.

[0031] In one possible embodiment, a standardized behavior sequence is constructed by extracting flow-level statistical features from the encrypted bidirectional stream, followed by channel clustering and concatenation, and sequence length standardization. This includes: performing time segmentation on the encrypted bidirectional stream according to a preset fixed time window to obtain encrypted bidirectional streams corresponding to different fixed time windows; performing communication channel partitioning on the encrypted bidirectional stream within each fixed time window based on IP pairs consisting of source and destination IP addresses to obtain multiple communication channels; sorting the encrypted bidirectional streams within each communication channel in ascending order using a timestamp as the starting time to obtain sorted encrypted bidirectional streams; extracting flow-level statistical features from the sorted encrypted bidirectional streams and combining them to form a single-channel behavior sequence; performing clustering operations based on the flow-level statistical features and the channel statistical features of each communication channel, and concatenating the single-channel behavior sequences from the clustered communication channels in the same category according to their starting time order to obtain an initial behavior sequence; and performing length standardization on the initial behavior sequence according to a preset standard length to obtain a standardized behavior sequence.

[0032] The communication channel is a set of encrypted bidirectional streams between the communication endpoints of the same IP pair, and the IP pair allows the source IP address and destination IP address to be interchanged during bidirectional communication.

[0033] The preset fixed time window is a 24-hour fixed time window, used to define the range of the original encrypted bidirectional streams involved in constructing the behavioral sequence; the stream-level statistical characteristics include at least PN (Packet Number), IAT (Inter-Arrival Time), and SP (Source Number). Port (source port) and DP (Destination Port), where the adjacent flow time interval is the time difference between the start times of two adjacent encrypted bidirectional flows after sorting within the same communication channel. The adjacent flow time interval of the first encrypted bidirectional flow within the communication channel is set to zero or a preset default value. Channel statistical features are features obtained by aggregating and statistically analyzing all encrypted bidirectional flows and flow-level statistical features within the communication channel, including at least the channel duration, the number of flows within the channel, the total data volume, the uplink data volume, and the downlink data volume. Single-channel behavior sequence is a behavior sequence formed by sequentially combining the flow-level statistical features within the same communication channel according to the order of their start times. Initial behavior sequence is a continuous behavior sequence formed by splicing single-channel behavior sequences from the same type of communication channels after clustering according to their start times. The preset standard length is a fixed sequence length adapted to the neural network input (128 in the example). The length standardization operation refers to the truncation or padding of the initial behavior sequence.

[0034] Furthermore, this embodiment follows a serial processing principle of time segmentation, channel partitioning, time-series sorting, feature extraction and single-sequence construction, channel clustering and multi-sequence concatenation, and length standardization. Taking encrypted bidirectional streams as the processing object, it first defines the traffic range using a fixed 24-hour time window. Then, it implements channel partitioning based on IP pairs according to the communication subject, while simultaneously sorting the traffic within each channel in ascending order of timestamps to ensure time sequence consistency. Subsequently, it extracts four-dimensional core flow-level statistical features and constructs single-channel behavior sequences. Then, it combines flow-level statistical features with channel statistical features to complete channel clustering. Single-channel behavior sequences corresponding to communication channels with similar behavior patterns are concatenated by time to form an initial behavior sequence. Finally, it performs truncation or padding operations on the initial behavior sequence according to a preset standard length to achieve unified standardization of sequence length. In this embodiment, the time window is used to determine the original traffic range participating in the construction of the behavior sequence, and the preset standard length is used to unify the constructed behavior sequence to a fixed input length acceptable to the neural network. These are independent concepts. The process first completes channel aggregation, clustering, and behavior sequence concatenation within a 24-hour window, and then truncates or pads according to the preset standard length.

[0035] As can be seen in this example, the above series of operations successfully constructed a standardized behavior sequence based on the encrypted bidirectional stream, realizing the hierarchical organization of the encrypted bidirectional stream in the time dimension and the communication subject dimension. This allows the behavior sequence to accurately characterize the overall communication behavior pattern of the encrypted traffic and the correlation between behavior units. By channel clustering and splicing, the behavior sequences of communication channels with similar behavior patterns are merged, avoiding the limitations of a single channel in characterizing the behavior of encrypted traffic. The sequence length standardization operation unifies the initial behavior sequence to a fixed length, providing input data with a unified format and fixed dimension for subsequent model training, meeting the input requirements for batch training of neural networks. At the same time, the entire construction process does not rely on message payload content parsing, but only uses flow-level statistical features and temporal relationships to complete the construction of structured behavior sequences.

[0036] In one possible embodiment, the flow-level statistical features include at least the number of data packets, the time interval between adjacent flows, the source port, and the destination port. The time interval between adjacent flows is the time difference between the start times of two adjacent encrypted bidirectional flows after sorting within the same communication channel. A single-channel behavior sequence is formed by combining the flow-level statistical features, including: performing a normalization operation on the time interval between adjacent flows in the flow-level statistical features based on the start times within the same communication channel to obtain a time interval between adjacent flows after time synchronization; and performing a format conversion operation on the flow-level statistical features according to the conversion rules for numerical sequences to obtain numerical statistical features. Based on the order of start times, a time-series combination operation is performed on the numerical statistical features within each communication channel to obtain the single-channel behavior sequence corresponding to each communication channel.

[0037] Among them, the adjacent flow time interval of the first encrypted bidirectional flow in the communication channel is set to zero or to a preset default value. This setting is the core requirement of the adjacent flow time interval normalization operation, which is used to ensure the integrity and uniformity of the timing characteristics of the adjacent flow time interval within the same communication channel. The conversion rule is used to indicate that continuous features in the flow-level statistical features retain floating-point or integer forms, while discrete source port and destination port features use the original values. Among them, the number of data packets and the adjacent flow time interval belong to continuous flow-level statistical features, while the source port and destination port belong to discrete flow-level statistical features. The normalization operation refers to the uniform and standardized processing operation of the numerical form of the adjacent flow time interval based on the start time of the encrypted bidirectional flow within the same communication channel. The numerical statistical features are the statistical features that are presented in numerical form after the flow-level statistical features have been format converted, and they are the basic units that constitute the single-channel behavior sequence.

[0038] This embodiment follows a serial processing principle of adjacent flow time interval regularization, flow-level statistical feature format conversion, and time-series combination of numerical statistical features. It takes the sorted encrypted bidirectional flows within the same communication channel as the processing object, and all operations are carried out based on the order of the start times of the encrypted bidirectional flows within the communication channel. First, the regularization operation unifies the numerical setting rules of the adjacent flow time interval to solve the problem of missing time intervals caused by the absence of a preceding flow in the first encrypted bidirectional flow. Then, the format conversion operation converts different types of flow-level statistical features into numerical forms to adapt to the input requirements of subsequent model processing. Finally, the numerical statistical features are combined in chronological order to form a single-channel behavior sequence. The entire process only performs time-series and numerical processing on the flow-level statistical features and does not rely on the parsing of the message payload content.

[0039] As can be seen, in this example, by regularizing the time intervals between adjacent flows, the integrity and uniformity of the timing features within the same communication channel are ensured, and the problem of determining the value of the time interval between adjacent flows of the first encrypted bidirectional flow is solved. Through format conversion, different types of flow-level statistical features are unified into numerical statistical features, providing a standardized numerical input basis for the construction of subsequent behavior sequences. Through timing combination operations based on the start time, a single-channel behavior sequence corresponding to each communication channel is successfully generated. This sequence can accurately reflect the timing communication behavior pattern of encrypted traffic within a single communication channel, providing a standardized and unified single-channel behavior sequence basis for subsequent channel clustering and splicing, and the construction of initial behavior sequences.

[0040] In one possible embodiment, a clustering operation is performed based on the flow-level statistical characteristics and the channel statistical characteristics of each communication channel, and a splicing operation is performed on the single-channel behavior sequences of the clustered communication channels of the same type according to the start time order to obtain an initial behavior sequence. This includes: performing a full aggregation statistical operation based on the encrypted bidirectional stream and flow-level statistical characteristics in each communication channel to obtain channel statistical characteristics; calculating the feature quantization similarity between any two communication channels based on the flow-level statistical characteristics and the channel statistical characteristics; clustering two communication channels with feature quantization similarity greater than or equal to a preset threshold into the same type of communication channels; and performing a time-series splicing operation based on the start time corresponding to the single-channel behavior sequence to obtain a continuous initial behavior sequence.

[0041] Among them, the start time corresponding to the single-channel behavior sequence is the start time of the first encrypted bidirectional stream in the communication channel; the full aggregation statistical operation refers to the operation of comprehensively summarizing and statistically calculating all encrypted bidirectional streams and extracted stream-level statistical features in each communication channel; the channel statistical features are the output results of the full aggregation statistical operation, which at least include the duration of the communication channel, the number of encrypted bidirectional streams in the channel, the total data volume, the uplink data volume, and the downlink data volume; the feature quantization similarity is the similarity index obtained after quantifying the stream-level statistical features and channel statistical features of any two communication channels, which is used to characterize the degree of similarity of the communication behavior patterns of the two communication channels; the preset threshold is the quantization reference value for determining whether two communication channels are of the same type, which is a fixed value set in advance; the time sequence splicing operation refers to the processing operation of continuously splicing the single-channel behavior sequences corresponding to the clustered communication channels of the same type according to the order of their respective start times.

[0042] This embodiment follows a serial processing principle of full aggregation statistics - feature quantization similarity calculation - channel clustering - time sequence splicing. Taking each communication channel and its corresponding single-channel behavior sequence as the processing object, it first performs full aggregation statistics of flow-level statistical features and encrypted bidirectional streams for each communication channel to obtain channel statistical features that reflect the overall communication attributes of the channel. Then, combining the flow-level statistical features and channel statistical features, feature quantization similarity calculation is performed on any two communication channels to achieve quantitative determination of the similarity of behavior patterns between channels. Subsequently, based on a preset threshold, channels that meet the similarity standard are clustered into the same type of communication channels to achieve the merging of channels with similar behavior patterns. Finally, based on the start time of the first encrypted bidirectional stream of the channel, the single-channel behavior sequences of the same type of channels are spliced ​​in time to form a continuous initial behavior sequence. The entire processing is based on the statistical features and time sequence relationship of encrypted traffic and does not depend on the parsing of message payload content.

[0043] As can be seen, in this example, by performing a full aggregation statistical operation on each communication channel, channel statistical features that reflect the overall communication attributes of the channel are obtained. Combining these with flow-level statistical features makes the similarity determination of the behavioral patterns between channels more comprehensive and accurate. Through feature quantization similarity calculation and preset threshold determination, communication channels with similar behavioral patterns are successfully clustered into similar channels, realizing the merging of similar communication behavioral patterns. By performing a time-series splicing operation based on the start time, the single-channel behavioral sequences of similar channels are spliced ​​into a continuous initial behavioral sequence, which can reflect the overall encrypted traffic communication behavioral pattern of similar communication channels. This makes up for the deficiency of the incomplete characterization of single-channel behavioral sequences and lays a standardized sequence foundation for subsequent sequence length standardization operations.

[0044] In one possible embodiment, a length standardization operation is performed on the initial behavior sequence according to a preset standard length to obtain a standardized behavior sequence, including: performing a sequence truncation operation on the initial behavior sequence whose length exceeds the preset standard length to obtain a truncated behavior sequence whose length conforms to the preset standard length; or performing a feature padding operation on the initial behavior sequence whose length is less than the preset standard length to obtain a padded behavior sequence whose length conforms to the preset standard length; and determining the truncated behavior sequence or the padded behavior sequence as a standardized behavior sequence with uniform length.

[0045] The preset standard length is a fixed sequence length that is pre-set and adapted to the batch training requirements of neural network models. In this example, the preset standard length is 128. The sequence truncation operation refers to the processing operation of retaining the feature content of the preset standard length in time sequence and removing the excess part for the initial behavior sequence whose length exceeds the preset standard length. The feature padding operation refers to the processing operation of supplementing the features at the end of the initial behavior sequence whose length is less than the preset standard length by padding with zeros until the sequence length reaches the preset standard length. The truncated behavior sequence and the padded behavior sequence are intermediate sequences obtained after performing differentiated processing on the initial behavior sequences of different lengths. Both of them meet the length requirement of the preset standard length.

[0046] In this embodiment, the processing principle of differentiated length processing and unified length determination is followed. The initial behavior sequence is used as the processing object. Based on the comparison between the actual length of the initial behavior sequence and the preset standard length, targeted sequence truncation or feature filling operations are performed. Both sequence truncation and feature filling follow the principle of time preservation to ensure that the temporal characteristics of the behavior sequence are not destroyed. The preset standard length in this embodiment is used to unify the constructed behavior sequence into a fixed input length acceptable to the neural network. It is an independent concept from the fixed time window used to define the original flow range of the behavior sequence construction. In terms of process, the initial behavior sequence is constructed first, and then the length standardization operation of this embodiment is performed.

[0047] As can be seen, in this example, by performing differentiated processing such as sequence truncation or feature padding on initial behavior sequences of different lengths, various initial behavior sequences were successfully unified into sequences that conform to the preset standard length. By determining the truncated or padded behavior sequences as standardized behavior sequences, the length of all behavior sequences was globally unified, which met the requirements of neural network models for fixed dimensions and uniform format of input data. This provided standardized and unified input data for the subsequent self-supervised joint training of the encoding and decoding models, ensuring the smooth progress of batch training of the models.

[0048] Step S203: Based on the standardized behavior sequence, perform self-supervised joint training of the pre-set encoding and decoding models. Optimize the model parameters through global feature extraction, sequence reconstruction, and error backpropagation to obtain and determine the trained encoding model as the feature extraction model.

[0049] In one possible embodiment, a pre-defined encoding and decoding model is subjected to self-supervised joint training based on a standardized behavior sequence. The model parameters are optimized through global feature extraction, sequence reconstruction, and error backpropagation to obtain and determine the trained encoding model as the feature extraction model. This includes: inputting the standardized behavior sequence into the encoding model to perform global feature extraction and sequence compression operations, outputting an intermediate vector representing the local communication features and cross-stream global aggregation behavior features of the encrypted bidirectional stream; inputting the intermediate vector into the decoding model to perform a sequence reconstruction operation, outputting a reconstructed sequence that maintains the same length and feature dimensions as the standardized behavior sequence; calculating the reconstruction error based on the elemental differences between the standardized behavior sequence and the reconstructed sequence to quantify the overall sequence reconstruction deviation; and performing error backpropagation in a self-supervised training mode based on the reconstruction error to simultaneously optimize the model parameters of the encoding and decoding models until a pre-defined model training convergence condition is met, at which point training is stopped and the parameters of the encoding model are fixed to obtain the feature extraction model.

[0050] The encoding model is a network model capable of sequence feature extraction and compression. It can be a recurrent neural network, a GRU (Gated Recurrent Unit), or an autoencoder network structure. In this example, a two-layer GRU encoding model is used, with each layer containing 128 hidden units and the tanh activation function. The decoding model is a sequence reconstruction network model symmetrical to the encoding model. In this example, a two-layer GRU decoding model is used, with the output layer having a linear activation function. The structures of the encoding and decoding models can be replaced with different types of recurrent neural network structures, gated network mechanisms, or other network structures with sequence modeling capabilities. The number of network layers, the number of hidden units, and the vector dimension can be flexibly adjusted according to the application scenario.

[0051] Global feature extraction refers to the operation of extracting the overall communication behavior pattern features of the standardized behavior sequence; sequence compression refers to the operation of mapping the high-dimensional standardized behavior sequence into a low-dimensional vector; the intermediate vector is the output of the encoding model, with a dimension of 128 in the example, which can simultaneously represent the local communication features of a single encrypted bidirectional stream and the cross-stream global aggregation behavior features between multiple streams; the sequence reconstruction operation refers to the operation of the decoding model to restore the low-dimensional intermediate vector into a sequence with the same dimensions as the original standardized behavior sequence; the reconstructed sequence is the output of the decoding model, with its length dimension and feature dimension completely consistent with the standardized behavior sequence, and it is aligned with the standardized behavior sequence element by element using the time step + feature dimension; the reconstruction error is an indicator that quantifies the difference between the elements of the standardized behavior sequence and the reconstructed sequence, and the core is calculated using MSE (Mean Squared Error); the reconstruction method can adopt different forms such as full sequence reconstruction, partial reconstruction, or feature dimension reconstruction, and the loss function can be optimized by selecting mean squared error, weighted reconstruction error, or other functions that quantify sequence differences according to actual needs.

[0052] Among them, the self-supervised training mode refers to the training mode that does not rely on sample labeling and only relies on the error feedback of sequence reconstruction to complete the optimization of model parameters; the error backpropagation operation refers to the operation of passing the reconstruction error from the model output layer to the input layer in reverse to update the model parameters; the preset model training convergence condition instance is that the validation set loss does not decrease within 10 consecutive rounds; the feature extraction model is an encoding model with fixed parameters after training convergence, which is only used for subsequent behavioral feature extraction of encrypted traffic; the decoding model only participates in training and does not participate in subsequent actual deployment.

[0053] This embodiment follows the serial processing principle of feature extraction and compression of the encoding model, sequence reconstruction of the decoding model, reconstruction error calculation, parameter optimization through backpropagation of error, and fixing of the encoding model after convergence. It uses standardized behavior sequences, a preset encoding model, and a decoding model as processing objects, and employs an end-to-end joint training approach for self-supervised training. First, the standardized behavior sequence is input into the encoding model, which performs global feature extraction and sequence compression through layer-by-layer processing, outputting an intermediate vector that considers both local and global features. Then, the intermediate vector is input into the decoding model, which performs sequence reconstruction to generate a reconstructed sequence with dimensions completely identical to the standardized behavior sequence. Finally, the reconstruction error between the standardized behavior sequence and the reconstructed sequence is calculated using an element-wise alignment method. The core MSE calculation formula is: ; in, To standardize the time step length of the behavioral sequence, For time step index, Indexed by feature dimensions, These are the feature values ​​of the original standardized behavioral sequence. To reconstruct the sequence feature values.

[0054] Furthermore, based on the reconstruction error, backpropagation of the error is performed in the self-supervised training mode to simultaneously optimize the parameters of the encoding and decoding models. The training parameters can be set as follows: batch size 32 or 64, optimizer Adam (Adaptive Moment Estimation), learning rate 0.001, number of training epochs 50, and Dropout (Dropout Regularization) ratio 0.2, which is the regularization method in model training to suppress model overfitting. When the preset model training convergence condition is reached, training is stopped, all parameters of the encoding model are fixed, and it is determined as the feature extraction model.

[0055] As can be seen, in this example, through self-supervised joint training of encoding and decoding, the parameters of the encoding and decoding models were successfully optimized using standardized behavior sequences, ultimately resulting in a trained feature extraction model. After training, the encoding model can accurately extract global features from standardized behavior sequences and perform sequence compression. The output intermediate vector can simultaneously represent the local communication features of encrypted bidirectional streams and the global aggregation behavior features across streams. Relying on the self-supervised training mode, the strong dependence on sample labeling is eliminated, improving the model's generalization ability. Through sequence reconstruction and backpropagation of reconstruction errors in the decoding model, the parameter optimization of the encoding model has clear error constraints, ensuring the feature extraction model's ability to extract encrypted traffic behavior features. The feature extraction model with fixed parameters can be directly used to generate behavior representation vectors for subsequent traffic to be detected, providing core model support for the subsequent identification and analysis of encrypted malicious traffic.

[0056] Step S204: Construct the standardized behavior sequence corresponding to the traffic to be detected and input it into the feature extraction model to output the behavior representation vector.

[0057] In step S204, the acquired traffic to be detected undergoes preprocessing, flow-level statistical feature extraction, channel clustering and splicing, and sequence length standardization operations that are completely consistent with those in the model training phase, to construct a standardized behavior sequence to be detected with a unified format; the sequence is then input into a feature extraction model that has been trained and has fixed parameters, and after the model performs feature extraction operations, it outputs the corresponding behavior representation vector.

[0058] In this application, the behavioral representation vector can be directly input into the subsequent machine learning model, or optional post-processing operations can be performed according to the actual downstream task requirements, including: performing feature normalization operations such as standardization or interval normalization on the output vector to improve the training stability of the downstream model; using PCA (Principal Component Analysis), t-SNE (t-Distributed Stochastic Neighbor Embedding), or UMAP (Uniform Manifold Approximation and Projection) for dimensionality reduction in visualization or retrieval tasks; performing feature selection and fusion as needed when combining traditional statistical features; and persistently storing the representation vector in engineering deployment to realize vector caching and batch inference for direct use by subsequent modules.

[0059] Step S205: Input the behavior representation vector into the preset encrypted traffic analysis machine learning model and output the traffic identification result.

[0060] Among them, the traffic identification results are used to characterize the malicious attributes, traffic categories, or abnormal communication states of the traffic to be detected.

[0061] In step S205, the behavior representation vector is input into a preset encrypted traffic analysis machine learning model. After the model performs calculations and analysis, the traffic identification result is output. The traffic identification result is used to characterize the malicious attributes, traffic categories, or abnormal communication states of the traffic to be detected. The encrypted traffic analysis machine learning model can be adapted to various model types that support fixed-dimensional numerical vector input, such as binary classification, multi-class classification, and anomaly detection.

[0062] It can be seen that, as Figure 2 As shown in the embodiments of this application, this solution does not require parsing the message payload throughout the entire process, breaking through the analysis limitation that encrypted traffic content cannot be parsed; by constructing a structured and standardized behavior sequence, it accurately depicts the overall communication behavior pattern of encrypted traffic and the correlation between behavior units, making up for the shortcomings of incomplete feature characterization in traditional methods; relying on self-supervised joint training of encoding and decoding, it gets rid of the strong dependence on sample labeling, effectively improving the generalization ability of the model, and can still maintain good representation effect when there are insufficient samples or changes in categories; the behavior representation vector output by the feature extraction model takes into account both local and global features, removes redundant information, and strengthens core behavior features; the encrypted traffic analysis machine learning model has strong adaptability and can directly connect to the representation vector to output accurate recognition results. The entire process is standardized and normalized, with low engineering deployment difficulty, providing reliable technical support for scenarios such as network security detection, malicious traffic tracing, and abnormal communication monitoring, and significantly improving the efficiency and accuracy of encrypted malicious traffic analysis.

[0063] The following are embodiments of the apparatus of this application. These embodiments of the apparatus and the embodiments of the method of this application belong to the same concept and are used to execute the methods described in the embodiments of this application. For ease of explanation, only the parts related to the apparatus embodiments of this application are shown in the embodiments of this application. For specific technical details not disclosed, please refer to the description of the embodiments of the method of this application, which will not be repeated here.

[0064] This application provides an encrypted malicious traffic characterization device based on statistical behavior sequences. Specifically, the encrypted malicious traffic characterization device based on statistical behavior sequences is used to execute the steps performed by the server in the above-described encrypted malicious traffic characterization method based on statistical behavior sequences. The encrypted malicious traffic characterization device based on statistical behavior sequences in this application may include modules corresponding to the respective steps.

[0065] This application embodiment can divide the encrypted malicious traffic characterization device based on statistical behavior sequences into functional modules according to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. The module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0066] When dividing each function into modules according to its corresponding function. Figure 3 This is a functional unit block diagram of an encrypted malicious traffic characterization device based on statistical behavior sequences provided in this application embodiment. The device 30 includes a preprocessing unit 301, used to acquire a network traffic capture file containing encrypted malicious traffic and perform preprocessing operations to obtain an encrypted bidirectional stream. The encrypted bidirectional stream is a bidirectional communication stream record that cannot be directly parsed for payload and has been anomaly-removed. A sequence construction unit 302 is used to extract flow-level statistical features based on the encrypted bidirectional stream, and construct a standardized behavior sequence through channel clustering and sequence length standardization. A model training unit 303 is used to perform self-supervised joint training of a preset encoding model and decoding model based on the standardized behavior sequence, and optimize the model parameters through global feature extraction, sequence reconstruction, and error backpropagation to obtain and determine the trained encoding model as the feature extraction model. A feature characterization unit 304 is used to construct the standardized behavior sequence to be detected corresponding to the traffic to be detected and input it into the feature extraction model, and output a behavior characterization vector. A traffic identification unit 305 is used to input the behavior characterization vector into a preset encrypted traffic analysis machine learning model and output a traffic identification result. The traffic identification result is used to characterize the malicious attributes, traffic category, or abnormal communication status of the traffic to be detected.

[0067] In one possible embodiment, in acquiring a network traffic capture file containing encrypted malicious traffic and performing preprocessing operations to obtain an encrypted bidirectional stream, the preprocessing unit 301 is specifically used to: parse the network traffic capture file into bidirectional communication stream records uniquely identified by a 5-tuple of information and a timestamp, wherein the 5-tuple information includes the source IP address, destination IP address, source port, destination port, and transport layer protocol; perform a protocol filtering operation on the bidirectional communication stream records, retaining encrypted communication stream records that use encrypted transport protocols and whose payload content cannot be directly parsed; and perform an anomaly cleaning operation on the filtered encrypted communication stream records, removing invalid abnormal stream records to obtain an encrypted bidirectional stream, wherein invalid abnormal stream records are bidirectional communication stream records that at least have incomplete packet capture, missing timestamps, missing key statistical fields, zero duration, zero data packet count, or corrupted format.

[0068] In one possible embodiment, regarding the extraction of stream-level statistical features based on encrypted bidirectional streams, followed by channel clustering and sequence length standardization to construct a standardized behavioral sequence, the sequence construction unit 302 is specifically used for: performing time segmentation on the encrypted bidirectional streams according to a preset fixed time window to obtain encrypted bidirectional streams corresponding to different fixed time windows; and performing communication channel partitioning operations on the encrypted bidirectional streams within each fixed time window based on IP pairs consisting of source IP addresses and destination IP addresses to obtain multiple communication channels. Each communication channel is a set of encrypted bidirectional streams between communication endpoints of the same IP pair, and the IP pairs allow source IP addresses... The destination IP address is exchanged during bidirectional communication; the encrypted bidirectional streams in each communication channel are sorted in ascending order starting from the timestamp to obtain sorted encrypted bidirectional streams; flow-level statistical features are extracted from the sorted encrypted bidirectional streams, and single-channel behavior sequences are formed based on the flow-level statistical features; clustering is performed based on the flow-level statistical features and the channel statistical features of each communication channel, and the single-channel behavior sequences in the same type of clustered communication channels are spliced ​​in order of their starting times to obtain the initial behavior sequence; according to the preset standard length, the initial behavior sequence is standardized to obtain the standardized behavior sequence.

[0069] In one possible embodiment, the flow-level statistical features include at least the number of data packets, the time interval between adjacent flows, the source port, and the destination port. The time interval between adjacent flows is the time difference between the start times of two adjacent encrypted bidirectional flows in the same communication channel after sorting. In terms of forming a single-channel behavior sequence based on the flow-level statistical features, the sequence construction unit 302 is specifically used to: perform a normalization operation on the time interval between adjacent flows in the flow-level statistical features according to the start time in the same communication channel to obtain the time interval between adjacent flows after time unification, and set the time interval between adjacent flows of the first encrypted bidirectional flow in the communication channel to zero or a preset default value; perform a format conversion operation on the flow-level statistical features according to the conversion rules of the numerical sequence to obtain numerical statistical features, and the conversion rules are used to indicate that the continuous features in the flow-level statistical features retain floating-point or integer forms, and the discrete source port and destination port features adopt the original values; and perform a time-series combination operation on the numerical statistical features in each communication channel according to the order of the start time to obtain the single-channel behavior sequence corresponding to each communication channel.

[0070] In one possible embodiment, the sequence construction unit 302 is specifically used to: perform a full aggregation statistical operation based on the encrypted bidirectional stream and the channel statistical characteristics of each communication channel to obtain the channel statistical characteristics; calculate the feature quantization similarity between any two communication channels based on the stream-level statistical characteristics and the channel statistical characteristics; cluster two communication channels whose feature quantization similarity is greater than or equal to a preset threshold into the same type of communication channels; and perform a time-series splicing operation based on the start time corresponding to the single-channel behavior sequence to obtain a continuous initial behavior sequence, wherein the start time corresponding to the single-channel behavior sequence is the start time of the first encrypted bidirectional stream in the communication channel to which it belongs.

[0071] In one possible embodiment, in order to perform a length standardization operation on the initial behavior sequence according to a preset standard length to obtain a standardized behavior sequence, the sequence construction unit 302 is specifically used to: perform a sequence truncation operation on the initial behavior sequence whose length exceeds the preset standard length to obtain a truncated behavior sequence whose length conforms to the preset standard length; or, perform a feature padding operation on the initial behavior sequence whose length is less than the preset standard length to obtain a padded behavior sequence whose length conforms to the preset standard length; and determine the truncated behavior sequence or the padded behavior sequence as a standardized behavior sequence with uniform length.

[0072] In one possible embodiment, in terms of performing self-supervised joint encoding and decoding training on a preset encoding model and decoding model based on a standardized behavior sequence, and optimizing model parameters through global feature extraction, sequence reconstruction, and error backpropagation to obtain and determine the trained encoding model as the feature extraction model, the model training unit 303 is specifically used to: input the standardized behavior sequence into the encoding model to perform global feature extraction and sequence compression operations, so as to output an intermediate vector for representing the local communication features and cross-stream global aggregation behavior features of the encrypted bidirectional stream; input the intermediate vector into the decoding model to perform a sequence reconstruction operation, so as to output a reconstructed sequence that is consistent with the length dimension and feature dimension of the standardized behavior sequence; calculate the reconstruction error based on the element differences between the standardized behavior sequence and the reconstructed sequence to quantify the overall sequence reconstruction deviation; and perform error backpropagation operation in the self-supervised training mode based on the reconstruction error to simultaneously optimize the model parameters of the encoding model and the decoding model until the preset model training convergence condition is reached, then stop training and fix the parameters of the encoding model to obtain the feature extraction model.

[0073] When using integrated units, such as Figure 4 As shown, Figure 4 This is a functional unit block diagram of another encrypted malicious traffic characterization device based on statistical behavior sequences provided in this application embodiment. Figure 4 The encrypted malicious traffic characterization device 40 based on statistical behavior sequences includes a processing module 402 and a communication module 401. The processing module 402 controls and manages the operations of the encrypted malicious traffic characterization device 40, including steps such as the preprocessing unit 301, sequence construction unit 302, model training unit 303, feature characterization unit 304, and traffic identification unit 305, and / or other processes for executing the techniques described herein. The communication module 401 supports interaction between the encrypted malicious traffic characterization device based on statistical behavior sequences and other devices. Figure 4 As shown, the encrypted malicious traffic characterization device based on statistical behavior sequences may include a storage module 403, which is used to store the program code and data of the encrypted malicious traffic characterization device based on statistical behavior sequences.

[0074] The processing module 402 can be a processor or processing module, such as a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), an ASIC, an FPGA, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc. The communication module 401 can be a transceiver, RF circuitry, or a communication interface, etc. The storage module 403 can be a memory.

[0075] All relevant content in each scenario involved in the above method embodiments can be referenced from the functional descriptions of the corresponding functional modules, and will not be repeated here. The above-mentioned encrypted malicious traffic characterization device 40 based on statistical behavior sequences can all execute the above-mentioned... Figure 2 The method shown is an encrypted malicious traffic characterization method based on statistical behavior sequences.

[0076] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions according to the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. A computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. Available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. Semiconductor media can be solid-state drives.

[0077] Figure 5 This is a structural block diagram of a server provided in an embodiment of this application. For example... Figure 5As shown, server 110 may include one or more of the following components: processor 501, memory 502 coupled to processor 501, wherein memory 502 may store one or more computer programs 503, the one or more computer programs 503 being configured to implement the methods described in the above embodiments when executed by one or more processors 501.

[0078] Processor 501 may include one or more processing cores. Processor 501 connects to various parts of server 110 using various interfaces and lines, and performs various functions and processes data of server 110 by running or executing instructions, programs, code sets, or instruction sets stored in memory 502, and by calling data stored in memory 502. Optionally, processor 501 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). Processor 501 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the displayed content; and the modem handles wireless communication. It is understood that the modem may also not be integrated into processor 501 and may be implemented separately using a communication chip.

[0079] The memory 502 may include random access memory (RAM) or read-only memory (ROM). The memory 502 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 502 may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as touch functionality, sound playback functionality, image playback functionality, etc.), and instructions for implementing the various method embodiments described above. The data storage area may also store data created by the server 110 during use.

[0080] It is understood that server 110 may include more or fewer structural elements than those shown in the above block diagram, and this is not limited thereto.

[0081] This application also provides a computer storage medium storing a computer program / instructions thereon, which, when executed by a processor, implements some or all of the steps of any of the methods described in the above method embodiments.

[0082] This application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program operable to cause a computer to perform some or all of the steps of any of the methods described in the above method embodiments.

[0083] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0084] In the several embodiments provided in this application, it should be understood that the disclosed methods, apparatuses, and systems can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for example, the division of units is merely a logical functional division, and there may be other division methods in actual implementation; for example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0085] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0086] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can be physically comprised separately, or two or more units can be integrated into one unit. The integrated unit described above can be implemented in hardware or in the form of hardware plus software functional units.

[0087] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute partial steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes: a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, volatile memory, or non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM), etc., which are various media capable of storing program code.

[0088] While the present invention has been disclosed above, it is not limited thereto. Any person skilled in the art can easily conceive of variations or substitutions without departing from the spirit and scope of the present invention, and various modifications and alterations can be made, including combinations of the different functions and implementation steps described above, as well as software and hardware implementation methods, all of which are within the protection scope of the present invention.

Claims

1. A method for characterizing encrypted malicious traffic based on statistical behavior sequences, characterized in that, The method comprises the following steps: obtaining a network traffic capture file containing encrypted malicious traffic, and performing a preprocessing operation to obtain an encrypted bidirectional flow, wherein the encrypted bidirectional flow is a bidirectional communication flow record that cannot directly analyze the payload and is filtered out by an exception; extracting flow-level statistical features based on the encrypted bidirectional flow, performing channel clustering splicing and sequence length normalization, and constructing a standardized behavior sequence; based on the standardized behavior sequence, the preset encoding model and decoding model are jointly trained by encoding and decoding self-supervision, the model parameters are optimized through global feature extraction, sequence reconstruction and error back propagation, and the trained encoding model is determined as a feature extraction model; constructing a to-be-detected standardized behavior sequence corresponding to to-be-detected traffic and inputting the to-be-detected standardized behavior sequence into the feature extraction model to output a behavior representation vector; inputting the behavior representation vector into a preset encrypted traffic analysis machine learning model to output a traffic recognition result, wherein the traffic recognition result is used to represent the malicious property, traffic category or abnormal communication state of the to-be-detected traffic.

2. The method of claim 1, wherein, The method comprises the following steps: parsing the network traffic capture file into bidirectional communication flow records identified by five-tuple information and time stamp, wherein the five-tuple information includes source IP address, destination IP address, source port, destination port and transmission layer protocol; performing a protocol filtering operation on the bidirectional communication flow records to retain encrypted communication flow records that use encrypted transmission protocols and cannot directly analyze payload content; performing an exception cleaning operation on the filtered encrypted communication flow records to filter out invalid abnormal flow records, wherein the invalid abnormal flow records are bidirectional communication flow records that are at least incomplete, lack time stamps, lack key statistical fields, have zero duration, have zero data packet number or have format damage.

3. The method of claim 2, wherein, The method comprises the following steps: performing time division on the encrypted bidirectional flow according to a preset fixed time window to obtain encrypted bidirectional flows corresponding to different fixed time windows; performing a communication channel division operation on the encrypted bidirectional flow in each fixed time window according to an IP pair formed by the source IP address and the destination IP address to obtain a plurality of communication channels, wherein the communication channel is a set of encrypted bidirectional flows between communication endpoints of the same IP pair, and the IP pair allows the source IP address and the destination IP address to be exchanged in bidirectional communication; performing ascending sorting on the encrypted bidirectional flow in each communication channel with the time stamp as the starting time to obtain sorted encrypted bidirectional flow; extracting the flow-level statistical features from the sorted encrypted bidirectional flow and combining the flow-level statistical features to form a single-channel behavior sequence; performing clustering operation according to the flow-level statistical features and channel statistical features of each communication channel, and performing splicing operation on the single-channel behavior sequences in the clustered same communication channel in the order of the starting time to obtain an initial behavior sequence; Based on a preset standard length, a length standardization operation is performed on the initial behavior sequence to obtain the standardized behavior sequence.

4. The method of claim 3, wherein, The stream-level statistical features include at least the number of data packets, the time interval between adjacent streams, the source port, and the destination port. The time interval between adjacent streams is the time difference between the start times of two adjacent encrypted bidirectional streams after sorting within the same communication channel. The step of forming a single-channel behavior sequence based on the combined flow-level statistical characteristics includes: Based on the start time within the same communication channel, a normalization operation is performed on the adjacent flow time interval in the flow-level statistical characteristics to obtain the time interval of adjacent flow after time-unified processing. The adjacent flow time interval of the first encrypted bidirectional flow within the communication channel is set to zero or a preset default value. According to the conversion rules of numerical sequences, the flow-level statistical features are subjected to format conversion operations to obtain numerical statistical features. The conversion rules are used to indicate that continuous features in the flow-level statistical features retain floating-point or integer forms, while the discrete source port and destination port features adopt the original values. Based on the order of the start times, a time-series combination operation is performed on the numerical statistical features within each communication channel to obtain a single-channel behavior sequence corresponding to each communication channel.

5. The method of claim 3, wherein, The step of performing clustering operations based on the flow-level statistical characteristics and the channel statistical characteristics of each communication channel, and performing a splicing operation on the single-channel behavior sequences of the clustered communication channels of the same type according to the starting time order to obtain the initial behavior sequence, includes: Based on the encrypted bidirectional stream and the stream-level statistical characteristics in each communication channel, a full aggregation statistical operation is performed to obtain the channel statistical characteristics; Based on the flow-level statistical characteristics and the channel statistical characteristics, calculate the feature quantization similarity between any two of the communication channels; Two communication channels whose feature quantization similarity is greater than or equal to a preset threshold are clustered into the same type of communication channels; A timing splicing operation is performed based on the start time corresponding to the single-channel behavior sequence to obtain a continuous initial behavior sequence. The start time corresponding to the single-channel behavior sequence is the start time of the first encrypted bidirectional stream in the communication channel to which it belongs.

6. The method of claim 3, wherein, The step of performing a length standardization operation on the initial behavior sequence according to a preset standard length to obtain the standardized behavior sequence includes: Perform a sequence truncation operation on the initial behavior sequence whose length exceeds the preset standard length to obtain a truncated behavior sequence whose length conforms to the preset standard length; or, For initial behavior sequences whose length is less than the preset standard length, a feature padding operation is performed to obtain a padding behavior sequence whose length conforms to the preset standard length; The truncated behavior sequence or the padded behavior sequence is determined as a standardized behavior sequence with uniform length.

7. The method according to any one of claims 1 to 6, characterized in that, The step of performing self-supervised joint training of the preset encoding and decoding models based on the standardized behavior sequence, optimizing model parameters through global feature extraction, sequence reconstruction, and error backpropagation, to obtain and determine the trained encoding model as the feature extraction model includes: The standardized behavior sequence is input into the encoding model to perform global feature extraction and sequence compression operations, so as to output an intermediate vector for characterizing the local communication features and cross-stream global aggregation behavior features of the encrypted bidirectional stream; The intermediate vector is input into the decoding model to perform a sequence reconstruction operation, so as to output a reconstructed sequence that is consistent with the length dimension and feature dimension of the standardized behavior sequence; The reconstruction error is calculated based on the elemental differences between the standardized behavior sequence and the reconstructed sequence to quantify the overall reconstruction deviation of the sequence. Based on the reconstruction error, backpropagation is performed in the self-supervised training mode to simultaneously optimize the model parameters of the encoding model and the decoding model until the preset model training convergence condition is met. Then, training is stopped and the parameters of the encoding model are fixed to obtain the feature extraction model.

8. A device for characterizing encrypted malicious traffic based on statistical behavior sequences, characterized in that, include: The preprocessing unit is used to acquire a network traffic capture file containing encrypted malicious traffic and perform preprocessing operations to obtain an encrypted bidirectional stream. The encrypted bidirectional stream is a bidirectional communication stream record that cannot be directly parsed and has been anomaly-removed. The sequence construction unit is used to extract stream-level statistical features based on the encrypted bidirectional stream, and construct a standardized behavior sequence through channel clustering and sequence length standardization; The model training unit is used to perform self-supervised joint training of the preset encoding model and decoding model based on the standardized behavior sequence, and optimize the model parameters through global feature extraction, sequence reconstruction and error backpropagation, so as to obtain and determine the trained encoding model as the feature extraction model. The feature representation unit is used to construct the standardized behavior sequence to be detected corresponding to the traffic to be detected and input it into the feature extraction model, and output the behavior representation vector. The traffic identification unit is used to input the behavior representation vector into a preset encrypted traffic analysis machine learning model and output the traffic identification result. The traffic identification result is used to characterize the malicious attributes, traffic category or abnormal communication status of the traffic to be detected.

9. A server, characterized by The method includes a processor, a memory, a communication interface, and one or more programs, said programs being stored in the memory and configured to be executed by the processor, said programs including instructions for performing the steps of the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, A computer program for storing electronic data interchange is provided, wherein the computer program causes a computer to perform the method as described in any one of claims 1-7.

Images