A SSH hidden tunnel detection device and method for industrial control network

Abstract

The present invention discloses an SSH hidden tunnel detection device and method for industrial control networks. The SSH hidden tunnel detection device includes a flow collection and analysis system, a data processing and analysis system, and a machine learning system. The pattern vector uses a sequence recognition algorithm to identify whether the SSH tunnel boundary exists, and uses flow statistics data and a trained integrated learning algorithm model to detect the SSH tunnel flow. Then, a voting scheme (voting) is combined with the results of the two models to determine whether the specific flow data is SSH hidden tunnel flow. The technical solution can realize the detection of SSH hidden tunnel flow to solve the problem of SSH hidden tunnel information leakage in the industrial control field in the prior art.

Description

Technical Field

[0001] The present invention relates to the field of information security detection in industrial control networks, and in particular to a device and method for detecting SSH concealed tunnel traffic in an industrial control network environment. Background Art

[0002] Industrial control network security has increasingly become one of the hot topics in the market, but the means of detecting various attacks within industrial control networks still need to be developed, especially for the detection technology related to information leakage between the edge of the industrial control network and the traditional IT network. As a two-way encrypted secure remote communication, the Secure Shell (SSH) protocol is often used for remote login and file transfer for secure encryption. In addition, SSH can also forward network data from other TCP ports through SSH connections, and automatically provides corresponding encryption and decryption services, namely encrypted tunnels. Based on this, it is often used to transmit sensitive information between internal and external networks, especially OT networks (industrial control networks) and traditional IT networks, threatening the information security of industrial control networks. Therefore, a new technical solution is needed to solve the above problems. Summary of the invention

[0003] The purpose of the present invention is to solve the problem of SSH hidden tunnel information leakage in the current industrial control field.

[0004] In order to solve the above technical problems, the present invention provides an SSH hidden tunnel detection device for industrial control network, including: a flow collection and analysis system, which is used to parse the industrial control SSH protocol flow data; a data processing and analysis system, which is used to reconstruct the TCP flow for each packet of data, and if the TCP flow three-way handshake information is incomplete, all relevant data packets of the reconstructed TCP flow are discarded, otherwise a unique identifier is generated for the reconstructed TCP flow to be grouped; the flow pattern vectors of the specified number of packets in each reconstructed TCP flow are counted, and feature engineering is constructed for the flow statistical information to generate data results; a machine learning system; which is used to take the marked normal flow as the normal class and the hidden tunnel flow as the abnormal class, and the two types of data are randomly merged according to A certain proportion of random sampling is performed to generate a training set, a test set, and a validation set; the sequence recognition model is trained on the pattern vector part of the merged data, and the base classifier is used to minimize the classification error as the goal. The cross entropy loss function is used to continuously iterate and optimize the model structure parameters, that is, the training model, and the results of the multi-classification model are fused using ensemble learning to obtain the ensemble learning algorithm model, and finally the results of the sequence recognition model and the ensemble learning algorithm model are weighted by voting to generate an industrial control site SSH hidden tunnel detection model; the data results are transferred into the industrial control site SSH hidden tunnel detection model to obtain the model output results, and the detection model is called to detect the model output result data to obtain the classification results of each flow.

[0005] Corresponding to the above-mentioned SSH hidden tunnel detection device, the present invention also provides a technical solution for an SSH hidden tunnel detection method in an industrial control network, comprising the following steps:

[0006] (1) Parse the industrial control SSH protocol traffic data;

[0007] (2) Reconstruct the TCP stream for each packet of data. If the three-way handshake information of the TCP stream is incomplete, all relevant data packets of the reconstructed TCP stream are discarded. Otherwise, a unique identifier is generated for the reconstructed TCP stream to group them; count the flow pattern vectors of the specified number of packets in each reconstructed TCP stream, and construct feature engineering for the flow statistical information to generate data results;

[0008] (3) The marked normal traffic is taken as the normal class, and the hidden tunnel traffic is taken as the abnormal class. The two types of data are randomly merged and randomly extracted in a certain proportion to generate a training set, a test set, and a validation set; the sequence recognition model is trained on the pattern vector part of the merged data, and the base classifier is used to minimize the classification error as the goal. The cross entropy loss function is used to continuously iterate and optimize the model structure parameters, that is, the training model, and the results of the multi-classification model are integrated by ensemble learning to obtain the ensemble learning algorithm model, and finally the results of the sequence recognition model and the ensemble learning algorithm model are weighted by voting to generate an industrial control site SSH hidden tunnel detection model; the data results are transferred to the industrial control site SSH hidden tunnel detection model to obtain the model output results, and the detection model is called to detect the model output result data to obtain the classification results of each flow.

[0009] Beneficial effect: The technical solution of the SSH hidden tunnel detection device and method for industrial control network provided by the present invention uses machine learning related algorithms to model the SSH hidden tunnel; the statistical characteristics such as the arrival time of data packets and the size of packets are different due to the difference in handshake and interaction mode design between the SSH hidden tunnel and other functions of SSH. In addition, according to relevant research, the tunnel start boundary has certain serialization characteristics. Therefore, in this solution, machine learning related algorithms are used to model the SSH hidden tunnel. The pattern vector is used to use a sequence recognition algorithm to identify whether the SSH tunnel boundary exists, and the flow statistics data and the trained integrated learning algorithm model are used to detect the SSH tunnel traffic. Then, a voting scheme (voting) is combined with the results of the two models to determine whether the specific flow data is SSH hidden tunnel traffic. This technical solution can realize the detection of SSH hidden tunnel traffic to solve the problem of SSH hidden tunnel information leakage in the industrial control field in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 The figure is a flowchart of the overall process of the method of the present invention.

[0011] Figure 2 The figure is a flow chart related to data preprocessing in the method of the present invention.

[0012] Figure 3 Schematic diagram of the model algorithm. DETAILED DESCRIPTION

[0013] Embodiment 1

[0014] Please combine Figure 1 and Figure 2 As shown, this embodiment provides an SSH hidden tunnel detection device for an industrial control network, including:

[0015] Traffic receiving device: used to collect industrial control SSH protocol traffic data. The traffic receiving device is placed on the primary switch side of the industrial site to receive industrial control network traffic.

[0016] The traffic collection and analysis system is used to analyze the industrial control SSH protocol traffic data; including: five elements, timestamp, TCP flag, SEQ number, ACK number, SSH packet payload length; the five elements include source IP, destination IP, source port, destination port, and protocol name.

[0017] The data processing and analysis system is used to reconstruct the TCP flow for each packet of data. If the TCP flow three-way handshake information is incomplete, all relevant data packets of the reconstructed TCP flow are discarded. Otherwise, a unique identifier is generated for the reconstructed TCP flow to group them. The flow pattern vector of the specified number of packets in each reconstructed TCP flow is counted, and the flow pattern vector is extracted. The packet length of the specified number of packets in each flow is extracted, and the window (t) size is slided to obtain (X1, X2, ... X t ), where X i =(x,y,z),X i It is the first data packet, x is the packet size, y is the direction, and z is the packet interval.

[0018] And, construct feature engineering for flow statistics to generate data results; constructing feature engineering includes constructing feature engineering for flow statistics divided by network layer and transport layer, and constructing feature engineering for flow statistics divided by time.

[0019] The feature engineering of constructing flow statistics information divided by network layer and transport layer includes: counting the maximum value of the size of incoming data packets and the minimum value of the size of incoming data packets; calculating the mean value of the size of incoming data packets, the standard deviation of the size of incoming data packets, the total value of the size of incoming data packets, and the total number of incoming data packets; counting the maximum value of the size of outgoing data packets and the minimum value of the size of outgoing data packets; calculating the mean value of the size of outgoing data packets, the variance of the size of outgoing data packets, and the total value of the size of outgoing data packets;

[0020] The feature engineering of flow statistics divided by time includes: counting session duration, the maximum value of the interval time between incoming data packets, and the minimum value of the interval time between incoming data packets; calculating the mean value of the interval time between incoming data packets and the standard deviation of the interval time between incoming data packets; counting the maximum value of the interval time between data packet pairs and the minimum value of the interval time between outgoing data packet pairs; calculating the mean value of the interval time between data packet pairs and the standard deviation of the interval time between outgoing data packet pairs.

[0021] A machine learning system; used to treat the marked normal traffic as the normal class and the hidden tunnel traffic as the abnormal class, randomly merge the two types of data and randomly extract them according to a certain ratio to generate a training set, a test set and a validation set; train a sequence recognition model for the pattern vector part of the merged data and use a base classifier to minimize the classification error as the goal, use a cross entropy loss function, continuously iterate and optimize the model structure parameters, that is, train the model, and use integrated learning to fuse the results of multiple classification models to obtain an integrated learning algorithm model, and finally weight the results of the sequence recognition model and the integrated learning algorithm model by voting to generate an industrial control site SSH hidden tunnel detection model; transfer the data results into the industrial control site SSH hidden tunnel detection model to obtain the model output results, and call the detection model to detect the model output result data to obtain each flow classification result.

[0022] Embodiment 2

[0023] Please combine again Figures 1 to 3 As shown, this embodiment is a SSH hidden tunnel detection method for an industrial control network, comprising the following steps:

[0024] (1) Parse the industrial control SSH protocol traffic data, including: five elements, timestamp, TCP flag, SEQnumber, ACK number, SSH packet payload length; five elements include source IP, destination IP, source port, destination port, protocol name

[0025] (2) Reconstruct the TCP stream for each packet of data. If the three-way handshake information of the TCP stream is incomplete, all relevant data packets of the reconstructed TCP stream are discarded. Otherwise, a unique identifier is generated for the reconstructed TCP stream to group them. Count the flow pattern vectors of the first specified number of packets in each reconstructed TCP stream, extract the flow pattern vector, extract the packet length of the first specified number of packets of each stream, slide according to the specified window (t), and obtain (X1, X2, ... X t ), where X i =(x,y,z),X i It is the first data packet, x is the packet size, y is the direction, and z is the packet interval.

[0026] And, construct feature engineering for flow statistics to generate data results. Convection statistics feature engineering includes:

[0027] Step 2.1. Divide by network layer and transport layer: count the maximum value of the size of the incoming data packet and the minimum value of the size of the incoming data packet; calculate the mean value of the size of the incoming data packet, the standard deviation of the size of the incoming data packet, the total value of the size of the incoming data packet, and the total number of incoming data packets; count the maximum value of the size of the outgoing data packet and the minimum value of the size of the outgoing data packet; calculate the mean value of the size of the outgoing data packet, the variance of the size of the outgoing data packet, and the total value of the size of the outgoing data packet;

[0028] Step 2.2. Divide by time: count the duration of the session, the maximum value of the interval time between incoming data packets, and the minimum value of the interval time between incoming data packets; calculate the mean value of the interval time between incoming data packets and the standard deviation of the interval time between incoming data packets; count the maximum value of the interval time between outgoing data packets and the minimum value of the interval time between outgoing data packets; calculate the mean value of the interval time between outgoing data packets and the standard deviation of the interval time between outgoing data packets;

[0029] The above mean is calculated as:

[0030] The variance is calculated as:

[0031] Where x is the type of data that needs to be calculated in each group, and N is the number of data.

[0032] Step 2.3. All the above data results are merged and stored in an unstructured database (ES) according to the unique stream identifier for subsequent integrated learning algorithm detection.

[0033] (3) Figure 3The figure shows a machine learning system, which is collected from real industrial field data; the marked normal traffic is taken as the normal class, and the hidden tunnel traffic (transmission traffic containing data information related content) is taken as the abnormal class. The two types of data are randomly merged and randomly extracted according to a certain ratio (such as 7:2:1, 8:1:1, etc.) to generate training sets, test sets and validation sets (for example, 70% of the data is used to generate the training set, 20% of the data is used to generate the test set, and 10% of the data is used to generate the validation set); the sequence recognition model is trained for the pattern vector part of the merged data, and the base classifiers such as logistic regression (LR), decision tree, support vector machine (SVM), multi-layer perceptron (MLP) are used at the same time to minimize the classification error as the goal, and the cross entropy loss function is used to continuously iterate and optimize the model structure parameters, that is, the training model, and the results of the multi-classification model are integrated by ensemble learning to obtain the ensemble learning algorithm model, and finally the results of the sequence recognition model and the ensemble learning algorithm model are weighted by voting to generate the industrial control field SSH hidden tunnel detection model;

[0034] (4) After taking out the processed data from the ES database as the input of the integrated learning algorithm model, the integrated learning algorithm model is called on the server to obtain the output result, which is the model output result of each flow (normal traffic or covert tunnel traffic); and the industrial control site SSH covert tunnel detection model is called to detect the data to obtain the classification result of each flow.

[0035] (5) For traffic classified as SSH covert tunnel, record five-element information, push it to the designated front end, and generate relevant alarms.

[0036] The present invention has many specific application paths. The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, improvements made without departing from the method and system mentioned in the present invention should also be regarded as the scope of protection of the present invention.

Claims

1. A SSH hidden tunnel detection device for industrial control network, characterized in that: include: Traffic collection and analysis system, used to analyze industrial control SSH protocol traffic data; A data processing and analysis system is used to reconstruct the TCP stream for each packet of data. If the three-way handshake information of the TCP stream is incomplete, all relevant data packets of the reconstructed TCP stream are discarded. Otherwise, a unique identifier is generated for the reconstructed TCP stream to group it; Count the flow pattern vectors of the specified number of packets in each reconstructed TCP flow, and construct feature engineering for the flow statistics to generate data results; The feature engineering of flow statistics in the data processing and analysis system includes the feature engineering of flow statistics divided by network layer and transport layer and the feature engineering of flow statistics divided by time. The feature engineering of constructing flow statistics information divided by network layer and transport layer includes: counting the maximum value of the size of incoming data packets and the minimum value of the size of incoming data packets; calculating the mean value of the size of incoming data packets, the standard deviation of the size of incoming data packets, the total value of the size of incoming data packets, and the total number of incoming data packets; counting the maximum value of the size of outgoing data packets and the minimum value of the size of outgoing data packets; calculating the mean value of the size of outgoing data packets, the variance of the size of outgoing data packets, and the total value of the size of outgoing data packets; The feature engineering of constructing flow statistics information divided by time includes: counting session duration, the maximum value of the interval time between incoming data packets, and the minimum value of the interval time between incoming data packets; calculating the mean value of the interval time between incoming data packets and the standard deviation of the interval time between incoming data packets; counting the maximum value of the interval time between data packets and the minimum value of the interval time between outgoing data packets; calculating the mean value of the interval time between data packets and the standard deviation of the interval time between outgoing data packets; A machine learning system; used to treat the marked normal traffic as the normal class and the hidden tunnel traffic as the abnormal class, randomly merge the two types of data and randomly extract them according to a certain ratio to generate a training set, a test set and a validation set; train a sequence recognition model for the pattern vector part of the merged data and use a base classifier to minimize the classification error as the goal, use a cross entropy loss function, continuously iterate and optimize the model structure parameters, that is, train the model, and use integrated learning to fuse the results of multiple classification models to obtain an integrated learning algorithm model, and finally weight the results of the sequence recognition model and the integrated learning algorithm model by voting to generate an industrial control site SSH hidden tunnel detection model; transfer the data results into the industrial control site SSH hidden tunnel detection model to obtain the model output results, and call the detection model to detect the model output result data to obtain each flow classification result.

2. The SSH hidden tunnel detection device according to claim 1, characterized in that: The flow pattern vector extracted in the data processing and analysis system is to extract the packet length of the specified number of packets before each flow, slide according to the specified window (t) size, and obtain ( X 1, X 2, … X t ),in X i =( x , y , z ), X i It is the first data packet, x is the packet size, y is the direction, and z is the packet interval.

3. The SSH hidden tunnel detection device according to claim 1 is characterized in that: In the traffic set and analysis system, the analysis of SSH protocol traffic includes: five elements, timestamp, TCP flag, SEQ number, ACK number, and SSH packet payload length; the five elements include source IP, destination IP, source port, destination port, and protocol name; the unique identifier uses the five-element information to perform hash calculation to generate a unique string.

4. The SSH hidden tunnel detection device according to claim 1, characterized in that: It also includes a flow receiving device for collecting industrial control SSH protocol flow data.

5. A SSH hidden tunnel detection method for industrial control networks, characterized in that: The following steps are involved: (1) Parse the industrial control SSH protocol traffic data; (2) Reconstruct the TCP stream for each packet of data. If the three-way handshake information of the TCP stream is incomplete, that is, there are no complete three handshake process packets, then all relevant data packets of the reconstructed TCP stream will be discarded. Otherwise, a unique identifier will be generated for the reconstructed TCP stream to group them; count the flow pattern vectors of the specified number of packets in each reconstructed TCP stream ( X 1, X 2, … X t ), and construct feature engineering for stream statistics to generate data results; Convection statistics feature engineering includes: Step 2.

1. Divide by network layer and transport layer: count the maximum size of the data packets sent from the client to the server, and the minimum size of the data packets; calculate the mean size of the incoming data packets, the standard deviation of the size of the incoming data packets, the total size of the incoming data packets, and the total number of incoming data packets; count the maximum size of the outgoing data packets, and the minimum size of the outgoing data packets; calculate the mean size of the outgoing data packets, the variance of the outgoing data packets, and the total size of the outgoing data packets; Step 2.

2. Divide by time: count the duration of the session, the maximum value of the interval time between incoming data packets, and the minimum value of the interval time between incoming data packets; calculate the mean value of the interval time between incoming data packets and the standard deviation of the interval time between incoming data packets; count the maximum value of the interval time between outgoing data packets and the minimum value of the interval time between outgoing data packets; calculate the mean value of the interval time between outgoing data packets and the standard deviation of the interval time between outgoing data packets; Step 2.

3. All the above data results are merged and stored in an unstructured database according to the unique stream identifier for subsequent integrated learning algorithm detection; (3) The marked normal traffic is taken as the normal class, and the hidden tunnel traffic is taken as the abnormal class. The two types of data are randomly merged and randomly extracted in a certain proportion to generate a training set, a test set, and a validation set; the sequence recognition model is trained on the pattern vector part of the merged data, and the base classifier is used to minimize the classification error as the goal. The cross entropy loss function is used to continuously iterate and optimize the model structure parameters, that is, the training model, and the results of the multi-classification model are fused using ensemble learning to obtain the ensemble learning algorithm model. Finally, the results of the sequence recognition model and the ensemble learning algorithm model are weighted by voting to generate an industrial control site SSH hidden tunnel detection model; the data results are transferred to the industrial control site SSH hidden tunnel detection model to obtain the model output results, and the detection model is called to detect the model output result data to obtain the classification results of each flow.

6. The SSH hidden tunnel detection method according to claim 5, characterized in that: In step (2), the flow pattern vector is extracted by extracting the packet length of the first specified number of packets of each flow, sliding according to the specified window size (t), and obtaining ( X 1, X 2, … X t ),in X i =( x , y , z ), X i It is the first data packet, x is the packet size, y is the direction, and z is the packet interval.

7. The SSH hidden tunnel detection method according to claim 5, characterized in that: In step (1), the analysis of SSH protocol traffic includes: five elements, timestamp, TCP flag, SEQ number, ACK number, SSH packet payload length; the five elements include source IP, destination IP, source port, destination port, and protocol name.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 5 to 7 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 5 to 7 are implemented.

Images