An efficient malicious traffic detection method based on national secret series algorithm

Abstract

The present invention provides an efficient malicious traffic detection method based on a national secret series algorithm, comprising the following steps: step S1, a sender sets a rule set; step S2, the sender and a receiver set a negotiated key; step S3, the sender generates a vector with wildcards, a non-wildcard subscript set and a random number for a rule in the rule set; step S4, the sender generates trapdoor information required for detecting traffic; step S5, the sender generates a quick retrieval table by negotiating a key and a vector; step S6, the sender sends the trapdoor information and the quick retrieval table to a cloud service provider; step S7, the sender converts plaintext data to be sent to the receiver into ciphertext; step S8, the sender sends the ciphertext to the cloud service provider, and the cloud service provider uses the trapdoor information, the quick retrieval table and the ciphertext to filter the traffic to obtain normal traffic and malicious traffic; step S9, the cloud service provider restores the operation corresponding to the rule through the trapdoor information, and performs the operation on the malicious traffic.

Description

Technical Field

[0001] The present invention relates to an intrusion detection method under ciphertext traffic, and in particular to an efficient malicious traffic detection method based on a national secret series algorithm. Background Art

[0002] As network security is gaining more and more attention from the public, HTTPS is now widely used on the Internet. Studies have shown that 80% of the data transmitted on the Internet today is transmitted in ciphertext. Although this improves the security of data transmission on the open Internet, it poses a huge challenge to the traditional plaintext-based traffic intrusion detection model because the data packets are encrypted. Assuming that malicious code attacks the target host in the form of ciphertext, it will bring difficulties to the traffic intrusion detection of network security equipment and also pose a threat to Internet security.

[0003] Intrusion detection technology is based on the open Internet. Due to insufficient local computing power or limited storage space, users will outsource data and company-defined rule sets to cloud service providers for processing. If the data and rule sets are transmitted to the cloud service provider in plain text for processing and filtering, the cloud service provider can obtain user information at will, posing a major challenge to user privacy protection.

[0004] Research shows that malicious traffic on the Internet accounts for less than 0.01% of total traffic. Performing intrusion detection on each data packet will consume a lot of computing and time costs. The emergence of cloud computing has reduced computing costs, but the time cost has not changed significantly, which will affect the user experience of Internet users.

[0005] In the ciphertext-based intrusion detection model, there are generally three entities, namely the sender, the receiver, and the cloud service provider. In order to filter the data according to the intrusion detection rule set, some solutions first transmit the encrypted data sent by the sender to the cloud service provider, which decrypts the data and filters it according to the plaintext rule set provided by the company. Finally, the cloud service provider encrypts the data again and sends it to the receiver. However, this undoubtedly directly exposes the plaintext data and rule set to the cloud service provider, infringing the user's privacy. Therefore, studying the intrusion detection technology of traffic in the ciphertext state is of great significance to network security and user privacy protection. Summary of the invention

[0006] The present invention is made to solve the above-mentioned problems, and aims to provide an efficient malicious traffic detection method based on a national secret series algorithm.

[0007] The present invention provides an efficient malicious traffic detection method based on a national secret series algorithm, which has the following characteristics and comprises the following steps: Step S1, a sender sets a custom rule set, which is owned only by the sender;

[0008] Step S2, the sender and the receiver negotiate to set a negotiation key;

[0009] Step S3, the sender generates a vector with wildcards, a non-wildcard subscript set S, and a corresponding random number K for each rule in the rule set and saves them;

[0010] Step S4: The sender performs full obfuscation calculation based on the vectors corresponding to all rules, the non-wildcard subscript set S, the random number K, and the negotiated key, and generates corresponding trapdoor information for each rule. The trapdoor information is recorded as Trapdoor = {d0, d1, S, r}, including the random number hidden parameter d0, the rule operation hidden parameter d1, the non-wildcard subscript set S, and the matching parameter r.

[0011] Step S5, the sender performs semi-obfuscated calculation and XOR on the negotiated key and vector, and maps the result to a Bloom filter to generate a quick retrieval table;

[0012] Step S6, the sender sends the trapdoor information and the quick search table to the cloud service provider;

[0013] Step S7, the sender divides the plaintext data to be sent to the receiver into bytes, and obtains the ciphertext by semi-obfuscating the plaintext data in bytes in combination with the negotiated key;

[0014] Step S8, the sender sends the ciphertext to the cloud service provider, and the cloud service provider uses the trapdoor information, the quick search table, and the ciphertext to filter the traffic, obtain normal traffic and malicious traffic, and send the normal traffic to the receiver;

[0015] Step S9: The cloud service provider restores the operation corresponding to the rule through the trapdoor information and performs the operation on the malicious traffic.

[0016] In the efficient malicious traffic detection method based on the national secret series algorithm provided by the present invention, it can also have the following characteristics: wherein step S3 includes the following sub-steps:

[0017] Step S3-1, the sender generates an empty vector;

[0018] Step S3-2, the sender writes an empty vector in bytes according to the specified field of the rule in the rule set, and fills all the empty positions of the empty vector with wildcards to obtain a vector;

[0019] Step S3-3, the sender records the subscripts of the non-wildcard positions in the vector to obtain a non-wildcard subscript set S;

[0020] Step S3-4, the sender generates a random number K, which is bound to the rule and is unique;

[0021] Step S3-5, looping through steps S3-1 to S3-4, generating and saving a vector with wildcards, a non-wildcard subscript set S, and a corresponding random number K for each rule in the rule set.

[0022] The efficient malicious traffic detection method based on the national secret series algorithm provided by the present invention may also have the following features: wherein step S4 includes the following sub-steps:,

[0023] Step S4-1, the sender concatenates the elements at non-wildcard positions in each vector, the subscript information, and the negotiated key to obtain a concatenation result and saves it;

[0024] Step S4-2, the sender uses the national secret SM3 algorithm to calculate the message digest based on the splicing result;

[0025] Step S4-3, looping step S4-2 until all elements in non-wildcard positions have corresponding message digests;

[0026] Step S4-4, the sender performs an XOR operation on all message digests;

[0027] Step S4-5, perform full obfuscation calculation. The sender performs XOR calculation on the XOR result obtained in step S4-4 and the random number K, and the calculation result is recorded as the random number hidden parameter d0;

[0028] Step S4-6, the sender uses the national secret SM4 algorithm, takes the random number K as the key, encrypts the operation corresponding to the rule, and the calculation result is recorded as the rule operation hidden parameter d1;

[0029] Step S4-7, the sender uses the national secret SM3 algorithm to calculate the XOR operation result obtained in step S4-4, and the calculation result is recorded as the matching parameter r.

[0030] The efficient malicious traffic detection method based on the national secret series algorithm provided by the present invention may also have the following features: wherein step S7 includes the following sub-steps:

[0031] Step S7-1, the sender concatenates the elements, subscript information and negotiated key of each byte in the plaintext data;

[0032] Step S7-2, using the national encryption SM3 algorithm to calculate the concatenation result of step S7-1 to generate a data summary, and use the data summary as the ciphertext.

[0033] The efficient malicious traffic detection method based on the national secret series algorithm provided by the present invention may also have the following features: wherein step S8 includes the following sub-steps:

[0034] In step S8-1, the cloud service provider intercepts the non-wildcard position data in the ciphertext and performs an XOR operation based on the trapdoor information and the ciphertext, compares the operation result with the quick search table through Bloom filter mapping, filters out suspicious traffic and returns the XOR operation result. The traffic that does not hit the quick search table is normal traffic.

[0035] In step S8-2, the cloud service provider uses the national secret SM3 algorithm to calculate the digital summary of the XOR operation result returned by the screened suspicious traffic to check whether it hits the matching parameter r. If it hits, it is malicious traffic, otherwise it is normal traffic.

[0036] The efficient malicious traffic detection method based on the national secret series algorithm provided by the present invention may also have the following features: wherein step S9 includes the following sub-steps:

[0037] Step S9-1, the cloud service provider uses the non-wildcard subscript set S in the trapdoor information to XOR the ciphertext at the corresponding position, and restores the random number K in combination with the random number hidden parameter d0 in the trapdoor information;

[0038] In step S9-2, the cloud service provider hides the parameter d1 and the random number K through the rule operation in the trapdoor information, uses the national secret SM4 decryption algorithm to restore the operation corresponding to the rule and executes the operation on the malicious traffic.

[0039] Functions and Effects of the Invention

[0040] According to the present invention, an efficient malicious traffic detection method based on a national secret series algorithm, the sender first generates a vector, a non-wildcard subscript set and a corresponding random number for each rule in the rule set, and generates trapdoor information corresponding to the negotiated key and the rule, and sends the trapdoor information to the cloud service provider. The sender then divides the plaintext data to be sent according to bytes, obtains the data summary as ciphertext through a semi-obfuscated calculation based on the national secret SM3 algorithm, and sends the ciphertext to the cloud service provider for matching detection, so that the cloud service provider can directly filter the data in ciphertext form according to the trapdoor information provided by the sender without knowing any information about the plaintext data and the rule set. If the match is successful, it means that the traffic is malicious traffic and the corresponding rule operation needs to be executed, otherwise it is normal traffic. In addition, since the rule set is fixed in most cases, the present invention defines a fast retrieval table for fast filtering of traffic by preprocessing the rule set, avoiding repeated and inefficient calculation problems, and allowing cloud service providers to achieve more efficient traffic filtering.

[0041] Therefore, the efficient malicious traffic detection method based on the national secret series algorithm of the present invention can be applied to malicious traffic detection under ciphertext data, and can filter the encrypted traffic without decryption processing, which can protect the user's personal privacy information to the greatest extent, and the complex calculation overhead is deployed in the cloud for processing. The present invention realizes efficient and accurate intrusion detection of malicious traffic under the premise of protecting user data privacy, and can ensure the stable and secure operation of the network. The present invention can also apply the method to industrial control networks, mail filtering systems, ciphertext log audits and other aspects according to different rule sets. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a flow chart of an efficient malicious traffic detection method based on a national secret series algorithm in an embodiment of the present invention;

[0043] Figure 2 is a flow chart of filling a vector in an embodiment of the present invention;

[0044] Figure 3 is a flow chart of ciphertext matching in an embodiment of the present invention;

[0045] Figure 4 It is a schematic diagram of an efficient malicious traffic detection method based on a national secret series algorithm in an embodiment of the present invention. DETAILED DESCRIPTION

[0046] In order to make the technical means and effects achieved by the present invention easier to understand, the present invention is described in detail below in conjunction with embodiments and drawings.

[0047] <Example>

[0048] Figure 1 It is a flow chart of an efficient malicious traffic detection method based on a national secret series algorithm in an embodiment of the present invention.

[0049] like Figure 1 As shown, an efficient malicious traffic detection method based on a national secret series algorithm of this embodiment includes the following steps:

[0050] Step S1, the sender sets a custom rule set, which is owned only by the sender.

[0051] Step S2: The sender and the receiver negotiate to set a negotiation key.

[0052] Step S3: The sender generates and saves a vector with wildcards, a non-wildcard subscript set S, and a corresponding random number K for each rule in the rule set.

[0053] Figure 2 is a flow chart of filling a vector in an embodiment of the present invention.

[0054] like Figure 2 As shown, step S3 includes the following sub-steps:

[0055] Step S3-1, the sender generates an empty vector;

[0056] Step S3-2, the sender writes an empty vector in bytes according to the specified field of the rule in the rule set, and fills all the empty positions of the empty vector with wildcards to obtain a vector;

[0057] Step S3-3, the sender records the subscripts of the non-wildcard positions in the vector to obtain a non-wildcard subscript set S;

[0058] Step S3-4, the sender generates a random number K, which is bound to the rule and is unique;

[0059] Step S3-5, looping through steps S3-1 to S3-4, generating and saving a vector with wildcards, a non-wildcard subscript set S, and a corresponding random number K for each rule in the rule set.

[0060] In step S4, the sender performs full obfuscation calculation according to the vectors corresponding to all rules, the non-wildcard subscript set S, the random number K and the negotiated key, and generates corresponding trapdoor information for each rule. The trapdoor information is recorded as Trapdoor = {d0, d1, S, r}, including the random number hidden parameter d0, the rule operation hidden parameter d1, the non-wildcard subscript set S and the matching parameter r.

[0061] Step S4 includes the following sub-steps:

[0062] Step S4-1, the sender concatenates the elements at non-wildcard positions in each vector, the subscript information, and the negotiated key to obtain a concatenation result and saves it;

[0063] Step S4-2, the sender uses the national secret SM3 algorithm to calculate the message digest based on the splicing result;

[0064] Step S4-3, looping step S4-2 until all elements in non-wildcard positions have corresponding message digests;

[0065] Step S4-4, the sender performs an XOR operation on all message digests;

[0066] Step S4-5, perform full obfuscation calculation. The sender performs XOR calculation on the XOR result obtained in step S4-4 and the random number K, and the calculation result is recorded as the random number hidden parameter d0;

[0067] Step S4-6, the sender uses the national secret SM4 algorithm, takes the random number K as the key, encrypts the operation corresponding to the rule, and the calculation result is recorded as the rule operation hidden parameter d1;

[0068] Step S4-7, the sender uses the national secret SM3 algorithm to calculate the XOR operation result obtained in step S4-4, and the calculation result is recorded as the matching parameter r.

[0069] In this embodiment, the specific formula for semi-obfuscation calculation is as follows:

[0070] SCC(msk, V, S) = SM3(V pos ||pos||msk)

[0071] The specific formula for full obfuscation calculation is as follows:

[0072]

[0073] The calculation formula of the random number hidden parameter d0 in the trapdoor information is as follows:

[0074] d0=FCC(msk,V,S,K)

[0075] The calculation formula of the rule operation hidden parameter d1 in the trapdoor information is as follows:

[0076] d1=SM4(K,action)

[0077] The calculation formula of the matching parameter r in the trapdoor information is as follows:

[0078]

[0079] Step S5: The sender performs semi-obfuscated calculation and XOR on the negotiated key and vector, and maps the result to a Bloom filter to generate a quick retrieval table.

[0080] Step S6: The sender sends the trapdoor information and the quick search table to the cloud service provider.

[0081] In step S7, the sender divides the plaintext data to be sent to the receiver into bytes, and obtains the ciphertext by semi-obfuscating the plaintext data in units of bytes in combination with the negotiated key.

[0082] Step S7 includes the following sub-steps:

[0083] Step S7-1, the sender concatenates the elements, subscript information and negotiated key of each byte in the plaintext data;

[0084] Step S7-2, using the national encryption SM3 algorithm to calculate the concatenation result of step S7-1 to generate a data summary, and use the data summary as the ciphertext.

[0085] Figure 3 It is a flowchart of ciphertext matching in an embodiment of the present invention.

[0086] like Figure 3 As shown, in step S8, the sender sends the ciphertext to the cloud service provider, and the cloud service provider uses the trapdoor information, the quick search table and the ciphertext to filter the traffic, obtains normal traffic and malicious traffic, and sends the normal traffic to the receiver.

[0087] Step S8 includes the following sub-steps:

[0088] In step S8-1, the cloud service provider intercepts the non-wildcard position data in the ciphertext and performs an XOR operation based on the trapdoor information and the ciphertext, compares the operation result with the quick search table through Bloom filter mapping, filters out suspicious traffic and returns the XOR operation result. The traffic that does not hit the quick search table is normal traffic.

[0089] In step S8-2, the cloud service provider uses the national secret SM3 algorithm to calculate the digital summary of the XOR operation result returned by the screened suspicious traffic to check whether it hits the matching parameter r. If it hits, it is malicious traffic, otherwise it is normal traffic.

[0090] Step S9: The cloud service provider restores the operation corresponding to the rule through the trapdoor information and performs the operation on the malicious traffic.

[0091] Step S9 includes the following sub-steps:

[0092] Step S9-1, the cloud service provider uses the non-wildcard subscript set S in the trapdoor information to XOR the ciphertext at the corresponding position, and restores the random number K in combination with the random number hidden parameter d0 in the trapdoor information;

[0093] In step S9-2, the cloud service provider hides the parameter d1 and the random number K through the rule operation in the trapdoor information, uses the national secret SM4 decryption algorithm to restore the operation corresponding to the rule and executes the operation on the malicious traffic.

[0094] Figure 4 It is a schematic diagram of an efficient malicious traffic detection method based on a national secret series algorithm in an embodiment of the present invention.

[0095] like Figure 4 As shown, an efficient malicious traffic detection method (SM-DPI method) based on the national secret series algorithm of this embodiment can be divided into a vector filling module, a vector encryption module, a traffic encryption module, a fast filtering module and a ciphertext matching module.

[0096] In the vector filling module, the sender generates a vector with wildcards, a non-wildcard subscript set S, and a corresponding random number K for each rule in the rule set, and inputs them into the vector encryption module.

[0097] In the vector encryption module, the sender generates trapdoor information that can be processed in the ciphertext matching stage based on the vectors corresponding to all rules, the non-wildcard subscript set S, the random number K, the negotiated key, and the operations corresponding to the rules (such as discarding data packets, generating warning logs, etc.), and inputs it into the fast filtering module and the ciphertext matching module.

[0098] In the traffic encryption module, the sender converts the plaintext data to be sent to the receiver into ciphertext and inputs it into the fast filtering module and the ciphertext matching module.

[0099] In the quick filtering module, the sender generates a quick retrieval table, and the cloud service provider quickly filters out suspicious traffic based on the quick retrieval table and ciphertext, and sends normal traffic to the receiver and sends suspicious traffic to the ciphertext matching module.

[0100] In the ciphertext matching module, the cloud service provider compares the ciphertext with the trapdoor information to determine whether the suspicious traffic is malicious traffic, and sends the normal traffic to the receiver, and processes the malicious traffic according to the corresponding operations of the rules.

[0101] Functions and Effects of the Embodiments

[0102] According to an efficient malicious traffic detection method based on a national secret series algorithm involved in this embodiment, the sender first generates a vector, a non-wildcard subscript set and a corresponding random number for each rule in the rule set, and generates trapdoor information corresponding to the negotiated key and the rule, and sends the trapdoor information to the cloud service provider. The sender then divides the plaintext data to be sent according to bytes, obtains the data summary as ciphertext through a semi-obfuscated calculation based on the national secret SM3 algorithm, and sends the ciphertext to the cloud service provider for matching detection, so that the cloud service provider can directly filter the ciphertext data according to the trapdoor information provided by the sender without knowing any information about the plaintext data and the rule set. If the match is successful, it means that the traffic is malicious traffic and the corresponding rule operation needs to be executed, otherwise it is normal traffic. In addition, since the rule set is fixed in most cases, this embodiment defines a quick retrieval table for fast filtering of traffic by preprocessing the rule set, avoiding repeated and inefficient calculation problems, and allowing cloud service providers to achieve more efficient traffic filtering.

[0103] Therefore, the efficient malicious traffic detection method based on the national secret series algorithm of this embodiment can be applied to malicious traffic detection under ciphertext data, and can filter the encrypted traffic without decryption processing, which can protect the user's personal privacy information to the greatest extent, and the complex computing overhead is deployed in the cloud for processing. This embodiment realizes efficient and accurate intrusion detection of malicious traffic under the premise of protecting user data privacy, and can ensure the stable and secure operation of the network. This embodiment can also apply this method to industrial control networks, mail filtering systems, ciphertext log audits and other aspects according to different rule sets.

[0104] The above-mentioned embodiments are preferred examples of the present invention and are not intended to limit the protection scope of the present invention.

Claims

1. An efficient malicious traffic detection method based on a national secret series algorithm, characterized in that: The following steps are involved: Step S1, the sender sets a custom rule set, which is owned only by the sender; Step S2, the sender and the receiver negotiate to set a negotiation key; Step S3, the sender generates a vector with wildcards, a non-wildcard subscript set S and a corresponding random number K for each rule in the rule set and saves them; Step S4, the sender performs full obfuscation calculation according to the vector with wildcards corresponding to all the rules, the non-wildcard subscript set S, the random number K and the negotiated key, and generates corresponding trapdoor information for each rule, where the trapdoor information is recorded as Trapdoor={d0, d1, S, r}, including a random number hidden parameter d0, a rule operation hidden parameter d1, the non-wildcard subscript set S and a matching parameter r; Step S5, the sender performs semi-obfuscation calculation and XOR with the negotiated key and the vector with the wildcard, and maps the result to a Bloom filter to generate a quick retrieval table; Step S6, the sender sends the trapdoor information and the quick search table to the cloud service provider; Step S7, the sender divides the plaintext data to be sent to the receiver into bytes, and obtains ciphertext by semi-obfuscating the plaintext data in bytes in combination with the negotiated key; Step S8, the sender sends the ciphertext to the cloud service provider, and the cloud service provider uses the trapdoor information, the quick search table and the ciphertext to filter the traffic, obtain normal traffic and malicious traffic, and send the normal traffic to the receiver; Step S9: the cloud service provider restores the operation corresponding to the rule through the trapdoor information, and performs the operation on the malicious traffic. Wherein, step S4 includes the following sub-steps: Step S4-1, the sender concatenates the elements at non-wildcard positions in each of the vectors having wildcards, the subscript information and the negotiated key to obtain a concatenation result and saves it; Step S4-2, the sender uses the national secret SM3 algorithm to calculate the message digest according to the splicing result; Step S4-3, looping step S4-2 until all elements in non-wildcard positions have corresponding message digests; Step S4-4, the sender performs an XOR operation on all the message digests; Step S4-5, performing full obfuscation calculation, the sender performs XOR calculation on the XOR operation result obtained in step S4-4 and the random number K, and the calculation result is recorded as the random number hidden parameter d0; Step S4-6, the sender uses the national secret SM4 algorithm and the random number K as the key to encrypt the operation corresponding to the rule, and the calculation result is recorded as the rule operation hidden parameter d1; Step S4-7, the sender uses the national secret SM3 algorithm to calculate the XOR operation result obtained in step S4-4, and the calculation result is recorded as the matching parameter r.

2. The efficient malicious traffic detection method based on the national secret series algorithm according to claim 1 is characterized in that: in, Step S3 includes the following sub-steps: Step S3-1, the sender generates an empty vector; Step S3-2, the sender writes the empty vector in bytes according to the specified field of the rule in the rule set, and fills all the empty positions of the empty vector with wildcards to obtain the vector with wildcards; Step S3-3, the sender records the subscripts of the non-wildcard positions in the vector with wildcards to obtain the non-wildcard subscript set S; Step S3-4, the sender generates a random number K, which is bound to the rule and is unique; Step S3-5, looping through steps S3-1 to S3-4, generating and saving the vector with wildcards, the non-wildcard subscript set S and the corresponding random number K for each rule in the rule set.

3. The efficient malicious traffic detection method based on the national secret series algorithm according to claim 1 is characterized in that: in, Step S7 includes the following sub-steps: Step S7-1, the sender concatenates the elements, subscript information and the negotiated key of each byte in the plaintext data; Step S7-2, using the national encryption SM3 algorithm to calculate the concatenation result of step S7-1 to generate a data summary, and use the data summary as the ciphertext.

4. According to claim 1, the efficient malicious traffic detection method based on the national secret series algorithm, Features: in, Step S8 includes the following sub-steps: Step S8-1, the cloud service provider intercepts the non-wildcard position data in the ciphertext according to the trapdoor information and the ciphertext and performs an XOR operation, compares the operation result with the quick search table through Bloom filter mapping, screens out suspicious traffic and returns the XOR operation result, and the traffic that does not hit the quick search table is the normal traffic; Step S8-2, the cloud service provider uses the national secret SM3 algorithm to calculate the digital summary of the XOR operation result returned by the screened suspicious traffic to check whether it hits the matching parameter r. If it hits, it is the malicious traffic, otherwise it is the normal traffic.

5. The efficient malicious traffic detection method based on the national secret series algorithm according to claim 1 is characterized in that: in, Step S9 includes the following sub-steps: Step S9-1, the cloud service provider performs XOR on the ciphertext at the corresponding position through the non-wildcard subscript set S in the trapdoor information, and restores the random number K in combination with the random number hidden parameter d0 in the trapdoor information; Step S9-2, the cloud service provider uses the rule operation hidden parameter d1 and the random number K in the trapdoor information, uses the national secret SM4 decryption algorithm to restore the operation corresponding to the rule and executes the operation on the malicious traffic.

Images