Malicious encrypted network traffic detection and tracing method and system

Abstract

The present invention belongs to the field of cyberspace security technology, and particularly relates to a malicious encrypted network traffic detection and tracing method and system. For the original network data flow, the network data flow is converted into analyzable multidimensional network flow statistical features and feature extraction is performed; the extracted multidimensional network flow statistical features are input into a trained task analysis model, and the task analysis model is used to analyze and identify whether the network flow is encrypted, the encrypted network flow content type and the encrypted network flow application category; at the same time, the multidimensional network flow statistical features are input into a trained traffic perception model, and the traffic perception model is used to identify whether the network flow is abnormal traffic and output it; the Fabric blockchain platform's smart contract is used to store the relevant data information of the network flow, so as to find the marked network malicious traffic location by sending an access request address to the Fabric blockchain. The present invention uses a variety of machine learning algorithms to perform fine-grained identification of malicious traffic behavior, improve cyberspace security, and facilitate actual scene application.

Description

Technical Field

[0001] The present invention belongs to the technical field of cyberspace security, and in particular relates to a method and system for detecting and tracing malicious encrypted network traffic. Background Art

[0002] As the cyber security situation becomes increasingly severe, malware intrusions occur frequently. According to statistics, malware causes trillions of dollars in losses to the network environment each year. The attacks released by malware cause varying degrees of damage to computer systems, such as stealing private data and injecting malicious code. Therefore, in order to maintain the security of cyberspace, identifying the malicious behavior of malware has become one of the research hotspots in the field of network security.

[0003] Fine-grained identification of specific malicious behaviors within malware is extremely difficult and necessary. Malware is usually released into the victim's operating system and causes varying degrees of damage to it. Accurately identifying these malicious behaviors helps provide targeted defense. However, at this stage, most of the work is only about identifying the maliciousness of software or detecting malware categories. Identifying the specific malicious behaviors performed within the above malware requires extensive security experience. With the popularity of encrypted malware, the communication traffic during the execution of malicious behaviors is basically the encrypted data interaction part, and the non-encrypted part can only reflect the characteristics of the application protocol. There are no characteristics specific to each behavior, which brings difficulties to this fine-grained identification work.

[0004] In recent years, research on identifying malicious behaviors released by malware at home and abroad has mainly focused on the pairing of security log events and API sequences, and mainly uses machine learning methods. These studies basically analyze the malicious behaviors of malware by analyzing the traces left by the malware in the system after being attacked or by reverse analyzing the API sequences after the malware is executed, and select appropriate features to train machine learning algorithms. The above methods can achieve good recognition results for the behavior of malware. However, the existing methods have the following main problems: (1) The current methods analyze the malware after it has executed its malicious behavior. At this time, the system has been damaged to varying degrees by the malware and is difficult to deploy at the edge of the network; (2) Attackers usually use a variety of anti-detection methods, such as modifying log files after the attack is completed, or adding obfuscated API sequences to the malicious code. These methods will result in the inability to accurately identify the malicious behaviors of the malware. The above problems make it impossible for existing methods to quickly identify the specific malicious behaviors of malware, and the current research does not have a traffic data set of malware behavior, making it difficult to analyze from the traffic level. Summary of the invention

[0005] To this end, the present invention provides a method and system for detecting and tracing malicious encrypted network traffic. By analyzing the statistical information of malware that uses encryption protocols for data communication, labeled malicious behavior traffic data sets are extracted, and a variety of machine learning algorithms are used to perform fine-grained identification of malicious traffic behaviors, thereby improving network space security and facilitating application in actual scenarios.

[0006] According to the design scheme provided by the present invention, a method for detecting and tracing malicious encrypted network traffic is provided, which includes the following contents:

[0007] For the original network data flow, the network data flow is converted into analyzable multi-dimensional network flow statistical features and feature extraction is performed, wherein the statistical features at least include the number of bytes and packet interval;

[0008] The extracted multi-dimensional network flow statistical features are input into the trained task analysis model, and the task analysis model is used to analyze and identify whether the network flow is encrypted, the encrypted network flow content type, and the encrypted network flow application category; at the same time, the multi-dimensional network flow statistical features are input into the trained traffic perception model, and the traffic perception model is used to identify whether the network flow is abnormal traffic and output it;

[0009] The smart contract of the Fabric blockchain platform is used to store the relevant data information of the network flow, so as to find the marked network malicious traffic location by sending an access request address to the Fabric blockchain, wherein the relevant data information of the network flow at least includes the metadata of the network flow, multi-dimensional network flow statistical characteristics and forwarding information.

[0010] As a malicious encrypted network traffic detection and tracing method in the present invention, further, when extracting network flow statistical features, data packets are read one by one from the pcap file, each data packet is added to the corresponding network data flow, and currentFlows is used to store all TCP or UDP streams that are not currently ended. The TCP stream ends with the FIN mark for the current network data flow, and the UDP is limited by the set flowtimeout time. If the time is exceeded, it is judged that the current network data flow has ended.

[0011] As a malicious encrypted network traffic detection and tracing method in the present invention, further, when each data packet is added to the corresponding network data stream, the statistical features of each data stream are updated at the same time, and the statistical features are written into a csv file.

[0012] As a method for detecting and tracing malicious encrypted network traffic in the present invention, further, a TCP stream or a UDP stream is taken as a unit, and statistical features in the network data stream are extracted through forward and backward statistics, wherein the forward direction is from the source address to the destination address, and the reverse direction is from the destination address to the source address.

[0013] As a malicious encrypted network traffic detection and tracing method of the present invention, further, the task analysis model adopts a combination model of a support vector machine and a decision tree to perform multi-task identification, wherein a support vector machine is used to identify whether the network flow is encrypted, and a decision tree is used to identify the encrypted network flow content type and the encrypted network flow application category.

[0014] As a malicious encrypted network traffic detection and tracing method of the present invention, further, the support vector machine adopts a radial basis function as a kernel function, and utilizes the training process of the support vector machine to adjust the penalty factor representing the error tolerance and the dimensionality factor representing the number of supported vectors after the data is mapped to the new feature space, and uses a grid search method to determine the optimal penalty factor and dimensionality factor values ​​during the training process.

[0015] As a malicious encrypted network traffic detection and tracing method of the present invention, further, the ISCX VPN-nonVPN public data set is used, and the decision tree is trained by setting marked labels to adjust the decision tree depth and the minimum number of supported instances.

[0016] As a malicious encrypted network traffic detection and tracing method of the present invention, further, the traffic perception model adopts a KNN model to perceive and identify whether the network flow is a normal network flow or an abnormal network flow, wherein the KNN model selects the public data sets SCX-IDS-2012 and CIC-IDS-2017 as training samples, and uses the KNN algorithm for supervised learning to determine the KNN model hyperparameters.

[0017] As a malicious encrypted network traffic detection and tracing method of the present invention, further, when the blockchain node stores network traffic, the network traffic is encrypted using a hash encryption algorithm, and the hash value is stored in the blockchain node; the collected original network flow is stored off-chain, and on-chain and off-chain collaboration is used to perform network flow tracing and evidence collection.

[0018] Furthermore, the present invention also provides a malicious encrypted network traffic detection and tracing system, comprising: a feature extraction module, a traffic detection module and a data storage module, wherein:

[0019] A feature extraction module is used to convert the original network data flow into analyzable multi-dimensional network flow statistical features and perform feature extraction, wherein the statistical features at least include the number of bytes and packet interval;

[0020] The traffic detection module is used to input the extracted multi-dimensional network flow statistical features into the trained task analysis model, and use the task analysis model to analyze and identify whether the network flow is encrypted, the encrypted network flow content type and the encrypted network flow application category; at the same time, the multi-dimensional network flow statistical features are input into the trained traffic perception model, and the traffic perception model is used to identify whether the network flow is abnormal traffic and output it;

[0021] The data storage module is used to use the smart contract of the Fabric blockchain platform to store the relevant data information of the network flow, so as to find the marked network malicious traffic location by sending an access request address to the Fabric blockchain, wherein the relevant data information of the network flow at least includes the metadata of the network flow, multi-dimensional network flow statistical characteristics and forwarding information.

[0022] Beneficial effects of the present invention:

[0023] The present invention uses a data fingerprint extraction technology of multi-dimensional hybrid features to characterize and extract network traffic, dynamically extracts multi-dimensional hybrid features of encrypted network traffic as data fingerprints of network traffic, thereby comprehensively characterizing encrypted network traffic and converting unanalyzable and complex network flows into analyzable and classifiable multi-dimensional feature data; uses encrypted network traffic multi-task identification technology based on SVM and DecisionTree to achieve fine-grained classification of encrypted network traffic, uses data fingerprint extraction technology of multi-dimensional hybrid features to perform multi-dimensional feature processing, improves the accuracy of encrypted traffic classification, and effectively reduces the false alarm rate; uses an abnormal network traffic perception and discovery model based on the KNN algorithm to transform the perception and discovery problem of abnormal network traffic into a binary classification problem of network traffic data fingerprints represented in the form of multi-dimensional hybrid features; and uses the smart contract of the Fabric blockchain platform to store metadata, data fingerprints, forwarding information and other contents of network traffic, uses the off-chain to store the collected original network traffic data, constructs an on-chain and off-chain collaborative network traffic data storage mechanism that has both blockchain security and off-chain storage efficiency, and realizes decentralized storage of network traffic, so that the scheme of this case can be used for classification and detection evaluation of malicious encrypted network traffic, which is convenient for actual scene application. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is a schematic diagram of the malicious encrypted network traffic detection and tracing process in the embodiment;

[0025] Figure 2 This is a schematic diagram of the principle of the network traffic intelligent detection, analysis and evidence collection platform in the embodiment;

[0026] Figure 3 Schematic diagram of the mainstream encryption protocol in the embodiment

[0027] Figure 4 The overall process of feature extraction in the embodiment is shown in FIG.

[0028] Figure 5 It is a schematic diagram of the detection result of the encrypted network traffic multi-task identification technology module in the embodiment;

[0029] Figure 6This is a schematic diagram of the detection results of the abnormal network traffic perception and discovery technology module in the embodiment;

[0030] Figure 7 Schematic diagram of the operation mode of the transaction ledger in the embodiment. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0032] Embodiments of the present invention, see Figure 1 As shown, a method for detecting and tracing malicious encrypted network traffic is provided, comprising:

[0033] S101, for the original network data flow, convert the network data flow into analyzable multi-dimensional network flow statistical features and perform feature extraction, wherein the statistical features at least include the number of bytes and packet interval;

[0034] S102, inputting the extracted multi-dimensional network flow statistical features into the trained task analysis model, using the task analysis model to analyze and identify whether the network flow is encrypted, the encrypted network flow content type and the encrypted network flow application category; at the same time, inputting the multi-dimensional network flow statistical features into the trained traffic perception model, using the traffic perception model to identify whether the network flow is abnormal traffic and output it;

[0035] S103. Use the smart contract of the Fabric blockchain platform to store the relevant data information of the network flow, so as to find the marked network malicious traffic location by sending an access request address to the Fabric blockchain, wherein the relevant data information of the network flow at least includes the metadata of the network flow, multi-dimensional network flow statistical characteristics and forwarding information.

[0036] A network flow is a group of sequential data packets exchanged between a pair of IP entities on the same pair of ports within a certain period of time, mainly including TCP / UDP flows and ICMP flows. A network flow is uniquely identified by a flow ID. A TCP / UDP flow is a network flow whose transport layer protocol type is TCP / UDP. Its network flow ID is generated by the packet quintuple <source IP, destination IP, source port number, destination port number, transport layer protocol type>. An ICMP flow is a network flow whose transport layer protocol type is ICMP. Its network flow ID is generated by the packet triple <source IP, destination IP, ICMP.

[0037] like Figure 2As shown in the figure, firstly, for the complex and unanalyzable encrypted network data flow, we designed a multi-dimensional feature extraction technology for encrypted traffic, which converts it into analyzable multi-dimensional features, and prepares the necessary data preprocessing for the subsequent machine learning classification model. Secondly, the multi-dimensional feature traffic is input into the encrypted traffic multi-dimensional task analysis model, and the trained support vector machine model and decision tree model are used to analyze whether it is encrypted, the encrypted network traffic content category, and the encrypted network traffic application category, and a more comprehensive and thorough multi-task recognition result is given. Secondly, the multi-dimensional feature traffic is input into the normal network traffic perception and discovery model, and the trained KNN model is used to determine whether it is abnormal traffic, and the screening and classification tasks of abnormal network traffic are realized. Finally, after the abnormal network traffic is captured, when it is stored on the blockchain node, the hash, timestamp and other characteristic attributes of the network data flow are generated. At the same time, the data traffic is screened by the machine learning algorithm to identify the network malicious traffic, and then the hash of the marked malicious traffic is found by sending an access request to the Fabric blockchain to find the location of the malicious traffic, so as to achieve the traceability of the network malicious traffic.

[0038] As a preferred embodiment, further, when extracting the statistical features of the network flow, read the data packets one by one from the pcap file, add each data packet to the corresponding network data flow, and use currentFlows to store all TCP or UDP flows that are not currently ended. The TCP flow ends with the FIN mark for the current network data flow, and the UDP flow is limited by the set flowtimeout time, and the current network data flow is judged to end when the time is exceeded. Further, when each data packet is added to the corresponding network data flow, the statistical features of each data flow are updated at the same time, and the statistical features are written into the csv file.

[0039] Encrypted traffic has taken up a large part of network traffic. Traffic encryption itself is based on considerations such as user privacy protection, but many malicious traffic also evades detection and attacks through encryption. In the face of encrypted traffic, traditional detection methods cannot perform normal detection, which brings great uncertainty to network security. At present, the mainstream encryption protocols are IPsec (IP Security), SSL (Secure Socket Layer) / TLS (Transport Layer Security) and SSH (Secure SHell). Figure 3 shown.

[0040] For encrypted traffic, it is more meaningful to analyze network flow statistics such as the number of bytes and packet intervals than to analyze the encrypted traffic load. The following will introduce specific extraction implementation methods. Extract some statistical information of the transport layer, with a TCP stream or a UDP stream as a unit. The TCP stream ends with the FIN flag, and the UDP stream is limited by the set flowtimeout time. It is judged to be over after the time is exceeded. There are many data packets in a TCP stream, first three handshakes, then transmission of information, and four waves. Count the statistical information in a stream as the extracted features. And the statistical features are divided into forward and backward directions, stipulating that the source address to the destination address is the forward direction, and the destination address to the source address is the reverse direction.

[0041] It can extract nearly 80-dimensional features, making sufficient preparation for subsequent machine learning, and can be used directly according to the required features. Figure 4 As shown in the figure, read packets one by one from the pcap file, add each packet to the corresponding flow, and store all TCP and UDP flows that have not yet ended in currentFlows. In the process of adding, the statistical features of each flow are continuously updated, and finally the statistical features are written to the csv file. Determine whether the newly added data packet belongs to all the current unfinished flows. If it belongs to the current flow, determine whether it is forward or reverse. Then determine whether the time has timed out. If it has not timed out, determine whether it contains the FIN mark. If neither of them is satisfied, declare a BasicFlow object, get the flow corresponding to the current data packet from currentFlows according to the id, and call addPacket to add the data packet to the corresponding flow. If the previous judgment is not in all the current unfinished flows, directly create a new flow containing only the current data packet and store it in currentFlows. If it belongs to a current unfinished flow and times out or has the FIN mark, it means that the current flow has ended. If it times out, remove the corresponding flow from currentFlows, and store the new flow in currentFlows. If it contains the FIN mark, directly remove the corresponding flow from currentFlows. The ended flow directly calls the onFlowGenerated function to print and store the flow.

[0042] Based on the above feature extraction method, feature extraction can be achieved by writing code. The specific features extracted are as follows:

[0043] As shown in Table 1.

[0044]

[0045]

[0046]

[0047]

[0048] Store the extracted features in csv.

[0049] As a preferred embodiment, further, the task analysis model adopts a combination model of support vector machine and decision tree to perform multi-task identification, wherein the support vector machine is used to identify whether the network flow is encrypted, and the decision tree is used to identify the encrypted network flow content type and the encrypted network flow application category.

[0050] The encrypted network traffic multi-task identification technology based on SVM and Decision Tree is specifically divided into whether it is encrypted traffic (Vpn, Non_Vpn), encrypted traffic application type identification (AIM, BitTorrent, Email, Facebook, FTPS, Hangouts, ICQ, Netflix, SFTP, Skype, Spotify, Vimeo, VoipBuster, YouTube), and encrypted traffic content type identification (Chat, File, VoIP, Streaming.). Since encrypted traffic identification is a classic binary classification problem, in the embodiment of this case, the SVM support vector machine algorithm can be used to classify the network traffic encryption type, while other multi-task classifications can use a decision tree model.

[0051] As a preferred embodiment, further, the support vector machine adopts radial basis function as the kernel function, and utilizes the training process of the support vector machine to adjust the penalty factor representing the error tolerance and the dimensionality factor representing the number of supported vectors after the data is mapped to the new feature space, and uses the grid search method to determine the optimal penalty factor and dimensionality factor values ​​during the training process.

[0052] Support vector machine is a linear classification model that achieves binary classification by solving the sample maximum margin hyperplane. To solve the problem of linear inseparability of samples, SVM uses a kernel function to map the original sample space to a higher-dimensional feature space, so that the samples are linearly separable in the high-dimensional space. The SVM used uses the radial basis function (RBF) as the kernel function. There are two hyperparameters that need to be adjusted during training: the penalty factor C, which indicates the tolerance to error. The larger the C, the more attention is paid to the loss; the dimension factor γ, which determines the number of support vectors after the data is mapped to the new feature space. Since it contains two changing parameters, it is necessary to use the grid search method to determine the optimal C and γ values.

[0053] As a preferred embodiment, further, the ISCX VPN-nonVPN public data set is used to train the decision tree by setting label tags to adjust the decision tree depth and the minimum number of supported instances.

[0054] A decision tree is a tree-structured decision analysis model that divides nodes according to feature probabilities. In the present embodiment, a decision tree classification model can be constructed based on the C4.5 algorithm. The hyperparameters that need to be adjusted during training are the depth of the tree and the minimum number of supported instances. For the classification performance of application types and content types of encrypted network flows, since only the ISCX VPN-nonVPN dataset in the public dataset can meet the experimental requirements of this study, experiments were only conducted on this dataset. The size of the ISCXVPN-nonVPN dataset is 25GB, of which 22.8G is plaintext traffic and the remaining 2.4GB is encrypted traffic using VPN. The dataset contains 280,540 flows, of which 18,468 are ciphertext flows and 262,072 are plaintext flows, including 14 types of applications. As shown in Table 2.

[0055] Table 2 ISCX VPN-nonVPN dataset

[0056]

[0057] The training data can be trained using the public data set ISCX VPN-nonVPN to train the model, manually mark the data, vectorize the data, and finally pass the converted vector to adjust the model parameters for training. Train a model that can recognize encrypted network traffic multi-tasks. Finally, use a data set with a test_size of 0.25 to test the model performance, and use accuracy, precision, and recall as performance evaluation indicators. Their definitions are: Among them, TP i is the number of i-th class flows correctly classified as i-th class, FP i is the number of non-i-th class flows misclassified as i-th class, and FN i is the number of i-th class flows that are misclassified as non-i-th class flows, and n is the total number of classes. The detection results are as follows: Figure 5 As shown, the encrypted network traffic multi-task identification task can be completed well.

[0058] As a preferred embodiment, further, the traffic perception model adopts a KNN model to perceive and identify whether the network flow is a normal network flow or an abnormal network flow, wherein the KNN model selects the public data sets SCX-IDS-2012 and CIC-IDS-2017 as training samples, and uses the KNN algorithm for supervised learning to determine the KNN model hyperparameters.

[0059] The preprocessed experimental data is imported into the abnormal network traffic perception and discovery technology module based on the KNN algorithm in csv format, and the training data is manually labeled as normal network flow (Benign_traffic) and abnormal network flow (Malicious_traffic) SSH Patator, FTP Patator, Dos, DDos, Bot, Web attack. The data is then vectorized and finally the converted vector is passed to the machine learning algorithm used in this module. Since the training data of this classification problem is large and there is a large amount of irrelevant data, this patent uses the KNN algorithm to supervise the data and divide the analysis results into normal network flow (Benign_traffic) and abnormal network flow (Malicious_traffic) SSH Patator, FTP Patator, Dos, DDos, Bot, Web attack. The K-Nearest Neighbors (KNN) algorithm is a classification and regression algorithm, and is one of the most basic and simplest algorithms in machine learning algorithms. It was proposed by Cover and Hart in 1968, and its application scenarios include character recognition, text classification, image recognition and other fields. KNN stands for K Nearest Neighbors, which is a non-parametric, lazy algorithm model. Although KNN has no parameters, it has a series of hyperparameters, and some hyperparameters have a greater impact on the model's prediction effect. The most important parameter in this type of hyperparameter is the K value, which is the distance measurement method.

[0060] The methods of measuring distance usually include Minkowski distance, Euclidean distance, Chebyshev distance, Manhattan distance, etc. However, the most commonly used distance in the KNN algorithm is Euclidean distance. The following are the calculation formulas for these distances:

[0061] Minkowski distance:

[0062] Euclidean distance:

[0063]

[0064] Chebyshev distance:

[0065]

[0066] Manhattan distance:

[0067]

[0068] Through cross-validation (splitting sample data into training data and validation data in a certain proportion), starting from a smaller K value, continuously increasing the value of K, and then calculating the variance of the validation set, we finally find a more suitable K. Choosing a smaller K value is equivalent to using training instances in a smaller domain for prediction, and the "learning" approximate error will be reduced. Only training instances that are close or similar to the input instances will have an effect on the prediction results. At the same time, the problem is that the "learning" estimation error will increase. In other words, a decrease in the K value means that the overall model becomes complex and prone to overfitting. Choosing a larger K value is equivalent to using training instances in a larger domain for prediction. The advantage is that it can reduce the estimation error of learning, but the disadvantage is that the approximate error of learning will increase. At this time, training instances that are far away (dissimilar) from the input instances will also act on the predictor, causing errors in the prediction, and an increase in the K value means that the overall model becomes simpler.

[0069] In this embodiment, the public data sets SCX-IDS-2012 and CIC-IDS-2017 can be used as training samples, and the specific classification of the data is shown in Table 4 and Table 5.

[0070] Table 4 SCX-IDS-2012 dataset

[0071]

[0072] Table 5: CIC-IDS-2017 dataset

[0073]

[0074] Finally, the model performance is tested with a data set of test_size 0.25, and the three indicators of accuracy, precision, and recall are used as performance evaluation indicators. Their definitions are: Among them, TP i is the number of i-th class flows correctly classified as i-th class, FP i is the number of non-i-th class flows misclassified as i-th class, and FN i is the number of i-th class flows that are misclassified as non-i-th class flows, and n is the total number of classes. The detection results are as follows: Figure 6 shown.

[0075] As a preferred embodiment, further, when the blockchain node stores network traffic, it uses a hash encryption algorithm to encrypt the network traffic and stores the hash value in the blockchain node; the collected original network flow is stored off-chain, and on-chain and off-chain collaboration is used to trace the network flow and collect evidence.

[0076] Blockchain has the property that information data cannot be tampered with, and can effectively and reliably protect the data on the chain. However, given the difficulty in tracking network traffic and collecting evidence, using traditional methods, even if the data has been obtained, it is often difficult to effectively utilize and collect evidence. Therefore, with the help of the security characteristics of blockchain, first, resources can be effectively integrated and systematically stored to facilitate subsequent analysis, which is beneficial for short-term monitoring and effective capture of small attacks. At the same time, it can also effectively organize and provide evidence for large, purposeful, and complex attacks.

[0077] Blockchain is a chain data structure and storage method composed of multiple blocks. Each block is divided into a block header and a block body. The block header is mainly used to realize the hash value of the previous block of the block link, while the block body mainly includes the transaction ledger, such as Figure 7 As shown. In the embodiment of this case, unlike the previous centralized ledger, all users participating in the blockchain network can obtain detailed information on transactions that occurred in the network, thereby enhancing credibility. If one party tampers with the information, it is necessary to change the ledger information of other users at the same time, which increases the cost of tampering. The use of the hash algorithm makes it possible to quickly compare the user's ledger to find abnormal information, greatly improving the efficiency of finding abnormalities; the use of the public key cryptography system protects the user's own usage rights, further enhancing the security of blockchain information. The storage of data on the blockchain can directly store files, but the usual network traffic often has a huge amount of data, and the resources on the blockchain are also precious. Therefore, in the embodiment of this case, the file is encrypted with a hash algorithm and the hash value is stored on the blockchain. This not only saves space, but also completes the comparison of information fingerprints, which is convenient for the full traceability of malicious traffic.

[0078] Furthermore, based on the above method, an embodiment of the present invention also provides a malicious encrypted network traffic detection and tracing system, comprising: a feature extraction module, a traffic detection module and a data storage module, wherein:

[0079] A feature extraction module is used to convert the original network data flow into analyzable multi-dimensional network flow statistical features and perform feature extraction, wherein the statistical features at least include the number of bytes and packet interval;

[0080] The traffic detection module is used to input the extracted multi-dimensional network flow statistical features into the trained task analysis model, and use the task analysis model to analyze and identify whether the network flow is encrypted, the encrypted network flow content type and the encrypted network flow application category; at the same time, the multi-dimensional network flow statistical features are input into the trained traffic perception model, and the traffic perception model is used to identify whether the network flow is abnormal traffic and output it;

[0081] The data storage module is used to use the smart contract of the Fabric blockchain platform to store the relevant data information of the network flow, so as to find the marked network malicious traffic location by sending an access request address to the Fabric blockchain, wherein the relevant data information of the network flow at least includes the metadata of the network flow, multi-dimensional network flow statistical characteristics and forwarding information.

[0082] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0083] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0084] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0085] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0086] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for detecting and tracing malicious encrypted network traffic, characterized in that: Contains the following: For the original network data flow, the network data flow is converted into analyzable multi-dimensional network flow statistical features and feature extraction is performed, wherein the statistical features at least include the number of bytes and packet intervals; and when extracting the network flow statistical features, the data packets are read one by one from the pcap file, each data packet is added to the corresponding network data flow, and currentFlows is used to store all TCP or UDP flows that are not currently ended. The TCP flow ends with the FIN mark for the current network data flow, and the UDP flow is limited by the set flowtimeout time, and the current network data flow is judged to be ended when the time is exceeded; a TCP flow or a UDP flow is used as a unit, and statistical features in the network data flow are extracted through forward and backward statistics, from the source address to the destination address is the forward direction, and from the destination address to the source address is the reverse direction; The extracted multi-dimensional network flow statistical features are input into the trained task analysis model, and the task analysis model is used to analyze and identify whether the network flow is encrypted, the encrypted network flow content type and the encrypted network flow application category; at the same time, the multi-dimensional network flow statistical features are input into the trained traffic perception model, and the traffic perception model is used to identify whether the network flow is abnormal traffic and output it; wherein, the task analysis model adopts a combination model of support vector machine and decision tree for multi-task recognition, uses support vector machine to identify whether the network flow is encrypted, and uses decision tree to identify the encrypted network flow content type and encrypted network flow application category; The network traffic is encrypted using a hash encryption algorithm, and the hash value is stored in a blockchain node, so that the Fabric blockchain platform's smart contract can be used to store the relevant data information of the network flow; the collected original network flow is stored off-chain, and the network flow is traced and forensic by using on-chain and off-chain collaboration, so that the marked network malicious traffic location can be found by sending an access request address to the Fabric blockchain, where the relevant data information of the network flow at least includes the metadata of the network flow, multi-dimensional network flow statistical characteristics and forwarding information. Each block in the Fabric blockchain platform is divided into a block header and a block body. The block header is used to realize the hash value of the previous block of the block link, and the block body includes a transaction ledger. The transaction information occurring in the blockchain network is available to all users participating in the blockchain platform network. Users participating in the blockchain platform network use a public key cryptography system to protect their own usage rights.

2. The method for detecting and tracing malicious encrypted network traffic according to claim 1 is characterized in that: When each data packet is added to the corresponding network data flow, the statistical characteristics of each data flow are updated at the same time and written to the csv file.

3. The method for detecting and tracing malicious encrypted network traffic according to claim 1 is characterized in that: The support vector machine uses radial basis function as the kernel function and uses the training process of the support vector machine to adjust the penalty factor that represents the error tolerance and the dimensionality factor that represents the number of supported vectors after the data is mapped to the new feature space. A grid search method is used during the training process to determine the optimal penalty factor and dimensionality factor values.

4. The method for detecting and tracing malicious encrypted network traffic according to claim 1 is characterized in that: The ISCXVPN-nonVPN public dataset is used to train the decision tree by setting labeled labels to adjust the decision tree depth and the minimum number of support instances.

5. The method for detecting and tracing malicious encrypted network traffic according to claim 1 is characterized in that: The traffic perception model uses the KNN model to perceive and identify whether the network flow is normal network flow or abnormal network flow. The KNN model uses the public data sets SCX-IDS-2012 and CIC-IDS-2017 as training samples, and uses the KNN algorithm for supervised learning to determine the KNN model hyperparameters.

6. A malicious encrypted network traffic detection and tracing system, characterized in that: The method according to claim 1 is implemented, comprising: a feature extraction module, a flow detection module and a data storage module, wherein: A feature extraction module is used to convert the original network data flow into analyzable multi-dimensional network flow statistical features and perform feature extraction, wherein the statistical features at least include the number of bytes and packet interval; The traffic detection module is used to input the extracted multi-dimensional network flow statistical features into the trained task analysis model, and use the task analysis model to analyze and identify whether the network flow is encrypted, the encrypted network flow content type and the encrypted network flow application category; at the same time, the multi-dimensional network flow statistical features are input into the trained traffic perception model, and the traffic perception model is used to identify whether the network flow is abnormal traffic and output it; The data storage module is used to use the smart contract of the Fabric blockchain platform to store the relevant data information of the network flow, so as to find the marked network malicious traffic location by sending an access request address to the Fabric blockchain, wherein the relevant data information of the network flow at least includes the metadata of the network flow, multi-dimensional network flow statistical characteristics and forwarding information.

Images