Method and apparatus for detecting encrypted malicious traffic
By randomly traversing the connection paths between the host and the server, constructing a path connection list, and fusing traffic feature vectors, the problem of insufficient accuracy in the detection of encrypted malicious traffic in existing technologies is solved, and more efficient detection of encrypted malicious traffic is achieved.
Patent Information
- Application Number
- CN202211391725.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-11-08
- Publication Date
- 2026-01-20
- Estimated Expiration
- 2042-11-08
AI Technical Summary
Existing technologies struggle to accurately detect encrypted malicious traffic, especially unknown or mutated traffic, resulting in insufficient detection accuracy and stability.
By randomly traversing the connection paths between the host and the server, a path connection list is constructed, and a target vector is generated by fusing path vectors and traffic data feature vectors. This target vector is then combined with a classifier to detect encrypted malicious traffic.
It improves the accuracy and stability of detecting encrypted malicious traffic, enabling a more accurate depiction of the network behavior of malware and enhancing the robustness of detection.
Smart Images
Figure CN115567317B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of network security, and particularly relates to a method and device for detecting encrypted malicious traffic. BACKGROUND
[0002] Malicious traffic detection is an important content in the field of network security. At present, malicious traffic usually adopts encryption technology to evade detection. For example, malicious software adopts an encryption protocol to hide suspicious information in the communication process, so that the traditional malicious traffic detection method cannot accurately detect these encrypted malicious traffic. Therefore, the related technology extracts fine-grained features from the handshake message in the plaintext in the traffic to perform feature matching, thereby realizing the detection of encrypted malicious traffic. However, this method depends on the specific traffic feature of the plaintext in the traffic, and under the premise that most of the traffic has been encrypted, it is difficult to accurately and stably detect malicious behavior in encrypted traffic for unknown malicious traffic or variant traffic. SUMMARY
[0003] The present application aims to at least solve one of the technical problems in the related art. To this end, the present application provides a method for detecting encrypted malicious traffic, which can improve the detection accuracy of encrypted malicious traffic.
[0004] The present application also provides a device for detecting encrypted malicious traffic.
[0005] The present application also provides an electronic device.
[0006] The present application also provides a computer-readable storage medium.
[0007] According to the method for detecting encrypted malicious traffic provided by the first aspect of the present application, the method comprises:
[0008] From each connection path between at least one host and at least one server, any connection path is taken as an initial path, each connection path is randomly traversed, and a path connection list corresponding to the initial path is obtained;
[0009] According to the path connection list of the initial path, a target vector of the initial path is determined;
[0010] According to each flow vector corresponding to the initial path and each target host in each target vector, a detection result of encrypted malicious traffic of the target host is determined;
[0011] Wherein, each connection path corresponds to each network connection between the host and the server.
[0012] The encryption malicious traffic detection method provided by the embodiment of the application, by taking any connection path formed between the host and the server according to any network connection as an initial path, randomly traversing each connection path formed between the host and the server by each network connection, obtaining a path connection list corresponding to the initial path, and then determining a target vector of the initial path according to the path connection list, and using the target vectors of each initial path to determine the encryption malicious traffic detection result of the host. Since the network behavior sequence and the network access relationship feature between nodes exist in the path connection list corresponding to any connection path, all the target vectors finally obtained combine the time feature and the space feature of the network traffic, so that the network behavior of the encrypted malicious software can be described in a more accurate and robust manner, thereby improving the detection accuracy of the encrypted malicious traffic.
[0013] According to one embodiment of the application, further comprising:
[0014] According to each network connection between at least one host and at least one server, a heterogeneous graph is constructed;
[0015] Each connection path between at least one host and at least one server is obtained from the heterogeneous graph.
[0016] According to one embodiment of the application, from each connection path between at least one host and at least one server, any connection path is taken as an initial path, each connection path is randomly traversed, and a path connection list corresponding to the initial path is obtained, comprising:
[0017] Any connection path is taken as an initial path;
[0018] Starting from the initial path, random walk is performed on the initial path as the current connection path, each time the walk is performed from each neighbor path of the current connection path, and the next connection path obtained by walking from each neighbor path is iterated as the current connection path, so as to obtain a path connection list corresponding to the initial path according to the walking order of each connection path;
[0019] Wherein, the neighbor path is the connection path corresponding to the host or the server which is the same as the host or the server corresponding to the current connection path.
[0020] According to one embodiment of the application, the first walk determines the next connection path of the initial path in each neighbor path according to a first walking probability of each neighbor path;
[0021] From the second walk, according to a second walk probability of each of the neighbor paths, determining a next connection path of the current connection path in each of the neighbor paths;
[0022] The first walk probability is determined according to a distance between the neighbor path and the initial path;
[0023] The second walk probability of the neighbor path is determined according to a distance between the neighbor path and the current connection path, and a distance between the current connection path and a previous connection path of the current connection path;
[0024] The distance between any two connection paths is determined according to a generation order of the connection paths.
[0025] According to one embodiment of the present application, the target vector of the initial path is determined according to a path connection list of the initial path, comprising:
[0026] Inputting the path connection list of the initial path into a trained word vector model to obtain a path vector of the initial path;
[0027] Generating the target vector of the initial path according to the path vector of the initial path.
[0028] According to one embodiment of the present application, the target vector of the initial path is generated according to the path vector of the initial path, comprising:
[0029] Vector fusion is performed on the path vector of the initial path and a feature vector of traffic data transmitted in the initial path to generate the target vector of the initial path.
[0030] According to one embodiment of the present application, the vector fusion is performed on the path vector of the initial path and the feature vector of the traffic data transmitted in the initial path to generate the target vector of the initial path, comprising:
[0031] According to a normalization function, the path vector of the initial path and the feature vector of the traffic data transmitted in the initial path are normalized to generate the target vector of the initial path.
[0032] According to one embodiment of the present application, the feature vector is determined according to a plurality of traffic features of the traffic data;
[0033] The plurality of traffic features include domain name features, TLS handshake features and statistical features.
[0034] According to one embodiment of the present application, the encrypted malicious traffic detection result of the target host is determined according to each flow vector corresponding to the initial path and a target host of each host in each target vector.
[0035] Each flow vector is weighted and averaged to obtain a host vector of the target host.
[0036] The host vector is input into a trained classifier to determine the encrypted malicious traffic detection result of the target host.
[0037] According to one embodiment of the present application, the weight of each flow vector is determined according to the generation order of the initial path corresponding to the flow vector.
[0038] The generation order of the initial path is determined according to the establishment time of the network connection corresponding to the initial path.
[0039] The encrypted malicious traffic detection device according to the second aspect of the present application comprises:
[0040] A connection list acquisition module is configured to randomly traverse each connection path between at least one host and at least one server, and obtain a path connection list corresponding to an initial path of any connection path.
[0041] A target vector determination module is configured to determine a target vector of the initial path according to the path connection list of the initial path.
[0042] A malicious traffic detection module is configured to determine an encrypted malicious traffic detection result of a target host according to each flow vector corresponding to the initial path and the target host of each host in each target vector.
[0043] Each connection path corresponds to each network connection between the host and the server.
[0044] The electronic device according to the third aspect of the present application comprises a processor and a memory storing a computer program, and the processor executes the computer program to implement the encrypted malicious traffic detection method of any of the above embodiments.
[0045] The computer readable storage medium according to the fourth aspect of the present application stores a computer program, and the computer program is executed by a processor to implement the encrypted malicious traffic detection method of any of the above embodiments.
[0046] The computer program product according to the fifth aspect of the present application comprises: the computer program is executed by a processor to implement the encrypted malicious traffic detection method of any of the above embodiments.
[0047] The one or more technical solutions in the embodiments of the application have at least one of the following technical effects:
[0048] By taking any connection path formed between the host and the server according to any network connection as an initial path, randomly traversing each connection path formed between the host and the server by each network connection to obtain a path connection list corresponding to the initial path, and then determining a target vector of the initial path according to the path connection list and using the target vectors of the initial paths to determine the encrypted malicious traffic detection result of the host, the network behavior sequence and the network access relationship features between nodes in the path connection list corresponding to any connection path are collected, so that all the target vectors finally obtained collect the time features and the space features of the network traffic, thereby the network behavior of the encrypted malware can be described in a more accurate and robust manner, and the detection accuracy of the encrypted malicious traffic is improved.
[0049] Further, by starting from the initial path, determining that the initial path is a current connection path for random walk, performing walk from each neighbor path of the current connection path each time, and iterating the next connection path obtained by walking from each neighbor path as the current connection path, the path connection list corresponding to the initial path is obtained according to the walking order of each connection path, so that the two adjacent connection paths in the obtained path connection list have the same node, and the path connection list with the time sequence features can be formed based on the random walk, the network behavior sequence and the network access relationship features between nodes can be accurately described, and the accuracy of the subsequent malicious traffic detection using the path connection list is further improved.
[0050] Further, by determining the next connection path of the initial path according to the first walking probability determined according to the generation order of the initial path and the generation order of each neighbor path of the initial path when performing random walk, and using the second walking probability determined according to the connection paths obtained by the previous two traversals and the generation order of each neighbor path to be traversed to perform traversal for the subsequent traversal, the connection paths obtained from the second walk can more accurately reflect the space and time features of the network traffic, so that the obtained path connection list can more accurately describe the space and time features of the network traffic.
[0051] Further, by performing vector fusion on the path vector of the initial path and the feature vector of the traffic data transmitted in the initial path to generate the target vector of the initial path, the target vector obtained includes features of multiple dimensions, so that the network behavior of the encrypted malware can be described in a more accurate and robust manner using the target vector subsequently, and the detection accuracy of the encrypted malicious traffic is further improved. Attached Figure Description
[0052] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0053] Figure 1 This is a flowchart illustrating the encrypted malicious traffic detection method provided in the embodiments of this application;
[0054] Figure 2 This is a binary heterogeneous graph formed by the connection paths between the host and the server in the embodiments of this application;
[0055] Figure 3 This is a binary heterogeneous graph formed by the connection paths between the host and the server in another embodiment of this application;
[0056] Figure 4 Yes Figure 1 The flowchart for further refining the acquisition of the path connection list in the encrypted malicious traffic detection method;
[0057] Figure 5 Yes Figure 1 The flowchart for further refining the acquisition of the target vector in the encrypted malicious traffic detection method;
[0058] Figure 6 Yes Figure 1 The flowchart for further refining the detection of malicious traffic in the encrypted malicious traffic detection method;
[0059] Figure 7 This is a schematic diagram of the encrypted malicious traffic detection device provided in the embodiments of this application;
[0060] Figure 8 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation
[0061] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0062] Below, the encryption malicious traffic detection method and device provided by the embodiments of the present application will be described in detail and explained through several specific embodiments.
[0063] In an embodiment, an encryption malicious traffic detection method is provided, which is applied to a target server for detecting encryption malicious traffic. The target server can be an independent server or a server cluster composed of multiple servers, and can also be a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, and big data and artificial intelligence sampling point devices.
[0064] As shown in Figure 1 The encryption malicious traffic detection method provided by the embodiments of the present application includes:
[0065] Step 101, from each connection path between at least one host and at least one server, taking any connection path as an initial path, randomly traversing each connection path, and obtaining a path connection list corresponding to the initial path;
[0066] Step 102, determining a target vector of the initial path according to the path connection list of the initial path;
[0067] Step 103, determining an encryption malicious traffic detection result of a target host of the initial path according to each flow vector corresponding to the initial path and each target host of each host in each target vector;
[0068] Wherein, each connection path corresponds to each network connection between the host and the server one by one.
[0069] By taking any connection path formed between the host and the server according to any network connection as the initial path, randomly traversing each connection path formed between the host and the server by each network connection to obtain a path connection list corresponding to the initial path, and then determining the target vector of the initial path according to the path connection list, and using the target vector of each initial path to determine the encryption malicious traffic detection result of the host. Since there are network behavior sequences and network access relationship features between nodes in the path connection list corresponding to any connection path, all target vector sets finally obtained combine the time features and space features of network traffic, so as to more accurately and robustly depict the network behavior of encrypted malicious software, thereby improving the detection accuracy of encryption malicious traffic.
[0070] In an embodiment, the obtaining of each connection path can be based on constructing a heterogeneous graph according to each time the network connection between at least one host and at least one server, and obtaining each connection path between at least one host and at least one server from the heterogeneous graph.
[0071] In an embodiment, the heterogeneous graph can be a binary heterogeneous graph. Specifically, a binary heterogeneous graph G=(H, D, E, S, I) between a host and a server can be constructed in advance according to all network connections between the host and the server, as shown in Figure 2 If there are multiple hosts and multiple servers, the constructed binary heterogeneous graph G=(H, D, E, S, I) between the host and the server can be as shown in Figure 3 At this time, any edge in the binary heterogeneous graph is a connection path between the host and the server. Wherein, the host can be a terminal device or a server, and the server can also be a terminal device or a server. The terminal device can be a mobile device such as a mobile phone, a notebook computer, etc., or a desktop computer, etc. The server can be an independent server or a server cluster composed of multiple servers to achieve, and can also be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, and basic cloud computing services such as big data and artificial intelligence sampling point devices.
[0072] In an embodiment, the set H represents a set of initiators h of network connections, represented by IP. The set D represents a set of receivers d of network connections, represented by domain name when domain name information can be obtained, otherwise represented by ip:port as a substitute, and the domain name can be obtained from the TLS (Transport Layer Security) handshake. It can be understood that the initiator h is one of the host or the server, and the receiver d is one of the host or the server. The set E={e|e=(h e ,d e ),h e ∈H,d e ∈D} represents a set of connection paths formed by all network connections. Each connection path represents a complete handshake connection between the host and the server, that is, when the host and the server form a complete handshake connection once, it means that the host and the server form a network connection once, and at this time a connection path e is generated. Wherein, a complete handshake connection means that when the host and the server can transmit data between them through at least one handshake, it means that the host and the server form a complete handshake connection, that is, the host and the server form a network connection. At this time, the traffic data generated by the network connection is the traffic data of the connection path corresponding to the network connection. The set I={i e|e∈E} represents the time attribute i of each network connection. e The set, time attribute i e The order in which connection path e is generated among all connection paths, i.e., based on the order in which each network connection is established, determines the host h. e The order of access for each connection path e is determined, thus establishing the generation order of connection path e among all connection paths. e Set S = {s} e |e∈E} represents the feature vector s of the traffic data generated at each network connection, i.e., on each connection path. e A set of.
[0073] In one embodiment, after constructing the binary heterogeneous graph, any one of the connection paths in the binary heterogeneous graph is taken as the initial path. A random walk is applied to traverse each connection path in the binary heterogeneous graph to form a path connection list corresponding to the initial path. For example, the connection paths include path 1, path 2, and path 3. Taking any one connection path, such as path 1, as the initial path, and applying a random walk to traverse path 1, path 2, and path 3, the possible path connection lists are recorded in order as: path 1, path 2, and path 3, or path 1, path 3, and path 2. The resulting path connection list is the path connection list corresponding to path 1. Correspondingly, a path connection list corresponding to path 2 as the initial path and a path connection list corresponding to path 3 as the initial path can be obtained.
[0074] Considering that a binary heterogeneous graph may contain multiple hosts and multiple servers, such as Figure 3 As shown. However, when the endpoints of two connection paths are different, such as path 1 being a connection between host A and server B, and path 2 being a connection between host C and server D, the traffic data on the two connection paths will not affect each other; that is, they are not related. In this case, if connection paths with different endpoints are included in the path connection list during traversal, it will lead to deviations in the network behavior sequences and network access relationship characteristics between nodes in the path connection list. Therefore, to improve the accuracy of the network behavior sequences and network access relationship characteristics between nodes recorded in the obtained path connection list, in one embodiment, as... Figure 4 As shown, the step of taking any one of the connection paths from at least one host and at least one server as the initial path, randomly traversing each of the connection paths to obtain the path connection list corresponding to the initial path includes:
[0075] Step 201: Use any of the connection paths as the initial path;
[0076] Step 202: Starting from the initial path, determine the initial path as the current connection path and perform a random walk. Each walk will walk through each neighbor path of the current connection path, and update the next connection path obtained from each neighbor path to the current connection path, so as to obtain the path connection list corresponding to the initial path according to the walking order of each connection path.
[0077] Wherein, the neighbor path is the corresponding host or the server, and the connection path is the same as the host or server corresponding to the current connection path.
[0078] In one embodiment, after obtaining each connection path, based on the host or server corresponding to any connection path, each connection path that shares the same host or server (i.e., has at least one identical endpoint) is selected as a neighbor path of connection path e. The set consisting of the neighbor paths and connection path e is then C. e ={u:(h u ,d u )|u∈E,h e =h u ∨d e =d u}, where C e Let u represent the set of all neighboring paths of path e, and h represent the neighboring paths. e h represents the originating end of connection path e. u d represents the originating end of neighbor path u. e Indicates the receiving end of connection path e, d u This indicates the receiving end of the neighbor path u.
[0079] After determining the neighbor paths of any given connection path, this path is then used as the initial path. Starting from the initial path, it is determined as the current connection path, and a random walk is applied to traverse it. In each walk, a neighbor path is selected from the current connection path's neighbors as the next connection path. This next connection path is then iterated to become the current connection path, and the process continues, selecting a neighbor path from the new current connection path's neighbors as the next connection path, until all connection paths have been traversed. This results in a path connection list corresponding to the initial path, formed according to the order in which the random walk traverses each connection path.
[0080] The random walk is started from the initial path, the initial path is determined as a current connection path, each walk is performed from each neighbor path of the current connection path, and a next connection path obtained by walking from each neighbor path is iterated as the current connection path, so as to obtain a path connection list corresponding to the initial path according to a walking order of each connection path, so that two adjacent connection paths in the obtained path connection list have the same node, the network behavior sequence and the network access relationship feature between nodes can be accurately described, and the accuracy of subsequent malicious traffic detection using the path connection list is further improved.
[0081] wherein the random walk can be started from an initial path o, denoted as w0, a neighbor path x is randomly selected from neighbor paths of w0 as a next connection path of the initial path o, denoted as w1. Then w1 is marked as a current connection path, and a next neighbor path u is randomly selected from neighbor paths of w1, denoted as w2, w2 is marked as the current connection path, and a next neighbor path is randomly selected from neighbor paths of w2, and so on, until the traversal of each connection path is completed, so that the path connection list corresponding to the initial path o is w=[w0,w1,…,w PL ]。
[0082] To more efficiently reflect the spatial and temporal features of network traffic, in an embodiment, when performing the random walk, a first walk according to a first walk probability of each of the neighbor paths determines a next connection path of the initial path in each of the neighbor paths;
[0083] From the second walk, a next connection path of the current connection path is determined in each of the neighbor paths according to a second walk probability of each of the neighbor paths;
[0084] The first walk probability is determined according to a distance between the neighbor path and the initial path;
[0085] The second walk probability of the neighbor path is determined according to a distance between the neighbor path and the current connection path, and a distance between the current connection path and a previous connection path of the current connection path;
[0086] The distance between any two connection paths is determined according to a generation order of the connection paths.
[0087] In an embodiment, the distance d between two connection paths is defined as d(u,v)=|i u -i v |, that is, the distance between any two connection paths u and v is the generation order i u of the connection path u and the generation order i vthe absolute value of the difference between the distance of the initial path o and the distance of the neighbor path x. When performing the random walk, the random walk is performed starting from the initial path o, and the first walk probability of each neighbor path of the initial path is determined according to the distance between the initial path o and each neighbor path: The neighbor path x is selected from each neighbor path of the initial path o as the next connection path w1 of the initial path o, i.e., w0, and the initial path connection list w = [w0, w1] is obtained. Wherein, Pr(w1 = x | w0 = o) represents the first walk probability of the neighbor path x, y represents any neighbor path other than the initial path o and the neighbor path x, d(o, x) represents the distance between the initial path o and the neighbor path x, d(y, o) represents the distance between the initial path o and the neighbor path y, C o represents the set of the initial path o and each neighbor path of the initial path o.
[0088] Then, for the subsequent traversal, the selection of each random walk is based on the current connection path in the initial path connection list and the generation order of the previous connection path of the current connection path, to determine the second walk probability of each neighbor path of the current connection path in this walk, to determine the selected neighbor path in this traversal. For example, assuming that the current connection path is v, and the previous connection path of the current connection path is u, then based on the second preset probability The neighbor path x is selected from each neighbor path of the current connection path v as the next connection path w i of the current connection path v, i.e., w i+1 . Wherein, d(v, x) represents the distance between the current connection path v and the neighbor path x, d(v, t) represents the distance between the current connection path v and any neighbor path t thereof, C v represents the set of the current connection path v and each neighbor path t of the current connection path v.
[0089] That is, when the neighbor path x overlaps with the previous connection path u, the constant p can control the probability of returning from the current connection path v to the previous connection path u. When there is one or more neighbor paths between the neighbor path x and the previous connection path u, the constant q can control the probability of the current connection path v turning to a new neighbor path that has not been walked.
[0090] After the next connection path of the initial path is determined by the first walk probability determined according to the generation order of the initial path and the generation order of each neighbor path of the initial path when performing the random walk, for subsequent traversals, each neighbor path is traversed by using the second walk probability determined according to the connection path obtained by the previous two traversals and the generation order of each neighbor path to be traversed, so that the connection path obtained from the second walk can more accurately reflect the spatial and temporal characteristics of the network traffic, and thus the obtained path connection list can more accurately describe the spatial and temporal characteristics of the network traffic.
[0091] In an embodiment, the generation order of the connection path is determined according to a time attribute of the network connection corresponding to the connection path. The time attribute is the establishment time of the network connection. That is, according to the early or late establishment time of each network connection, the access order of each connection path by the host or the server can be determined, and the access order is determined as the generation order of the connection path in all connection paths.
[0092] After the path connection list of the initial path is obtained, the path connection list can be subjected to vector operation to determine the target vector of the initial path.
[0093] In an embodiment, as shown in FIG. 4, the target vector of the initial path is determined according to the path connection list of the initial path, and includes: Figure 5
[0094] Step 301: inputting the path connection list of the initial path into the trained word vector model to obtain the path vector of the initial path.
[0095] Step 302: generating the target vector of the initial path according to the path vector of the initial path.
[0096] In an embodiment, after the path connection list of the initial path is obtained, the path connection list can be subjected to operation by the trained word vector model to obtain the path vector of the initial path. Exemplarily, the word vector model can be a word2vec model. The word2vec is a group of related models for generating word vectors, and these models are shallow two-layer neural networks. After training is completed, the word2vec model can map each word to a vector to represent the relationship between words. Therefore, after the training of the word2vec model is completed, the path connection list can be input into the trained word2vec model, and then the initial path can be mapped to a vector, i.e., the path vector.
[0097] After the path vector is obtained, the path vector can be taken as the target vector of the initial path, and at this time, the target vector is the target vector of the traffic data on the initial path, which reflects the spatial and temporal characteristics of the traffic data on the initial path.
[0098] To enable the obtained target vector to reflect the characteristics of the traffic data from more dimensions, so as to improve the accuracy of subsequent malicious traffic detection, in an embodiment, the target vector of the initial path is generated according to the path vector of the initial path, comprising:
[0099] The path vector of the initial path is vector fused with the characteristic vector of the traffic data transmitted in the initial path to generate the target vector of the initial path.
[0100] In an embodiment, the traffic data transmitted in the initial path is obtained by capturing Pcap format packets from the network connection corresponding to the initial path, then extracting a five-tuple, i.e., <source IP, source port, target IP, target port, protocol>, from each packet, and integrating packets related to the same five-tuple into a flow, thereby obtaining the traffic data transmitted in the initial path.
[0101] After obtaining the traffic data transmitted in the initial path, a plurality of traffic characteristics, such as domain name characteristics, TLS handshake characteristics, and statistical characteristics, are extracted from the traffic data, and the characteristic vector of the traffic data is calculated based on the feature values of the plurality of traffic characteristics. Among them, the domain name characteristics include domain name length, domain name level, proportion of letters / numbers / symbols / vowels / consonants in the domain name, etc.; the TLS handshake characteristics include TLS version, client-supported cipher suite, server-selected cipher suite, number of client-provided extensions, client-supported compression algorithm, etc.; the statistical characteristics include the number, length, and average packet length of packets in the flow.
[0102] After obtaining the characteristic vector of the traffic data transmitted in the initial path, the characteristic vector is fused with the path vector of the initial path.
[0103] By vector fusing the path vector of the initial path with the characteristic vector of the traffic data transmitted in the initial path, the target vector of the initial path is generated, so that the obtained target vector includes a plurality of dimensions of characteristics, so that subsequent network behavior of encrypted malicious software can be described in a more accurate and robust manner using the target vector, thereby further improving the detection accuracy of subsequent encrypted malicious traffic.
[0104] To improve the accuracy of the obtained target vector, in an embodiment, the path vector of the initial path and the characteristic vector of the traffic data transmitted in the initial path are normalized according to a normalization function to generate the target vector of the initial path.
[0105] In an embodiment, the path vector and the characteristic vector can be normalized by a normalization function to realize vector fusion. For example, the path vector is re , the eigenvector is s e , the eigenvector is s e , the eigenvector is s e ]) according to the fusion model formed by the normalization function, to determine the target vector fe of the initial path. Wherein, φ(x) = x / |x| is a normalization function.
[0106] After determining the target vector of each initial path, since there may be multiple hosts in the binary heterogeneous graph, for any target host in each host, the initial paths corresponding to the target host need to be determined from each initial path, and then the target vectors of the initial paths corresponding to the target host are determined as the flow vectors of the target host. Wherein, when one end point in the initial path is the target host, it means that the initial path corresponds to the target host.
[0107] After determining the flow vectors of the target host, the flow vectors can be input into the trained classifier, such as the binary classifier trained by the random forest classification algorithm, to determine the encrypted malicious traffic detection result of the target host.
[0108] Alternatively, in an embodiment, as shown in Figure 6 , the encrypted malicious traffic detection result of the target host is determined according to the flow vectors in the target vectors corresponding to the target host of each host.
[0109] Step 401, weighted average of each flow vector to obtain the host vector of the target host;
[0110] Step 402, input the host vector into the trained classifier to determine the encrypted malicious traffic detection result of the target host.
[0111] In an embodiment, after obtaining each flow vector, the flow vectors are weighted and averaged according to preset weights of the flow vectors to obtain a host vector representing the target host, and the host vector is input into a classifier trained based on a supervised learning model for encrypted malicious traffic detection, so as to obtain a detection result of encrypted malicious traffic. The classifier adopts a random forest classification algorithm. The random forest is a collective learning method, which predicts by averaging the outputs of multiple decision trees. These decision trees, especially Classification And Regression Tree (CART), learn simple rules from input features to form simple classifiers, and select an optimal attribute for splitting at each step. Each decision tree in the random forest is learned from a bootstrap sample of the entire dataset and gives a probabilistic result. The output of this group is the average probability of all decision trees, i.e., whether the target host is attacked by malicious traffic. If the average probability is greater than a preset probability, it is determined that the target host is attacked by malicious traffic, otherwise, it is determined that the target host is normal.
[0112] To further improve the accuracy of the malicious traffic detection result, in an embodiment, the weights of the flow vectors can be determined according to the generation order of the initial paths corresponding to the flow vectors; and the generation order of the initial paths is determined according to the establishment time of the network connections corresponding to the initial paths.
[0113] In an embodiment, the host vector of the target host is represented as wherein, is a constant, represents all initial paths corresponding to the target host t, is the weight of the initial path e, and |E| represents the total number of initial paths. It can be seen that the weight of the initial path e is determined by the generation order i of the initial path. e
[0114] The encrypted malicious traffic detection device provided in the present application is described below. The encrypted malicious traffic detection device described below can be correspondingly referred to the encrypted malicious traffic detection method described above.
[0115] In an embodiment, as shown in Figure 7 , an encrypted malicious traffic detection device is provided, comprising:
[0116] The connection list acquisition module 210 is configured to randomly traverse each connection path between at least one host and at least one server, and acquire a path connection list corresponding to an initial path in each connection path.
[0117] The target vector determination module 220 is configured to determine a target vector of the initial path according to a path connection list of the initial path.
[0118] The malicious traffic detection module 230 is configured to determine an encrypted malicious traffic detection result of the target host according to each flow vector of the initial path corresponding to each target host of each host in each target vector.
[0119] Each connection path corresponds to each network connection between the host and the server.
[0120] By taking any connection path formed between the host and the server according to any network connection as an initial path, randomly traversing each connection path formed between the host and the server by each network connection, obtaining a path connection list corresponding to the initial path according to the path connection list, determining a target vector of the initial path according to the path connection list, and determining an encrypted malicious traffic detection result of the host by using the target vector of each initial path, the network behavior sequence and the network access relationship feature between nodes in the path connection list corresponding to any connection path are obtained, so that all target vectors finally obtained combine the time feature and the space feature of network traffic, so that the network behavior of encrypted malicious software can be described in a more accurate and robust manner, and the detection accuracy of encrypted malicious traffic is improved.
[0121] In an embodiment, the connection list acquisition module 210 is further configured to:
[0122] Construct a heterogeneous graph according to each network connection between at least one host and at least one server.
[0123] Obtain each connection path between at least one host and at least one server from the heterogeneous graph.
[0124] In an embodiment, the connection list acquisition module 210 is specifically configured to:
[0125] Take any connection path as an initial path.
[0126] Start from the initial path, determine that the initial path is a random walk for the current connection path, each time the walk is performed from each neighbor path of the current connection path, and the next connection path obtained by walking from each neighbor path is iterated as the current connection path, so as to obtain a path connection list corresponding to the initial path according to the walking order of each connection path.
[0127] The neighbor path is a connection path corresponding to the host or the server which is the same as the host or the server corresponding to the current connection path.
[0128] In an embodiment, the connection list obtaining module 210 is specifically configured to:
[0129] The first walk determines the next connection path of the initial path in each of the neighbor paths according to a first walk probability of each of the neighbor paths;
[0130] From the second walk, the next connection path of the current connection path is determined in each of the neighbor paths according to a second walk probability of each of the neighbor paths;
[0131] The first walk probability is determined according to a distance between the neighbor path and the initial path;
[0132] The second walk probability of the neighbor path is determined according to a distance between the neighbor path and the current connection path, and a distance between the current connection path and a previous connection path of the current connection path;
[0133] The distance between any two connection paths is determined according to a generation order of the connection paths.
[0134] In an embodiment, the target vector determining module 220 is specifically configured to:
[0135] The path connection list of the initial path is input into the trained word vector model to obtain a path vector of the initial path;
[0136] The target vector of the initial path is generated according to the path vector of the initial path.
[0137] In an embodiment, the target vector determining module 220 is specifically configured to:
[0138] The path vector of the initial path is vector fused with a feature vector of the traffic data transmitted in the initial path to generate the target vector of the initial path.
[0139] In an embodiment, the target vector determining module 220 is specifically configured to:
[0140] The path vector of the initial path and the feature vector of the traffic data transmitted in the initial path are normalized according to a normalization function to generate the target vector of the initial path.
[0141] In an embodiment, the feature vector is determined according to a plurality of traffic features of the traffic data;
[0142] The plurality of traffic features include domain name features, TLS handshake features, and statistical features.
[0143] In an embodiment, the malicious traffic detection module 230 is specifically configured to:
[0144] The host vector of the target host is obtained by performing a weighted average of the flow vectors.
[0145] The host vector is input into the trained classifier to determine the encrypted malicious traffic detection result of the target host.
[0146] In one embodiment, the weight of the flow vector is determined according to the generation order of the initial path corresponding to the flow vector;
[0147] The order in which the initial paths are generated is determined based on the establishment time of the network connection corresponding to the initial path.
[0148] Figure 8 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 8 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other via the communication bus 840. The processor 810 can call a computer program in the memory 830 to execute an encrypted malicious traffic detection method, such as including:
[0149] From each connection path between at least one host and at least one server, take any one of the connection paths as the initial path, randomly traverse each of the connection paths, and obtain the path connection list corresponding to the initial path.
[0150] The target vector of the initial path is determined based on the path connection list of the initial path;
[0151] Based on the flow vectors corresponding to the target hosts of the initial path and the target hosts of each of the target vectors, the encrypted malicious traffic detection result of the target host is determined;
[0152] Each of the connection paths corresponds one-to-one with each network connection between the host and the server.
[0153] Further, the logic instructions in the memory 830 described above can be implemented in the form of software functional units and sold or used as independent products, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that make contributions to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.
[0154] In another aspect, the embodiments of the present application also provide a storage medium, the storage medium includes a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program is executed by a processor, and the computer can execute the encrypted malicious traffic detection method provided by the above-mentioned embodiments, for example, including:
[0155] From each connection path between at least one host and at least one server, any connection path is taken as an initial path, each connection path is randomly traversed, and a path connection list corresponding to the initial path is obtained;
[0156] According to the path connection list of the initial path, a target vector of the initial path is determined;
[0157] According to each flow vector corresponding to the initial path and each target host of each host in each target vector, a detection result of encrypted malicious traffic of the target host is determined;
[0158] Wherein, each connection path corresponds to each network connection between the host and the server.
[0159] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be realized by means of software and the necessary general hardware platform, and of course, it can also be realized by hardware. Based on such understanding, the above technical solutions essentially or the parts that make contributions to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product can be stored in a computer readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiment.
[0160] Finally, it should be noted that the above examples are only used to illustrate the technical solutions of the present application, and are not intended to limit the same; although the present application has been described in detail with reference to the foregoing examples, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing examples, or make equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.
Claims
1. A method for detecting encrypted malicious traffic, characterized in that, include: From each connection path between at least one host and at least one server, take any one of the connection paths as the initial path, randomly traverse each of the connection paths, and obtain the path connection list corresponding to the initial path. The target vector of the initial path is determined based on the path connection list of the initial path; Input each flow vector corresponding to the target host in each of the target vectors into the trained classifier to determine the encrypted malicious traffic detection result of the target host; Each connection path corresponds one-to-one with each network connection between the host and the server. Each connection path represents a network connection formed between the host and the server. The target host is any of the hosts. The flow vector is the target vector of the initial path corresponding to the target host.
2. The encrypted malicious traffic detection method according to claim 1, characterized in that, Also includes: Construct a heterogeneous graph based on each of the network connections between at least one of the hosts and at least one of the servers; Obtain the connection paths between at least one host and at least one server from the heterogeneous graph.
3. The encrypted malicious traffic detection method according to claim 1, characterized in that, The step of selecting any one of the connection paths from at least one host and at least one server as the initial path, randomly traversing each of the connection paths, and obtaining a path connection list corresponding to the initial path includes: Use any of the aforementioned connection paths as the initial path; Starting from the initial path, a random walk is performed on the current connection path. Each walk involves walking through each neighboring path of the current connection path, and the next connection path obtained from each neighboring path is iterated as the current connection path. Based on the walking order of each connection path, a path connection list corresponding to the initial path is obtained. Wherein, the neighbor path is the corresponding host or the server, and the connection path is the same as the host or server corresponding to the current connection path.
4. The encrypted malicious traffic detection method according to claim 3, characterized in that, The first walk determines the next connection path of the initial path among the neighbor paths based on the first walk probability of each of the neighbor paths; Starting from the second walk, the next connection path of the current connection path is determined from each of the neighbor paths according to the second walk probability of each neighbor path; The first walk probability is determined based on the distance between the neighbor path and the initial path; The second walk probability of the neighbor path is determined based on the distance between the neighbor path and the current connection path, and the distance between the current connection path and the previous connection path. The distance between any two connection paths is determined according to the order in which the connection paths are generated.
5. The encrypted malicious traffic detection method according to claim 1, characterized in that, Based on the path connection list of the initial path, the target vector of the initial path is determined, including: Input the path connection list of the initial path into the trained word vector model to obtain the path vector of the initial path; Based on the path vector of the initial path, generate the target vector of the initial path.
6. The encrypted malicious traffic detection method according to claim 5, characterized in that, Based on the path vector of the initial path, generate the target vector of the initial path, including: The path vector of the initial path is fused with the feature vector of the traffic data transmitted in the initial path to generate the target vector of the initial path.
7. The encrypted malicious traffic detection method according to claim 6, characterized in that, The path vector of the initial path is fused with the feature vector of the traffic data transmitted in the initial path to generate the target vector of the initial path, including: The path vector of the initial path is normalized according to the normalization function, and the feature vector of the traffic data transmitted in the initial path is normalized to generate the target vector of the initial path.
8. The encrypted malicious traffic detection method according to claim 6, characterized in that, The feature vector is determined based on multiple traffic features of the traffic data; The traffic characteristics mentioned include domain name characteristics, TLS handshake characteristics, and statistical characteristics.
9. The method for detecting encrypted malicious traffic according to any one of claims 1-8, characterized in that, Input the flow vectors corresponding to the target host in each of the target vectors into the trained classifier to determine the encrypted malicious traffic detection result of the target host, including: The host vector of the target host is obtained by performing a weighted average of the flow vectors. The host vector is input into the trained classifier to determine the encrypted malicious traffic detection result of the target host.
10. The encrypted malicious traffic detection method according to claim 9, characterized in that, The weight of the flow vector is determined according to the generation order of the initial path corresponding to the flow vector; The order in which the initial paths are generated is determined based on the establishment time of the network connection corresponding to the initial path.
11. A device for detecting encrypted malicious traffic, characterized in that, include: The connection list acquisition module is used to randomly traverse each connection path from the connection paths between at least one host and at least one server, taking any one of the connection paths as the initial path, and to obtain the path connection list corresponding to the initial path. The target vector determination module is used to determine the target vector of the initial path based on the path connection list of the initial path; The malicious traffic detection module is used to input each flow vector corresponding to the target host in each of the target vectors into a trained classifier to determine the encrypted malicious traffic detection result of the target host; Each connection path corresponds one-to-one with each network connection between the host and the server. Each connection path represents a network connection formed between the host and the server. The target host is any of the hosts. The flow vector is the target vector of the initial path corresponding to the target host.
12. An electronic device comprising a processor and a memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the encrypted malicious traffic detection method according to any one of claims 1 to 10.
13. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the encrypted malicious traffic detection method according to any one of claims 1 to 10.