Real-time abnormal traffic detection method, device and electronic equipment based on software and hardware collaboration

Abstract

The present disclosure provides a kind of software and hardware cooperative abnormal flow real-time detection method, device and electronic equipment, it is related to network software and hardware cooperative abnormal flow field.The specific steps are: receiving the traffic to be detected of external network input, obtain the data packet to be detected in the traffic to be detected;First label is determined according to the first random forest model pre-set in hardware programmable switch by inputting the data packet to be detected into hardware programmable switch;Second label is determined according to the second random forest model pre-set in software programmable switch by inputting suspicious data packet into software programmable switch.The data packet of first label or second label for normal is inputted into internal network.The present disclosure determines the label corresponding to data packet by extracting the characteristics of data packet through hardware programmable switch and software programmable switch, realizes the detection of abnormal flow, avoids the network delay caused by too slow processing speed, improves the detection speed of abnormal flow under the premise of ensuring detection accuracy.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of network software and hardware cooperation of abnormal traffic, and particularly relates to a method and device for real-time detection of abnormal traffic based on software and hardware cooperation and an electronic device. BACKGROUND

[0002] At present, the frequency of network attacks is gradually increasing, and the security situation of the Internet still faces risks and challenges. Network attacks frequently cause property losses and have a negative impact on production and life in various industries. Network attacks are often defined as events that damage the security features of computer system access permissions, availability, integrity and confidentiality. The traffic generated by network attacks is defined as abnormal traffic. In order to protect network security, the software and hardware cooperation of abnormal traffic system needs to be cooperated with software and hardware to distinguish the abnormal traffic for attack behavior from normal network traffic, so as to filter out abnormal traffic and ensure network security.

[0003] In related technologies, the traffic is reported to the network controller, and the operation instruction of the traffic is issued by the controller after the judgment is completed. It mainly depends on the computing power of the network controller, and the controller often uses a general X86 processor, which is easy to introduce network congestion caused by insufficient processing speed. SUMMARY

[0004] The present disclosure provides a method and device for real-time detection of abnormal traffic based on software and hardware cooperation and an electronic device to at least solve the problem of network congestion caused by insufficient processing speed of the related technology of software and hardware cooperation of abnormal traffic. The technical solutions of the present disclosure are as follows:

[0005] According to a first aspect of the embodiments of the present disclosure, a method for real-time detection of abnormal traffic based on software and hardware cooperation is provided, comprising:

[0006] receiving the to-be-detected traffic input by an external network, and obtaining to-be-detected data packets in the to-be-detected traffic;

[0007] inputting the to-be-detected data packets into a hardware programmable switch, obtaining a first feature according to a packet header parameter of the to-be-detected data packets, and determining a first label of the to-be-detected data packets according to a first random forest model preset in the hardware programmable switch and the first feature, wherein the first label includes suspicious and normal;

[0008] inputting the suspicious data packets with the first label as suspicious into a software programmable switch, extracting a second feature according to a packet header parameter of the suspicious data packets and a data flow to which the suspicious data packets belong, and determining a second label of the suspicious data packets according to a second random forest model preset in the software programmable switch and the second feature, wherein the second label includes abnormal and normal;

[0009] The data packet with the first label or the second label being normal is input into the intranet through the core switch.

[0010] Optionally, obtaining the first feature according to a packet header parameter of the data packet to be detected includes:

[0011] Read the packet header parameters of the data packet to be detected to obtain the survival time sttl in the direction from the target address to the source address, the survival time dttl in the direction from the source address to the target address, and the target port number dstport.

[0012] Optionally, the step of extracting the second feature based on the header parameters of the suspicious data packet and the data stream to which the suspicious data packet belongs specifically includes:

[0013] Read the header parameters of the suspicious data packet to obtain the survival time sttl in the direction from the destination address to the source address, the survival time dttl in the direction from the source address to the destination address, and the destination port number dstport;

[0014] Counting the number of data packets from the destination address to the source address in the data flow to which the suspicious data packet belongs, and generating a destination-to-source data packet count dpkts;

[0015] Recording a first time point at which an acknowledgment character ACK is received and a second time point at which a synchronization sequence number SYN is received when a transmission control protocol TCP connection is first established for the data stream to which the suspicious data packet belongs, and obtaining a TCP round trip time tcprtt based on the first time point and the second time point;

[0016] Record the timestamp of the first data packet in the data stream to which the suspicious data packet belongs, and subtract the timestamp from the current time point to obtain the total duration dur;

[0017] Determine a state number ct_state_ttl according to sttl, dttl and the state of the data stream to which the suspicious data packet belongs;

[0018] Get the target address packet size mean dmeans based on the packet size dbytes and dpkts transmitted by the target address;

[0019] Get the source address packet size mean smeans based on the source address transmitted packet size sbytes and dpkts.

[0020] Optionally, the first random forest model includes a decision tree, and the step of determining the first label of the traffic to be detected based on the first random forest model preset in the hardware programmable switch and the first feature specifically includes:

[0021] Inputting the first feature into each decision layer in the decision tree in sequence, performing judgment according to the first feature and conditions of each decision layer, and obtaining a judgment result;

[0022] The corresponding branch flows to the next internal node or leaf node according to the judgment result, and the first label is determined according to the leaf node to which the branch flows finally.

[0023] Optionally, the second random forest model includes a plurality of sub-decision trees, and the step of determining the second label of the suspicious data packet according to the second random forest model preset in the software programmable switch and the second feature specifically includes:

[0024] inputting the second feature into each decision layer in each of the sub-decision trees in sequence, performing judgment according to the second feature and the conditions of each decision layer, and obtaining a judgment result;

[0025] Determine the next internal node or leaf node of the corresponding branch flow according to the judgment result, and determine the initial second label corresponding to each sub-decision tree according to the leaf node to which it finally flows, wherein the initial second label includes abnormal and normal;

[0026] The second label is determined according to the initial second label of each sub-decision tree.

[0027] Optionally, the step of determining the second label according to the initial second label of each sub-decision tree specifically includes:

[0028] In response to the initial second labels of the respective sub-decision trees being normal data packets, determining that the second label is normal;

[0029] In response to at least one of the initial second labels of the sub-decision trees being an abnormal data packet, the second label is determined to be abnormal.

[0030] Optionally, the method further includes:

[0031] The data packet with the second label being abnormal is determined to be an abnormal data packet, the abnormal data packet is stored in a software programmable switch, and the abnormal data packet is reported.

[0032] Optionally, a P4 program framework is set in the hardware programmable switch and the software programmable switch, and the first random forest model is implemented by the corresponding application unit in the P4 program framework, and the second random forest model is implemented by the corresponding application unit in the P4 program framework.

[0033] According to a second aspect of an embodiment of the present disclosure, a real-time abnormal traffic detection device with software and hardware collaboration is provided, comprising:

[0034] The receiving module is configured to receive external network input traffic to be detected, and obtain a data packet to be detected in the traffic to be detected.

[0035] The first detection module is configured to input the data packet to be detected into a hardware programmable switch, obtain a first feature according to a packet header parameter of the data packet to be detected, and determine a first label of the data packet to be detected according to a first random forest model preset in the hardware programmable switch and the first feature, wherein the first label includes suspicious and normal.

[0036] The second detection module is configured to input a suspicious data packet with the first label being suspicious into a software programmable switch, extract a second feature according to a packet header parameter of the suspicious data packet and a data flow to which the suspicious data packet belongs, and determine a second label of the suspicious data packet according to a second random forest model preset in the software programmable switch and the second feature, wherein the second label includes abnormal and normal.

[0037] The output module is configured to input a data packet with the first label or the second label being normal into an internal network through a core switch.

[0038] According to a third aspect of the embodiments of the present disclosure, an electronic device is provided, comprising:

[0039] a processor;

[0040] a memory for storing instructions executable by the processor;

[0041] The processor is configured to execute the instructions to implement the soft and hardware cooperative real-time detection method of abnormal traffic as described in any one of the first aspect.

[0042] According to a fourth aspect of the embodiments of the present disclosure, a computer readable storage medium is provided, when the instructions in the storage medium are executed by the processor of the electronic device, the electronic device can execute the soft and hardware cooperative real-time detection method of abnormal traffic as described in any one of the first aspect.

[0043] According to a fifth aspect of the embodiments of the present disclosure, a computer program product is provided, comprising a computer program, when the computer program is executed by the processor, the soft and hardware cooperative real-time detection method of abnormal traffic as described in any one of the first aspect is implemented.

[0044] The technical solutions provided by the embodiments of the present disclosure at least bring the following beneficial effects:

[0045] By extracting the characteristics of data packets through hardware programmable switches and software programmable switches to determine the labels corresponding to the data packets, abnormal traffic detection is achieved, network delays caused by slow processing speed are avoided, and the detection speed of abnormal traffic is improved while ensuring detection accuracy.

[0046] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute an improper limitation of the present disclosure.

[0048] Figure 1 The present invention is a flowchart showing a method for real-time abnormal traffic detection by software and hardware collaboration according to an exemplary embodiment.

[0049] Figure 2 The present invention is a flowchart showing a method for real-time abnormal traffic detection by software and hardware collaboration according to an exemplary embodiment.

[0050] Figure 3 The present invention is a flowchart showing a method for real-time abnormal traffic detection by software and hardware collaboration according to an exemplary embodiment.

[0051] Figure 4 It is a structural diagram of a P4 program framework according to an exemplary embodiment.

[0052] Figure 5 The present invention is a flowchart showing a method for real-time abnormal traffic detection by software and hardware collaboration according to an exemplary embodiment.

[0053] Figure 6 The present invention is a block diagram showing a real-time abnormal traffic detection device with software and hardware collaboration according to an exemplary embodiment. DETAILED DESCRIPTION

[0054] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0055] It should be noted that the terms "first," "second," and the like in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the numbers used in this manner are interchangeable where appropriate so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0056] Currently, the frequency of cyberattacks is increasing, and the internet security landscape continues to face risks and challenges. Cyberattacks frequently cause financial losses and have a detrimental impact on production and life across all industries. Cyberattacks are often defined as events that compromise the security characteristics of computer systems, such as access rights, availability, integrity, and confidentiality. Traffic generated by cyberattacks is defined as abnormal traffic. To protect network security, a collaborative hardware and software abnormal traffic detection system is required to distinguish abnormal traffic used for attack activities from normal network traffic, thereby filtering out abnormal traffic and ensuring network security.

[0057] The problem of abnormal traffic in software and hardware collaboration is a binary classification problem. Detectors attempt to distinguish normal and abnormal network traffic, thereby filtering out abnormal traffic to ensure network security. Existing work has primarily focused on improving intrusion detection systems (IDSs). These systems are typically monitoring devices installed on the intranet that perform detection by sniffing network packets. Once an anomaly is detected, they alert administrators or proactively address the anomaly. Decades of development have seen the development of IDSs, from applying traditional machine learning to improving IDS accuracy and reducing false positive rates, to using deep learning to extract deeper insights from data to improve detection performance, and finally to simplifying the inference process of deep learning models and reducing resource consumption. However, IDSs, installed on the network, typically acquire and detect network traffic through packet sniffing. By the time the IDS detects abnormal traffic and initiates appropriate action, the traffic has already reached the intranet host. This results in a delay between detection and alerting, and the use of packet sniffing also carries the risk of privacy leakage. This is due to the characteristics of the platforms on which they operate, making it difficult to achieve low latency and good privacy protection. To achieve privacy protection and avoid delayed alerts, a class of anomaly detection methods based on in-network computing and software-hardware collaboration has gained momentum. With the development of software-defined networking and network function virtualization, methods have emerged that detect anomalous traffic types within a controller, dynamically generate a varying number of defense virtual machines, and direct the anomalous traffic to appropriate virtual machines, thereby mitigating the anomalous traffic. While these methods successfully implement in-network computing and block anomalous traffic from entering the intranet, avoiding privacy leaks and delayed alerts, their effectiveness relies on the controller's processing speed. Controllers often use general-purpose X86 processors, which can easily cause network congestion due to insufficient processing speed. Another common method for detecting anomaly traffic using software-hardware collaboration is the use of a traffic cleaning center. A traffic cleaning center typically deploys a scaled-down set of traffic cleaning servers based on network throughput, connected in series within the network as network middleware. External network traffic is first forwarded to the traffic cleaning center for filtering. Using its built-in software, the traffic cleaning server distinguishes between normal and suspicious traffic. Normal traffic is forwarded to the user's intranet; suspicious traffic is further analyzed within the server and detailed information is reported to the customer. The advantages of this approach are: the traffic cleaning server can perform in-depth traffic analysis with high accuracy; suspicious traffic is directly reported and does not enter the customer's intranet, thus preventing it from triggering attacks. However, the disadvantage is that although the traffic cleaning server uses a high-performance configuration, it is generally based on a general-purpose X86 processor, which has high processing latency. This typically introduces processing delays of tens of milliseconds to several seconds, affecting network transmission performance.

[0058] Currently, academia and industry are addressing abnormal traffic issues in software and hardware collaboration through the following three approaches:

[0059] 1. Intrusion Detection System. This method involves installing the system on the network and performing anomaly detection through packet sniffing. By the time the intrusion detection system detects abnormal traffic and takes appropriate action, the abnormal traffic has already reached the intranet host. There is a certain lag in detection and alerting, and network packet sniffing also carries the risk of privacy leaks.

[0060] 2. Software-defined networking (SDN)-based approaches. This approach reports traffic to a network controller, which then issues traffic manipulation instructions after identification. This approach relies heavily on the computing power of the network controller, which often uses general-purpose X86 processors. This can easily lead to network congestion due to insufficient processing speed, increasing network latency.

[0061] 3. Traffic Cleaning Center. Traffic cleaning centers typically deploy a certain scale of traffic cleaning servers based on network throughput, which are connected in series within the network as network middleware. Although traffic cleaning servers utilize high-performance configurations, they are typically based on general-purpose X86 processors, resulting in high processing latency, typically introducing processing delays ranging from tens of milliseconds to several seconds, impacting network transmission performance. Forwarding traffic to other networks also poses the risk of data leakage.

[0062] In summary, low latency, high bandwidth, and privacy leakage are drawbacks of the aforementioned approaches. These drawbacks cannot be directly addressed by advances in anomaly detection algorithms but are inherent to the anomaly detection platforms themselves. Hardware-programmable switches offer the advantages of high throughput, low latency, and in-network computing, while also eliminating privacy concerns and offering high programming flexibility. However, due to the limited computing power of hardware-programmable switches, software-based processing methods are necessary to supplement these algorithm-heavy scenarios.

[0063] Figure 1 FIG. 1 is a flow chart showing a method for real-time abnormal traffic detection using software and hardware collaboration according to an exemplary embodiment. Figure 1 As shown, the method includes the following steps:

[0064] Step 101: receiving traffic to be detected input from an external network, and obtaining a data packet to be detected in the traffic to be detected;

[0065] In this embodiment, traffic based on the TCP and UDP protocols is transmitted across the network, and traffic detection is performed between the external network and the intranet. Before the traffic enters the intranet, abnormal traffic in the traffic to be detected is screened out and blocked from entering the intranet. It should be noted that the traffic to be detected input from the external network includes multiple data streams, each of which contains multiple data packets.

[0066] Step 102: Input the data packet to be detected into the hardware programmable switch, obtain a first feature based on a packet header parameter of the data packet to be detected, and determine a first label of the data packet to be detected based on a first random forest model preset in the hardware programmable switch and the first feature, wherein the first label includes suspicious and normal.

[0067] In this embodiment, a preliminary detection of the data packet to be detected is first performed through a hardware programmable switch. The hardware programmable switch uses a programmable switch chip customized by the Ethernet switch chip hardware manufacturer. While achieving highly flexible programmability, it also retains the characteristic of fast data packet processing of traditional switches. Its delay is generally in the nanosecond level, and the throughput can reach Tbps. The P4 (Programming Protocol-independent Packet Processors) language is used for programming the data plane in the hardware programmable switch. Through P4 language programming, the data plane can be made to perform certain processing on the data packet. In this embodiment, through P4 language programming, the data plane in the hardware programmable switch can obtain the first feature based on the packet header parameters of the data packet to be detected, and determine the first label of the data packet to be detected based on the first random forest model preset in the hardware programmable switch and the first feature.

[0068] The data packets to be detected with the first label of suspicious are suspicious data packets, which may be abnormal data packets or normal data packets and need further analysis; the data packets to be detected with the first label of normal can be directly input into the intranet.

[0069] Step 103: Inputting a suspicious data packet with a first label of suspicious into a software programmable switch, extracting a second feature based on header parameters of the suspicious data packet and the data flow to which the suspicious data packet belongs, and determining a second label for the suspicious data packet based on a second random forest model preset in the software programmable switch and the second feature, wherein the second label includes abnormal and normal.

[0070] In this embodiment, after identifying a suspicious packet, further analysis is required to determine whether it is abnormal. This embodiment utilizes a software-programmable switch within the BMv2 framework for further analysis. The software-programmable switch runs on a server. BMv2 allows implementers to distribute and execute P4 programs, which then process packets accordingly. Compared to hardware-programmable switches, BMv2 offers greater flexibility and controllability, enabling more complex packet processing. However, this processing speed is slower, making it suitable for more sophisticated screening.

[0071] Compared to hardware programmable switches, software programmable switches not only extract second features from packet header parameters, but also from the data stream to which suspicious packets belong. By incorporating these rich second features into a pre-set second random forest model, the system can more accurately determine the second label of suspicious packets and determine whether they are normal or abnormal.

[0072] Step 104: The data packet with the first label or the second label being normal is input into the intranet through the core switch.

[0073] In this embodiment, after the first two steps of filtering the data packets, the first label and the second label of the data packet to be detected in the traffic to be detected input from the external network are checked. As long as one of the first label or the second label of the data packet is normal, it means that the data packet is normal and can be input into the intranet through the core switch.

[0074] This embodiment uses a hardware programmable switch to perform a relatively fast preliminary screening of the data packets to be detected, and then uses a software programmable switch to perform a slower but more accurate screening of suspicious data packets. This not only improves the speed of processing data packets, but also ensures the accuracy of abnormal data packet detection and improves the security of network data.

[0075] Optional, Figure 1 The step 102 of obtaining the first feature according to the header parameters of the data packet to be detected includes:

[0076] Read the packet header parameters of the data packet to be detected to obtain the survival time sttl in the direction from the target address to the source address, the survival time dttl in the direction from the source address to the target address, and the target port number dstport.

[0077] In this embodiment, the hardware programmable switch needs to detect as many abnormal data packets as possible and forward as few abnormal data packets as possible to the intranet, which puts forward requirements for the first random forest model used in the initial screening. If the probability of an abnormal data packet being judged as normal is very small, it is acceptable because the abnormal traffic that escapes detection is very small and the security threat caused is also very small; misjudging a small amount of normal traffic as abnormal traffic is also acceptable because the software programmable switch will perform deep data packet detection, and normal traffic will still be forwarded to the intranet, but this part of the traffic will introduce some delays due to the slow processing speed of the software programmable switch. In order to meet the above requirements, this embodiment reads the packet header parameters of the data packet to be detected through the P4 program in the hardware programmable switch to obtain the first feature, and uses the first feature as the input feature of the first random forest model.

[0078] The feature table of the first feature is shown in Table 1

[0079]

[0080] Table 1

[0081] Optional, Figure 1 The step of extracting the second feature according to the header parameters of the suspicious data packet and the data stream to which the suspicious data packet belongs in step 103 specifically includes:

[0082] Read the header parameters of the suspicious data packet to obtain the survival time sttl in the direction from the destination address to the source address, the survival time dttl in the direction from the source address to the destination address, and the destination port number dstport;

[0083] Counting the number of data packets from the destination address to the source address in the data flow to which the suspicious data packet belongs, and generating a destination-to-source data packet count dpkts;

[0084] Recording a first time point at which an acknowledgment character ACK is received and a second time point at which a synchronization sequence number SYN is received when a transmission control protocol TCP connection is first established for the data stream to which the suspicious data packet belongs, and obtaining a TCP round trip time tcprtt based on the first time point and the second time point;

[0085] Record the timestamp of the first data packet in the data stream to which the suspicious data packet belongs, and subtract the timestamp from the current time point to obtain the total duration dur;

[0086] Determine a state number ct_state_ttl according to sttl, dttl and the state of the data stream to which the suspicious data packet belongs;

[0087] Get the target address packet size mean dmeans based on the packet size dbytes and dpkts transmitted by the target address;

[0088] Get the source address packet size mean smeans based on the source address transmitted packet size sbytes and dpkts.

[0089] In this embodiment, the software-programmable switch, acting as a traffic cleaner, leverages its high detection precision to perform in-depth inspection of suspicious packets after initial screening. Because the initial screening step significantly reduces the number of packets the software-programmable switch needs to inspect, it also alleviates the problem of excessive latency caused by the software-programmable switch's insufficient processing speed. To more accurately determine whether a suspicious packet is abnormal, it is necessary to extract more secondary features for inference in the second random forest model within the software-programmable switch.

[0090] The feature table of the second feature is shown in Table 2

[0091]

[0092] Table 2

[0093] Wherein, the step of acquiring dpkts is specifically: when the data packet with target address to source address appears in the data stream to which the suspicious data packet belongs, the dpkts count is added by 1.

[0094] When a normal TCP network connection is established between the sending end and the receiving end, the receiving end first sends a SYN message, the sending end uses a SYN+ACK response to indicate that the message has been received, and finally the receiving end responds with an ACK message. In this way, a reliable TCP connection can be established between the sending end and the receiving end, and data traffic can be transmitted between the sending end and the receiving end. The above is the process of TCP three-way handshake. ACK (Acknowledge character) is an acknowledgment character. In data communication, the receiving end sends a transmission class control character to the sending end. It indicates that the data sent has been confirmed to be received correctly. In the TCP / IP protocol, if the receiving end successfully receives the data, it will reply to the sending end with an ACK data. Synchronize Sequence Numbers (SYN) is a handshake signal used when establishing a connection in TCP / IP. When the sending end and the receiving end first establish a connection, record the first time point when the sending end receives the acknowledgment character ACK in the third handshake and the second time point when the sending end receives the synchronization sequence number SYN in the first handshake. Subtract the first time point from the second time point to obtain tcprtt, wherein rtt (Round-Trip Time) is the round-trip time.

[0095] dur is the total duration of the suspicious data packet. ct_state_ttl is determined according to the sttl, dttl of the suspicious data packet and the connection state state of the data stream.

[0096] It should be noted that dmeans should be obtained by dividing the data packet size dbytes originally transmitted by the target address by dpkts, but the P4 program does not support division but supports multiplication. Therefore, dmeans can not be directly obtained, and in the corresponding decision layer in the decision tree, the preset dmeans threshold is multiplied by dpkts and compared with dbytes to determine the next internal node or leaf node.

[0097] smeans should be calculated by dividing the source packet size (sbytes) by dpkts. However, the P4 program does not support division, but does support multiplication. Therefore, instead of directly obtaining smeans, the corresponding decision layer in the decision tree multiplies the preset smeans threshold by dpkts and then compares it with sbytes to determine the next internal node or leaf node.

[0098] Figure 2 FIG. 1 is a flow chart showing a method for real-time abnormal traffic detection using software and hardware collaboration according to an exemplary embodiment. Figure 2 As shown, Figure 1 Step 102 in the embodiment includes the following steps:

[0099] Step 201: input the first feature into each decision layer in the decision tree in sequence, perform judgment based on the first feature and the conditions of each decision layer, and obtain a judgment result;

[0100] In this embodiment, to ensure the processing speed of the hardware programmable switch, the first random forest model includes only one decision tree. Since the number of first features is three, the decision tree has a depth of three layers. The decision tree consists of a root node, internal nodes, and leaf nodes. The root node is the starting point for the decision tree's reasoning and judgment. Both the root node and internal nodes contain certain conditions for judgment. The leaf nodes contain the classification results of the first label. The root node and internal nodes compare the input data with the conditions to determine whether the conditions are met and obtain the judgment results.

[0101] Step 202: Determine the next internal node or leaf node to which the corresponding branch flows according to the judgment result, and determine the first label according to the leaf node to which the branch flows finally.

[0102] The next internal node or leaf node to flow to is determined according to the judgment result. The reasoning judgment of the decision tree stops when it reaches the leaf node, and the classification of the leaf node to which it finally flows is determined as the first label.

[0103] Optionally, before step 201, a step of training a first random forest model is further included, specifically: based on the existing data set, extracting the features in Table 1 to train a decision tree in the first random forest model. The first decision tree model is then programmed into the hardware programmable switch.

[0104] Figure 3 FIG. 1 is a flow chart showing a method for real-time abnormal traffic detection using software and hardware collaboration according to an exemplary embodiment. Figure 3 As shown, Figure 1 Step 103 in the embodiment includes the following steps:

[0105] Step 301: input the second feature into each decision layer in each sub-decision tree in sequence, perform judgment based on the second feature and the conditions of each decision layer, and obtain a judgment result;

[0106] In this embodiment, the hardware programmable switch requires precise judgment of suspicious packets, so multiple sub-decision trees are set up in the second random forest model to perform inference and judgment on suspicious packets. Since the number of second features is 9, the sub-decision trees are 9 layers deep. Each sub-decision tree contains a root node, internal nodes, and leaf nodes. The root node is the starting point for the decision tree's inference and judgment. Both the root node and internal nodes contain specific conditions for judgment. The leaf nodes contain the classification results of the second label. The root node and internal nodes compare the input data with the conditions to determine whether the conditions are met and obtain the judgment result.

[0107] In a possible embodiment, there are 4 sub-decision trees in the second random forest model.

[0108] Step 302: Determine the next internal node or leaf node to which the corresponding branch flows based on the judgment result, and determine the initial second label corresponding to each sub-decision tree based on the leaf node to which the branch flows. The initial second label includes abnormal and normal.

[0109] The next internal node or leaf node to flow to is determined according to the judgment result, the reasoning judgment of the sub-decision tree stops when it reaches the leaf node, and the classification of the leaf node to which it finally flows is determined as the initial second label.

[0110] Step 303: Determine the second label according to the initial second label of each sub-decision tree.

[0111] In this embodiment, during inference and judgment, the second feature of a suspicious data packet is input into each sub-decision tree for inference to obtain the corresponding initial second label, and then the second label is determined based on the initial second label of each sub-decision tree. This can reduce the judgment error rate and improve the accuracy of the second label finally obtained.

[0112] Optionally, before step 301, a step of training a second random forest model is further included, specifically: based on the existing data set, the features in Table 2 are extracted to train each sub-decision tree in the second random forest model. The second decision tree model is then programmed into the software programmable switch.

[0113] Optional, Figure 3 Step 303 in includes:

[0114] In response to the initial second labels of the respective sub-decision trees all being normal data packets, determining that the second label is normal; or,

[0115] In response to at least one of the initial second labels of the sub-decision trees being an abnormal data packet, the second label is determined to be abnormal.

[0116] In this embodiment, voting is performed using the initial second labels obtained by each sub-decision tree in the second random forest model. As long as one of the initial second labels is abnormal, the second label corresponding to the suspicious data packet can be determined to be abnormal.

[0117] In a possible embodiment, there are 4 sub-decision trees in the second random forest model, among which the initial second labels output by 3 sub-decision trees are normal, and the initial second label output by 1 sub-decision tree is abnormal, then the second label is determined to be abnormal.

[0118] Optionally, the method further includes:

[0119] The data packet with the second label being abnormal is determined to be an abnormal data packet, the abnormal data packet is stored in a software programmable switch, and the abnormal data packet is reported.

[0120] In this embodiment, the abnormal data packet is stored in a software programmable switch and reported to a network administrator for further processing.

[0121] Optionally, a P4 program framework is set in the hardware programmable switch and the software programmable switch, and the first random forest model is implemented by the corresponding application unit in the P4 program framework, and the second random forest model is implemented by the corresponding application unit in the P4 program framework.

[0122] Figure 4 This is a structural diagram of a P4 program framework according to an exemplary embodiment. Figure 4 As shown in the figure, the P4 program framework includes the header module, the parser module, the ingress module, the egress module and the deparser module.

[0123] The Headers module is responsible for defining the IP, TCP, UDP and other protocols.

[0124] The Parser module is responsible for mapping data packets to packet headers and metadata. The parsing order of the Parser module is: Ethernet parsing, IPv4 parsing, TCP or UDP parsing.

[0125] The Ingress module is the focus of this embodiment. Feature extraction and anomaly detection of the random forest model are all completed in this module. The Ingress module mainly includes some variable definitions of the program, Action units, Table units, and Apply units. The Action unit is used to define actions for processing direction settings and normal / abnormal category settings. The Table unit defines the correspondence between direction and action. The Apply unit is used to determine the direction, and to look up the table according to the Table unit to obtain the corresponding action and execute it.

[0126] When a TCP or UDP packet enters the hardware programmable switch, the Parser module reads its TTL and other information, generating the characteristic parameters shown in Table 1. It then uses the trained first random forest model for inference to obtain the first label, forwarding suspicious packets to the software programmable switch and forwarding normal traffic to the intranet. The software programmable switch then uses the Parser module to read its TTL and other information, generating the characteristic parameters shown in Table 2. It then uses the trained second random forest model for inference to obtain the second label, saving the abnormal packet in the software programmable switch and reporting it to the network administrator for further processing. Normal traffic is then forwarded to the intranet.

[0127] It should be noted that when performing reasoning, the branch matching process of the decision tree can be converted into the if-else process of the P4 programming language.

[0128] The function of the Deparser module is opposite to that of the Parser module. It updates the packet header for the data packet, such as updating the source / destination MAC address, updating the TTL parameter, etc. (The packet header parameters must be updated every time the data packet passes through a switch / router)

[0129] Figure 5 FIG. 1 is a flow chart showing a method for real-time abnormal traffic detection using software and hardware collaboration according to an exemplary embodiment. Figure 5As shown, after the traffic of the outer network is input into the combined detection system, the traffic is first input into the traffic preliminary filter in the combined detection system, that is, the first feature is extracted in the hardware programmable switch, and inference is performed according to the first random forest model preset in the hardware programmable switch to obtain the first label of the data packet to be detected. The normal traffic is input into the inner network through the core switch, and the normal traffic includes data packets with the first label being normal. Then, the suspicious traffic is input into the traffic cleaner. The suspicious traffic includes suspicious data packets with the first label being suspicious, that is, the second feature is extracted in the software programmable switch, and inference is performed according to the second random forest model preset in the software programmable switch to obtain the second label of the suspicious data packet. The normal traffic is input into the inner network through the core switch, and the normal traffic includes data packets with the second label being normal. The data packets with the second label being abnormal are saved in the software programmable switch, reported to the network administrator, and further processed.

[0130] Figure 6 is a block diagram of a soft and hardware cooperative abnormal traffic real-time detection device according to an example embodiment. Referring to Figure 6 The device 600 includes a receiving module 610, a first detection module 620, a second detection module 630, and an output module 640.

[0131] The receiving module 610 is configured to receive the to-be-detected traffic input by an external network, and obtain a to-be-detected data packet in the to-be-detected traffic.

[0132] The first detection module 620 is configured to input the to-be-detected data packet into a hardware programmable switch, obtain a first feature according to a packet header parameter of the to-be-detected data packet, and determine a first label of the to-be-detected data packet according to a first random forest model preset in the hardware programmable switch and the first feature. The first label includes suspicious and normal.

[0133] The second detection module 630 is configured to input the suspicious data packet with the first label being suspicious into a software programmable switch, extract a second feature according to a packet header parameter of the suspicious data packet and a data flow to which the suspicious data packet belongs, and determine a second label of the suspicious data packet according to a second random forest model preset in the software programmable switch and the second feature. The second label includes abnormal and normal.

[0134] The output module 640 is configured to input the data packet with the first label or the second label being normal into an inner network through a core switch.

[0135] As to the device in the above embodiments, the specific manners in which various modules perform operations have been described in detail in the embodiments of the method, and will not be described in detail here.

[0136] Other embodiments of the present disclosure will readily occur to those skilled in the art after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the following claims.

[0137] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes can be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A real-time abnormal traffic detection method based on software and hardware collaboration, characterized in that: include: Receiving traffic to be detected input from an external network, and obtaining data packets to be detected in the traffic to be detected; Input the data packet to be detected into the hardware programmable switch, and obtain a first feature according to the packet header parameters of the data packet to be detected, wherein the first feature includes the survival time sttl in the direction from the destination address to the source address, the survival time dttl in the direction from the source address to the destination address, and the destination port number dstport; Determining a first label of the data packet to be detected based on a first random forest model preset in the hardware programmable switch and the first feature, wherein the first random forest model includes a decision tree, and the first label includes suspicious and normal; Inputting a suspicious data packet with a first label as suspicious into a software programmable switch, extracting a second feature based on the header parameters of the suspicious data packet and the data stream to which the suspicious data packet belongs, this step specifically includes: reading the header parameters of the suspicious data packet, obtaining the time to live (sttl) from the destination address to the source address, the time to live (dttl) from the source address to the destination address, and the destination port number (dstport); Counting the number of data packets from the destination address to the source address in the data flow to which the suspicious data packet belongs, and generating a destination-to-source data packet count dpkts; Recording a first time point at which an acknowledgment character ACK is received and a second time point at which a synchronization sequence number SYN is received when a transmission control protocol TCP connection is first established for the data stream to which the suspicious data packet belongs, and obtaining a TCP round trip time tcprtt based on the first time point and the second time point; Record the timestamp of the first data packet in the data stream to which the suspicious data packet belongs, and subtract the timestamp from the current time point to obtain the total duration dur; Determine a state number ct_state_ttl according to sttl, dttl and the state of the data stream to which the suspicious data packet belongs; Get the target address packet size mean dmeans based on the packet size dbytes and dpkts transmitted by the target address; Get the mean value smeans of the source address packet size based on the source address transmitted packet size sbytes and dpkts; The method further comprises: determining a second label for the suspicious data packet based on a second random forest model preset in the software programmable switch and the second feature, wherein the second random forest model includes multiple sub-decision trees, and the second label includes abnormal and normal; The data packet with the first label or the second label being normal is input into the intranet through the core switch.

2. The method according to claim 1, characterized in that The step of determining the first label of the traffic to be detected according to the first random forest model preset in the hardware programmable switch and the first feature specifically includes: Inputting the first feature into each decision layer in the decision tree in sequence, performing judgment according to the first feature and conditions of each decision layer, and obtaining a judgment result; The corresponding branch flows to the next internal node or leaf node according to the judgment result, and the first label is determined according to the leaf node to which the branch flows finally.

3. The method according to claim 1, characterized in that The step of determining the second label of the suspicious data packet according to the second random forest model preset in the software programmable switch and the second feature specifically includes: inputting the second feature into each decision layer in each of the sub-decision trees in sequence, performing judgment according to the second feature and the conditions of each decision layer, and obtaining a judgment result; Determine the next internal node or leaf node of the corresponding branch flow according to the judgment result, and determine the initial second label corresponding to each sub-decision tree according to the leaf node to which it finally flows, wherein the initial second label includes abnormal and normal; The second label is determined according to the initial second label of each sub-decision tree.

4. The method according to claim 3, characterized in that The step of determining the second label according to the initial second label of each sub-decision tree specifically includes: In response to the initial second labels of the respective sub-decision trees all being normal data packets, determining that the second label is normal; or, In response to at least one of the initial second labels of the sub-decision trees being an abnormal data packet, the second label is determined to be abnormal.

5. The method according to claim 1, wherein The method further comprises: The data packet with the second label being abnormal is determined to be an abnormal data packet, the abnormal data packet is stored in a software programmable switch, and the abnormal data packet is reported.

6. The method according to any one of claims 1 to 5, characterized in that A P4 program framework is set in the hardware programmable switch and the software programmable switch. The first random forest model is implemented by the corresponding application unit in the P4 program framework, and the second random forest model is implemented by the corresponding application unit in the P4 program framework.

7. A real-time abnormal traffic detection device with software and hardware collaboration, characterized in that: The device is used to implement the software-hardware collaborative abnormal traffic real-time detection method according to claim 1, and the device includes: A receiving module, configured to receive traffic to be detected inputted from an external network and obtain data packets to be detected in the traffic to be detected; a first detection module, configured to input the data packet to be detected into the hardware programmable switch, obtain a first feature based on a packet header parameter of the data packet to be detected, the first feature including a time to live (sttl) from the destination address to the source address, a time to live (dttl) from the source address to the destination address, and a destination port number (dstport); and determine a first label for the data packet to be detected based on a first random forest model preset in the hardware programmable switch and the first feature, wherein the first random forest model includes a decision tree, and the first label includes suspicious and normal. a second detection module, configured to input a suspicious data packet with a first label as suspicious into a software programmable switch, and extract a second feature based on a packet header parameter of the suspicious data packet and a data flow to which the suspicious data packet belongs; The output module is used to input the data packet with the first label or the second label as normal into the intranet through the core switch.

8. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the software-hardware collaborative real-time abnormal traffic detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute the real-time abnormal traffic detection method of software and hardware collaboration as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, wherein when executed by a processor, the computer program implements the software-hardware coordinated real-time abnormal traffic detection method according to any one of claims 1 to 6.

Images