A flow detection method and apparatus

Abstract

The application provides a traffic detection method and device, applied to the network security technical field, wherein the traffic detection method comprises the following steps: obtaining field information and destination IP information corresponding to each piece of to-be-detected traffic in multiple pieces of to-be-detected traffic; wherein the field information is extracted according to a handshake message; dividing the multiple pieces of to-be-detected traffic into multiple traffic groups according to the destination IP information; wherein the number of to-be-detected traffics in each traffic group and the destination IP information of the to-be-detected traffics are the same; for each traffic group, extracting the features of the field information corresponding to the multiple pieces of to-be-detected traffics in the traffic group as the communication features corresponding to the destination IP information of the traffic group; and performing traffic detection on the to-be-detected traffics in the traffic group according to the communication features. The consistent features of the communication channel can be extracted based on the multiple pieces of to-be-detected traffics in the communication channel, so that the malicious behavior can be effectively represented, and therefore, the accuracy of traffic detection can be improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a traffic detection method and apparatus. Background Technology

[0002] In recent years, the Transport Layer Security (TLS) protocol has become increasingly widely used, with most network communications employing TLS to protect user messages, transactions, and credentials. However, while TLS effectively protects network traffic privacy, attackers are also exploiting it to evade detection by security devices. For example, TLS can be used to hide instructions received from a Command and Control server (C&C) or sensitive data destined for the C&C. Therefore, it is necessary to detect and block C&C communications with malware.

[0003] In existing technologies, machine learning is generally used to detect each TLS traffic. However, the accuracy of the detection methods used in existing technologies is relatively low. Summary of the Invention

[0004] The purpose of this application is to provide a traffic detection method and apparatus to solve the technical problem of low accuracy in traffic detection of TLS traffic in the prior art.

[0005] In a first aspect, embodiments of this application provide a traffic detection method, comprising: acquiring field information and destination IP information corresponding to each of multiple traffic streams to be detected; wherein the field information is extracted based on a handshake message; dividing the multiple traffic streams to be detected into multiple traffic groups based on the destination IP information; wherein the number of traffic streams to be detected and the destination IP information of the traffic streams to be detected are the same in each traffic group; for each traffic group, extracting features of the field information corresponding to the multiple traffic streams to be detected in the traffic group as communication features corresponding to the destination IP information of the traffic group; and performing traffic detection on the traffic streams to be detected in the traffic group based on the communication features.

[0006] In the above scheme, multiple traffic streams to be detected can be divided into multiple traffic groups based on the destination IP information. Feature extraction is performed on the field information corresponding to the traffic streams with the same destination IP information within each traffic group. This allows the channel characteristics corresponding to the destination IP information to be obtained based on the field information of multiple traffic streams to be detected, and traffic detection is then performed on the traffic streams corresponding to the destination IP information based on these channel characteristics. Compared with existing technologies, since the consistency characteristics of the communication channel can be extracted based on multiple traffic streams to be detected in the communication channel, malicious behavior can be effectively characterized. Furthermore, by constructing communication behavior characteristics at both ends, it is unaffected by the parameters and certificate characteristics of both ends, and can effectively detect highly disguised malware and C&C servers. Therefore, the traffic detection method provided in this application embodiment can improve the accuracy of traffic detection.

[0007] In an optional implementation, dividing multiple traffic streams to be detected into multiple traffic groups based on the destination IP information includes: sorting multiple traffic streams to be detected with the same destination IP information in chronological order to obtain a traffic set corresponding to the destination IP information; and dividing the traffic streams in the traffic set into a traffic group for every preset number of traffic streams. In the above scheme, the traffic streams to be detected with the same destination IP information can be sorted in chronological order before being divided, thereby allowing the extraction of consistency features of the communication channel based on multiple traffic streams in the communication channel corresponding to the destination IP information. This effectively characterizes malicious behavior, effectively detects highly disguised malware and C&C servers, and thus improves the accuracy of traffic detection.

[0008] In an optional implementation, extracting the features of the field information corresponding to multiple traffic streams to be detected in the traffic group as communication features corresponding to the destination IP information of the traffic group includes: initializing the value of each slot in the slot numbering system to 0; updating the slot numbering system sequentially according to the field information of each traffic stream to be detected in the traffic group; and using the updated slot numbering system as the communication feature. In the above scheme, the slot numbering system can be used to represent the communication features of the communication channel, thereby effectively detecting highly disguised malware and C&C servers regardless of the parameters and certificate features at both ends. Therefore, the traffic detection method provided in this application embodiment can improve the accuracy of traffic detection.

[0009] In an optional implementation, after dividing multiple traffic streams to be detected into multiple traffic groups based on the destination IP information, the method further includes: storing the field information corresponding to the multiple traffic streams to be detected in each traffic group in a JSON file. In the above scheme, the field information corresponding to the traffic streams to be detected with the same destination IP information in each traffic group can be stored in a JSON file. This allows the channel characteristics corresponding to the destination IP information to be obtained based on the field information of multiple traffic streams to be detected, and traffic detection can be performed on the traffic streams to be detected corresponding to the destination IP information based on these channel characteristics, thereby improving the accuracy of traffic detection.

[0010] In an optional implementation, the step of performing traffic detection on the traffic to be detected in the traffic group based on the communication characteristics includes: inputting the communication characteristics into a pre-trained traffic detection model to obtain the detection result output by the traffic detection model; wherein the detection result represents the probability that the destination IP information is a malicious IP; and performing traffic detection on the traffic to be detected in the traffic group based on the detection result. In the above scheme, a pre-trained traffic detection model can be used to perform traffic detection on the traffic to be detected, thereby achieving accurate and fast traffic detection.

[0011] In an optional implementation, before obtaining the field information and destination IP information corresponding to each of the multiple traffic streams to be detected, the method further includes: training a neural network model using the following steps to obtain the traffic detection model: obtaining the field sample information and destination IP sample information corresponding to each of the multiple sample traffic streams; dividing the multiple sample traffic streams into multiple traffic sample groups based on the destination IP sample information; labeling the destination IP sample information corresponding to each traffic sample group to obtain corresponding labeling information; and extracting sample features of the field information corresponding to the multiple sample traffic streams in each traffic sample group; training the parameters of the neural network model using the labeling information and the sample features until the traffic detection model is obtained. In the above scheme, the neural network model can be trained using the labeling information corresponding to the sample traffic streams and the sample features corresponding to the destination IP sample information to obtain a pre-trained traffic detection model.

[0012] Secondly, embodiments of this application provide a traffic detection device, comprising: an acquisition module, configured to acquire field information and destination IP information corresponding to each of multiple traffic streams to be detected; wherein the field information is extracted based on a handshake message; a division module, configured to divide the multiple traffic streams to be detected into multiple traffic groups based on the destination IP information; wherein the number of traffic streams to be detected and the destination IP information of the traffic streams to be detected are the same in each traffic group; an extraction module, configured to extract features of the field information corresponding to the multiple traffic streams to be detected in each traffic group, as communication features corresponding to the destination IP information of the traffic group; and a detection module, configured to perform traffic detection on the traffic streams to be detected in the traffic group based on the communication features.

[0013] In the above scheme, multiple traffic streams to be detected can be divided into multiple traffic groups based on the destination IP information. Feature extraction is performed on the field information corresponding to the traffic streams with the same destination IP information within each traffic group. This allows the channel characteristics corresponding to the destination IP information to be obtained based on the field information of multiple traffic streams to be detected, and traffic detection is then performed on the traffic streams corresponding to the destination IP information based on these channel characteristics. Compared with existing technologies, since the consistency characteristics of the communication channel can be extracted based on multiple traffic streams to be detected in the communication channel, malicious behavior can be effectively characterized. Furthermore, by constructing communication behavior characteristics at both ends, it is unaffected by the parameters and certificate characteristics of both ends, and can effectively detect highly disguised malware and C&C servers. Therefore, the traffic detection method provided in this application embodiment can improve the accuracy of traffic detection.

[0014] In an optional implementation, the segmentation module is specifically used to: sort multiple traffic streams with the same destination IP information according to time order to obtain a traffic set corresponding to the destination IP information; and divide the traffic streams in the traffic set into a traffic group for every preset number of traffic streams. In the above scheme, the traffic streams with the same destination IP information can be sorted according to time order before segmentation, thereby allowing the extraction of consistency features of the communication channel based on multiple traffic streams in the communication channel corresponding to the destination IP information. This effectively characterizes malicious behavior, effectively detects highly disguised malware and C&C servers, and thus improves the accuracy of traffic detection.

[0015] In an optional implementation, the extraction module is specifically used to: initialize the value of each slot in the slot number to 0; update the slot number sequentially according to the field information of each traffic to be detected in the traffic group; and use the updated slot number as the communication feature. In the above scheme, the slot number can be used to represent the communication characteristics of the communication channel, thereby effectively detecting highly disguised malware and C&C servers regardless of the parameters and certificate characteristics at both ends. Therefore, the traffic detection method provided in this application embodiment can improve the accuracy of traffic detection.

[0016] In an optional implementation, the traffic detection device further includes a storage module for storing field information corresponding to multiple traffic streams to be detected in each traffic group in a JSON file. In the above scheme, the field information corresponding to traffic streams with the same destination IP information in each traffic group can be stored in a JSON file. This allows the channel characteristics corresponding to the destination IP information to be obtained based on the field information of multiple traffic streams to be detected, and traffic detection can be performed on the traffic streams corresponding to the destination IP information based on these channel characteristics, thereby improving the accuracy of traffic detection.

[0017] In an optional implementation, the detection module is specifically used to: input the communication features into a pre-trained traffic detection model to obtain the detection result output by the traffic detection model; wherein the detection result represents the probability that the destination IP information is a malicious IP; and perform traffic detection on the traffic to be detected in the traffic group based on the detection result. In the above scheme, a pre-trained traffic detection model can be used to perform traffic detection on the traffic to be detected, thereby achieving accurate and fast traffic detection.

[0018] In an optional implementation, the traffic detection device further includes a training module, configured to train a neural network model using the following steps to obtain the traffic detection model: acquiring field sample information and destination IP sample information corresponding to each sample traffic in multiple sample traffic streams; dividing the multiple sample traffic streams into multiple traffic sample groups based on the destination IP sample information; labeling the destination IP sample information corresponding to each traffic sample group to obtain corresponding labeling information; and extracting sample features of the field information corresponding to multiple sample traffic streams in each traffic sample group; and training the parameters of the neural network model using the labeling information and the sample features until the traffic detection model is obtained. In the above scheme, the neural network model can be trained using the labeling information corresponding to the sample traffic and the sample features corresponding to the destination IP sample information to obtain a pre-trained traffic detection model.

[0019] Thirdly, embodiments of this application provide a computer program product, including computer program instructions, which are read and executed by a processor to perform the traffic detection method as described in the first aspect.

[0020] Fourthly, embodiments of this application provide an electronic device, including: a processor, a memory, and a bus; the processor and the memory communicate with each other via the bus; the memory stores computer program instructions executable by the processor, and the processor can execute the traffic detection method as described in the first aspect by calling the computer program instructions.

[0021] Fifthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions that, when executed by a computer, cause the computer to perform the traffic detection method as described in the first aspect.

[0022] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, embodiments of this application are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0023] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 A flowchart of a traffic detection method provided in an embodiment of this application;

[0025] Figure 2 A structural block diagram of a flow detection device provided in an embodiment of this application;

[0026] Figure 3 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0027] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0028] Please refer to Figure 1 , Figure 1 A flowchart of a traffic detection method provided in this application embodiment, the traffic detection method may include the following steps:

[0029] Step S101: Obtain the field information and destination IP information corresponding to each of the multiple traffic streams to be detected.

[0030] Step S102: Divide multiple traffic streams to be detected into multiple traffic groups based on the destination IP information.

[0031] Step S103: For each traffic group, extract the features of the field information corresponding to multiple traffic streams to be detected in the traffic group, and use them as communication features corresponding to the destination IP information of the traffic group.

[0032] Step S104: Perform traffic detection on the traffic to be detected in the traffic group based on communication characteristics.

[0033] Specifically, in step S101 above, the traffic to be detected refers to the traffic that needs to be detected, and the field information corresponding to the traffic to be detected is extracted from the handshake message.

[0034] It should be noted that the embodiments of this application do not impose specific limitations on the specific implementation methods of handshake messages and field information, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, handshake messages may include Client Hello messages, Server Hello messages, Client Key Exchange messages, Certificate messages, etc.

[0035] Furthermore, this application does not impose specific limitations on the implementation methods for obtaining the field information and destination IP information corresponding to each of multiple traffic streams to be detected. Those skilled in the art can also make appropriate adjustments according to the actual situation. For example, the field information and destination IP information corresponding to the traffic streams to be detected can be received from other devices; or, the handshake message corresponding to the traffic streams to be detected can be obtained, and the field information and destination IP information corresponding to the traffic streams to be detected can be extracted from the handshake message, etc.

[0036] It is understood that, in this embodiment, traffic with the same triples (destination IP, destination port, transport layer protocol) is considered traffic generated on the same communication channel. Applications typically generate different key negotiation processes depending on the browser and operating system, while the key negotiation process of malware is generally fixed in the code and does not change frequently. Therefore, malware and normal applications can be explored by calculating whether the values ​​of each field in the handshake message are consistent within the same communication channel; if the handshake fields are consistent in the communication channel, the server generating the traffic is suspicious; if the handshake fields are inconsistent, the server is normal.

[0037] In step S102 above, the multiple traffic streams to be detected can be divided into multiple traffic groups based on the destination IP information. Each traffic group contains the same number of traffic streams to be detected, and the destination IP information of the traffic streams to be detected in each traffic group is the same.

[0038] It should be noted that the embodiments of this application do not specifically limit the implementation method of dividing the traffic to be detected, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, the traffic to be detected with the same destination IP information can be divided according to the time sequence; or, the traffic to be detected with the same destination IP information can be divided randomly, etc.

[0039] In step S103 above, for each traffic group obtained above, features of field information corresponding to multiple traffic streams to be detected in the traffic group can be extracted, wherein the feature is the communication feature corresponding to the destination IP information of the traffic group.

[0040] It should be noted that the embodiments of this application do not impose specific limitations on the specific implementation methods for feature extraction, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, a neural network can be used to extract features from the field information corresponding to the traffic to be detected; or, the number of slots can be used to extract features from the field information corresponding to the traffic to be detected, etc.

[0041] In step S104 above, traffic detection can be performed on the traffic to be detected in the traffic group based on the above communication characteristics to determine whether the traffic to be detected is abnormal traffic or normal traffic.

[0042] In the above scheme, multiple traffic streams to be detected can be divided into multiple traffic groups based on the destination IP information. Feature extraction is performed on the field information corresponding to the traffic streams with the same destination IP information within each traffic group. This allows the channel characteristics corresponding to the destination IP information to be obtained based on the field information of multiple traffic streams to be detected, and traffic detection is then performed on the traffic streams corresponding to the destination IP information based on these channel characteristics. Compared with existing technologies, since the consistency characteristics of the communication channel can be extracted based on multiple traffic streams to be detected in the communication channel, malicious behavior can be effectively characterized. Furthermore, by constructing communication behavior characteristics at both ends, it is unaffected by the parameters and certificate characteristics of both ends, and can effectively detect highly disguised malware and C&C servers. Therefore, the traffic detection method provided in this application embodiment can improve the accuracy of traffic detection.

[0043] Furthermore, based on the above embodiments, step S102 may specifically include the following steps:

[0044] Step 1) Sort multiple traffic streams with the same destination IP information in chronological order to obtain a traffic set corresponding to that destination IP information.

[0045] Step 2) Divide each preset number of traffic to be detected in the traffic set into a traffic group.

[0046] Specifically, in step 1) above, for the multiple traffic streams to be detected, the same destination IP information can first be grouped together; then, for the multiple traffic streams to be detected with the same destination IP information, they can be sorted in chronological order to obtain the traffic set corresponding to that destination IP information. In other words, the traffic set includes multiple traffic streams to be detected with the same destination IP information sorted in chronological order.

[0047] In step 2) above, each preset number of traffic flows to be detected in the traffic set can be divided into a traffic group. The specific implementation of the preset number is not limited in this application embodiment; those skilled in the art can make appropriate adjustments according to actual circumstances, such as 12, 15, 18, etc.

[0048] For example, suppose the traffic set corresponding to a certain destination IP information includes: a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, with a preset quantity of 8. Then the traffic groups corresponding to this destination IP information are: Group 1: a1, a2, a3, a4, a5, a6, a7, a8; Group 2: a2, a3, a4, a5, a6, a7, a8, a9; Group 3: a3, a4, a5, a6, a7, a8, a9, a10.

[0049] In the above scheme, the traffic to be detected with the same destination IP information can be sorted in chronological order and then divided. This allows for the extraction of consistency features of the communication channel based on multiple traffic streams in the communication channel corresponding to the destination IP information. This effectively characterizes malicious behavior and detects highly disguised malware and C&C servers, thus improving the accuracy of traffic detection.

[0050] Furthermore, based on the above embodiments, step S103 may specifically include the following steps:

[0051] Step 1) Initialize the value of each slot in the number of slots to 0.

[0052] Step 2) Update the number of slots according to the field information of each traffic to be detected in the traffic group.

[0053] Step 3) Use the updated slot number as a communication feature.

[0054] Specifically, in this embodiment of the application, a slot with 734 bits can be constructed.

[0055] In one implementation, slots 1-3 can represent optional ClientHello versions; slots 4-154 can represent discrete interval numbers for the ClientHello packet length, each interval being 10 bytes long; slots 155-283 can represent discrete interval numbers for the number of ClientHello Cipher Suites, each interval being 1 byte long; slots 284-638 can represent each optional cipher suite in the ClientHello Cipher Suites; slots 639-647 can represent discrete interval numbers for the Client Pubkey length; slots 648-690 can represent some optional extensions of the ClientHello Extension; slots 691-699 can represent discrete interval numbers for the number of signature_algorithms in the ClientHello Extension, each interval being 1 byte long; slots 700-702 can represent discrete values ​​for the application_layer_protocol_negotiation length in the ClientHello Extension; slots 703-704 can represent discrete values ​​for the extended_master_secret length in the ClientHello Extension; and slots 705-708 can represent the ClientHello... Each optional element in supported_groups in the Extension; slots 705-734 can represent discrete interval numbers of the padding length in the ClientHello Extension, with each interval being 8 bytes long.

[0056] In step 1) above, the value of each slot in the number of slots is first initialized to 0, resulting in a 734-bit sequence of all zeros.

[0057] In step 2) above, the number of slots is updated sequentially based on the field information of each traffic item to be detected in the traffic group. One implementation method is to extract the TLSVersion, Client Pubkey, Cipher Suites list, and Extension list for each traffic item to be detected in the traffic group. For each traffic item to be detected, the elements in the TLSVersion, Client Pubkey, Cipher Suites list, and Extension list are mapped to the number of slots. If a content from the list appears in that slot, the value of that slot is incremented by 1.

[0058] Let's take updating the slot values ​​of slots 1-3 as an example. Assume there are 3 traffic items to be detected in the traffic group, and initialize slots 1-3 as [0,0,0]. If the ClientHello version of the first traffic item to be detected is 1, then slots 1-3 are updated to [1,0,0]. If the ClientHello version of the second traffic item to be detected is 1, then slots 1-3 are updated to [2,0,0]. If the ClientHello version of the third traffic item to be detected is 3, then slots 1-3 are updated to [2,0,1].

[0059] In the above scheme, the communication characteristics of the communication channel can be represented by the 734-dimensional vector corresponding to the slot, thus effectively detecting highly disguised malware and C&C servers regardless of the parameters and certificate characteristics at both ends. Therefore, the traffic detection method provided in this application embodiment can improve the accuracy of traffic detection.

[0060] Furthermore, based on the above embodiments, after step S102, the traffic detection method provided in this application embodiment may further include the following steps:

[0061] The field information corresponding to multiple traffic items to be detected in each traffic group is stored in a JSON file.

[0062] In the above scheme, the field information corresponding to the traffic to be detected with the same destination IP information in each traffic group can be stored in a JSON file. This allows the channel characteristics corresponding to the destination IP information to be obtained based on the field information of multiple traffic to be detected, and traffic detection can be performed on the traffic to be detected corresponding to the destination IP information based on the channel characteristics, which can improve the accuracy of traffic detection.

[0063] Furthermore, based on the above embodiments, step S104 may specifically include the following steps:

[0064] Step 1) Input the communication features into the pre-trained traffic detection model to obtain the detection results output by the traffic detection model.

[0065] Step 2) Perform flow detection on the flow to be detected in the flow group based on the detection results.

[0066] Specifically, in step 1) above, this application embodiment does not impose specific limitations on the specific implementation of the traffic detection model, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, the traffic detection model can adopt a gradient boosting decision tree model.

[0067] The gradient boosting tree model can be represented as follows: if h t (x) represents the t-th CART tree, and the model is defined as follows:

[0068]

[0069] The gradient boosting tree model is trained using a forward stepwise algorithm. The model at step t is determined by the model at step t-1. Each CART tree fits the loss function to the negative gradient of the current model. The final boosting tree model is a linear sum of multiple CART trees. The model at step t is represented as:

[0070] f t (x)=f t-1 (x)+h t (x).

[0071] In step 2) above, traffic detection can be performed on the traffic to be detected in the traffic group based on the detection results obtained in step 1). The detection results represent the probability that the destination IP information is a malicious IP.

[0072] As one implementation method, the above probability can be compared with a preset threshold. If the probability is greater than the above threshold, the destination IP information is determined to be a malicious IP, and the traffic to be detected corresponding to the destination IP information is abnormal traffic.

[0073] In the above scheme, a pre-trained traffic detection model can be used to detect the traffic to be detected, thereby accurately and quickly detecting the traffic.

[0074] Furthermore, based on the above embodiments, prior to step S101, the traffic monitoring method provided in this application embodiment may further include the following steps:

[0075] The neural network model is trained using the following steps to obtain the traffic detection model:

[0076] Step 1) Obtain the field sample information and destination IP sample information corresponding to each sample traffic in multiple sample traffic.

[0077] Step 2) Divide multiple sample traffic into multiple traffic sample groups based on the destination IP sample information.

[0078] Step 3) Label the destination IP sample information corresponding to each traffic sample group to obtain the corresponding label information, and extract the sample features of the field information corresponding to multiple sample traffic in each traffic sample group.

[0079] Step 3) Use the labeled information and sample features to train the parameters of the neural network model until the traffic detection model is obtained.

[0080] Specifically, in step 1) above, malicious sample traffic can be collected by running multiple malicious samples in a sandbox, as well as normal sample traffic under normal circumstances.

[0081] Similar to the above embodiments for obtaining the field information and destination IP information corresponding to each of the multiple traffic streams to be detected, the embodiments of this application do not impose specific limitations on the specific implementation of obtaining the field sample information and destination IP sample information corresponding to each of the multiple sample traffic streams. Those skilled in the art can also make appropriate adjustments according to the actual situation.

[0082] In step 3) above, since it is known whether the sample traffic is malicious or normal, the destination IP sample information corresponding to each traffic sample group can be labeled. For example, the destination IP sample information corresponding to malicious sample traffic is a malicious IP, and the destination IP sample information corresponding to normal sample traffic is a normal IP.

[0083] In step 4) above, the parameters of the neural network model can be trained using the labeled information and sample features until the traffic detection model is obtained. It should be noted that this application does not specifically limit the specific implementation method for training the neural network model; those skilled in the art can make appropriate adjustments based on existing technology.

[0084] In the above scheme, the labeling information corresponding to the sample traffic and the sample features corresponding to the destination IP sample information can be used to train the neural network model, thereby obtaining a pre-trained traffic detection model.

[0085] Please refer to Figure 2 , Figure 2 The present application provides a structural block diagram of a traffic detection device 200, which includes: an acquisition module 201, configured to acquire field information and destination IP information corresponding to each of multiple traffic streams to be detected; wherein the field information is extracted based on handshake messages; a division module 202, configured to divide the multiple traffic streams to be detected into multiple traffic groups based on the destination IP information; wherein the number of traffic streams to be detected and the destination IP information of the traffic streams to be detected are the same in each traffic group; an extraction module 203, configured to extract features of the field information corresponding to the multiple traffic streams to be detected in each traffic group as communication features corresponding to the destination IP information of the traffic group; and a detection module 204, configured to perform traffic detection on the traffic streams to be detected in the traffic group based on the communication features.

[0086] In the above scheme, multiple traffic streams to be detected can be divided into multiple traffic groups based on the destination IP information. Feature extraction is performed on the field information corresponding to the traffic streams with the same destination IP information within each traffic group. This allows the channel characteristics corresponding to the destination IP information to be obtained based on the field information of multiple traffic streams to be detected, and traffic detection is then performed on the traffic streams corresponding to the destination IP information based on these channel characteristics. Compared with existing technologies, since the consistency characteristics of the communication channel can be extracted based on multiple traffic streams to be detected in the communication channel, malicious behavior can be effectively characterized. Furthermore, by constructing communication behavior characteristics at both ends, it is unaffected by the parameters and certificate characteristics of both ends, and can effectively detect highly disguised malware and C&C servers. Therefore, the traffic detection method provided in this application embodiment can improve the accuracy of traffic detection.

[0087] Furthermore, based on the above embodiments, the partitioning module 202 is specifically used to: sort multiple traffic streams to be detected with the same destination IP information in chronological order to obtain a traffic set corresponding to the destination IP information; and partition each preset number of traffic streams to be detected in the traffic set into a traffic group.

[0088] In the above scheme, the traffic to be detected with the same destination IP information can be sorted in chronological order and then divided. This allows for the extraction of consistency features of the communication channel based on multiple traffic streams in the communication channel corresponding to the destination IP information. This effectively characterizes malicious behavior and detects highly disguised malware and C&C servers, thus improving the accuracy of traffic detection.

[0089] Furthermore, based on the above embodiments, the extraction module 203 is specifically used to: initialize the value of each slot in the slot number to 0; update the slot number sequentially according to the field information of each traffic to be detected in the traffic group; and use the updated slot number as the communication feature.

[0090] In the above scheme, the number of slots can be used to represent the communication characteristics of the communication channel, thereby effectively detecting highly disguised malware and C&C servers regardless of the parameters and certificate characteristics at both ends. Therefore, the traffic detection method provided in this application embodiment can improve the accuracy of traffic detection.

[0091] Furthermore, based on the above embodiments, the traffic detection device 200 further includes a storage module for storing field information corresponding to multiple traffic streams to be detected in each traffic group in a JSON file.

[0092] In the above scheme, the field information corresponding to the traffic to be detected with the same destination IP information in each traffic group can be stored in a JSON file. This allows the channel characteristics corresponding to the destination IP information to be obtained based on the field information of multiple traffic to be detected, and traffic detection can be performed on the traffic to be detected corresponding to the destination IP information based on the channel characteristics, which can improve the accuracy of traffic detection.

[0093] Furthermore, based on the above embodiments, the detection module 204 is specifically used to: input the communication features into a pre-trained traffic detection model to obtain the detection result output by the traffic detection model; wherein, the detection result represents the probability that the destination IP information is a malicious IP; and perform traffic detection on the traffic to be detected in the traffic group according to the detection result.

[0094] In the above scheme, a pre-trained traffic detection model can be used to detect the traffic to be detected, thereby accurately and quickly detecting the traffic.

[0095] Furthermore, based on the above embodiments, the traffic detection device 200 further includes: a training module, used to train a neural network model using the following steps to obtain the traffic detection model: acquiring field sample information and destination IP sample information corresponding to each sample traffic in multiple sample traffic; dividing the multiple sample traffic into multiple traffic sample groups according to the destination IP sample information; labeling the destination IP sample information corresponding to each traffic sample group to obtain corresponding labeling information; and extracting sample features of the field information corresponding to multiple sample traffic in each traffic sample group; and training the parameters of the neural network model using the labeling information and the sample features until the traffic detection model is obtained.

[0096] In the above scheme, the labeling information corresponding to the sample traffic and the sample features corresponding to the destination IP sample information can be used to train the neural network model, thereby obtaining a pre-trained traffic detection model.

[0097] Please refer to Figure 3 , Figure 3This application provides a structural block diagram of an electronic device 300, which includes at least one processor 301, at least one communication interface 302, at least one memory 303, and at least one communication bus 304. The communication bus 304 enables direct communication between these components, the communication interface 302 facilitates signaling or data communication with other node devices, and the memory 303 stores machine-readable instructions executable by the processor 301. When the electronic device 300 is running, the processor 301 communicates with the memory 303 via the communication bus 304, and the aforementioned flow detection method is executed when the machine-readable instructions are invoked by the processor 301.

[0098] For example, the processor 301 in this embodiment of the application can read a computer program from the memory 303 via the communication bus 304 and execute the computer program to implement the following method: Step S101: Obtain the field information and destination IP information corresponding to each of the multiple traffic streams to be detected. Step S102: Divide the multiple traffic streams to be detected into multiple traffic groups according to the destination IP information. Step S103: For each traffic group, extract the features of the field information corresponding to the multiple traffic streams to be detected in the traffic group as communication features corresponding to the destination IP information of the traffic group. Step S104: Perform traffic detection on the traffic streams to be detected in the traffic group according to the communication features.

[0099] The processor 301 may include one or more, and may be an integrated circuit chip with signal processing capabilities. The processor 301 may be a general-purpose processor, including a Central Processing Unit (CPU), a Microcontroller Unit (MCU), a Network Processor (NP), or other conventional processors; it may also be a special-purpose processor, including a Neural-network Processing Unit (NPU), a Graphics Processing Unit (GPU), a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. Furthermore, when there are multiple processors 301, some may be general-purpose processors, and others may be special-purpose processors.

[0100] The memory 303 includes one or more, which may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0101] Understandable. Figure 3 The structure shown is for illustrative purposes only; the electronic device 300 may also include components that are more advanced than those shown. Figure 3 The more or fewer components shown, or having the same Figure 3 The different configurations shown. Figure 3 The components shown can be implemented using hardware, software, or a combination thereof. In the embodiments of this application, electronic device 300 can be, but is not limited to, physical devices such as desktop computers, laptops, smartphones, smart wearable devices, and in-vehicle devices, or virtual devices such as virtual machines. Furthermore, electronic device 300 is not necessarily a single device; it can be a combination of multiple devices, such as a server cluster, etc.

[0102] This application also provides a computer program product, including a computer program stored on a computer-readable storage medium. The computer program includes computer program instructions. When the computer program instructions are executed by a computer, the computer can perform the steps of the traffic detection method described in the above embodiments, such as: obtaining field information and destination IP information corresponding to each of multiple traffic streams to be detected; wherein the field information is extracted based on a handshake message; dividing the multiple traffic streams to be detected into multiple traffic groups based on the destination IP information; wherein the number of traffic streams to be detected and the destination IP information of the traffic streams to be detected are the same in each traffic group; for each traffic group, extracting features of the field information corresponding to the multiple traffic streams to be detected in the traffic group as communication features corresponding to the destination IP information of the traffic group; and performing traffic detection on the traffic streams to be detected in the traffic group based on the communication features.

[0103] This application also provides a computer-readable storage medium that stores computer program instructions. When the computer program instructions are executed by a computer, the computer performs the traffic detection method described in the foregoing method embodiments.

[0104] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0105] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0106] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0107] It should be noted that if the function is implemented as a software module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0108] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0109] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A flow rate detection method, characterized in that, include: Obtain the field information and destination IP information corresponding to each of the multiple traffic streams to be detected; wherein, the field information is extracted from the handshake message; Based on the destination IP information, multiple traffic streams to be detected are divided into multiple traffic groups; wherein, the number of traffic streams to be detected in each traffic group and the destination IP information of the traffic streams to be detected are the same; For each traffic group, extract the features of the field information corresponding to multiple traffic streams to be detected in the traffic group, and use them as communication features corresponding to the destination IP information of the traffic group; Traffic detection is performed on the traffic to be detected in the traffic group based on the communication characteristics; The step of dividing multiple traffic streams to be detected into multiple traffic groups based on the destination IP information includes: Multiple traffic streams with the same destination IP information are sorted in chronological order to obtain a traffic set corresponding to that destination IP information; The traffic to be detected in the traffic set is divided into a traffic group for each preset number of traffic flows; The step of extracting the features of the field information corresponding to multiple traffic streams to be detected in the traffic group, as communication features corresponding to the destination IP information of the traffic group, includes: Initialize the value of each slot in the number of slots to 0; The number of slots is updated sequentially based on the field information of each traffic item to be detected in the traffic group; The number of slots updated is used as the communication feature.

2. The flow detection method according to claim 1, characterized in that, After dividing multiple traffic streams to be detected into multiple traffic groups based on the destination IP information, the method further includes: The field information corresponding to multiple traffic items to be detected in each traffic group is stored in a JSON file.

3. The flow detection method according to claim 1, characterized in that, The step of detecting the traffic to be detected in the traffic group based on the communication characteristics includes: The communication features are input into a pre-trained traffic detection model to obtain the detection result output by the traffic detection model; wherein, the detection result represents the probability that the destination IP information is a malicious IP; Based on the detection results, the flow rate to be detected in the flow rate group is detected.

4. The flow detection method according to claim 3, characterized in that, Before obtaining the field information and destination IP information corresponding to each of the multiple traffic streams to be detected, the method further includes: The traffic detection model is obtained by training the neural network model using the following steps: Obtain the field sample information and destination IP sample information for each sample traffic from multiple sample traffic streams; Based on the destination IP sample information, multiple sample traffic flows are divided into multiple traffic sample groups; The destination IP sample information corresponding to each traffic sample group is labeled to obtain the corresponding label information. Also, the sample features of the field information corresponding to multiple sample traffic in each traffic sample group are extracted. The parameters of the neural network model are trained using the labeled information and the sample features until the traffic detection model is obtained.

5. A flow detection device, characterized in that, include: The acquisition module is used to acquire the field information and destination IP information corresponding to each of the multiple traffic streams to be detected; wherein, the field information is extracted from the handshake message; The segmentation module is used to divide multiple traffic streams to be detected into multiple traffic groups based on the destination IP information; wherein the number of traffic streams to be detected and the destination IP information of the traffic streams to be detected are the same in each traffic group. The extraction module is used to extract the features of the field information corresponding to multiple traffic streams to be detected in each traffic group, and use them as communication features corresponding to the destination IP information of the traffic group. The detection module is used to perform traffic detection on the traffic to be detected in the traffic group based on the communication characteristics. The partitioning module is specifically used for: Multiple traffic streams with the same destination IP information are sorted in chronological order to obtain a traffic set corresponding to that destination IP information; The traffic to be detected in the traffic set is divided into a traffic group for each preset number of traffic flows; The extraction module is specifically used for: Initialize the value of each slot in the number of slots to 0; The number of slots is updated sequentially based on the field information of each traffic item to be detected in the traffic group; The number of slots updated is used as the communication feature.

6. A computer program product, characterized in that, It includes computer program instructions, which, when read and executed by a processor, perform the traffic detection method as described in any one of claims 1-4.

7. An electronic device, characterized in that, include: Processor, memory, and bus; The processor and the memory communicate with each other via the bus; The memory stores computer program instructions that can be executed by the processor, and the processor can execute the flow detection method as described in any one of claims 1-4 by calling the computer program instructions.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a computer, cause the computer to perform the traffic detection method as described in any one of claims 1-4.

Images