A network abnormal behavior monitoring method and device based on timing characteristics

Abstract

The application discloses a network abnormal behavior monitoring method and device based on time sequence characteristics. The method comprises the following steps: acquiring a network data packet to be processed, wherein the network data packet at least comprises time sequence information; determining a data packet vector for representing network abnormal behavior according to the time sequence information and a preset network abnormal behavior characteristic; and inputting the data packet vector into a preset machine learning model to obtain a network abnormal behavior discrimination result. The application solves the technical problem that single traffic intrusion detection results in low accuracy and low detection rate. Each network flow is gathered together according to time sequence for correlation analysis, so that the detection rate is improved.

Description

Technical Field

[0001] This application relates to the field of network intrusion detection and abnormal behavior detection, and more specifically, to a method and apparatus for monitoring abnormal network behavior based on time-series features. Background Technology

[0002] Intrusion detection systems primarily rely on extracting security features from network connection logs to perform feature analysis, thereby classifying network behavior and issuing alerts for abnormal behavior.

[0003] In reality, attacks are often complex, multi-scenario, and multi-demand; a general intrusion detection model cannot solve all the different problems.

[0004] There is currently no effective solution to the problem of low accuracy and low detection rate caused by single-traffic intrusion detection in related technologies. Summary of the Invention

[0005] The main objective of this application is to provide a method and apparatus for monitoring abnormal network behavior based on time-series characteristics, so as to solve the problems of low accuracy and low detection rate caused by single-traffic intrusion detection.

[0006] To achieve the above objectives, according to one aspect of this application, a method for monitoring abnormal network behavior based on time-series features is provided.

[0007] The network abnormal behavior monitoring method based on time-series features according to this application includes: acquiring network data packets to be processed, wherein the network data packets include at least: time-series information; determining a data packet vector to characterize the network abnormal behavior based on the time-series information and preset network abnormal behavior features; and obtaining a network abnormal behavior discrimination result by inputting the data packet vector into a preset machine learning model.

[0008] To achieve the above objectives, according to another aspect of this application, a device for processing abnormal network behavior is provided.

[0009] The network abnormal behavior processing apparatus according to this application includes: an acquisition module for acquiring network data packets to be processed, wherein the network data packets include at least: timing information; a determination module for determining a data packet vector representing the network abnormal behavior based on the timing information and preset network abnormal behavior features; and a discrimination module for obtaining a network abnormal behavior discrimination result by inputting the data packet vector into a preset machine learning model.

[0010] Since a real, complete attack is not simply a single abnormal connection or a single abnormal traffic instance, different attack methods exhibit significant differences in their temporal characteristics, and a general intrusion detection model cannot solve different problems. In this application's embodiments, data packets are aggregated according to certain rules, and feature transformations are performed on the data packets to improve detection efficiency and accuracy.

[0011] In this application embodiment, the network abnormal behavior monitoring method and apparatus based on time-series features acquire network data packets to be processed, wherein the network data packets include at least time-series information. Through the time-series information and preset network abnormal behavior features, a data packet vector for characterizing the network abnormal behavior is determined. This achieves the purpose of obtaining network abnormal behavior discrimination results by inputting the data packet vector into a preset machine learning model, thereby improving the technical effect of detection efficiency and accuracy, and solving the technical problem of single intrusion detection method and low detection rate. Attached Figure Description

[0012] The accompanying drawings, which form part of this application, are used to provide a further understanding of the application and to make other features, objects, and advantages of the application more apparent. The illustrative embodiments and descriptions of the accompanying drawings are used to explain the application and do not constitute an undue limitation of the application. In the drawings:

[0013] Figure 1 This is a schematic diagram of the system structure of the network abnormal behavior monitoring method based on time-series features according to an embodiment of this application;

[0014] Figure 2 This is a schematic flowchart of a network abnormal behavior monitoring method based on time-series features according to an embodiment of this application;

[0015] Figure 3 This is a schematic diagram of the network abnormal behavior monitoring device based on time-series features according to an embodiment of this application;

[0016] Figure 4 A schematic diagram of the network abnormal behavior monitoring method based on time-series features in this application embodiment. Detailed Implementation

[0017] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0018] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0019] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0020] like Figure 1 As shown, in an optional embodiment, the network abnormal behavior monitoring method based on time-series features in this application employs a system including: an application server 100, a data server 200, a file server 300, a security device 400, a data formatting server 500, and a data analysis server 600. After the network data in the application server 100, data server 200, file server 300, and security device 400 form time-series correlated network data packets, they are processed by the data formatting server 500 and the data analysis server 600 to obtain data packet abnormality detection results.

[0021] In reality, attack behaviors often exhibit temporal correlations. When large-scale attacks occur, there must be a connection between them, and only by examining them together can the complete abnormal behavior be discovered. Therefore, under certain conditions, traffic aggregation and abnormal behavior analysis of the aggregated traffic are more practically meaningful.

[0022] like Figure 2 As shown, the method includes the following steps S201 to S203:

[0023] Step S201: Obtain the network data packet to be processed, wherein the network data packet includes at least: timing information;

[0024] Step S202: Determine a data packet vector to characterize the abnormal network behavior based on the timing information and preset network abnormal behavior characteristics;

[0025] Step S203: By inputting the data packet vector into a preset machine learning model, the network abnormal behavior discrimination result is obtained.

[0026] As can be seen from the above description, this application achieves the following technical effects:

[0027] By acquiring network data packets to be processed, wherein the network data packets include at least time-series information, and using the time-series information and preset network abnormal behavior features, a data packet vector is determined to characterize the network abnormal behavior. This achieves the goal of obtaining network abnormal behavior discrimination results by inputting the data packet vector into a preset machine learning model, thereby improving the technical effect of detection efficiency and accuracy, and solving the technical problem of single intrusion detection methods and low detection rate.

[0028] In step S201 above, the acquired network data packets to be processed are processed according to the timing information. This step is executed on the server.

[0029] In step S202 above, based on the time-series information obtained in the previous steps and the preset network abnormal behavior features, a data packet vector is determined to characterize the network abnormal behavior. That is, network abnormal behavior is represented based on data packets. The preset network abnormal behavior features can be obtained through steps such as data aggregation and normalization representation, feature transformation based on self-similar matrices, and feature mapping transformation.

[0030] In one specific implementation, determining the data packet vector characterizing the abnormal network behavior based on the time sequence information and preset network abnormal behavior characteristics includes: aggregating the network data packets according to the time sequence information to obtain a first processing result, wherein the first processing result includes a processed result after aggregation and / or normalization; performing feature transformation on the first processing result to obtain a second processing result, wherein the second processing result includes a feature transformation result based on a self-similar matrix; and converting the second processing result into a target vector of the data packets.

[0031] In one specific implementation, the data is divided into two parts: abnormal data and normal data.

[0032] In a preferred embodiment, for the abnormal data: select data within a certain period, aggregate data with the same destination IP within that period, and form m*n data packets, where m is the number of data entries and n is the characteristic of each entry. The same processing is performed on the normal data.

[0033] In one specific implementation, the network data packet can be represented as:

[0034]

[0035] In a preferred embodiment, to facilitate subsequent calculations and enable the algorithm to converge quickly, the data packet matrix is ​​normalized as follows:

[0036]

[0037] Where, min l (x lk ) represents the minimum value in the data packet, max l (x lk () indicates the maximum value in the data packet.

[0038] In a preferred embodiment, converting the second processing result into a target vector of the data packet includes: setting the same dimension feature of different data in the network data packet as x. ak and x bk ; Obtain the distance between the k-th features of each sample in the network data packet. The data packet resulting from the second processing will be converted into n distance matrices: S = {D} 1 D 2 ,…,D n}, where n is a natural number; the target vector is obtained through the distance matrix.

[0039] In practice, for the matrix obtained in the above steps, define x ak and x bk It refers to the same dimensional feature of different data within a data packet. Define the distance function. This represents the distance between the k-th features of each sample in a data packet.

[0040] A data packet will then be converted into n distance matrices: S = {D} 1 D 2 ,…,D n}, where D represents the distance matrix of the Kth feature.

[0041]

[0042] That is, an m*m matrix.

[0043] In a preferred embodiment, converting the second processing result into a target vector of a data packet includes: dynamically defining the Gaussian distribution number K so that it is adjusted to a preset degree as the number of samples of the network data packets increases.

[0044] In a preferred embodiment, converting the second processing result into a target vector of data packets includes: simulating the distribution of each feature within the network data packet summary using a Gaussian mixture model.

[0045] In practice, the distance matrix is ​​converted into a vector.

[0046] The k-th feature can be written as a vector

[0047] The similarity matrix of the k-th feature Since all diagonal elements are 0, and the upper and lower triangular matrices are identical, we choose the upper triangular matrix and arrange it column-wise to form a vector: Its size is r×1,

[0048] Based on the above changes in characteristics, the data in a data packet is expanded. This ensures the invariance of elements within the data packet, guaranteeing that no data is lost. S, expressed as distance, ensures the invariance of the overall information even if the flow changes sequentially.

[0049] To better fit the distribution pattern of the data, a Gaussian mixture model is used to simulate the distribution of each feature within the data packet.

[0050] The Gaussian model is as follows:

[0051]

[0052] The Gaussian mixture model is as follows:

[0053]

[0054]

[0055] Where, θ i ,μ i ,δ i It is derived from the EM algorithm.

[0056] Through the following mapping function Each element in the vector represents the probability of being selected by a certain component in the Gaussian mixture model.

[0057]

[0058] vector The fit is then:

[0059] vector The fit is then:

[0060] In summary, a data packet will be determined according to the mapping function. It can be represented in the following form:

[0061]

[0062] In the above application scenarios, the GMM algorithm does not obtain a clustering model by fitting the data, but rather a probabilistic model describing the data distribution. If the number of specified Gaussian distributions is too large, it will consume more computational resources; if the number is too small, it cannot accurately describe the samples after packetization. Therefore, it is chosen to dynamically define the number of Gaussian distributions K, so that it can be adjusted to a certain extent according to the number of packet samples without losing generality.

[0063]

[0064] Through grid search, the optimal hyperparameter is defined as c, where m is the number of samples and λ is the adjustment coefficient, used to balance the size of the packet and the descriptive power of the statistical distribution.

[0065] In step S203 above, the network abnormal behavior discrimination result is obtained by inputting the data packet vector into a preset machine learning model.

[0066] In a preferred embodiment, the preset machine learning model is a detection model based on a convolutional neural network, wherein the detection model adopts a CNN model and the loss function adopts the cross-entropy loss function.

[0067] In one specific implementation, the model input is

[0068]

[0069] The output is 0 or 1, where 0 indicates normal and 1 indicates abnormal.

[0070] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0071] According to embodiments of this application, a processing apparatus for handling abnormal network behavior in implementing the above-described method is also provided, such as... Figure 3 As shown, the device includes:

[0072] The acquisition module 301 is used to acquire network data packets to be processed, wherein the network data packets include at least: timing information;

[0073] The determining module 302 is used to determine a data packet vector representing the abnormal network behavior based on the timing information and preset network abnormal behavior characteristics;

[0074] The discrimination module 303 is used to obtain the network abnormal behavior discrimination result by inputting the data packet vector into a preset machine learning model.

[0075] The aforementioned acquisition module 301 processes the acquired network data packets according to timing information. This step is performed on the server.

[0076] In the aforementioned determining module 302, based on the time-series information obtained in the above steps and the preset network abnormal behavior features, a data packet vector is determined to characterize the network abnormal behavior. That is, network abnormal behavior is represented based on data packets. The preset network abnormal behavior features can be obtained through steps such as data aggregation and normalization representation, feature transformation based on self-similar matrices, and feature mapping transformation.

[0077] In one specific implementation, determining the data packet vector characterizing the abnormal network behavior based on the time sequence information and preset network abnormal behavior characteristics includes: aggregating the network data packets according to the time sequence information to obtain a first processing result, wherein the first processing result includes a processed result after aggregation and / or normalization; performing feature transformation on the first processing result to obtain a second processing result, wherein the second processing result includes a feature transformation result based on a self-similar matrix; and converting the second processing result into a target vector of the data packets.

[0078] In a preferred embodiment, converting the second processing result into a target vector of a data packet includes: dynamically defining the Gaussian distribution number K so that it is adjusted to a preset degree as the number of samples of the network data packets increases.

[0079] In a preferred embodiment, converting the second processing result into a target vector of data packets includes: simulating the distribution of each feature within the network data packet summary using a Gaussian mixture model.

[0080] In the aforementioned discrimination module 303, the network abnormal behavior discrimination result is obtained by inputting the data packet vector into a preset machine learning model.

[0081] In a preferred embodiment, the preset machine learning model is a detection model based on a convolutional neural network, wherein the detection model adopts a CNN model and the loss function adopts the cross-entropy loss function.

[0082] To better understand the above-described network anomaly behavior monitoring method based on time-series features, the following explanation of the technical solution is provided in conjunction with preferred embodiments, but is not intended to limit the technical solution of the embodiments of the present invention.

[0083] This application provides a preferred embodiment of an attack behavior detection model based on temporal feature packet representation. Since network attacks are often continuous, a single network behavior cannot represent the complete path of a network attack, and the same type of network attack often has similar behavioral characteristics. Therefore, it is essential to aggregate each network traffic in chronological order and perform contextual analysis.

[0084] like Figure 4 The diagram shown is a flowchart of a network anomaly behavior monitoring method based on time-series features according to an embodiment of this application, which specifically includes the following steps:

[0085] Step S401, network traffic data.

[0086] Step S402, packet representation of network behavior characteristics.

[0087] Based on the time sequence information and preset network abnormal behavior characteristics, determining the data packet vector used to characterize the network abnormal behavior includes: aggregating the network data packets according to the time sequence information to obtain a first processing result, wherein the first processing result includes a processed result after aggregation and / or normalization; performing feature transformation on the first processing result to obtain a second processing result, wherein the second processing result includes a feature transformation result based on a self-similar matrix; and converting the second processing result into a target vector of the data packets.

[0088] Step S4021: Data aggregation and normalization representation.

[0089] In one specific implementation, the data is divided into two parts: abnormal data and normal data.

[0090] In a preferred embodiment, for the abnormal data: select data within a certain period, aggregate data with the same destination IP within that period, and form m*n data packets, where m is the number of data entries and n is the characteristic of each entry. The same processing is performed for the normal data.

[0091] In one specific implementation, the network data packet can be represented as:

[0092]

[0093] Step S4022: Feature transformation based on self-similar matrix.

[0094] Converting the second processing result into a target vector for the data packet includes: setting the same dimension feature of different data in the network data packet as x. ak and x bk ; Obtain the distance between the k-th features of each sample in the network data packet. The data packet resulting from the second processing will be converted into n distance matrices: S = {D} 1 D 2 ,…,D n}, where n is a natural number; the target vector is obtained through the distance matrix.

[0095] Step S4023, feature mapping transformation.

[0096] The step of converting the second processing result into a target vector for a data packet includes:

[0097] The Gaussian distribution quantity K is dynamically defined so that it is adjusted to a preset degree as the number of network data packet samples increases.

[0098] The step of converting the second processing result into a target vector of data packets includes: using a Gaussian mixture model to simulate the distribution of each feature within the network data packet summary.

[0099] Step S403, Intrusion detection model based on convolutional neural network.

[0100] The preset machine learning model is a detection model based on a convolutional neural network, wherein the detection model adopts a CNN model and the loss function adopts the cross-entropy loss function.

[0101] The model parameters are as follows:

[0102]

[0103] Embodiments of this application also provide a storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above method embodiments when running.

[0104] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0105] S1, Obtain the network data packet to be processed, wherein the network data packet includes at least: timing information;

[0106] S2, Based on the timing information and preset network abnormal behavior characteristics, determine the data packet vector used to characterize the network abnormal behavior;

[0107] S3, by inputting the data packet vector into a preset machine learning model, the network abnormal behavior discrimination result is obtained.

[0108] Optionally, the storage medium is also configured to store a computer program for performing the following steps:

[0109] S1, according to the time sequence information, the network data packets are aggregated to obtain a first processing result, wherein the first processing result includes the aggregated and / or normalized processing result;

[0110] S2, perform feature transformation on the first processing result to obtain the second processing result, wherein the second processing result includes feature transformation results based on the self-similar matrix;

[0111] S3, convert the second processing result into the target vector of the data packet.

[0112] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0113] Embodiments of this application also provide an electronic device including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0114] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0115] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0116] S1, Obtain the network data packet to be processed, wherein the network data packet includes at least: timing information;

[0117] S2, Based on the timing information and preset network abnormal behavior characteristics, determine the data packet vector used to characterize the network abnormal behavior;

[0118] S3, by inputting the data packet vector into a preset machine learning model, the network abnormal behavior discrimination result is obtained.

[0119] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.

[0120] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device, or fabricating them separately as individual integrated circuit modules, or fabricating multiple modules or steps as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0121] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for monitoring abnormal network behavior based on temporal features, characterized in that, include: Obtain network data packets to be processed, wherein the network data packets include at least: timing information; Based on the time sequence information and preset network abnormal behavior characteristics, the data packet vector used to characterize the network abnormal behavior is determined by: aggregating the network data packets according to the time sequence information to obtain a first processing result, wherein the first processing result includes the processing result after aggregation and normalization; the data is divided into abnormal data and normal data, and the normal data and abnormal data are processed as follows: data within a certain period of time is selected, and data with the same destination IP within that period of time are aggregated to form m*n data packets, where m is the number of data entries and n is the feature of each entry; The network data packet can be represented as: The data packet matrix is ​​normalized as follows: The first processing result is subjected to feature transformation to obtain the second processing result, wherein the second processing result includes feature transformation results based on the self-similarity matrix; The second processing result is converted into the target vector of the data packet, including: Set the same dimension feature of different data in the network data packets as and ; The first sample in each of the network data packets is obtained. Distance between features ; Convert the data packet resulting from the second processing into... Distance matrices: n is a natural number; The target vector is obtained through the distance matrix; By inputting the data packet vector into a preset machine learning model, the network abnormal behavior discrimination result is obtained.

2. The method according to claim 1, characterized in that, The step of converting the second processing result into a data packet target vector includes: The Gaussian distribution quantity K is dynamically defined so that it is adjusted to a preset degree as the number of network data packet samples increases.

3. The method according to claim 1, characterized in that, The step of converting the second processing result into a data packet target vector includes: A Gaussian mixture model is used to simulate the distribution of each feature within the network data packet summary.

4. The method according to claim 1, characterized in that, The preset machine learning model is a detection model based on a convolutional neural network, wherein the detection model adopts a CNN model and the loss function adopts the cross-entropy loss function.

5. A network abnormal behavior monitoring device based on time-series characteristics, characterized in that, include: An acquisition module is used to acquire network data packets to be processed, wherein the network data packets include at least: timing information; The determination module is used to determine a data packet vector representing the abnormal network behavior based on the time sequence information and preset network abnormal behavior characteristics: after aggregating the network data packets according to the time sequence information, a first processing result is obtained, wherein the first processing result includes the processing result after aggregation and normalization; the data is divided into abnormal data and normal data, and the normal data and abnormal data are processed as follows: select data within a certain period of time, aggregate data with the same destination IP within that period of time to form m*n data packets, where m is the number of data entries and n is the feature of each entry; The network data packet can be represented as: The data packet matrix is ​​normalized as follows: The first processing result is subjected to feature transformation to obtain the second processing result, wherein the second processing result includes feature transformation results based on the self-similarity matrix; The second processing result is converted into the target vector of the data packet, including: Set the same dimension feature of different data in the network data packets as and ; The first sample in each of the network data packets is obtained. Distance between features ; Convert the data packet resulting from the second processing into... Distance matrices: n is a natural number; The target vector is obtained through the distance matrix; The discrimination module is used to obtain network abnormal behavior discrimination results by inputting the data packet vector into a preset machine learning model.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, performs the method described in any one of claims 1 to 4.

7. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method as described in any one of claims 1 to 4.

Images