Malicious traffic detection method and device, electronic equipment, storage medium
By semantically encoding and extracting features from the packet header information of network traffic, and using a traffic discrimination model, the problem of inaccurate detection of malicious traffic in existing technologies is solved, and accurate discrimination of malicious traffic is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING TOPSEC NETWORK SECURITY TECH
- Filing Date
- 2022-11-01
- Publication Date
- 2026-04-21
AI Technical Summary
In existing technologies, malicious traffic detection struggles to accurately identify the semantic features of data packets using image classification models, leading to inaccurate detection results.
By semantically encoding the header information of network traffic, an initial encoding matrix is generated, and a traffic discrimination model is used for discrimination. Feature extraction and classification are performed by combining an attention module, an average pooling layer, a gated recurrent unit, and a fully connected layer.
It enables accurate identification of malicious traffic, improving the accuracy and reliability of detection.
Smart Images
Figure CN115865413B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and in particular to a method and apparatus for detecting malicious traffic, an electronic device, and a computer-readable storage medium. Background Technology
[0002] Malicious traffic refers to network traffic generated by unauthorized intrusion, interference, or data theft, and it is one of the most common and significant cybersecurity threats. As more and more malware uses encrypted communication methods, the detection of malicious traffic is becoming increasingly difficult. One related technology involves collecting network traffic data packets, converting them into image files using Hilbert curve filling, and then classifying these image files using an image classification model to obtain the network traffic identification result. However, this approach can only extract byte distribution features within the data packets from the image file. Since data packets and images differ, the images reconstructed from data packets lack local correlation; therefore, classification based on byte distribution features is unreasonable and cannot obtain accurate identification results. Summary of the Invention
[0003] The purpose of this application is to provide a method, apparatus, electronic device, and storage medium for detecting malicious traffic, which can be used to accurately detect malicious traffic based on semantic features.
[0004] On the one hand, this application provides a method for detecting malicious traffic, including:
[0005] Network traffic is aggregated based on traffic aggregation parameters to obtain at least one target traffic item;
[0006] For each target traffic, semantic encoding is performed based on the header information of multiple data packets in the target traffic to obtain the initial encoding matrix corresponding to each data packet;
[0007] Multiple initial encoding matrices corresponding to any target traffic are input into the traffic discrimination model to obtain discrimination information output by the traffic discrimination model; wherein, the discrimination information indicates whether the target traffic is malicious traffic.
[0008] By using the above measures, the header information can be semantically encoded to obtain an initial encoding matrix containing semantic features and contextual features. This initial encoding matrix can then be used to determine whether the target traffic is malicious, thus achieving accurate identification of malicious traffic.
[0009] In one embodiment, before performing semantic encoding based on the header information of multiple data packets in the target traffic for each target traffic to obtain an initial encoding matrix corresponding to each data packet, the method further includes:
[0010] For each target traffic flow, store the header information of the first K data packets; where K is a preset positive integer.
[0011] By using the above measures, the header information used for semantic encoding can be selected.
[0012] In one embodiment, the header information includes field information corresponding to multiple header fields;
[0013] For each target traffic flow, semantic encoding is performed based on the header information of multiple data packets within the target traffic flow to obtain an initial encoding matrix corresponding to each data packet, including:
[0014] For each data packet in each target traffic, the field information of each header field of the data packet is encoded by a pre-trained word vector model to obtain the word vector corresponding to the header field;
[0015] For each data packet, the word vectors of the multiple header fields corresponding to the data packet are used to construct the initial encoding matrix corresponding to the data packet.
[0016] The above measures can be used to semantically encode the header information into an initial encoding matrix.
[0017] In one embodiment, the step of encoding the field information of each header field of the data packet using a pre-trained word vector model to obtain the word vector corresponding to the header field includes:
[0018] If any header field contains at least two words, each word is encoded using the word vector model to obtain the corresponding field information vector.
[0019] The word vectors corresponding to at least two fields of the header field are averaged to obtain the word vectors corresponding to the header field.
[0020] The above measures can be used to encode field information containing at least two words, thereby obtaining the word vector of the header field.
[0021] In one embodiment, the traffic discrimination model includes an attention module, an average pooling layer, a gated recurrent unit, a fully connected layer, and a classification layer;
[0022] The step of inputting multiple initial encoding matrices corresponding to any target traffic into a traffic discrimination model to obtain discrimination information output by the traffic discrimination model includes:
[0023] Multiple initial encoding matrices corresponding to any target traffic are input into the traffic discrimination model. The attention module processes each initial encoding matrix to obtain a specified encoding matrix corresponding to each initial encoding matrix.
[0024] Each specified encoding matrix is processed by the average pooling layer to obtain the encoding vector corresponding to each specified encoding matrix;
[0025] The gated loop unit processes multiple encoded vectors corresponding to the target traffic to obtain the flow vector corresponding to the target traffic;
[0026] The flow vector is input into the fully connected layer to obtain a specified flow vector, and the specified flow vector is input into the classification layer to obtain the discrimination information output by the classification layer.
[0027] Through the above measures, the traffic discrimination model can output discrimination information for the target traffic.
[0028] In one embodiment, before inputting multiple initial encoding matrices corresponding to any target traffic into a traffic discrimination model to obtain discrimination information output by the traffic discrimination model, the method further includes:
[0029] Multiple initial encoding matrices are generated for multiple sample traffic in the sample dataset; each sample traffic carries a traffic label, which indicates whether the sample traffic is malicious or normal traffic.
[0030] Input the initial encoding matrix of multiple samples of the sample traffic into the classification model to obtain the prediction and discrimination information of the sample traffic;
[0031] Based on the difference between the predicted discrimination information of the sample traffic and the traffic label, the model parameters of the classification model are adjusted;
[0032] Repeat the above process until the classification model converges to obtain the trained traffic discrimination model.
[0033] The above measures can be used to train a traffic discrimination model.
[0034] In one embodiment, before generating multiple initial encoding matrices for multiple sample flows in the sample dataset, the method further includes:
[0035] Multiple malicious traffic and multiple normal traffic are simulated and generated as sample traffic, and a corresponding traffic label is added to each sample traffic.
[0036] The sample dataset is constructed based on the sample traffic labeled with traffic tags.
[0037] The above measures can be used to construct a sample dataset for training the traffic discrimination model.
[0038] On the other hand, this application provides a malicious traffic detection device, including:
[0039] The aggregation module is used to aggregate network traffic based on traffic aggregation parameters to obtain at least one target traffic item.
[0040] The encoding module is used to perform semantic encoding on each target traffic based on the header information of multiple data packets in the target traffic, so as to obtain an initial encoding matrix corresponding to each data packet.
[0041] The discrimination module is used to input multiple initial encoding matrices corresponding to any target traffic into the traffic discrimination model to obtain discrimination information output by the traffic discrimination model; wherein, the discrimination information indicates whether the target traffic is malicious traffic.
[0042] Furthermore, this application provides an electronic device, the electronic device comprising:
[0043] processor;
[0044] Memory used to store processor-executable instructions;
[0045] The processor is configured to execute the aforementioned method for detecting malicious traffic.
[0046] In addition, this application provides a computer-readable storage medium storing a computer program that can be executed by a processor to perform the above-described method for detecting malicious traffic. Attached Figure Description
[0047] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly described below.
[0048] Figure 1 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application;
[0049] Figure 2 A flowchart illustrating a method for detecting malicious traffic according to an embodiment of this application;
[0050] Figure 3 A flowchart illustrating a semantic encoding method provided in an embodiment of this application;
[0051] Figure 4 A schematic flowchart illustrating the processing method of a traffic discrimination model provided in an embodiment of this application;
[0052] Figure 5A schematic diagram illustrating the processing of a traffic discrimination model provided in an embodiment of this application;
[0053] Figure 6 A schematic flowchart illustrating the training method of a traffic discrimination model provided in an embodiment of this application;
[0054] Figure 7 A block diagram of a malicious traffic detection device provided in an embodiment of this application. Detailed Implementation
[0055] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.
[0056] Similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.
[0057] like Figure 2 As shown, this embodiment provides an electronic device 1, including: at least one processor 11 and a memory 12. Figure 2 Taking a processor 11 as an example, the processor 11 and memory 12 are connected via bus 10. Memory 12 stores instructions that can be executed by the processor 11. The instructions are executed by the processor 11 to enable the electronic device 1 to perform all or part of the processes of the methods described in the embodiments below. In one embodiment, the electronic device 1 may be the router, switch, server, or server cluster described above, used to execute the malicious traffic detection method. The following description uses the electronic device as the execution subject.
[0058] The memory 12 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable red-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.
[0059] This application also provides a computer-readable storage medium storing a computer program that can be executed by a processor 11 to perform the malicious traffic detection method provided in this application.
[0060] See Figure 2 This is a flowchart illustrating a malicious traffic detection method provided in an embodiment of this application. Figure 3 As shown, the method may include steps 210-230.
[0061] Step 210: Aggregate network traffic according to traffic aggregation parameters to obtain at least one target traffic item.
[0062] Traffic aggregation parameters are used to segment different network traffic. These parameters can be configured according to application requirements. For example, a traffic aggregation parameter can be a 5-tuple, which includes the source IP (Internet Protocol Address), source port, destination IP, destination port, and transport layer protocol.
[0063] Electronic devices can collect network traffic and then aggregate it using traffic aggregation parameters to separate it from other network traffic. This separated network traffic is the target traffic, which the electronic device must then inspect to determine if it is malicious.
[0064] Step 220: For each target traffic, semantic encoding is performed based on the header information of multiple data packets in the target traffic to obtain the initial encoding matrix corresponding to each data packet.
[0065] For each target traffic to be detected, the electronic device can semantically encode the header information of multiple data packets within the target traffic. Here, the header information can include field information from various header fields in the IP header, TCP (Transmission Control Protocol) header, and UDP (User Datagram Protocol) header. IP header fields may include, but are not limited to, version, header length, type of service, total length, identifier, flags, fragmented offset, time to live (TTL), and protocol. TCP header fields may include, but are not limited to, source port, destination port, sequence number, acknowledgment number, window size value, header length, flags, and urgent pointer. UDP header fields may include, but are not limited to, source port, destination port, and length.
[0066] By semantically encoding the fields of each header field of a data packet, an initial encoding matrix corresponding to that data packet can be obtained. Similarly, by semantically encoding multiple data packets within a target traffic stream, multiple initial encoding matrices corresponding to that target traffic can be obtained.
[0067] In one embodiment, before semantically encoding any target traffic, the electronic device may store the header information of the first K data packets for each target traffic. Here, K is a preset positive integer that can be pre-configured based on experience.
[0068] For example, with K being 10, for each target traffic, the electronic device can store the header information of the first 10 data packets into separate JSON (JavaScript Object Notation) files. Subsequent electronic devices can then use the stored header information to perform semantic encoding on the target traffic.
[0069] In one embodiment, see Figure 3This is a flowchart illustrating a semantic encoding method provided in an embodiment of this application, as shown below. Figure 3 As shown, the method may include the following steps 221 to 222.
[0070] Step 221: For each data packet in each target traffic, the field information of each header field of the data packet is encoded by a pre-trained word vector model to obtain the word vector corresponding to the header field.
[0071] The word-to-vector model can be any of the following: CBOW (Continuous Bagof-Words) model, Skip-Gram model, RNNLM (Recurrent Neural Network based Language Model).
[0072] For any given data packet, after parsing the field information corresponding to multiple header fields in the packet header information, a word vector model can be used to semantically encode the field information of each header field, thereby obtaining the word vector corresponding to the header field. The word vector model outputs vectors with the same dimension; if N header fields are selected, N word vectors with the same dimension can be output.
[0073] In one embodiment, when semantically encoding the field information of any header field, the field information under that header field may include at least two words. In this case, the electronic device can encode each word separately using a word vector model to obtain a field information vector corresponding to each word. Here, the field information vector refers to the vector obtained by encoding a single word in the field information.
[0074] After obtaining the information vectors of at least two fields corresponding to the header field, the information vectors of at least two fields can be averaged. In other words, the average value of each dimension of the information vectors is calculated to obtain the single word vector corresponding to the header field.
[0075] Step 222: For each data packet, construct the initial encoding matrix corresponding to the data packet from the word vectors of the multiple header fields corresponding to the data packet.
[0076] For any data packet, after encoding the field information of each header field into word vectors, the word vectors of each header field can be arranged in a specified order to obtain the initial encoding matrix corresponding to the data packet. Here, the specified order can be pre-configured based on experience. For example, if N header fields are selected for semantic encoding and M-dimensional word vectors are obtained, an N*M initial encoding matrix can be obtained by sorting them. For any target traffic, if the header information of K data packets is selected for semantic encoding, K N*M initial encoding matrices can be obtained.
[0077] Step 230: Input multiple initial encoding matrices corresponding to any target traffic into the traffic discrimination model to obtain the discrimination information output by the traffic discrimination model; wherein, the discrimination information indicates whether the target traffic is malicious traffic.
[0078] Here, the traffic discrimination model can be obtained by training a classification model.
[0079] After obtaining multiple initial encoding matrices corresponding to the target traffic, the electronic device can input these matrices into a traffic discrimination model. The model then identifies the semantic and contextual features contained within the initial encoding matrices, outputting discrimination information corresponding to the target traffic. For example, the discrimination information might be the probability that the target traffic is malicious. The electronic device can determine whether this discrimination information is greater than a preset threshold. If not, the target traffic is not malicious; if so, it is. Here, the threshold can be pre-configured based on experience; for example, it could be 0.5.
[0080] When any target traffic is determined to be malicious, the electronic device can issue a warning message indicating that the target traffic is malicious. Furthermore, the electronic device can record the traffic aggregation parameters of this target traffic, allowing it to subsequently filter out malicious traffic from network traffic directly based on these parameters.
[0081] In one embodiment, the traffic discrimination model may include an attention module, an average pooling layer, a gated recurrent unit (GRU), a fully connected layer, and a classification layer. Here, the classification layer can be implemented using a fully connected layer.
[0082] See Figure 4 This is a flowchart illustrating the processing method of a traffic discrimination model provided in an embodiment of this application. Figure 4 As shown, the method may include the following steps 231 to 234.
[0083] Step 231: Input multiple initial encoding matrices corresponding to any target traffic into the traffic discrimination model, and process each initial encoding matrix through the attention module to obtain the specified encoding matrix corresponding to each initial encoding matrix.
[0084] For any target traffic flow, the electronic device can input multiple initial encoding matrices corresponding to that target traffic flow into the traffic discrimination model. The attention module processes each initial encoding matrix separately, and then aggregates the initial encoding matrices through self-attention weighted aggregation to obtain the specified encoding matrix. For example, the following formula (1) represents the processing method of the attention module:
[0085] A att =softmax(P M P M T )P M (1)
[0086] Among them, P M A is the initial encoding matrix; att To specify the encoding matrix.
[0087] Step 232: Process each specified encoding matrix using an average pooling layer to obtain the encoding vector corresponding to each specified encoding matrix.
[0088] Electronic devices can use an average pooling layer to perform average pooling on each specified encoding matrix to obtain an encoding vector. For example, the average pooling process is represented by the following formula (2):
[0089] p = AvgPooling(A att (2)
[0090] Where p is the encoding vector; A att To specify the encoding matrix.
[0091] After average pooling, multiple encoding vectors can be obtained for any target traffic.
[0092] Step 233: Process the multiple encoded vectors corresponding to the target traffic through the gated loop unit to obtain the flow vector corresponding to the target traffic.
[0093] Electronic devices can process multiple encoded vectors of a target traffic flow through a gated loop unit to extract the sequence features of the target traffic flow, thereby obtaining the flow vector corresponding to the target traffic flow. Here, the flow vector is a vector obtained by fusing multiple encoded vectors.
[0094] Step 234: Input the flow vector into the fully connected layer to obtain the specified flow vector, and then input the specified flow vector into the classification layer to obtain the discriminant information output by the classification layer.
[0095] After obtaining the flow vector of the target traffic, the electronic device can input this flow vector into a fully connected layer. The fully connected layer processes the flow vector to obtain a specified flow vector. Furthermore, a classification layer calculates the specified flow vector to obtain the discrimination information of the target traffic.
[0096] See Figure 5 This is a schematic diagram of the processing of a traffic discrimination model provided in an embodiment of this application, as shown below. Figure 5 As shown, multiple initial encoding matrices P of the target traffic M1 P M2 P M3 ...and so on, are input into the attention module of the traffic discrimination model. The attention module processes these inputs to obtain multiple specified encoding matrices. Further, average pooling is performed on each specified encoding matrix to obtain multiple encoding vectors p1, p1, p1, ... etc. These multiple encoding vectors are then fused using a gated recurrent unit to obtain a flow vector. This flow vector is then input into a fully connected layer for processing to obtain a specified flow vector. Finally, the fully connected layer, acting as a classification layer, calculates the specified flow vector to obtain the discrimination information for the target traffic.
[0097] Through the above measures, the present application scheme can semantically encode the header information of multiple data packets of the target traffic, thereby obtaining an initial encoding matrix including semantic features and context features of header information, and then processing the semantic features and context features according to the traffic judgment model to obtain discrimination information.
[0098] In one embodiment, see Figure 6 This is a flowchart illustrating the training method of a traffic discrimination model provided in an embodiment of this application. Figure 6 As shown, the method may include steps 610 to 640.
[0099] Step 610: Generate multiple initial encoding matrices for multiple sample traffic in the sample dataset; wherein each sample traffic carries a traffic label, and the traffic label indicates whether the sample traffic is malicious traffic or normal traffic.
[0100] Here, the sample dataset can record data packets from multiple sample traffic streams. Alternatively, the sample dataset can record the packet header information from multiple sample traffic streams.
[0101] For each sample traffic flow, the electronic device can perform semantic encoding on multiple data packets within the sample traffic flow, thereby generating an initial encoding matrix for each data packet. In other words, multiple initial encoding matrices for the sample traffic flow are obtained. The encoding process is detailed in the relevant description above and will not be repeated here.
[0102] Step 620: Input the initial encoding matrices of multiple samples of the sample flow into the classification model to obtain the prediction and discrimination information of the sample flow.
[0103] Among them, the predicted discriminant information is the discriminant information output by the classification model during the training process.
[0104] After obtaining multiple initial encoding matrices of the sample traffic, the electronic device can input these initial encoding matrices into a classification model. The classification model then processes these initial encoding matrices to determine the predictive information of the sample traffic based on the semantic and contextual features contained within them.
[0105] Step 630: Adjust the model parameters of the classification model based on the difference between the predicted discrimination information of the sample traffic and the traffic label.
[0106] Step 640: Repeat the above process until the classification model converges, and the trained traffic discrimination model is obtained.
[0107] After obtaining the predicted discrimination information of sample traffic, the electronic device can evaluate the difference between the predicted discrimination information and the traffic label through the loss function, and adjust the model parameters of the classification model according to the evaluation results.
[0108] After adjusting the model parameters, you can return to step 620 to re-output predicted discrimination information for the sample traffic based on the adjusted classification model, and re-evaluate the difference between the new predicted discrimination information and the traffic labels, thereby adjusting the model parameters of the classification model. After repeated iterations, when the classification model converges, a trained traffic discrimination model is obtained. The electronic device can save the traffic discrimination model to storage space and subsequently read it from storage space to execute malicious traffic detection methods.
[0109] In one embodiment, before training the traffic discrimination model, the electronic device can simulate and generate multiple malicious traffic flows and multiple normal traffic flows as sample traffic. For each sample traffic flow, multiple data packets can be simulated and generated. Furthermore, the electronic device can add corresponding traffic tags to the sample traffic flows, adding traffic tags indicating malicious traffic and traffic tags indicating normal traffic. For example, the traffic tag for malicious traffic is 1, and the traffic tag for normal traffic is 0.
[0110] Electronic devices can construct a sample dataset based on sample traffic from tagged traffic. This sample dataset can then be used to train a classification model to obtain a traffic discrimination model.
[0111] Figure 7 This is a block diagram of a malicious traffic detection device according to an embodiment of the present invention, as shown below. Figure 7As shown, the device may include:
[0112] The aggregation module 710 is used to aggregate network traffic according to traffic aggregation parameters to obtain at least one target traffic item;
[0113] The encoding module 720 is used to perform semantic encoding on each target traffic based on the header information of multiple data packets in the target traffic, so as to obtain an initial encoding matrix corresponding to each data packet.
[0114] The discrimination module 730 is used to input multiple initial encoding matrices corresponding to any target traffic into the traffic discrimination model to obtain discrimination information output by the traffic discrimination model; wherein, the discrimination information indicates whether the target traffic is malicious traffic.
[0115] In one embodiment, the aggregation module 710 is further configured to:
[0116] For each target traffic flow, store the header information of the first K data packets; where K is a preset positive integer.
[0117] In one embodiment, the encoding module 720 is further configured to:
[0118] For each data packet in each target traffic, the field information of each header field of the data packet is encoded by a pre-trained word vector model to obtain the word vector corresponding to the header field;
[0119] For each data packet, the word vectors of the multiple header fields corresponding to the data packet are used to construct the initial encoding matrix corresponding to the data packet.
[0120] In one embodiment, the encoding module 720 is further configured to:
[0121] If any header field contains at least two words, each word is encoded using the word vector model to obtain the corresponding field information vector.
[0122] The word vectors corresponding to at least two fields of the header field are averaged to obtain the word vectors corresponding to the header field.
[0123] In one embodiment, the traffic discrimination model includes an attention module, an average pooling layer, a gated recurrent unit, a fully connected layer, and a classification layer; the discrimination module 730 is further configured to:
[0124] Multiple initial encoding matrices corresponding to any target traffic are input into the traffic discrimination model. The attention module processes each initial encoding matrix to obtain a specified encoding matrix corresponding to each initial encoding matrix.
[0125] Each specified encoding matrix is processed by the average pooling layer to obtain the encoding vector corresponding to each specified encoding matrix;
[0126] The gated loop unit processes multiple encoded vectors corresponding to the target traffic to obtain the flow vector corresponding to the target traffic;
[0127] The flow vector is input into the fully connected layer to obtain a specified flow vector, and the specified flow vector is input into the classification layer to obtain the discrimination information output by the classification layer.
[0128] In one embodiment, the apparatus further includes a training module 740, for:
[0129] Multiple initial encoding matrices are generated for multiple sample traffic in the sample dataset; each sample traffic carries a traffic label, which indicates whether the sample traffic is malicious or normal traffic.
[0130] Input the initial encoding matrix of multiple samples of the sample traffic into the classification model to obtain the prediction and discrimination information of the sample traffic;
[0131] Based on the difference between the predicted discrimination information of the sample traffic and the traffic label, the model parameters of the classification model are adjusted;
[0132] Repeat the above process until the classification model converges to obtain the trained traffic discrimination model.
[0133] In one embodiment, the aggregation module 710 is further configured to:
[0134] Multiple malicious traffic and multiple normal traffic are simulated and generated as sample traffic, and a corresponding traffic label is added to each sample traffic.
[0135] The sample dataset is constructed based on the sample traffic labeled with traffic tags.
[0136] The specific implementation process of the functions and roles of each module in the above-mentioned device can be found in the implementation process of the corresponding steps in the above-mentioned malicious traffic detection method, and will not be repeated here.
[0137] The apparatuses and methods disclosed in the several embodiments provided in this application can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatuses, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.
[0138] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.
[0139] If a function is implemented as a software module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.
Claims
1. A method for detecting malicious traffic, characterized in that, include: Network traffic is aggregated based on traffic aggregation parameters to obtain at least one target traffic item; For each target traffic, semantic encoding is performed based on the header information of multiple data packets in the target traffic to obtain an initial encoding matrix corresponding to each data packet; wherein, the header information includes field information in each header field of the IP header, TCP header, and UDP header; Multiple initial encoding matrices corresponding to any target traffic are treated as a whole and input into the traffic discrimination model to obtain discrimination information output by the traffic discrimination model; wherein, the discrimination information indicates whether the target traffic is malicious traffic; The traffic discrimination model includes multiple attention modules, multiple average pooling layers, a gated recurrent unit, a fully connected layer, and a classification layer. The process involves taking multiple initial encoding matrices corresponding to any target traffic as a whole and inputting them into the traffic discrimination model to obtain the discrimination information output by the traffic discrimination model, including: Multiple initial encoding matrices corresponding to any target traffic are treated as a whole and input into the traffic discrimination model. Each initial encoding matrix is processed by the multiple attention modules to obtain a specified encoding matrix corresponding to each initial encoding matrix. Among them, one attention module is responsible for processing one initial encoding matrix. Each specified encoding matrix is processed by the multiple average pooling layers to obtain the encoding vector corresponding to each specified encoding matrix. Each average pooling layer is responsible for processing one specified encoding matrix. The gated loop unit fuses multiple encoded vectors corresponding to the target traffic to obtain a flow vector corresponding to the target traffic, wherein the flow vector is a vector obtained by fusing multiple encoded vectors. The flow vector is input into the fully connected layer to obtain a specified flow vector, and the specified flow vector is input into the classification layer to obtain the discrimination information output by the classification layer.
2. The method according to claim 1, characterized in that, Before performing semantic encoding on each target traffic packet based on the header information of multiple data packets in the target traffic to obtain the initial encoding matrix corresponding to each data packet, the method further includes: For each target traffic flow, store the header information of the first K data packets; where K is a preset positive integer.
3. The method according to claim 1, characterized in that, For each target traffic flow, semantic encoding is performed based on the header information of multiple data packets within the target traffic flow to obtain an initial encoding matrix corresponding to each data packet, including: For each data packet in each target traffic, the field information of each header field of the data packet is encoded by a pre-trained word vector model to obtain the word vector corresponding to the header field; For each data packet, the word vectors of the multiple header fields corresponding to the data packet are used to construct the initial encoding matrix corresponding to the data packet.
4. The method according to claim 3, characterized in that, The process of encoding the field information of each header field of the data packet using a pre-trained word vector model to obtain the word vector corresponding to the header field includes: If any header field contains at least two words, each word is encoded using the word vector model to obtain the corresponding field information vector. The word vectors corresponding to at least two fields of the header field are averaged to obtain the word vectors corresponding to the header field.
5. The method according to claim 1, characterized in that, Before inputting multiple initial encoding matrices corresponding to any target traffic into the traffic discrimination model to obtain the discrimination information output by the traffic discrimination model, the method further includes: Multiple initial encoding matrices are generated for multiple sample traffic flows in the sample dataset; wherein each sample traffic flow carries a traffic label, the traffic label indicating whether the sample traffic flow is malicious traffic or normal traffic; Input the initial encoding matrix of multiple samples of the sample traffic into the classification model to obtain the prediction and discrimination information of the sample traffic; Based on the difference between the predicted discrimination information of the sample traffic and the traffic label, the model parameters of the classification model are adjusted; Repeat the above process until the classification model converges to obtain the trained traffic discrimination model.
6. The method according to claim 5, characterized in that, Before generating multiple initial encoding matrices for multiple sample flows in the sample dataset, the method further includes: Multiple malicious traffic and multiple normal traffic are simulated and generated as sample traffic, and a corresponding traffic label is added to each sample traffic. The sample dataset is constructed based on the sample traffic labeled with traffic tags.
7. A device for detecting malicious traffic, characterized in that, include: The aggregation module is used to aggregate network traffic based on traffic aggregation parameters to obtain at least one target traffic item. The encoding module is used to perform semantic encoding on each target traffic based on the header information of multiple data packets in the target traffic to obtain an initial encoding matrix corresponding to each data packet; wherein, the header information includes field information in each header field of the IP header, TCP header, and UDP header; The discrimination module is used to take multiple initial encoding matrices corresponding to any target traffic as a whole, input them into the traffic discrimination model, and obtain the discrimination information output by the traffic discrimination model; wherein, the discrimination information indicates whether the target traffic is malicious traffic; The traffic discrimination model includes multiple attention modules, multiple average pooling layers, a gated recurrent unit, a fully connected layer, and a classification layer; the discrimination module is specifically used for: Multiple initial encoding matrices corresponding to any target traffic are treated as a whole and input into the traffic discrimination model. Each initial encoding matrix is processed by the multiple attention modules to obtain a specified encoding matrix corresponding to each initial encoding matrix. Among them, one attention module is responsible for processing one initial encoding matrix. Each specified encoding matrix is processed by the multiple average pooling layers to obtain the encoding vector corresponding to each specified encoding matrix. Each average pooling layer is responsible for processing one specified encoding matrix. The gated loop unit fuses multiple encoded vectors corresponding to the target traffic to obtain a flow vector corresponding to the target traffic, wherein the flow vector is a vector obtained by fusing multiple encoded vectors. The flow vector is input into the fully connected layer to obtain a specified flow vector, and the specified flow vector is input into the classification layer to obtain the discrimination information output by the classification layer.
8. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store processor-executable instructions; The processor is configured to execute the malicious traffic detection method according to any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that can be executed by a processor to perform the malicious traffic detection method according to any one of claims 1-6.
Citation Information
Patent Citations
Unsupervised malicious traffic detection system and method
TWI715457B