Cryptographic malicious traffic detection method, device, storage medium and electronic device

Abstract

Embodiments of the present application provide a malicious encrypted traffic detection method and device, a storage medium and an electronic device. The method comprises: extracting a plurality of messages of a predetermined number of training samples; extracting different key fields from the plurality of messages of the predetermined number of training samples respectively, and forming a predetermined number of word vectors from the extracted key fields; constructing a target BiLSTM model according to the predetermined number of word vectors by using a multi-head attention and BiLSTM mode; and performing malicious encrypted traffic detection according to the target BiLSTM model. The method can solve the problem that in related technologies, the first m bytes of traffic are extracted as input in the malicious traffic detection method, which is only a simple slicing of traffic bytes and cannot learn the accurate semantics of traffic, resulting in poor malicious encrypted traffic detection effect. By using the multi-head attention mode, the weight of the key field is improved, and the forward and backward long-distance dependencies are obtained by BiLSTM, thereby achieving better malicious encrypted traffic detection effect.

Description

Technical Field

[0001] This application relates to the field of communications, and more specifically, to a method, apparatus, storage medium, and electronic device for detecting encrypted malicious traffic. Background Technology

[0002] Amidst various eavesdropping and man-in-the-middle attacks, and driven by security and privacy concerns, HTTPS (Hyper Text Transfer Protocol Over Secure Socket) has gradually become mainstream, leading to an increase in the proportion of encrypted traffic. While protecting transmitted content, malicious attacks also utilize Secure Sockets Layer / Transport Layer Security (SSL / TLS) protocols for encryption, disguising it as legitimate traffic.

[0003] The related technology proposes an anomaly traffic detection method based on CNN and Long Short-Term Memory (BiLSTM) networks, which learns the spatial domain representation and temporal features of the original traffic data. Figure 1 This is a flowchart of encrypted malicious traffic detection in related technologies, such as... Figure 1 As shown, the process includes: capturing network traffic from network interface card (NIC) nodes; preprocessing the network traffic, specifically including data cleaning, data slicing, dimensionality processing, and data transformation; using the preprocessed data as data samples; extracting spatial domain representation features from the data samples using a 1D-CNN (Convolutional Neural Network); extracting temporal features from the traffic data using an LSTM neural network, i.e., inputting the raw traffic into the LSTM and calculating the state before and after each byte; merging the extracted features using a classifier, then classifying them, and finally processing malicious traffic to determine whether the network traffic is abnormal.

[0004] This method extracts information from the first m bytes and uses 1D-CNN and LSTM to learn the spatial and temporal features between bytes. However, each byte is only a part of the key field and does not have complete semantic information on its own. For example, in a message with a length of 13, 1 and 3 are only part of the length field and do not have actual semantic meaning on their own. Convolving individual bytes, the 1D-CNN model does not learn good spatial features.

[0005] LSTM focuses on forward information and lacks the ability to learn backward dependencies. In the LSTM model, information from preceding data is passed to subsequent data, thus LSTM prioritizes forward information. However, data packets contain bytes with sequential relationships from front to back, as well as backward dependencies, which the LSTM model lacks the ability to represent.

[0006] The input slice is too short and lacks encryption features. In the input given in this patent, the model extracts the first m bytes of the traffic (100 bytes in the patent). According to the communication process analysis, the first 100 bytes are mainly TCP three-way handshake information, which is not very relevant to the encryption process. It lacks analysis of SSL / TLS traffic encryption information and extraction of key fields.

[0007] Malicious traffic detection methods based on raw input extract the first m bytes of the traffic as input, which is just a simple slice of the traffic bytes. There is no complete semantics at the byte level, so it is impossible to learn the accurate semantics of the traffic.

[0008] There is currently no solution to the problem that in malicious traffic detection methods in related technologies, extracting the first m bytes of traffic as input is merely a simple slice of the traffic bytes, which cannot learn the accurate semantics of the traffic and thus leads to poor detection results for malicious encrypted traffic. Summary of the Invention

[0009] This application provides a method, apparatus, storage medium, and electronic device for detecting encrypted malicious traffic, which at least solves the problem in related technologies where extracting the first m bytes of traffic as input is merely a simple slice of the traffic bytes, failing to learn the accurate semantics of the traffic, resulting in poor detection performance of encrypted malicious traffic.

[0010] According to one embodiment of this application, a method for detecting encrypted malicious traffic is provided, including:

[0011] Extract a predetermined number of training samples from multiple messages;

[0012] Different key fields are extracted from various messages of the predetermined number of training samples, and the extracted key fields are used to construct the predetermined number of word vectors.

[0013] A target BiLSTM model is constructed based on the predetermined number of word vectors using multi-head attention and bidirectional long short-term memory (BiLSTM) networks.

[0014] Encrypted malicious traffic detection is performed based on the target BiLSTM model.

[0015] In one exemplary embodiment, constructing a target BiLSTM model based on the predetermined number of word vectors using multi-head attention and a bidirectional long short-term memory network (BiLSTM) includes:

[0016] The predetermined number of word vectors are encoded and selected through the Multi-Head Attention layer of the BiLSTM model to obtain the predetermined number of encoded samples.

[0017] The predetermined number of encoded samples are input into the BiLSTM layer of the BiLSTM model. After passing through the linear layer and the softmax layer, the predetermined number of prediction results y_pred are output.

[0018] The neuron parameters of the BiLSTM model are updated by performing back gradient propagation through the cross-entropy loss of the predetermined number of prediction results y_pred and the corresponding labels y_label, thus obtaining the trained target BiLSTM model.

[0019] In one exemplary embodiment, the predetermined number of word vectors are encoded and selected through the Multi-Head Attention layer of the BiLSTM model to obtain encoded samples, including:

[0020] Determine the Query, Key, and Value of each word vector in the predetermined number of word vectors:

[0021] Query=W Q X;

[0022] Key=W k X;

[0023] Value = W v X, where X is the word vector, W Q W K W V Let W be the neuron parameters of the BiLSTM model. Q W K W V It is an n*n matrix corresponding to the Query, the Key, and the Value respectively, where n is a positive integer;

[0024] Extract multiple pieces of information from each word vector based on the Query, the Key, and the Value;

[0025] The attention distribution of each word vector is obtained by concatenating the multiple pieces of information;

[0026] The attention distribution for each word vector is determined as the encoded sample of each word vector.

[0027] In one exemplary embodiment, the various messages used to extract a predetermined number of training samples include:

[0028] Extract the Client_Hello, Server_Hello, and Certificate messages from the predetermined number of training samples.

[0029] In one exemplary embodiment, after constructing the target BiLSTM model based on the predetermined number of word vectors using multi-head attention and a bidirectional long short-term memory network (BiLSTM), the method further includes:

[0030] The target BiLSTM model was tested based on the test samples to obtain the accuracy (Acc), recall (Rec), precision (Pre), and F1 score.

[0031] In one exemplary embodiment, constructing the predetermined number of word vectors from the extracted key fields includes:

[0032] The extracted key fields are processed into target key fields with the same field length;

[0033] The target key fields are used to construct the word vector.

[0034] In one exemplary embodiment, after constructing the predetermined number of word vectors from the extracted key fields, the method further includes:

[0035] The lengths of the predetermined number of word vectors are standardized according to the pre-set correspondence between message and length.

[0036] According to another embodiment of this application, an encrypted malicious traffic detection device is also provided, comprising:

[0037] The extraction module is used to extract multiple messages from a predetermined number of training samples;

[0038] The module is used to extract different key fields from various messages of the predetermined number of training samples, and to construct the predetermined number of word vectors from the extracted key fields.

[0039] The building module is used to construct the target BiLSTM model based on the predetermined number of word vectors using Multi-Head Attention and Bidirectional Long Short-Term Memory (BiLSTM) networks.

[0040] The detection module is used to detect encrypted malicious traffic based on the target BiLSTM model.

[0041] In one exemplary embodiment, the building module includes:

[0042] The encoding selection submodule is used to select the encoding of the predetermined number of word vectors through the Multi-Head Attention layer of the BiLSTM model to obtain the predetermined number of encoded samples;

[0043] The input submodule is used to input the predetermined number of encoded samples into the BiLSTM layer of the BiLSTM model, and after passing through the linear layer and the softmax layer, output the predetermined number of prediction results y_pred;

[0044] The update submodule is used to perform back gradient propagation by the cross-entropy loss of the predetermined number of prediction results y_pred and the corresponding labels y_label, and update the neuron parameters of the BiLSTM model to obtain the trained target BiLSTM model.

[0045] In one exemplary embodiment, the encoding selection submodule is further configured to

[0046] Determine the Query, Key, and Value of each word vector in the predetermined number of word vectors:

[0047] Query=W Q X;

[0048] Key=W K X;

[0049] Value = W V X, where X is the word vector, W Q W K W V Let W be the neuron parameters of the BiLSTM model. Q W K W V It is an n*n matrix corresponding to the Query, the Key, and the Value respectively, where n is a positive integer;

[0050] Extract multiple pieces of information from each word vector based on the Query, the Key, and the Value;

[0051] The attention distribution of each word vector is obtained by concatenating the multiple pieces of information;

[0052] The attention distribution for each word vector is determined as the encoded sample of each word vector.

[0053] In one exemplary embodiment, the extraction module is further configured to

[0054] Extract the Client_Hello, Server_Hello, and Certificate messages from the predetermined number of training samples.

[0055] In one exemplary embodiment, the apparatus further includes:

[0056] The testing module is used to test the target BiLSTM model based on the test samples to obtain accuracy (Acc), recall (Rec), precision (Pre) and F1 score.

[0057] In one exemplary embodiment, the constitutive module includes:

[0058] The processing submodule is used to process the extracted key fields into target key fields with the same field length;

[0059] A submodule is constructed to form the word vector from the target key fields.

[0060] In one exemplary embodiment, the apparatus further includes:

[0061] The length unification module is used to unify the length of the predetermined number of word vectors according to a pre-set correspondence between messages and lengths.

[0062] According to yet another embodiment of this application, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when it is run.

[0063] According to yet another embodiment of this application, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0064] In this embodiment, a predetermined number of training samples are extracted from various messages. Different key fields are extracted from each of the predetermined number of training samples, and the extracted key fields are used to construct a predetermined number of word vectors. A target BiLSTM model is constructed based on the predetermined number of word vectors using Multi-Head Attention and Bidirectional Long Short-Term Memory (BiLSTM) networks. Encrypted malicious traffic detection is performed based on the target BiLSTM model. This addresses the problem in related malicious traffic detection methods where extracting the first m bytes of traffic as input is merely a simple slicing of the traffic bytes, failing to learn the accurate semantics of the traffic, resulting in poor detection performance. By extracting key fields from various messages, concatenating them into word vectors, increasing the weight of key fields through Multi-Head Attention, and obtaining long-distance dependencies in the forward and backward directions through BiLSTM, a better malicious encrypted traffic detection effect is achieved. Attached Figure Description

[0065] Figure 1 This is a flowchart of encrypted malicious traffic detection in related technologies;

[0066] Figure 2 This is a hardware structure block diagram of a mobile terminal for the encrypted malicious traffic detection method according to an embodiment of this application;

[0067] Figure 3 This is a flowchart of an encrypted malicious traffic detection method according to an embodiment of this application;

[0068] Figure 4 This is an architecture diagram of encrypted malicious traffic detection based on word vector modeling according to an embodiment of this application;

[0069] Figure 5 This is a flowchart of the model training process according to an embodiment of this application;

[0070] Figure 6 This is a block diagram of an encrypted malicious traffic detection device according to an embodiment of this application. Detailed Implementation

[0071] The embodiments of this application will be described in detail below with reference to the accompanying drawings and examples.

[0072] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0073] The methods and embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, Figure 2 This is a hardware structure block diagram of a mobile terminal for the encrypted malicious traffic detection method according to an embodiment of this application, as shown below. Figure 2 As shown, a mobile terminal may include one or more ( Figure 2 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 2 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 2 The more or fewer components shown, or having the same Figure 2 The different configurations shown.

[0074] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the encrypted malicious traffic detection method in this embodiment. The processor 102 executes various functional applications and business chain address pool slicing processing by running the computer program stored in the memory 104, thus implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102. These remote memories can be connected to the mobile terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0075] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0076] This embodiment provides a method for detecting encrypted malicious traffic that runs on the aforementioned mobile terminal or network architecture. Figure 3 This is a flowchart of an encrypted malicious traffic detection method according to an embodiment of this application, such as... Figure 3 As shown, the process includes the following steps:

[0077] Step S302: Extract a predetermined number of training samples from various messages;

[0078] In this embodiment of the application, step S302 may specifically include: extracting the Client_Hello message, Server_Hello message and Certificate message of the predetermined number of training samples.

[0079] Step S304: Extract different key fields from various messages of the predetermined number of training samples, and construct the predetermined number of word vectors from the extracted key fields.

[0080] Step S306: Using Multi-Head Attention and Bidirectional Long Short-Term Memory (BiLSTM) networks, a target BiLSTM model is constructed based on the predetermined number of word vectors.

[0081] Step S308: Detect encrypted malicious traffic based on the target BiLSTM model.

[0082] Through the above steps S302 to S308, the problem that in the malicious traffic detection methods of related technologies, extracting the first m bytes of traffic as input is just a simple slice of traffic bytes, which cannot learn the accurate semantics of traffic, resulting in poor detection effect of malicious encrypted traffic can be solved. The key fields of various packets are extracted, concatenated into word vectors, and the weight of key fields is improved by Multi-HeadAttention. The long-distance dependencies of forward and backward directions are obtained by BiLSTM to achieve better detection effect of malicious encrypted traffic.

[0083] In this embodiment of the application, step S306 may specifically include:

[0084] S3061, The predetermined number of word vectors are encoded and selected through the Multi-Head Attention layer of the BiLSTM model to obtain the predetermined number of encoded samples;

[0085] Furthermore, step S2061 above may specifically include:

[0086] Determine the Query, Key, and Value of each word vector in the predetermined number of word vectors:

[0087] Query=W Q X;

[0088] Key=W K X;

[0089] Value = W VX, where X is the word vector, W Q W K W V Let W be the neuron parameters of the BiLSTM model. Q W K W V It is an n*n matrix corresponding to the Query, the Key, and the Value respectively, where n is a positive integer;

[0090] Extract multiple pieces of information from each word vector based on the Query, the Key, and the Value;

[0091] The attention distribution of each word vector is obtained by concatenating the multiple pieces of information;

[0092] The attention distribution for each word vector is determined as the encoded sample of each word vector.

[0093] S3062, The predetermined number of encoded samples are input into the BiLSTM layer of the BiLSTM model. After passing through the linear layer and the softmax layer, the predetermined number of prediction results y_pred are output.

[0094] S3063, the neuron parameters of the BiLSTM model are updated by performing back gradient propagation through the cross-entropy loss of the predetermined number of prediction results y_pred and the corresponding labels y_label, so as to obtain the trained target BiLSTM model.

[0095] In one embodiment, after step S306 above, the target BiLSTM model is tested based on the test samples to obtain accuracy (Acc), recall (Rec), precision (Pre) and F1 score.

[0096] In this embodiment, step S304 may specifically include: processing the extracted key fields into target key fields with the same field length; and constructing the word vector from the target key fields.

[0097] In another embodiment, after step S204 above, the length of the predetermined number of word vectors is unified according to a pre-set correspondence between messages and lengths.

[0098] Figure 4 This is an architecture diagram of encrypted malicious traffic detection based on word vector modeling according to an embodiment of this application, such as... Figure 4 As shown, it includes: preprocessing stage, model building and training stage, and model testing stage.

[0099] In the preprocessing stage, the raw traffic obtained from the network environment needs to be preprocessed before it can be input into the model. The specific process of the preprocessing stage is as follows.

[0100] Message extraction. In this embodiment, bidirectional flows are divided according to the traffic 5-tuple, and the first Client_Hello, Server_Hello, and Certificate messages of each bidirectional flow are extracted based on the transport layer protocol according to the direction of the bidirectional flow.

[0101] Key field extraction. Based on different messages, extract the byte values ​​of corresponding key fields. For example, for Client_Hello, extract fields such as handshake message type, message length, and supported encryption components. Specific extracted fields are shown in Table 1.

[0102] Standardize field lengths. To eliminate the impact of different key field lengths, this embodiment performs truncation and zero-padding on each feature field. For feature fields that are less than 4 bytes, zeros are padded in the high bits. For feature fields that are more than 4 bytes, they are truncated. For fields whose low bits are truncated, the above process is repeated until no bytes remain.

[0103] Standardize sample length. Standardize the input length of all samples. For each message, select Client_hello: 20, Server_hello: 10, and Certificate: 25 respectively, with a total length of 55, and finally use (55,4) as the input dimension.

[0104] Table 1

[0105]

[0106] Model building and training phases Figure 5 This is a flowchart of the model training process according to an embodiment of this application, such as... Figure 5 As shown, in the model building phase, this embodiment consists of Multi-Head Attention, BiLSTM, and linear layers (Linear1, Linear2). The Multi-Head Attention and the neuron settings of each layer are shown in Table 2. An Adam optimizer with a learning rate of 0.0001 is used in the gradient descent process. The model's loss function is the cross-entropy between the label y_label and the output y_pred.

[0107] Table 2

[0108] Model Composition Set hyperparameters Multi-Head attention nums_head = 2 BiLSTM nums_layer=1, hidden_num=144 Dropout 0.3 Linear (288，84) Linear (84，2)

[0109] During the model training phase, this embodiment uses a training set to train the model by minimizing the reconstruction error. To learn the relationships and contextual relationships between fields, it employs methods such as... Figure 5 The Multi-Head Attention and BiLSTM methods shown demonstrate that, after training, the model effectively learns the semantic relationships between various fields in the traffic flow. The model training process is as follows.

[0110] Train the sample X = (x1, x2, ..., xn) on the current sample space.

[0111] Calculate Q, K, and V of the current sample using the following formulas:

[0112] Q = W Q X;

[0113] K = W K X;

[0114] V = W V X;

[0115] Here, Q, K, and V are the Query, Key, and Value defined in the attention mechanism, respectively, and WQ, WK, and WV are n*n matrices corresponding to Q, K, and V, respectively.

[0116] Based on the following formula, multiple queries Q = [q1, q2, ..., qn] are used for parallel computation. Multiple pieces of information are selected from the input information, with each attention focusing on a different part of the input information. The attention distribution is then obtained by concatenating these components:

[0117]

[0118]

[0119] The input information X is encoded using a multi-head attention approach. By calculating its correlation with other fields, the weights of the corresponding key fields are increased, highlighting some more important key fields. The encoded result is X', which is then input into the BiLSTM layer.

[0120] After the previous output passes through a linear layer and a softmax layer, the predicted result y_pred is output. By calculating the cross-entropy loss of y_label and y_pred, backward gradient propagation is performed to update the parameters of each neuron in the model.

[0121] During the model testing phase, for new traffic, following the data preprocessing procedure described earlier, the processed input is directly fed into the model to obtain the detection result. If y_pred = 1, it is normal traffic; if y_pred = 0, it is malicious traffic.

[0122] The dataset contains 18,565 instances of normal traffic (generated by normal processes) and 9,764 instances of malicious traffic (generated by malicious processes). The training set (12,431 samples) and test set (6,134 samples) are randomly partitioned at a 2:1 ratio. The training and test sets have no overlap. Within the training set, a validation set is further divided at a 4:1 ratio. The validation set is used to assess model convergence and perform parameter tuning during the learning process; it is not used in training or testing.

[0123] Experimental performance metrics include accuracy (Acc), recall (Rec), precision (Pre), and F1 score, calculated as shown in the following formulas:

[0124]

[0125]

[0126]

[0127]

[0128] Wherein, TP is the number of samples that were detected as malicious traffic, TN is the number of samples that were detected as normal traffic, FP is the number of samples that were detected as malicious traffic, and FN is the number of samples that were detected as normal traffic.

[0129] The experimental results are shown in Table 3. Compared with traditional malicious encrypted traffic detection methods (flow-level features + encryption features, load size behavior sequence, and original input), this invention improves all indicators and can better detect malicious traffic. Compared with traditional machine learning methods, neural networks extract data features at different levels by constructing multi-layer neurons, resulting in stronger representation capabilities. On the other hand, this patent uses a Multi-Head Attention mechanism to increase the importance of each key field according to weights, and uses a BiLSTM mechanism to extract long-distance dependencies between the input forward and backward directions, giving it stronger representation capabilities and significantly improving the model's ability to detect malicious encrypted traffic.

[0130] Table 3

[0131]

[0132] This embodiment analyzes the time performance metrics of various methods in terms of feature extraction, model training time, and model testing time. As shown in Table 4, in terms of feature extraction time, the order is: original input < field word vectors < load size behavior sequence < flow-level features + encryption features. Since the original input and field information are the same, only the load information of the first few packets needs to be extracted. Compared with other methods, it does not need to traverse all packets of the flow, thus the feature extraction time is much shorter than other methods. In terms of model training time, the order is: load size behavior sequence < flow-level features + encryption features < original input < field word vectors. Due to the need for more epochs in neural network training and the complexity of the model, the method proposed in the patent suffers from a longer model training time. In terms of model testing time, the methods are basically the same. Therefore, based on the above analysis, this invention proposes to use offline training and online testing to overcome the disadvantage of long training time. Furthermore, after the model is trained, due to its superior feature extraction time, features can be extracted faster, improving the real-time performance of traffic detection and providing detection results with high accuracy.

[0133] This application's embodiments employ a word vector modeling method that extracts key fields, constructs word vectors, and enhances the corresponding weights through Multi-Head Attention. A BiLSTM model is then used to build an encrypted malicious traffic detection system. First, key fields with discriminative power are extracted to form field word vectors. Multi-Head Attention is then used to increase the weights of these key fields. Finally, BiLSTM is used to obtain the long-distance dependencies of the traffic. Compared to traditional detection methods that extract flow-level statistical features, this method eliminates the need to wait for the entire traffic flow to finish, effectively improving feature extraction time. Compared to detection methods using the original input, by extracting key fields, useless random byte information and encrypted information in the traffic load are removed, while retaining effective features.

[0134] Table 4

[0135]

[0136] According to another embodiment of this application, an encrypted malicious traffic detection device is also provided. Figure 6 This is a block diagram of an encrypted malicious traffic detection device according to an embodiment of this application, such as... Figure 6 As shown, it includes:

[0137] Extraction module 62 is used to extract multiple messages from a predetermined number of training samples;

[0138] The constituting module 64 is used to extract different key fields from various messages of the predetermined number of training samples, and to construct the predetermined number of word vectors from the extracted key fields.

[0139] Module 66 is used to construct a target BiLSTM model based on the predetermined number of word vectors using a multi-head attention and bidirectional long short-term memory network (BiLSTM).

[0140] The detection module 68 is used to detect encrypted malicious traffic based on the target BiLSTM model.

[0141] In one exemplary embodiment, the building module 66 includes:

[0142] The encoding selection submodule is used to select the encoding of the predetermined number of word vectors through the Multi-Head Attention layer of the BiLSTM model to obtain the predetermined number of encoded samples;

[0143] The input submodule is used to input the predetermined number of encoded samples into the BiLSTM layer of the BiLSTM model, and after passing through the linear layer and the softmax layer, output the predetermined number of prediction results y_pred;

[0144] The update submodule is used to perform back gradient propagation by the cross-entropy loss of the predetermined number of prediction results y_pred and the corresponding labels y_label, and update the neuron parameters of the BiLSTM model to obtain the trained target BiLSTM model.

[0145] In one exemplary embodiment, the encoding selection submodule is further configured to

[0146] Determine the Query, Key, and Value of each word vector in the predetermined number of word vectors:

[0147] Query=W Q X;

[0148] Key=W K X;

[0149] Value = W v X, where X is the word vector, W Q W K W V Let W be the neuron parameters of the BiLSTM model. Q W K W V It is an n*n matrix corresponding to the Query, the Key, and the Value respectively, where n is a positive integer;

[0150] Extract multiple pieces of information from each word vector based on the Query, the Key, and the Value;

[0151] The attention distribution of each word vector is obtained by concatenating the multiple pieces of information;

[0152] The attention distribution for each word vector is determined as the encoded sample of each word vector.

[0153] In one exemplary embodiment, the extraction module 62 is further configured to

[0154] Extract the Client_Hello, Server_Hello, and Certificate messages from the predetermined number of training samples.

[0155] In one exemplary embodiment, the apparatus further includes:

[0156] The testing module is used to test the target BiLSTM model based on the test samples to obtain accuracy (Acc), recall (Rec), precision (Pre) and F1 score.

[0157] In one exemplary embodiment, the constitutive module 64 includes:

[0158] The processing submodule is used to process the extracted key fields into target key fields with the same field length;

[0159] A submodule is constructed to form the word vector from the target key fields.

[0160] In one exemplary embodiment, the apparatus further includes:

[0161] The length unification module is used to unify the length of the predetermined number of word vectors according to a pre-set correspondence between messages and lengths.

[0162] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above method embodiments when run.

[0163] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0164] Embodiments of this application also provide an electronic device including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0165] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0166] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0167] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0168] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A method for detecting encrypted malicious traffic, characterized in that, include: Extracting a predetermined number of training samples using various messages, including: Client_Hello messages, Server_Hello messages, and Certificate messages for extracting the predetermined number of training samples; Different key fields are extracted from various messages of the predetermined number of training samples. The key fields of each message reflect their own accurate semantics. The key fields of the Client_Hello message include handshake message type, message length, and supported encryption components. The extracted key fields are used to construct the predetermined number of word vectors, including: processing the extracted key fields into target key fields with the same field length; and constructing the word vectors from the target key fields. By using multi-head attention, the weights of key fields are increased, and long-distance dependencies between the input forward and backward are obtained through BiLSTM. The target BiLSTM model is constructed based on the predetermined number of word vectors. Encrypted malicious traffic detection is performed based on the target BiLSTM model.

2. The method according to claim 1, characterized in that, The method of constructing a target BiLSTM model based on the predetermined number of word vectors, using multi-head attention and a bidirectional long short-term memory network (BiLSTM), includes: The predetermined number of word vectors are encoded and selected through the Multi-Head Attention layer of the BiLSTM model to obtain the predetermined number of encoded samples. The predetermined number of encoded samples are input into the BiLSTM layer of the BiLSTM model. After passing through the linear layer and the softmax layer, the predetermined number of prediction results y_pred are output. The neuron parameters of the BiLSTM model are updated by performing back gradient propagation through the cross-entropy loss of the predetermined number of prediction results y_pred and the corresponding labels y_label, thus obtaining the trained target BiLSTM model.

3. The method according to claim 2, characterized in that, The predetermined number of word vectors are encoded and selected using the Multi-Head Attention layer of the BiLSTM model to obtain encoded samples, including: Determine the Query, Key, and Value of each word vector in the predetermined number of word vectors: ； ； ,in, For the word vector, W Q W K W V Let W be the neuron parameters of the BiLSTM model. Q W K W V It is an n*n matrix corresponding to the Query, the Key, and the Value respectively, where n is a positive integer; Extract multiple pieces of information from each word vector based on the Query, the Key, and the Value; The attention distribution of each word vector is obtained by concatenating the multiple pieces of information; The attention distribution for each word vector is determined as the encoded sample of each word vector.

4. The method according to claim 1, characterized in that, After constructing the target BiLSTM model based on the predetermined number of word vectors using Multi-Head Attention and Bidirectional Long Short-Term Memory (BiLSTM) networks, the method further includes: The target BiLSTM model was tested based on the test samples to obtain the accuracy (Acc), recall (Rec), precision (Pre), and F1 score.

5. The method according to claim 1, characterized in that, After constructing the predetermined number of word vectors from the extracted key fields, the method further includes: The lengths of the predetermined number of word vectors are standardized according to the pre-set correspondence between message and length.

6. A device for detecting encrypted malicious traffic, characterized in that, The apparatus is used to perform the method as described in any one of claims 1 to 5, comprising: The extraction module is used to extract multiple messages from a predetermined number of training samples; The module is configured to extract different key fields from various messages of the predetermined number of training samples, and to construct the predetermined number of word vectors from the extracted key fields, including: processing the extracted key fields into target key fields of the same length; and constructing the word vectors from the target key fields. The building module is used to construct the target BiLSTM model based on the predetermined number of word vectors using Multi-Head Attention and Bidirectional Long Short-Term Memory (BiLSTM) networks. The detection module is used to detect encrypted malicious traffic based on the target BiLSTM model.

7. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the method described in any one of claims 1 to 5 when it is run.

8. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method as described in any one of claims 1 to 5.

Images