A bot host detection method, device, equipment and storage medium

Abstract

This application discloses a method, apparatus, device, and storage medium for detecting botnet hosts. The method includes: acquiring NetFlow data of the network traffic of the host to be detected; extracting features from the NetFlow data to obtain target feature information; and using a KNN algorithm model to detect the target feature information to determine whether the host to be detected is a botnet host. This method improves detection efficiency by extracting target feature information consistent with botnet hosts based on NetFlow data. Furthermore, the use of the KNN algorithm model improves detection accuracy, enabling rapid identification of botnet hosts and timely blocking of malicious requests initiated by them, resulting in good timeliness.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device, and storage medium for detecting zombie hosts. Background Technology

[0002] Botnets are a common threat across various networks. They send and execute malicious code to user hosts via email, web scripts, and other means, thereby gaining control of the user's host, which becomes a "zombie host." This creates a one-to-many control network between the attacker and the zombie host. Attackers spread bot programs through various means to infect a large number of hosts on the Internet. After receiving instructions from the attacker, the main harms of a zombie host include attacking external network services or stealing sensitive corporate information. Once these attacks occur, they will consume a lot of network resources and may even leak corporate secrets.

[0003] While methods for detecting botnets already exist in related technologies, current methods have some drawbacks, resulting in long detection times, inability to detect botnets and reduce their harm in a timely manner, and low detection accuracy. Summary of the Invention

[0004] This application proposes a method, apparatus, device, and storage medium for detecting zombie hosts, which can not only improve the detection accuracy but also has high detection efficiency, enabling rapid identification of zombie hosts and timely blocking of their malicious requests.

[0005] To achieve the above objectives, the technical solution of this application is implemented as follows:

[0006] In a first aspect, embodiments of this application provide a method for detecting zombie hosts, the method comprising:

[0007] Obtain the NetFlow stream data of the network traffic of the host under test;

[0008] Feature extraction is performed on NetFlow stream data to obtain target feature information;

[0009] The KNN algorithm model is used to detect target feature information to determine whether the host to be detected is a zombie host.

[0010] Secondly, embodiments of this application provide a zombie host detection device, which includes an acquisition unit, a feature extraction unit, and a detection unit; wherein,

[0011] The acquisition unit is configured to acquire NetFlow stream data from the host to be detected;

[0012] The feature extraction unit is configured to extract features from NetFlow stream data to obtain target feature information;

[0013] The detection unit is configured to use the KNN algorithm model to detect target feature information and determine whether the host to be detected is a zombie host.

[0014] Thirdly, embodiments of this application provide a detection device, which includes a memory and a processor; wherein,

[0015] Memory is used to store computer programs that can run on a processor;

[0016] A processor for executing the method described in the first aspect when running a computer program.

[0017] Fourthly, embodiments of this application provide a computer storage medium storing a computer program that, when executed by at least one processor, implements the method described in the first aspect.

[0018] This application provides a method, apparatus, device, and storage medium for detecting zombie hosts. It acquires NetFlow stream data of the host to be detected; extracts features from the NetFlow stream data to obtain target feature information; and uses a KNN algorithm model to detect the target feature information to determine whether the host to be detected is a zombie host. This method improves detection efficiency by extracting target feature information consistent with zombie hosts based on NetFlow stream data. Furthermore, the use of the KNN algorithm model improves detection accuracy, enabling rapid identification of zombie hosts and timely blocking of their malicious requests, resulting in good timeliness. Attached Figure Description

[0019] Figure 1 A flowchart illustrating a method for detecting zombie hosts provided in an embodiment of this application;

[0020] Figure 2 A flowchart illustrating another method for detecting zombie hosts provided in this application embodiment;

[0021] Figure 3 This is a schematic diagram of the composition structure of a zombie host detection device provided in an embodiment of this application;

[0022] Figure 4 This is a schematic diagram of the composition structure of another zombie host detection device provided in an embodiment of this application;

[0023] Figure 5 This is a schematic diagram of the composition structure of a detection device provided in an embodiment of this application;

[0024] Figure 6This is a schematic diagram of the composition structure of another detection device provided in an embodiment of this application. Detailed Implementation

[0025] In order to gain a more detailed understanding of the features and technical content of the embodiments of this application, the implementation of the embodiments of this application will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for reference and illustration only and are not intended to limit the embodiments of this application.

[0026] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0027] In the following description, references to "some embodiments" refer to a subset of all possible embodiments. It is understood that "some embodiments" may be the same or different subsets of all possible embodiments and may be combined with each other without conflict. It should also be noted that the terms "first, second, third" used in the embodiments of this application are merely for distinguishing similar objects and do not represent a specific ordering of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0028] Currently, numerous methods exist for detecting and blocking malicious code, but most of these methods are unsuitable for detecting botnets. Furthermore, most deployed botnets are open-source and easy to implement, allowing ordinary users to easily establish botnets.

[0029] Understandably, while sandboxes, honeypots, and encrypted networks can capture and analyze botnet malware, they are time-consuming, hindering timely detection and mitigation of botnet threats. To address this issue, methods for detecting botnets based on the host and network behavior of controlled nodes have been proposed. However, most current methods focus on feature detection of the Internet Relay Chat (IRC) protocol, primarily because IRC is the most widely used communication protocol in botnets, used for traffic monitoring and identifying Challenge Collapsar (CC) servers. However, new botnets can also use Hypertext Transfer Protocol (HTTP) and Peer-to-Peer (P2P) protocols. Currently, P2P network architecture is most prevalent, eliminating single points of failure and employing the latest encryption and obfuscation techniques, but this significantly reduces detection accuracy.

[0030] In other words, although methods for detecting zombie hosts already exist in related technologies, current detection methods have some shortcomings, resulting in long processing times, failure to detect botnets in a timely manner and reduce their harm, and low detection accuracy for botnets using encryption technology; in addition, although the detection accuracy is obvious for zombie hosts using the traditional IRC protocol, the detection accuracy is relatively low for zombie hosts using HTTP and P2P protocols.

[0031] Based on this, this application provides a method for detecting botnet hosts. The basic idea of ​​this method is: to acquire NetFlow stream data of the host to be detected; to extract features from the NetFlow stream data to obtain target feature information; and to use the KNN algorithm model to detect the target feature information to determine whether the host to be detected is a botnet host. In this way, extracting target feature information consistent with botnet hosts based on NetFlow stream data improves detection efficiency; moreover, using the KNN algorithm model results in high detection accuracy, good prediction performance for processing large amounts of data, and fast model training time, thereby enabling rapid identification of botnet hosts and timely blocking of their malicious requests.

[0032] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0033] In one embodiment of this application, see [link to embodiment]. Figure 1 The diagram illustrates a flowchart of a zombie host detection method provided in an embodiment of this application. Figure 1 As shown, the method may include:

[0034] S101: Obtain NetFlow stream data from the host to be tested.

[0035] It should be noted that the method in this application embodiment is applied to a zombie host detection device, or a detection device integrated with such a device. Here, the detection device can be implemented in various forms. For example, the detection device described in this application embodiment may include devices such as smartphones, tablets, laptops, handheld computers, personal digital assistants (PDAs), desktop computers, servers, etc. This application embodiment does not specifically limit the scope of the device.

[0036] It should also be noted that the embodiments of this application focus on the host under test as the primary monitoring and protection target, while network traffic (NetFlow) data is collected through routers in the backbone network. With the widespread application of Internet technology, new threats (i.e., "botnets") have emerged targeting Internet service providers and users. Botnets can construct a one-to-many or many-to-many control network through various propagation and infection programs, manipulating a large number of zombie hosts to launch distributed denial-of-service (DDoS) attacks, send spam, steal sensitive data, send phishing emails, and engage in other malicious activities.

[0037] Thus, taking a DDoS attack as an example, a single DDoS attack may utilize many vulnerable botnets, and these botnets may also launch attacks against more than one host; therefore, the NetFlow stream data here may include one or more NetFlow streams.

[0038] S102: Extract features from NetFlow stream data to obtain target feature information.

[0039] It should be noted that the embodiments of this application are based on NetFlow stream data for zombie host detection, and the target feature information matching the zombie host is extracted based on the key fields corresponding to the NetFlow stream data. Therefore, in some embodiments, the feature extraction of NetFlow stream data to obtain target feature information may include:

[0040] Identify the key fields corresponding to the NetFlow stream data;

[0041] Feature extraction is performed on NetFlow streaming data using key fields to obtain target feature information.

[0042] It should also be noted that for NetFlow streaming data, the key fields differ depending on the version. Here, taking the first and second versions as examples, specifically, in some embodiments, determining the key fields corresponding to the NetFlow streaming data may include:

[0043] Detect the version information of NetFlow streaming data;

[0044] If the version information of the NetFlow stream data is version 1, then key fields are extracted from the NetFlow stream data using fixed fields to obtain the corresponding key fields; or,

[0045] If the version information of the NetFlow stream data is version 2, then the key fields of the NetFlow stream data are extracted using a preset template to obtain the corresponding key fields of the NetFlow stream data.

[0046] In one possible implementation, if the version information of the NetFlow stream data is version 1, the method may further include: determining fixed fields corresponding to the first version; wherein the fixed fields include at least: source Internet Protocol (IP) address, destination IP address, next-hop IP address, source port, destination port, protocol type, number of packets, and number of bytes.

[0047] In another possible implementation, if the NetFlow streaming data version information is version 2, the method may further include:

[0048] Determine the required fields for the second version;

[0049] Configure the preset template corresponding to the second version according to the required fields; among them, the preset required fields include at least: number of bytes, number of packets, timestamp, source IP address, destination IP address, source port, destination port, protocol type, and ToS type.

[0050] In this embodiment of the application, the first version can be NetFlow V5 and the second version can be NetFlow V9.

[0051] In other words, the most common versions of NetFlow streaming data are NetFlow V5 and NetFlow V9. The key fields for NetFlow V5 are fixed, while the key fields for NetFlow V9 are extracted based on templates. In this embodiment, the corresponding key fields can be extracted as needed.

[0052] It should also be noted that NetFlow stream data may include one or more NetFlow streams. Therefore, the method may also include determining whether the NetFlow stream data are the same NetFlow stream based on preset information.

[0053] In this embodiment, the preset information may include: 5-tuple information, Type of Service (ToS) information, and input interface; wherein, the 5-tuple information may further include source IP address, destination IP address, source port, destination port, and transport protocol. That is to say, the preset information may also be referred to as "7-tuple information".

[0054] In this way, based on the 5-tuple information, ToS information, input interface, and other fields, a NetFlow flow can be uniquely identified. Specifically, this can include:

[0055] If the quintuple information, ToS information, input interface and other fields are all consistent, then it means that the NetFlow stream data is the same NetFlow stream.

[0056] If any of the fields such as the quintuple information, ToS information, or input interface are inconsistent, it means that the NetFlow stream data is not from the same NetFlow stream.

[0057] It is understandable that for NetFlow V5 version NetFlow stream data, its fixed fields can include at least the source IP address, destination IP address, next-hop IP address, source port, destination port, protocol type, number of packets and number of bytes, etc., as shown in Table 1.

[0058] Table 1

[0059]

[0060] It is also understandable that, for NetFlow V9 version NetFlow streaming data, firstly, for the preset template, its code description is as follows:

[0061]

[0062]

[0063] Secondly, the corresponding fields (Field Values) need to be configured for the preset templates, as shown in Table 2. Here, according to Table 2, the switch / router can parse NetFlow flow data based on the preset template (identified by the Template ID, which varies depending on the template ID). Table 2 shows the Field Values ​​that need to be parsed according to the corresponding template.

[0064] Table 2

[0065]

[0066] Its code description is as follows:

[0067]

[0068]

[0069] Thus, for NetFlow V9, the main fields can include byte count, packet count, timestamp, source IP address, destination IP address, source port, destination port, protocol type, ToS type, etc. The key fields are shown in Table 3.

[0070] Table 3

[0071]

[0072]

[0073]

[0074] It should be noted that the NetFlow stream data of the host to be detected may include one or more NetFlow streams; these NetFlow streams may be NetFlow V5, NetFlow V9, or even both NetFlow V5 and NetFlow V9 versions simultaneously, and this application embodiment does not impose specific limitations. Furthermore, it should be noted that if both NetFlow V5 and NetFlow V9 versions are included, they need to be parsed separately to determine the key fields; both versions contain the key fields used to extract target feature information.

[0075] In this way, based on the key fields corresponding to the NetFlow stream data, characteristic information matching zombie hosts can be extracted, specifically based on statistics within a preset time window. Therefore, in some embodiments, the step of using key fields to extract features from NetFlow stream data to obtain target feature information may include:

[0076] Based on a preset time window, at least one segment of NetFlow stream within the preset time window is obtained from the NetFlow stream data;

[0077] Feature extraction is performed on at least one segment of NetFlow stream using key fields to obtain target feature information.

[0078] It should be noted that, in the embodiments of this application, the target feature information may include: the average interval between two flows, the average duration of the flow, the average number of sub-bytes, the average number of packets, the ratio of flow requests to responses, and the protocol entropy value.

[0079] It should also be noted that the embodiments in this application are based on statistics of NetFlow stream data within a time window. The two streams mentioned here refer to the same NetFlow stream, which may be divided into multiple NetFlow stream segments within that time window. In this case, the average interval between the two streams refers to the average interval between any two adjacent streams within these multiple NetFlow stream segments within the statistical time window. If there is only one NetFlow stream, the average interval between the two streams will default to zero.

[0080] In other words, based on the key fields corresponding to the NetFlow stream data, the corresponding feature information that matches the zombie host is extracted. Specifically, the feature information of the stream is selected within a certain time window. The target feature information extracted here can include: the average interval between two streams, the average stream duration, the average byte size, the average packet size, the ratio of stream requests to responses, and the protocol entropy value, etc., as shown below:

[0081] (1) Average interval between two streams: For a zombie host, it is controlled by the master control end. That is, the master control end scans vulnerable hosts through malicious scanning and installs programs that initiate malicious requests on the zombie host through malicious operations. Moreover, the commands issued by these programs are relatively fixed. Therefore, the time interval between the same streams is also relatively fixed.

[0082] (2) Average flow duration: Similar to feature (1), the duration of each flow is almost similar. This feature is achieved by statistically analyzing the duration of the same flow within a certain time window and calculating its average.

[0083] (3) Average byte size: Based on the number of bytes in the NetFlow stream field, the average byte size is calculated within a certain time window.

[0084] (4) Average packet size: Based on the number of packets in the NetFlow flow field, the average number of packets within a certain time window is calculated.

[0085] (5) Ratio of requests to responses: Since zombie hosts often send malicious requests, they only care about whether the number of requests reaches a certain level, and do not care whether they will be responded to. Therefore, the number of requests to zombie hosts is much greater than the number of responses, and the ratio is a very large value.

[0086] (6) Protocol entropy: The attack launched by zombie hosts is relatively regular, and the types of protocols used are also relatively fixed. Therefore, the entropy of the protocols can be statistically analyzed to reflect the changes in the proportion of protocols.

[0087] In short, a botnet is generally a group of hosts on the internet with exploitable vulnerabilities that launch attacks against a victim host. Here, in this embodiment, after receiving NetFlow stream data from the host to be detected, the system extracts features matching those of a botnet based on key fields to obtain target feature information, which can then be used for subsequent botnet detection.

[0088] S103: Use the KNN algorithm model to detect target feature information and determine whether the host to be detected is a zombie host.

[0089] It's important to note that the KNN algorithm model uses the K-Nearest Neighbor (KNN) classification algorithm. KNN is one of the most fundamental and simplest algorithms in machine learning. It can be used for both classification and regression. KNN classifies features by measuring the distances between them. The core idea of ​​the KNN algorithm is very simple: for any n-dimensional input vector, each feature corresponds to a point in the feature space, and the output is the class label or predicted value corresponding to that feature vector.

[0090] It's also important to note that the KNN algorithm is a very special type of machine learning algorithm because it doesn't involve a typical learning process. Its working principle is to partition the feature vector space using training data and then use the partitioning result as the final algorithm model. In other words, there exists a set of sample data, also called the training sample set, and each sample in the set has a label, representing the correspondence between each sample and its corresponding classification label.

[0091] In this way, for the input target feature information, since these data are unlabeled, each feature of the unlabeled data can be compared with the corresponding features of the sample data in the sample set. Then, the classification labels (also called "class labels") of the k nearest neighbors (nearest neighbors) of the sample data with the most similar features are extracted. Generally speaking, the classification label that appears most frequently among the k classification labels is selected as the final detection result.

[0092] Specifically, if the selected category label is "zombie," then the host to be detected can be determined to be a zombie host; if the selected category label is "non-zombie," then the host to be detected can be determined to be a non-zombie host.

[0093] This embodiment provides a method for detecting botnet hosts. It involves acquiring NetFlow stream data of the host to be detected; extracting features from the NetFlow stream data to obtain target feature information; and using the KNN algorithm model to detect the target feature information to determine whether the host to be detected is a botnet host. This method improves detection efficiency by extracting target feature information matching botnet hosts based on NetFlow stream data. Furthermore, the use of the KNN algorithm model improves detection accuracy, enabling rapid identification of botnet hosts and timely blocking of malicious requests initiated by them, resulting in good timeliness.

[0094] In another embodiment of this application, based on the zombie host detection method described in the foregoing embodiments, see [link to relevant documentation]. Figure 2 The diagram illustrates a flowchart of another zombie host detection method provided in an embodiment of this application.

[0095] like Figure 2 As shown, the method may include:

[0096] S201: Obtain at least one set of training samples; wherein each set of training samples includes sample data and corresponding category labels.

[0097] S202: Perform feature learning on sample data from at least one set of training samples to obtain feature information corresponding to each sample data.

[0098] S203: Compare the target feature information with the feature information corresponding to each sample data, and based on the comparison result, select the category labels corresponding to the K nearest neighbor sample data from at least one set of training samples, where K is an integer greater than zero.

[0099] S204: Determine the target category label from the category labels corresponding to each of the K groups of sample data, and determine the target category label as the detection result; wherein, the detection result is used to indicate whether the host to be detected is a zombie host.

[0100] It should be noted that the embodiments of this application may use the KNN algorithm model. Here, the KNN algorithm is chosen as the detection algorithm for zombie hosts because the KNN algorithm has the following advantages: (1) it is simple and easy to use compared with other algorithms; (2) the model training time is fast; (3) the prediction effect is good; and (4) it is not sensitive to outliers.

[0101] It should also be noted that the choice of the value of K in the KNN algorithm has a crucial impact on the prediction results. If the K value is small, it's equivalent to predicting instances using training samples within a small neighborhood. In this case, the approximate error of the algorithm will be relatively small because only training samples close to the input instance will affect the prediction result. However, the estimation error of the algorithm will be relatively large, and the prediction result will be very sensitive to nearest neighbors. That is, if the nearest neighbor is a noise point, the prediction will be wrong. Therefore, a too-small k value can easily lead to overfitting in the KNN algorithm. If the k value is large, even training samples that are far away can affect the instance prediction result. In this case, the model is relatively robust and will not be affected by a few noise points. However, the nearest neighbor error of the algorithm will be large, and points that are far away (not similar to the predicted instance) will also affect the prediction result, causing a large deviation in the prediction result. In this case, the model is prone to underfitting. Therefore, in practical applications, the choice of the K value should be specifically set according to the actual situation. Cross-validation is usually used to select the K value, but this embodiment does not impose a specific limitation.

[0102] In addition, feature learning is performed on sample data in at least one training sample set. Specifically, this may include: determining the key fields corresponding to the sample data; and then using the key fields to extract features from the sample data to obtain the feature information corresponding to the sample data.

[0103] It should be noted that the feature information corresponding to the sample data is also obtained through statistical learning based on a preset time window. Here, the feature information corresponding to the sample data may include: the average interval between two flows, the average flow duration, the average number of sub-bytes, the average number of packets, the ratio of flow requests to responses, and the protocol entropy value.

[0104] It should also be noted that the key fields corresponding to the sample data still need to be determined based on the version information of the sample data (NetFlow V5 version or NetFlow V9 version). The method for determining the key fields is the same as in the aforementioned embodiments, and will not be described in detail here.

[0105] Thus, after determining the key fields corresponding to the sample data, feature information corresponding to the sample data can be extracted based on a preset time window. Since the NetFlow stream data of the host to be detected does not have category labels, the extracted target feature information can be compared with the feature information corresponding to the sample data. For example, the distance between two points in the sample space can be used to represent the similarity between the two sample points: the shorter the distance, the higher the similarity; conversely, the longer the distance, the lower the similarity. Therefore, in some embodiments, for S203, comparing the target feature information with the feature information corresponding to each sample data, and selecting the category labels corresponding to the K nearest neighbor sample data from at least one training sample set based on the comparison results, may include:

[0106] Based on a preset distance metric, the similarity value between the target feature information and the feature information corresponding to each sample data is calculated.

[0107] Based on the similarity value, select the top K groups of sample data with the highest similarity value from at least one training sample set, and determine the category label corresponding to each of the top K groups of sample data with the highest similarity value as the category label corresponding to each of the K nearest neighbor sample data.

[0108] In the embodiments of this application, the preset distance measurement method includes at least one of the following: Minkowski distance measurement method, Euclidean distance measurement method, Manhattan distance measurement method, Chebyshev distance measurement method, and cosine distance measurement method.

[0109] In one specific implementation, for the Minkowski distance metric, the Minkowski distance itself is not a distance, but rather a definition of a class of distances. For two points x(x1, x2, ..., xn) in n-dimensional space... n ) and y(y1,y2,…,y n The Minkowski distance between x and y can be expressed by the following formula:

[0110]

[0111] Where p is a variable parameter:

[0112] When p = 1, equation (1) can be called the Manhattan distance;

[0113] When p = 2, equation (1) can be called Euclidean distance;

[0114] When p = ∞, equation (1) can be called Chebyshev distance.

[0115] In one specific embodiment, if the Euclidean distance metric is selected, the formula is as follows.

[0116]

[0117] Among them, Euclidean distance (L2 norm) is the easiest distance calculation method to understand. It comes from the distance formula between two points in Euclidean space and is also the most commonly used distance measure.

[0118] Furthermore, in some embodiments, for S204, determining the target category label from the category labels corresponding to each of the K groups of sample data may include: selecting the category label that appears most frequently from the category labels corresponding to each of the K groups of sample data, and determining the category label that appears most frequently as the target category label.

[0119] At this point, in some embodiments, the method for detecting whether the host to be detected is a zombie host may further include:

[0120] If the target category label is "zombie", then the host to be detected is determined to be a zombie host.

[0121] If the target category label is "non-zombie", then the host to be detected is determined to be a non-zombie host.

[0122] In short, in this embodiment, the KNN algorithm partitions the feature vector space using training data for any n-dimensional input vector, and uses the partitioning result as the final KNN algorithm model. This algorithm model is a supervised learning algorithm.

[0123] (1) Learning Phase: A training sample set exists, and each sample data in the training sample set has a class label, thus establishing the correspondence between each sample data in the training sample set and its corresponding class label. It is important to note that the training sample data all have class labels to distinguish between botnets and non-botnets. For example, non-botnet sample data can be labeled as 1, and botnet sample data can be labeled as -1.

[0124] (2) Detection phase: Input unlabeled data, compare each feature of the unlabeled data with the corresponding feature of the data in the training sample set, and then extract the category label corresponding to the sample data (nearest neighbor) with the most similar feature in the training sample set.

[0125] Typically, only the K most similar samples in the training sample set are selected, which is the origin of K in the KNN algorithm. Usually, k ≤ 20 (an integer). Then, the class label that appears most frequently among the K most similar samples is selected as the target class label, which is the final detection result.

[0126] For example, suppose there are n samples, forming the sample set (x1, y1), (x2, y2), ..., (x... n ,y n The training sample set is as follows:

[0127] Input terms: T = {(x1,y1), (x2,y2), ..., (x n ,y n )}; where x is an instance, and y is the category label to which the instance belongs, y i ∈Y={C1,C2,…,C n};

[0128] Output: Predict the category label y to which instance x belongs.

[0129] In the above process, the similarity value can be confirmed by judging the distance between vectors. Commonly used distance measurement methods include: Minkowski distance measurement, Euclidean distance measurement, Manhattan distance measurement, Chebyshev distance measurement, cosine distance measurement, etc. In this embodiment of the application, the Euclidean distance measurement method is selected as an example, and its calculation formula is shown in equation (2) above.

[0130] In summary, this application proposes a method for detecting botnet hosts based on NetFlow streams. This method can extract target feature information consistent with botnet hosts, including six features: the average interval between two streams, the average stream duration, the average byte size, the average packet size, the ratio of stream requests to responses, and the protocol entropy value. Furthermore, this application proposes using the KNN algorithm, which offers higher detection accuracy, better prediction performance for large datasets, and faster model training, enabling rapid identification of botnet hosts and timely blocking of their malicious requests.

[0131] The above embodiments provide a detailed explanation of the specific implementation of the aforementioned embodiments. It can be seen that, through the technical solutions of the aforementioned embodiments, on the one hand, an intelligent method for detecting zombie hosts based on NetFlow is proposed, which extracts target feature information that matches the zombie host and improves detection efficiency; on the other hand, the KNN algorithm model is used, which has a high detection accuracy and good prediction effect for processing large amounts of data, and the model training time is fast, thus enabling rapid identification of zombie hosts and timely blocking of their malicious requests, with good timeliness.

[0132] In another embodiment of this application, based on the same inventive concept as the foregoing embodiments, see [link to previous embodiment]. Figure 3 This document illustrates a schematic diagram of the composition of a zombie host detection device 30 provided in an embodiment of this application. Here, the zombie host detection device 30 is used to implement any of the zombie host detection methods described in the foregoing embodiments, specifically, as... Figure 3 As shown, the zombie host detection device 30 may include an acquisition unit 301, a feature extraction unit 302, and a detection unit 303; wherein,

[0133] Acquisition unit 301 is configured to acquire NetFlow stream data of the host to be detected;

[0134] Feature extraction unit 302 is configured to extract features from NetFlow stream data to obtain target feature information;

[0135] The detection unit 303 is configured to use the KNN algorithm model to detect target feature information and determine whether the host to be detected is a zombie host.

[0136] In some embodiments, the target characteristic information includes: average interval between two flows, average flow duration, average number of sub-bytes, average number of packets, ratio of flow requests to responses, and protocol entropy value.

[0137] In some embodiments, the feature extraction unit 302 is specifically configured to determine the key fields corresponding to the NetFlow stream data; and to extract features from the NetFlow stream data using the key fields to obtain target feature information.

[0138] In some embodiments, the acquisition unit 301 is further configured to acquire at least one segment of NetFlow stream within the preset time window from the NetFlow stream data based on the preset time window;

[0139] The feature extraction unit 302 is specifically configured to extract features from at least one segment of NetFlow using key fields to obtain target feature information.

[0140] In some embodiments, the feature extraction unit 302 is further configured to detect the version information of the NetFlow stream data; and if the version information of the NetFlow stream data is a first version, then key fields are extracted from the NetFlow stream data using fixed fields to obtain the key fields corresponding to the NetFlow stream data; or, if the version information of the NetFlow stream data is a second version, then key fields are extracted from the NetFlow stream data using a preset template to obtain the key fields corresponding to the NetFlow stream data.

[0141] In some embodiments, the acquisition unit 301 is further configured to determine fixed fields corresponding to the first version when the version information of the NetFlow stream data is the first version; wherein the fixed fields include at least: source IP address, destination IP address, next-hop IP address, source port, destination port, protocol type, number of packets, and number of bytes.

[0142] In some embodiments, see Figure 4 The zombie host detection device 30 may also include a configuration unit 304, configured to determine the required fields corresponding to the second version when the version information of the NetFlow stream data is the second version; and to configure the preset template corresponding to the second version according to the required fields; wherein the preset required fields include at least: number of bytes, number of packets, timestamp, source IP address, destination IP address, source port, destination port, protocol type, and ToS type.

[0143] In some embodiments, the first version is NetFlow V5 and the second version is NetFlow V9.

[0144] In some embodiments, see Figure 4 The zombie host detection device 30 may further include a comparison unit 305; wherein,

[0145] The acquisition unit 301 is further configured to acquire at least one set of training samples; wherein each set of training samples includes sample data and corresponding category labels;

[0146] The comparison unit 305 is configured to perform feature learning on sample data in at least one set of training samples to obtain feature information corresponding to each sample data; and to compare the target feature information with the feature information corresponding to each sample data, and select the category labels corresponding to the K nearest neighbor sample data from at least one set of training samples based on the comparison results, where K is an integer greater than zero.

[0147] The detection unit 303 is specifically configured to determine the target category label from the category labels corresponding to each of the K groups of sample data, and to determine the target category label as the detection result; wherein, the detection result is used to indicate whether the host to be detected is a zombie host.

[0148] In some embodiments, the comparison unit 305 is specifically configured to calculate the similarity value between the target feature information and the feature information corresponding to each sample data based on a preset distance metric; and to select the top K groups of sample data with the highest similarity values ​​from at least one set of training samples based on the similarity values, and to determine the category labels corresponding to each of the top K groups of sample data with the highest similarity values ​​as the category labels corresponding to each of the K nearest neighbor groups of sample data; wherein the preset distance metric includes at least one of the following: Minkowski distance metric, Euclidean distance metric, Manhattan distance metric, Chebyshev distance metric, and cosine distance metric.

[0149] In some embodiments, see Figure 4The zombie host detection device 30 may also include a selection unit 306, configured to select the category label that appears most frequently from the category labels corresponding to each of the K groups of sample data, and determine the category label that appears most frequently as the target category label.

[0150] In some embodiments, the detection unit 303 is specifically configured to determine that the host to be detected is a zombie host if the target category label is a zombie category; and to determine that the host to be detected is a non-zombie host if the target category label is a non-zombie category.

[0151] Understandably, in this embodiment, a "unit" can be a portion of a circuit, a portion of a processor, a portion of a program or software, etc., and can also be a module or a non-modular component. Furthermore, the components in this embodiment can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional module.

[0152] If the integrated unit is implemented as a software functional module and not sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this embodiment, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the method described in this embodiment. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0153] Therefore, this embodiment provides a computer storage medium storing a computer program that, when executed by at least one processor, implements the steps of the method described in any of the foregoing embodiments.

[0154] Based on the composition of the aforementioned zombie host detection device 30 and the computer storage medium, see [link to relevant documentation]. Figure 5 This illustrates a schematic diagram of the composition of a detection device 50 provided in an embodiment of this application. For example... Figure 5As shown, the detection device 50 may include: a communication interface 501, a memory 502, and a processor 503; the various components are coupled together via a bus system 504. It is understood that the bus system 504 is used to realize the connection and communication between these components. In addition to a data bus, the bus system 504 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 5 All buses are labeled as bus system 504. Among them, communication interface 501 is used for receiving and sending signals during information exchange with other external network elements;

[0155] Memory 502 is used to store computer programs that can run on processor 503;

[0156] Processor 503, when running the computer program, performs the following:

[0157] Obtain NetFlow stream data from the host to be tested;

[0158] Feature extraction is performed on NetFlow stream data to obtain target feature information;

[0159] The KNN algorithm model is used to detect target feature information to determine whether the host to be detected is a zombie host.

[0160] It is understood that the memory 502 in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DRRAM). The memory 502 of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0161] The processor 503 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 503 or by instructions in software form. The processor 503 can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory 502, and the processor 503 reads the information in memory 502 and, in conjunction with its hardware, completes the steps of the above method.

[0162] It is understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described herein, or combinations thereof.

[0163] For software implementation, the techniques described herein can be achieved through modules (e.g., procedures, functions, etc.) that perform the functions described herein. The software code can be stored in memory and executed by a processor. The memory can be implemented within the processor or externally.

[0164] Alternatively, as another embodiment, the processor 503 is further configured to perform the steps of the method described in any of the foregoing embodiments when running the computer program.

[0165] Based on the composition of the aforementioned zombie host detection device 30 and the computer storage medium, see [link to relevant documentation]. Figure 6 This illustrates a schematic diagram of the composition of another detection device 50 provided in an embodiment of this application. For example... Figure 6 As shown, the detection device 50 may include at least the zombie host detection device 30 described in any of the foregoing embodiments.

[0166] In this embodiment, the detection device 50 includes a zombie host detection device 30 and can implement any of the zombie host detection methods described in the preceding embodiments. Thus, for the detection device 50, extracting target feature information matching zombie hosts based on NetFlow stream data improves detection efficiency; furthermore, using the KNN algorithm model improves detection accuracy, enabling rapid identification of zombie hosts and timely blocking of their malicious requests, resulting in good timeliness.

[0167] It should be noted that, in this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0168] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0169] The methods disclosed in the several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0170] The features disclosed in the several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0171] The features disclosed in the several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method or device embodiments.

[0172] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting zombie hosts, characterized in that, The method includes: Obtain the NetFlow stream data of the network traffic of the host under test; Feature extraction is performed on the NetFlow stream data to obtain target feature information; The KNN algorithm model is used to detect the target feature information to determine whether the host to be detected is a zombie host; The step of extracting features from the NetFlow stream data to obtain target feature information includes: Identify the key fields corresponding to the NetFlow stream data; wherein, the key fields have a corresponding relationship with the version information of the NetFlow stream data; The target feature information is obtained by extracting features from the NetFlow stream data using the key fields. The target feature information includes: average interval between two flows, average flow duration, average number of segments, average number of packets, ratio of flow requests to responses, and protocol entropy value; The method further includes: determining whether the NetFlow flow data are the same NetFlow flow based on the seven-tuple information; wherein the seven-tuple information includes: five-tuple information, service type information and input interface, and the five-tuple information includes: source IP address, destination IP address, source port, destination port and transport protocol.

2. The method according to claim 1, characterized in that, The step of extracting features from the NetFlow stream data using the key fields to obtain the target feature information includes: Based on a preset time window, at least one segment of NetFlow flow within the preset time window is obtained from the NetFlow flow data; The target feature information is obtained by extracting features from the at least one segment of the NetFlow stream using the key fields.

3. The method according to claim 1, characterized in that, The process of determining the key fields corresponding to the NetFlow stream data includes: Detect the version information of the NetFlow stream data; If the version information of the NetFlow stream data is version 1, then key fields are extracted from the NetFlow stream data using fixed fields to obtain the key fields corresponding to the NetFlow stream data; or, If the version information of the NetFlow stream data is version 2, then the key fields of the NetFlow stream data are extracted using a preset template to obtain the key fields corresponding to the NetFlow stream data.

4. The method according to claim 3, characterized in that, If the version information of the NetFlow stream data is version 1, the method further includes: Determine the fixed fields corresponding to the first version; wherein the fixed fields include at least: source IP address, destination IP address, next-hop IP address, source port, destination port, protocol type, number of packets, and number of bytes.

5. The method according to claim 3, characterized in that, If the version information of the NetFlow stream data is version 2, the method further includes: Determine the required fields corresponding to the second version; Configure the preset template corresponding to the second version according to the required fields; wherein, the required fields include at least: number of bytes, number of packets, timestamp, source IP address, destination IP address, source port, destination port, protocol type, and ToS type.

6. The method according to claim 3, characterized in that, The first version is NetFlow V5, and the second version is NetFlow V9.

7. The method according to claim 1, characterized in that, The step of using the KNN algorithm model to detect the target feature information and determine whether the host to be detected is a zombie host includes: Obtain at least one training sample set; wherein each training sample set includes sample data and corresponding class labels; Feature learning is performed on the sample data in the at least one set of training samples to obtain the feature information corresponding to each sample data. The target feature information is compared with the feature information corresponding to each sample data, and according to the comparison result, the category labels corresponding to the K nearest neighbor sample data are selected from the at least one set of training sample data, where K is an integer greater than zero. The target category label is determined from the category labels corresponding to each of the K groups of sample data, and the target category label is determined as the detection result; wherein, the detection result is used to indicate whether the host to be detected is a zombie host.

8. The method according to claim 7, characterized in that, The step of comparing the target feature information with the feature information corresponding to each sample data, and selecting the category labels corresponding to the K nearest neighbor groups of sample data from the at least one set of training samples based on the comparison results, includes: Based on a preset distance metric, the similarity value between the target feature information and the feature information corresponding to each sample data is calculated. Based on the similarity value, select the top K groups of sample data with the highest similarity value from the at least one set of training samples, and determine the category label corresponding to each of the top K groups of sample data with the highest similarity value as the category label corresponding to each of the K nearest neighbor sample data. The preset distance measurement method includes at least one of the following: Minkowski distance measurement method, Euclidean distance measurement method, Manhattan distance measurement method, Chebyshev distance measurement method, and cosine distance measurement method.

9. The method according to claim 7, characterized in that, Determining the target category label from the category labels corresponding to each of the K groups of sample data includes: Select the category label that appears most frequently from the category labels corresponding to each of the K groups of sample data, and determine the category label that appears most frequently as the target category label.

10. The method according to any one of claims 7 to 9, characterized in that, The method further includes: If the target category label is a zombie category, then the host to be detected is determined to be a zombie host; If the target category label is a non-zombie category, then the host to be detected is determined to be a non-zombie host.

11. A zombie host detection device, characterized in that, The zombie host detection device includes an acquisition unit, a feature extraction unit, and a detection unit; wherein... The acquisition unit is configured to acquire NetFlow stream data of the host to be detected; The feature extraction unit is configured to extract features from the NetFlow stream data to obtain target feature information; The detection unit is configured to use the KNN algorithm model to detect the target feature information and determine whether the host to be detected is a zombie host. Specifically, the feature extraction unit is configured to determine the key fields corresponding to the NetFlow stream data; wherein the key fields have a corresponding relationship with the version information of the NetFlow stream data; and to extract features from the NetFlow stream data using the key fields to obtain the target feature information. The target feature information includes: average interval between two flows, average flow duration, average number of segments, average number of packets, ratio of flow requests to responses, and protocol entropy value; The zombie host detection device is further configured to determine whether the NetFlow stream data is the same NetFlow stream based on the seven-tuple information; wherein the seven-tuple information includes: five-tuple information, service type information and input interface, and the five-tuple information includes: source IP address, destination IP address, source port, destination port and transport protocol.

12. A testing device, characterized in that, The detection device includes a memory and a processor; wherein... The memory is used to store computer programs that can run on the processor; The processor is configured to perform the method as described in any one of claims 1 to 10 when running the computer program.

13. A computer storage medium, characterized in that, The computer storage medium stores a computer program that, when executed by at least one processor, implements the method as described in any one of claims 1 to 10.

Images