Vulnerability attack traffic detection method and device
By acquiring static features of traffic and response data, and combining them with a trained traffic detection model and ACGAN model, the problem of high false positive rate in vulnerability attack traffic detection is solved, achieving higher detection accuracy.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING TOPSEC NETWORK SECURITY TECH
- Filing Date
- 2022-12-01
- Publication Date
- 2026-07-31
AI Technical Summary
Existing technologies for detecting vulnerability attack traffic suffer from a high false positive rate, with a large number of unknown vulnerability attack traffic being falsely reported.
By acquiring static features of traffic and response data, a trained traffic detection model is used to detect vulnerability attack traffic. Combined with the ACGAN model for dynamic feature detection, the detection accuracy is improved.
It effectively reduces the false positive rate of vulnerability testing such as fuzzing and unsuccessful vulnerability attack traffic, and improves the accuracy of vulnerability attack traffic detection.
Smart Images
Figure CN116112209B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, specifically to a method and apparatus for detecting vulnerability attack traffic. Background Technology
[0002] Vulnerability attack traffic refers to traffic data that successfully exploits network vulnerabilities. Currently, the detection of vulnerability attack traffic typically involves segmenting unencrypted traffic into word vectors, training a deep learning classifier using a vectorized payload to distinguish between normal application traffic and vulnerability attack traffic, and then using this trained classifier to detect the requester's traffic data to determine whether it is vulnerability attack traffic. However, this method of detecting vulnerability attack traffic can lead to traffic data that is performing fuzzing vulnerability probing or has not successfully exploited vulnerabilities being classified as vulnerability attack traffic, resulting in a large number of false positives. This causes unknown vulnerability attacks to be overwhelmed by a large number of false positives. Summary of the Invention
[0003] This application aims to address at least one of the technical problems existing in related technologies. To this end, this application proposes a method for detecting vulnerability attack traffic, which can improve the accuracy of detecting vulnerability attack traffic.
[0004] This application also proposes a vulnerability attack traffic detection device.
[0005] This application also proposes an electronic device.
[0006] This application also proposes a computer-readable storage medium.
[0007] The vulnerability attack traffic detection method according to the first aspect of this application includes:
[0008] The first data content of the traffic data is obtained, and the second data content of the response data generated in response to the request for the traffic data is obtained;
[0009] Based on the first data content and the second data content, determine the static characteristics of the traffic data;
[0010] The static features of the traffic data are input into the trained traffic detection model to obtain the vulnerability attack traffic detection results of the traffic data.
[0011] The traffic detection model is trained using the static features of each first traffic data sample.
[0012] The static characteristics of the first traffic data sample are determined based on the data content of the first traffic data sample and the data content of the first response data sample generated in response to the request of the first traffic data sample.
[0013] The vulnerability attack traffic detection method provided in this application determines the static characteristics of traffic data by using the first data content of the traffic data and the second data content of the response data generated in response to the request of the traffic data. The static characteristics of the traffic data are then input into a trained traffic detection model to obtain the vulnerability attack traffic detection result. Thus, when determining whether traffic data is vulnerability attack traffic, the static characteristics formed by the data content of the traffic data and the response data are considered. This overcomes the unavoidable vulnerability testing such as fuzzing and false positives of unsuccessful vulnerability attack traffic that cannot be avoided when only detecting the requester's traffic data, thereby improving the accuracy of vulnerability attack traffic detection.
[0014] According to one embodiment of this application, determining the static characteristics of the traffic data based on the first data content and the second data content includes:
[0015] Generate bidirectional data content based on the first data content and the second data content;
[0016] Vector transformation is performed on each character in the bidirectional data content to determine the static characteristics of the traffic data.
[0017] According to one embodiment of this application, bidirectional data content is generated based on the first data content and the second data content, including:
[0018] If the first data content is determined to exceed N bytes, N bytes are extracted sequentially from the first data content to generate the first target data content; and,
[0019] Extract (MN) bytes sequentially from the second data content to generate the second target data content;
[0020] The bidirectional data content is generated based on the first target data content and the second target data content;
[0021] Where M is the longest byte length allowed as input by the traffic detection model.
[0022] According to one embodiment of this application, it also includes:
[0023] Determining that the first data content does not exceed N bytes, the first target data content is generated based on the first data content; and,
[0024] Extract (Ma) bytes sequentially from the second data content to generate the second target data content;
[0025] Where 'a' represents the number of bytes in the first data content.
[0026] According to one embodiment of this application, the static features of the traffic data are input into a trained traffic detection model to obtain vulnerability attack traffic detection results of the traffic data, including:
[0027] The static features of the traffic data are input into the trained traffic detection model to obtain the traffic score corresponding to the traffic data.
[0028] Based on the comparison between the traffic score and the preset score, the vulnerability attack traffic detection result is obtained.
[0029] According to one embodiment of this application, the first traffic data sample includes normal traffic;
[0030] The method further includes:
[0031] Multiple verification samples are extracted from the static characteristics of each of the normal traffic flows;
[0032] Input each of the aforementioned validation samples into the trained traffic detection model, and determine the average loss and standard deviation of each of the aforementioned validation samples;
[0033] The preset score is determined based on the average loss and the standard deviation.
[0034] According to one embodiment of this application, the traffic detection model includes an attention mechanism model;
[0035] The attention mechanism model includes an encoder, a decoder, and an attention layer, wherein the encoder and decoder include 8 layers of Bi-LSTM;
[0036] The attention mechanism model has a dropout parameter of 0.4 and a batch_size parameter of 128.
[0037] According to one embodiment of this application, the vulnerability attack traffic detection result is obtained based on the comparison result between the traffic score and the preset score, including:
[0038] If the traffic score is determined to be less than the preset score, first metadata of the traffic data and second metadata of the traffic data are obtained.
[0039] Based on the first metadata and the second metadata, the dynamic characteristics of the traffic data are determined;
[0040] The dynamic characteristics of the traffic data are detected using the trained ACGAN model to obtain the vulnerability attack traffic detection results.
[0041] The ACGAN model is trained using the dynamic features of each second flow data sample.
[0042] The dynamic characteristics of the second traffic data sample are determined based on the metadata of the second traffic data sample and the metadata of the second response data sample generated in response to the request of the second traffic data sample.
[0043] According to one embodiment of this application, the ACGAN model includes a residual block constructed by a 3-layer one-dimensional convolutional neural network, an anti-residual block constructed by a 3-layer one-dimensional deconvolutional neural network, and a fully connected neural network.
[0044] The batch_size parameter of the ACGAN model is 128.
[0045] According to one embodiment of this application, it also includes:
[0046] From each second traffic data sample, obtain each first target traffic data sample that is known to be vulnerability attack traffic;
[0047] The dynamic features of each first target traffic data sample are input into the trained GAN model to obtain each extended data.
[0048] Based on the extended data and the dynamic characteristics of the second target traffic data samples known to be normal traffic in each second traffic data sample, the ACGAN model to be trained is trained to obtain the trained ACGAN model.
[0049] The GAN model is trained from multiple training samples extracted from the dynamic features of each first target traffic data sample.
[0050] According to one embodiment of this application, it also includes:
[0051] The session data between the requester and the responder is reassembled to obtain the traffic data sent by the requester and the response data sent by the responder.
[0052] The vulnerability attack traffic detection apparatus according to the second aspect of this application includes:
[0053] The data content acquisition module is used to acquire the first data content of the traffic data and the second data content of the response data generated in response to the request of the traffic data;
[0054] A static feature acquisition module is used to determine the static features of the traffic data based on the first data content and the second data content;
[0055] The vulnerability attack traffic detection module is used to input the static features of the traffic data into the trained traffic detection model to obtain vulnerability attack traffic detection results.
[0056] The traffic detection model is trained using the static features of each first traffic data sample.
[0057] The static characteristics of the first traffic data sample are determined based on the data content of the first traffic data sample and the data content of the first response data sample generated in response to the request of the first traffic data sample.
[0058] An electronic device according to a third aspect of this application includes a processor and a memory storing a computer program, wherein the processor executes the computer program to implement the vulnerability attack traffic detection method described in any of the above embodiments.
[0059] A computer-readable storage medium according to a fourth aspect of this application stores a computer program thereon, which, when executed by a processor, implements the vulnerability attack traffic detection method described in any of the above embodiments.
[0060] A computer program product according to a fifth aspect of this application includes: when the computer program is executed by a processor, it implements the vulnerability attack traffic detection method as described in any of the above embodiments.
[0061] The above-described one or more technical solutions in the embodiments of this application have at least one of the following technical effects:
[0062] By analyzing the first data content of traffic data and the second data content of the response data generated in response to the traffic data request, the static characteristics of the traffic data are determined. These static characteristics are then input into a trained traffic detection model to obtain vulnerability attack traffic detection results. This approach considers the static characteristics formed by the data content of both traffic data and response data when determining whether traffic data is vulnerability attack traffic. This overcomes the unavoidable issues of fuzzing and false positives of unsuccessful vulnerability attack traffic that cannot be avoided when only detecting traffic data, thus improving the accuracy of vulnerability attack traffic detection. Attached Figure Description
[0063] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0064] Figure 1 This is a flowchart illustrating the vulnerability attack traffic detection method provided in the embodiments of this application;
[0065] Figure 2 Yes Figure 1A flowchart for further refining the determination of static features in the vulnerability attack traffic detection method;
[0066] Figure 3 Yes Figure 2 The flowchart for further refining the generation of bidirectional data content in the vulnerability attack traffic detection method;
[0067] Figure 4 Yes Figure 1 The flowchart for further refining the acquisition of vulnerability attack traffic detection results in the vulnerability attack traffic detection method;
[0068] Figure 5 Yes Figure 4 A flowchart for further refining the determination of preset scores in the vulnerability attack traffic detection method;
[0069] Figure 6 Yes Figure 4 The flowchart for further refining the acquisition of vulnerability attack traffic detection results in the vulnerability attack traffic detection method;
[0070] Figure 7 Yes Figure 6 The flowchart for further refining the training of the ACGAN model in the vulnerability attack traffic detection method.
[0071] Figure 8 This is a schematic diagram of the vulnerability attack traffic detection device provided in the embodiments of this application;
[0072] Figure 9 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation
[0073] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0074] The vulnerability attack traffic detection method and apparatus provided in this application will be described in detail and explained through several specific embodiments.
[0075] In one embodiment, a method for detecting vulnerability attack traffic is provided. This method is applied to a server to detect vulnerability attack traffic. The server can be a standalone server or a server cluster composed of multiple servers. It can also be a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence sampling point devices.
[0076] like Figure 1 As shown, the vulnerability attack traffic detection method provided in this embodiment includes:
[0077] Step 101: Obtain the first data content of the traffic data and the second data content of the response data generated in response to the request for the traffic data;
[0078] Step 102: Determine the static characteristics of the traffic data based on the first data content and the second data content;
[0079] Step 103: Input the static features of the traffic data into the trained traffic detection model to obtain the vulnerability attack traffic detection results;
[0080] The traffic detection model is trained using the static features of each first traffic data sample.
[0081] The static characteristics of the first traffic data sample are determined based on the data content of the first traffic data sample and the data content of the first response data sample generated in response to the request of the first traffic data sample.
[0082] By analyzing the first data content of traffic data and the second data content of the response data generated in response to the traffic data request, the static characteristics of the traffic data are determined. These static characteristics are then input into a trained traffic detection model to obtain vulnerability attack traffic detection results. This approach considers the static characteristics formed by the data content of both traffic data and response data when determining whether traffic data is vulnerability attack traffic. This overcomes the unavoidable issues of fuzzing and false positives of unsuccessful vulnerability attack traffic that cannot be avoided when only detecting traffic data, thus improving the accuracy of vulnerability attack traffic detection.
[0083] In one embodiment, when a requester and a responseer establish an HTTP session, the server can probe the HTTP session to obtain the traffic data sent by the requester to the responseer, as well as the response data generated by the responseer based on the request of the traffic data. When obtaining the traffic data and response data, considering that the data uses IP to transmit its segments, and IP does not provide deduplication or guarantee of correct order, to avoid problems such as out-of-order and duplicate data, the session data between the requester and the responseer can be reassembled based on the five-tuple information of the uplink and downlink data to obtain the traffic data sent by the requester and the response data sent by the responseer.
[0084] Uplink data refers to the session data sent from the requester to the responder, while downlink data refers to the session data sent from the responder to the requester. When traffic data or response data needs to be obtained, the session data can be parsed to extract a five-tuple containing the source IP address, source MAC address, source port number, destination port number, and the TCP flag field. This five-tuple information can then be used to identify uplink and downlink data. For uplink data, TCP stream reassembly can be performed based on the parsed five-tuple information to obtain the traffic data. For example, assuming the obtained uplink data is pkt1, the parsed five-tuple information includes source IP address A, destination IP address B, source port number C, destination port number D, and the TCP flag field E. At this point, the 5-tuple information of the uplink data pkt1 is matched with the 5-tuple information recorded in the preset linked list. If the 5-tuple information recorded in a certain preset linked list fb is the same as that of the uplink data pkt1, including source IP address A, destination IP address B, source port number C, destination port number D, and the TCP protocol flag field E, then the preset linked list fb is used as the target linked list. The TCP data segment of the uplink data pkt1 is then placed into this target linked list. When placing the TCP data segment of the uplink data pkt1 into this target linked list, the sequence number of the uplink data pkt1 is compared with the sequence number of the uplink data corresponding to the existing TCP data segment in the target linked list to determine the placement position of the TCP data segment of the uplink data pkt1. For example, if the target linked list contains TCP segments of upstream data pkt2, with sequence number 2 and sequence number 1 of upstream data pkt1, then the TCP segment of upstream data pkt1 is added before the TCP segment of upstream data pkt2. After sorting all TCP segments in the target linked list in ascending order according to the sequence number of each upstream data segment, the traffic data is obtained.
[0085] Similarly, response data can be obtained by reassembling the downlink data using TCP stream reassembly.
[0086] After obtaining traffic and response data through TCP stream reassembly, protocol parsing, such as HTTP protocol parsing, can be performed on the traffic and response data to correctly parse data hidden by protocol misuse. Simultaneously, obfuscation and de-encoding processing is performed on the traffic and response data, such as URL encoding obfuscation, double URL encoding obfuscation, HTML encoding obfuscation, Hex (hexadecimal) escape obfuscation, and octal escape obfuscation, to obtain the first data content of the traffic data and the second data content of the response data.
[0087] After obtaining the first and second data contents, they can be merged to obtain the static features of the traffic data. These static features are then input into a trained traffic detection model for vulnerability attack traffic detection. To ensure that the obtained static features better reflect the inherent characteristics of the traffic data and further improve the accuracy of subsequent vulnerability attack traffic detection results, in one embodiment, as follows... Figure 2 As shown, based on the first data content and the second data content, the static characteristics of the traffic data are determined, including:
[0088] Step 201: Generate bidirectional data content based on the first data content and the second data content;
[0089] Step 202: Perform vector conversion on each character in the bidirectional data content to determine the static characteristics of the traffic data.
[0090] Since the byte sequences of normal traffic and vulnerability attack traffic usually have different inherent characteristics, such as the HTTP protocol byte sequences of normal traffic and vulnerability attack traffic transmitted based on the HTTP protocol have different inherent characteristics, the static characteristics of traffic data can be determined by vector conversion of each byte, so that the obtained static characteristics can better reflect the characteristics of traffic data.
[0091] For example, after obtaining the first data content and the second data content, the first data content is merged with the second data content in the order of first data content first, resulting in bidirectional data content composed of the first and second data content. After obtaining the bidirectional data content, the word2vec method of Skip-gram can be used to perform vector conversion on each character in the bidirectional data content to obtain the character's... 3D feature vectors, where, This indicates the length of the bidirectional data content in characters. (This is after obtaining each character.) After generating the feature vector, the corresponding characters can be replaced with the feature vector to form the static features of the traffic data. The feature vectors of each character in the static features can then be sequentially input into the trained traffic detection model for vulnerability attack traffic detection.
[0092] When traffic detection models perform vulnerability attack traffic detection, they typically limit the length of input bytes, such as 1500 bytes, meaning the static features input to the traffic detection model must be less than 1500 bytes. However, when static features are input into the trained traffic detection model, the feature vectors of each character in the static features are sequentially input. This means that if the initial data content is too long, the input traffic data will have too many feature vectors, and it cannot be guaranteed that the feature vectors of the response data will be sufficient to input into the traffic detection model, affecting the accuracy of subsequent vulnerability attack traffic detection results. Therefore, in one embodiment, as... Figure 3 As shown, bidirectional data content is generated based on the first data content and the second data content, including:
[0093] Step 301: Determine that the first data content exceeds N bytes, and sequentially extract N bytes from the first data content to generate the first target data content; and,
[0094] Step 302: Extract (MN) bytes sequentially from the second data content to generate the second target data content;
[0095] Step 303: Generate the bidirectional data content based on the first target data content and the second target data content;
[0096] Where M is the longest byte length allowed as input by the traffic detection model.
[0097] In one embodiment, after obtaining the first data content and the second data content, the bytes of the first data content are detected to determine whether it exceeds N bytes. N can be set according to actual conditions, such as 2 / 3 of the longest byte length allowed by the traffic detection model. If the first data content is determined to exceed N bytes, it indicates that the first data content is too long. In this case, N bytes are extracted sequentially from the first data content according to the data reading order, and the remaining bytes are discarded to form the first target data content. For example, assuming the longest byte length allowed by the traffic detection model is 1500 and N is 1000, if the first data content exceeds 1000 bytes, the portion exceeding 1000 bytes is discarded to form the first target data content.
[0098] Simultaneously, if the first data content is determined to exceed N bytes, then (MN) bytes of data are extracted from the second data content in the order of data reading as the second target data content. If the second data content has fewer than (MN) bytes, the remaining portion is left blank.
[0099] After obtaining the first target data content and the second target data content, the first target data content is merged with the second target data content in the order of first target data content first and second target data content last, to obtain bidirectional data content composed of the first target data content and the second target data content. Vector conversion is then performed on each character in the bidirectional data content to determine the static characteristics of the traffic data.
[0100] When the first data content exceeds N bytes, N bytes are extracted sequentially from the first data content to generate the first target data content. Then, (MN) bytes are extracted sequentially from the second data content to generate the second target data content. This allows the generation of bidirectional data content using the first and second target data contents. This ensures that the static features generated subsequently using the bidirectional data content simultaneously include the feature vectors of both the first and second target data contents, and that the length of the static features does not exceed the maximum byte length allowed by the traffic detection model. This ensures that the feature vectors input to the traffic detection model include the feature vectors of both traffic data and response data, thereby improving the accuracy of the subsequently obtained vulnerability attack traffic detection results.
[0101] In one embodiment, if it is determined that the first data content does not exceed N bytes, it means that the first data content does not exceed the limited length. In this case, the first data content can be directly marked as the first target data content. At the same time, the number of bytes 'a' of the first data content is obtained. Based on the maximum allowed byte length M of the traffic detection model and the number of bytes 'a' of the first data content, the number of bytes (Ma) to be extracted from the second data content is determined. Then, (Ma) bytes of data are extracted from the second data content in the order of data reading as the second target data content. If the number of bytes in the second data content is less than (Ma) bytes, the remaining part is left blank. Then, the first target data content and the second target data content are merged in the order of the first target data content first and the second target data content last to obtain bidirectional data content composed of the first target data content and the second target data content. Vector conversion is then performed on each character in the bidirectional data content to determine the static characteristics of the traffic data.
[0102] After determining the static characteristics of the traffic data, these characteristics can be input into the trained traffic detection model. This traffic detection model can be used as a deep learning classifier to distinguish between normal application traffic and vulnerability attack traffic.
[0103] Training the traffic detection model can begin by acquiring traffic data known to be vulnerability attack traffic, or traffic known to be normal traffic, as the first traffic data sample. Normal traffic refers to traffic data that has not been used for vulnerability attacks. The response data to the request in response to this traffic data is then used as the first response data sample. Based on the data content of the first traffic data sample and the data content of the first response data sample, the static features of the first traffic data sample are obtained. The acquisition of the static features of the first traffic data sample can be the same as the acquisition process for the static features of the traffic data itself; both involve generating bidirectional data content based on the data content of the first traffic data sample and the data content of the first response data sample, and then performing vector transformation on each character in the bidirectional data content to determine the static features of the first traffic data sample. Similarly, the generation process for the bidirectional data content corresponding to the traffic data is the same; the bidirectional data content corresponding to the first traffic data sample can also be determined by detecting whether the data content of the first traffic data sample exceeds N bytes. If the number of bytes exceeds the limit, then N bytes are extracted sequentially from the data content of the first traffic data sample, and (MN) bytes are extracted sequentially from the data content of the first response data sample. The extracted N bytes and (MN) bytes are then merged to generate the bidirectional data content corresponding to the first traffic data sample. If the number of bytes does not exceed the limit, then the data content of the first traffic data sample and the (Ma) bytes extracted sequentially from the data content of the first response data sample are merged to generate the bidirectional data content corresponding to the first traffic data sample.
[0104] After obtaining the static features of each first traffic data sample, the static features of each first traffic data sample are input into the traffic detection model for training. During the training process, the static features of each first traffic data sample are used as input to the traffic detection model in batches. Through multiple iterations, the parameters are continuously optimized to form the final traffic detection model.
[0105] The traffic detection model can be an attention mechanism model, such as the SEQ2SEQ model based on an attention mechanism. This attention mechanism model includes an encoder, a decoder, and an attention layer. Both the encoder and decoder use an 8-layer Bi-LSTM (Bidirectional Long Short-Term Memory) network. The dropout parameter of the attention mechanism model is uniformly set to 0.4, and the batch size is set to 128. The decoder receives the output of the fully connected layer of the encoder, processes it using an AT (autoregressive) method, then passes it through the attention layer, and finally uses the output of the fully connected layer. Testing showed that, with other variables remaining constant, the traffic detection model constructed using this method achieved the best training performance and was more accurate in detecting both normal traffic and vulnerability attack traffic.
[0106] To ensure the accuracy of a traffic detection model, a large amount of sample data is required for training. However, the amount of exploit traffic data that is readily available is relatively small. If the traffic detection model is trained using this available data, the training effect will be negatively impacted due to the insufficient amount of exploit traffic data. Therefore, in one embodiment, the first traffic data sample used for training the traffic detection model can be readily available normal traffic. This allows the traffic detection model to detect whether the input traffic data is normal after being trained on a large amount of normal traffic.
[0107] Among them, such as Figure 4 As shown, the methods for processing traffic data using a trained traffic detection model can include:
[0108] Step 401: Input the static features of the traffic data into the trained traffic detection model to obtain the traffic score corresponding to the traffic data;
[0109] Step 402: Obtain the vulnerability attack traffic detection result based on the comparison result between the traffic score and the preset score.
[0110] In one embodiment, the output of the traffic detection model is a traffic score used to evaluate whether the input data is normal data. After inputting the static features of the traffic data into the trained traffic detection model and obtaining the traffic score corresponding to the traffic data, the traffic score corresponding to the traffic data is compared with a pre-set preset score to obtain the comparison result.
[0111] To ensure the reliability of the comparison results, in one embodiment, such as Figure 5 As shown, the methods for determining the preset score include:
[0112] Step 501: Extract multiple verification samples from the static features of each of the normal traffic flows;
[0113] Step 502: Input each of the verification samples into the trained traffic detection model and determine the average loss and standard deviation of each of the verification samples;
[0114] Step 503: Determine the preset score based on the average loss and the standard deviation.
[0115] In one embodiment, when training the traffic detection model using first traffic data samples known to be normal traffic, the static features of each first traffic data sample can be grouped according to a preset ratio, such as 8:1:1. 80% of the static features of the first traffic data samples are used as training samples, 10% are used as training samples to verify the training effect of the traffic detection model, and 10% are used as test samples for performance testing after the traffic detection model has been trained. After training the traffic detection model using the training samples, each verification sample is input into the trained traffic detection model as a verification set. The mean loss and standard deviation (std_loss) of the verification samples are calculated, and the threshold (thres) for normal data is obtained using the formula: thres = mean_loss + 0.5 * std_loss. Here, C is the threshold parameter, which defaults to 0.5 but can be adjusted through testing based on specific data conditions. The threshold (thres) is a preset score used to determine whether the input data traffic is normal traffic. After determining the preset score, the training results of the traffic detection model can be tested using each test sample.
[0116] By using static features of a portion of normal traffic as validation samples, the trained traffic detection model is used to determine the average loss and standard deviation of each validation sample. Based on the average loss and standard deviation of each validation sample, a preset score is determined, thereby making the obtained preset score more reflective of the characteristics of normal traffic and improving the reliability of subsequent comparisons between traffic scores and preset scores.
[0117] When comparing the traffic score with the preset score, if the traffic score is greater than or equal to the preset score, it means that the traffic data meets the requirements of normal traffic, and the traffic data can be determined to be normal traffic. Otherwise, it means that the traffic data does not meet the requirements of normal traffic, and the traffic data can be determined to be vulnerability attack traffic.
[0118] Considering that the generalization ability is difficult to guarantee when judging the vulnerability attack traffic detection results using only static features, in order to make the detection basis more complete and further improve the accuracy of the obtained vulnerability attack traffic detection results, in one embodiment, such as Figure 6 As shown, based on the comparison result between the traffic score and the preset score, the vulnerability attack traffic detection result is obtained, including:
[0119] Step 601: Determine that the traffic score is less than the preset score, and obtain the first metadata of the traffic data and the second metadata of the response data;
[0120] Step 602: Determine the dynamic characteristics of the traffic data based on the first metadata and the second metadata;
[0121] Step 603: Detect the dynamic features of the traffic data based on the trained ACGAN model to obtain the vulnerability attack traffic detection results;
[0122] The ACGAN model is trained using the dynamic features of each second flow data sample.
[0123] The dynamic characteristics of the second traffic data sample are determined based on the metadata of the second traffic data sample and the metadata of the second response data sample generated in response to the request of the second traffic data sample.
[0124] In one embodiment, when the traffic score is determined to be less than a preset score, the packet timestamp and data length information of the traffic data are extracted from the traffic data. Statistical features such as median and variance are calculated, and these statistical features are determined as the first metadata of the traffic data. Similarly, the second metadata of the traffic data can be obtained.
[0125] After obtaining the first and second metadata, they are merged to obtain the dynamic behavioral characteristics representing the TCP session between the requester and responder. These dynamic behavioral characteristics are the dynamic features of the traffic data. Once the dynamic features of the traffic data are obtained, they can be input into the trained ACGAN model. The ACGAN model is constructed from a generative model G, a discriminative model D, and a classification model C. Each generated sample has a corresponding class label c, and the real source of each sample is S. In the generative model G, label variables are used to enhance the similarity between the generated data and the real data; that is, the class label is used as conditional information, and random noise z forms a joint hidden layer representation (z|c), which is used as input to G to generate pseudo-samples X. fake D discriminates X fake The authenticity of the sample is determined. The discriminant model D is used to provide the probability distribution of the input sample X on the real source S, and its probability of judging the sample as real is P. real The probability of identifying a fake sample is P. fake The classification model C is used to provide the probability distribution of the input sample X on the class label c, and the probability of classifying the sample as the true class is Ctrue. real The probability of identifying a fake sample is C. fakeThe goal of the generative model G is to minimize the loss between real and fake samples, the goal of the classification model C is to maximize the accurate probability of detecting the true class of the input sample, and the goal of the discriminative model D is to maximize the accurate probability of identifying the true source of the input sample. Therefore, through continuous adversarial training, a Nash equilibrium is reached, and the optimal parameters of the generative, discriminative, and classification models are finally determined. The generative model can generate fake samples that the discriminative model cannot distinguish, and the classification model can directly and accurately classify the input samples.
[0126] To ensure the ACGAN model can consistently improve performance by increasing the number of layers while avoiding gradient loss issues, the ACGAN model comprises a residual block built from three 1D convolutional neural networks, an anti-residual block built from three 1D deconvolutional neural networks, and a fully connected neural network. The residual block from the three 1D convolutional neural networks and the one fully connected neural network are used to build the discriminative and classification models of the ACGAN model. The generative model's network architecture is the inverse operation of the discriminative model's architecture, built using three anti-residual blocks and one fully connected neural network. The batch_size parameter of the ACGAN model can be set to 128, using the leaky ReLU activation function, and performing one-sided smoothing on the class labels.
[0127] When training the ACGAN model, the dynamic features of each second traffic data sample, whose nature is known to be vulnerability attack traffic, are used as input to the ACGAN model. Through multiple iterations, the parameters are continuously optimized to form a trained ACGAN model. The acquisition of the dynamic features of the second traffic data samples is the same as the acquisition of the dynamic features of the traffic data itself; both involve merging the metadata of the acquired second traffic data sample with the metadata of the second response data sample generated in response to the request for that second traffic data sample to obtain the dynamic features of the second traffic data sample.
[0128] Each second traffic data sample includes normal traffic and vulnerability attack traffic. However, in practical applications, it is difficult to obtain a large amount of vulnerability attack traffic, resulting in a relatively small amount of vulnerability attack traffic data in each second traffic data sample, often failing to meet the basic requirements for model training. Therefore, in one embodiment, as... Figure 7 As shown, the training of the ACGAN model includes:
[0129] Step 701: Obtain each first target traffic data sample known to be vulnerability attack traffic from each second traffic data sample;
[0130] Step 702: Input the dynamic features of each first target traffic data sample into the trained GAN model to obtain each extended data;
[0131] Step 703: Based on each extended data and the dynamic characteristics of each second target traffic data sample known as normal traffic in each second traffic data sample, train the ACGAN model to be trained and obtain the trained ACGAN model.
[0132] The GAN model is trained from multiple training samples extracted from the dynamic features of each first target traffic data sample.
[0133] In one embodiment, the GAN model consists of a generator model G and a discriminator model D. The generator G consists of a 1-layer fully connected network and 3-layer residual blocks, where the 3-layer residual blocks are constructed from 3 layers of conv1D. The discriminator D consists of 3-layer residual blocks and a 1-layer fully connected layer. The rated batch_size parameter of the GAN model can be set to 128, and the leaky ReLU activation function is used. When training the GAN model, all second traffic data samples known to be vulnerability attack traffic are obtained from each second traffic data sample known to be vulnerability attack traffic as first target traffic data samples. Then, according to a preset ratio, a portion of dynamic features are extracted from the dynamic features of each first target traffic data sample as training samples. The GAN model is iteratively trained using each training sample to optimize the parameters of the GAN model and obtain a trained GAN model.
[0134] After training the GAN model, the first target traffic data samples are input into the trained GAN model for data augmentation to obtain augmented data with the same number of dynamic features as the second target traffic data samples. Then, 80% of the dataset, consisting of the augmented data and the dynamic features of the second target traffic data samples, along with labels indicating whether the traffic is a vulnerability attack, is randomly selected as input to train the ACGAN model. The remaining 20% is further divided equally into a validation set and a test set. The validation set is used for model validation during training, and the test set is used for performance testing after model training.
[0135] By inputting data samples known to be vulnerability attack traffic into the trained GAN model to expand it, and obtaining various expanded data, the ACGAN model is then trained based on the dynamic characteristics of each expanded data and data samples known to be normal traffic. This ensures that there is sufficient vulnerability attack traffic to train the ACGAN model, thereby improving the accuracy of the trained ACGAN model.
[0136] After training the ACGAN model, it can be used to detect dynamic features of traffic data with traffic scores lower than the preset score. Alternatively, the dynamic features of the traffic data can be directly input into the trained ACGAN model to output vulnerability attack traffic detection results targeting that traffic data.
[0137] If the ACGAN model still determines that the traffic data is vulnerability attack traffic, then the vulnerability attack traffic detection result of the traffic data is determined to be vulnerability attack traffic, and an alarm message is generated; otherwise, the vulnerability attack traffic detection result of the traffic data is determined to be normal traffic.
[0138] The vulnerability attack traffic detection device provided in this application is described below. The vulnerability attack traffic detection device described below can be referred to in correspondence with the vulnerability attack traffic detection method described above.
[0139] In one embodiment, such as Figure 8 As shown, a vulnerability attack traffic detection device is provided, comprising:
[0140] The data content acquisition module 210 is used to acquire the first data content of traffic data and the second data content of response data generated in response to the request of the traffic data;
[0141] The static feature acquisition module 220 is used to determine the static features of the traffic data based on the first data content and the second data content;
[0142] The vulnerability attack traffic detection module 230 is used to input the static features of the traffic data into the trained traffic detection model to obtain vulnerability attack traffic detection results.
[0143] The traffic detection model is trained using the static features of each first traffic data sample.
[0144] The static characteristics of the first traffic data sample are determined based on the data content of the first traffic data sample and the data content of the first response data sample generated in response to the request of the first traffic data sample.
[0145] By analyzing the first data content of traffic data and the second data content of the response data generated in response to the traffic data request, the static characteristics of the traffic data are determined. These static characteristics are then input into a trained traffic detection model to obtain vulnerability attack traffic detection results. This approach considers the static characteristics formed by the data content of both traffic data and response data when determining whether traffic data is vulnerability attack traffic. This overcomes the unavoidable issues of fuzzing and false positives of unsuccessful vulnerability attack traffic that cannot be avoided when only detecting traffic data, thus improving the accuracy of vulnerability attack traffic detection.
[0146] In one embodiment, the static feature acquisition module 220 is specifically used for:
[0147] Generate bidirectional data content based on the first data content and the second data content;
[0148] Vector transformation is performed on each character in the bidirectional data content to determine the static characteristics of the traffic data.
[0149] In one embodiment, the static feature acquisition module 220 is specifically used for:
[0150] If the first data content is determined to exceed N bytes, N bytes are extracted sequentially from the first data content to generate the first target data content; and,
[0151] Extract (MN) bytes sequentially from the second data content to generate the second target data content;
[0152] The bidirectional data content is generated based on the first target data content and the second target data content;
[0153] Where M is the longest byte length allowed as input by the traffic detection model.
[0154] In one embodiment, the static feature acquisition module 220 is further configured to:
[0155] Determining that the first data content does not exceed N bytes, the first target data content is generated based on the first data content; and,
[0156] Extract (Ma) bytes sequentially from the second data content to generate the second target data content;
[0157] Where 'a' represents the number of bytes in the first data content.
[0158] In one embodiment, the vulnerability attack traffic detection module 230 is specifically used for:
[0159] The static features of the traffic data are input into the trained traffic detection model to obtain the traffic score corresponding to the traffic data.
[0160] Based on the comparison between the traffic score and the preset score, the vulnerability attack traffic detection result is obtained.
[0161] In one embodiment, the first traffic data sample includes normal traffic;
[0162] The vulnerability attack traffic detection module 230 is also used for:
[0163] Multiple verification samples are extracted from the static characteristics of each of the normal traffic flows;
[0164] Input each of the aforementioned validation samples into the trained traffic detection model, and determine the average loss and standard deviation of each of the aforementioned validation samples;
[0165] The preset score is determined based on the average loss and the standard deviation.
[0166] In one embodiment, the traffic detection model includes an attention mechanism model;
[0167] The attention mechanism model includes an encoder, a decoder, and an attention layer, wherein the encoder and decoder include 8 layers of Bi-LSTM;
[0168] The attention mechanism model has a dropout parameter of 0.4 and a batch_size parameter of 128.
[0169] In one embodiment, the vulnerability attack traffic detection module 230 is specifically used for:
[0170] If the traffic score is determined to be less than the preset score, first metadata of the traffic data and second metadata of the traffic data are obtained.
[0171] Based on the first metadata and the second metadata, the dynamic characteristics of the traffic data are determined;
[0172] The dynamic characteristics of the traffic data are detected using the trained ACGAN model to obtain the vulnerability attack traffic detection results.
[0173] The ACGAN model is trained using the dynamic features of each second flow data sample.
[0174] The dynamic characteristics of the second traffic data sample are determined based on the metadata of the second traffic data sample and the metadata of the second response data sample generated in response to the request of the second traffic data sample.
[0175] In one embodiment, the ACGAN model includes a residual block constructed from three layers of one-dimensional convolutional neural networks, an anti-residual block constructed from three layers of one-dimensional deconvolutional neural networks, and a fully connected neural network.
[0176] The batch_size parameter of the ACGAN model is 128.
[0177] In one embodiment, the vulnerability attack traffic detection module 230 is further configured to:
[0178] From each second traffic data sample, obtain each first target traffic data sample that is known to be vulnerability attack traffic;
[0179] The dynamic features of each first target traffic data sample are input into the trained GAN model to obtain each extended data.
[0180] Based on the extended data and the dynamic characteristics of the second target traffic data samples known to be normal traffic in each second traffic data sample, the ACGAN model to be trained is trained to obtain the trained ACGAN model.
[0181] The GAN model is trained from multiple training samples extracted from the dynamic features of each first target traffic data sample.
[0182] In one embodiment, the data content acquisition module 210 is further configured to:
[0183] The session data between the requester and the responder is reassembled to obtain the traffic data sent by the requester and the response data sent by the responder.
[0184] Figure 9 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 9 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other via the communication bus 840. The processor 810 can call a computer program in the memory 830 to execute a vulnerability attack traffic detection method, such as including:
[0185] The first data content of the traffic data is obtained, and the second data content of the response data generated in response to the request for the traffic data is obtained;
[0186] Based on the first data content and the second data content, determine the static characteristics of the traffic data;
[0187] The static features of the traffic data are input into the trained traffic detection model to obtain the vulnerability attack traffic detection results of the traffic data.
[0188] The traffic detection model is trained using the static features of each first traffic data sample.
[0189] The static characteristics of the first traffic data sample are determined based on the data content of the first traffic data sample and the data content of the first response data sample generated in response to the request of the first traffic data sample.
[0190] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0191] On the other hand, embodiments of this application also provide a storage medium, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the vulnerability attack traffic detection methods provided in the above embodiments, such as including:
[0192] The first data content of the traffic data is obtained, and the second data content of the response data generated in response to the request for the traffic data is obtained;
[0193] Based on the first data content and the second data content, determine the static characteristics of the traffic data;
[0194] The static features of the traffic data are input into the trained traffic detection model to obtain the vulnerability attack traffic detection results of the traffic data.
[0195] The traffic detection model is trained using the static features of each first traffic data sample.
[0196] The static characteristics of the first traffic data sample are determined based on the data content of the first traffic data sample and the data content of the first response data sample generated in response to the request of the first traffic data sample.
[0197] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0198] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.
Claims
1. A method of detecting exploit traffic, the method comprising: include: The first data content of the traffic data is obtained, and the second data content of the response data generated in response to the request for the traffic data is obtained; The first data content and the second data content are merged to obtain the static characteristics of the traffic data; The static features of the traffic data are input into the trained traffic detection model to obtain the traffic score corresponding to the traffic data. If the traffic score is determined to be less than a preset score, the first metadata of the traffic data and the second metadata of the response data are merged to obtain the dynamic characteristics of the traffic data; The dynamic characteristics of the traffic data are detected using the trained ACGAN model to obtain the vulnerability attack traffic detection results. The traffic detection model is trained using the static features of each first traffic data sample. The static characteristics of the first traffic data sample are obtained by combining the data content of the first traffic data sample and the data content of the first response data sample generated in response to the request of the first traffic data sample. Based on the first data content and the second data content, the static characteristics of the traffic data are determined, including: If the first data content is determined to be more than N bytes, N bytes are extracted from the first data content in the order of data reading to generate the first target data content, and (MN) bytes are extracted from the second data content in the order of data reading to generate the second target data content. The first target data content is merged with the second target data content in the order of first target data content first and second target data content last, to obtain bidirectional data content composed of the first target data content and the second target data content; Perform vector transformation on each character in the bidirectional data content to determine the static characteristics of the traffic data; Where N is 2 / 3 of the longest byte length allowed by the traffic detection model, and M is the longest byte length allowed by the traffic detection model.
2. The method of claim 1, wherein, Also includes: Determine that the first data content does not exceed N bytes, and generate the first target data content based on the first data content; as well as, Extract (Ma) bytes sequentially from the second data content to generate the second target data content; Where 'a' represents the number of bytes in the first data content.
3. The method of claim 1, wherein, The first traffic data sample includes normal traffic; The method further includes: Multiple verification samples are extracted from the static characteristics of each of the normal traffic flows; Input each of the aforementioned validation samples into the trained traffic detection model, and determine the average loss and standard deviation of each of the aforementioned validation samples; The preset score is determined based on the average loss and the standard deviation.
4. The vulnerability attack traffic detection method according to claim 1 or 3, characterized by, The traffic detection model includes an attention mechanism model; The attention mechanism model includes an encoder, a decoder, and an attention layer, wherein the encoder and decoder include 8 layers of Bi-LSTM; The attention mechanism model has a dropout parameter of 0.4 and a batch_size parameter of 128.
5. The method of claim 1, wherein, The ACGAN model is trained using the dynamic features of each second flow data sample; The dynamic characteristics of the second traffic data sample are determined based on the metadata of the second traffic data sample and the metadata of the second response data sample generated in response to the request of the second traffic data sample.
6. The method of detecting exploit traffic according to claim 5, wherein, The ACGAN model includes a residual block constructed from three layers of one-dimensional convolutional neural networks, an anti-residual block constructed from three layers of one-dimensional deconvolutional neural networks, and a fully connected neural network. The batch_size parameter of the ACGAN model is 128.
7. The method of claim 5, wherein, Also includes: From each second traffic data sample, obtain each first target traffic data sample that is known to be vulnerability attack traffic; The dynamic features of each first target traffic data sample are input into the trained GAN model to obtain each extended data. Based on the extended data and the dynamic characteristics of the second target traffic data samples known to be normal traffic in each second traffic data sample, the ACGAN model to be trained is trained to obtain the trained ACGAN model. The GAN model is trained from multiple training samples extracted from the dynamic features of each first target traffic data sample.
8. The method of claim 1, wherein, Also includes: The session data between the requester and the responder is reassembled to obtain the traffic data sent by the requester and the response data sent by the responder.
9. A vulnerability attack traffic detection apparatus characterized by comprising: include: The data content acquisition module is used to acquire the first data content of the traffic data and the second data content of the response data generated in response to the request of the traffic data; The static feature acquisition module is used to merge the first data content and the second data content to obtain the static features of the traffic data; The vulnerability attack traffic detection module is used to input the static features of the traffic data into a trained traffic detection model, obtain the traffic score corresponding to the traffic data, and merge the first metadata of the traffic data and the second metadata of the response data when the traffic score is determined to be less than a preset score, to obtain the dynamic features of the traffic data, so as to detect the dynamic features of the traffic data according to the trained ACGAN model and obtain the vulnerability attack traffic detection result. The traffic detection model is trained using the static features of each first traffic data sample. The static characteristics of the first traffic data sample are obtained by combining the data content of the first traffic data sample and the data content of the first response data sample generated in response to the request of the first traffic data sample. The static feature acquisition module is specifically used for: If the first data content is determined to be more than N bytes, N bytes are extracted from the first data content in the order of data reading to generate the first target data content, and (MN) bytes are extracted from the second data content in the order of data reading to generate the second target data content. The first target data content is merged with the second target data content in the order of first target data content first and second target data content last, to obtain bidirectional data content composed of the first target data content and the second target data content; Perform vector transformation on each character in the bidirectional data content to determine the static characteristics of the traffic data; Where N is 2 / 3 of the longest byte length allowed by the traffic detection model, and M is the longest byte length allowed by the traffic detection model.
10. An electronic device comprising a processor and a memory having a computer program stored therein, characterized in that, When the processor executes the computer program, it implements the vulnerability attack traffic detection method according to any one of claims 1 to 8.
11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the vulnerability attack traffic detection method according to any one of claims 1 to 8.