Early and accurate identification method for fine-grained behavior of malicious Trojans for persistent connections

Abstract

This invention provides a method for early and accurate identification of fine-grained malicious Trojan behavior in persistent connections. The specific steps include: extracting the packet length sequence, direction sequence, and time sequence of fine-grained attack traffic from persistent encrypted malicious Trojans, and inputting these sequences into a fine-grained behavior segmentation module to accurately identify attack behavior segmentation points; reconstructing the packet sequence containing complete behavior segments into TLS Fragments, selecting the first n TLS Fragments, and extracting m stable features from each to form an [n×m, 1]-dimensional sequence feature vector; and inputting the n-TLS Fragment stable feature sequence into a 1D-CNN classifier for training to identify fine-grained attack behavior. This invention can accurately segment attack behavior segments in persistent encrypted malicious Trojan traffic without relying on human experience; it can accurately identify fine-grained malicious Trojan attack behavior at an early stage; and the proposed stable TLS Fragment features are applicable to fine-grained behavior identification scenarios with network volatility.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security technology and relates to a method for early and accurate identification of fine-grained malicious Trojan behavior for persistent connections. Background Technology

[0002] With the development of encryption technology, an increasing number of malicious Trojans are using encryption protocols such as TLS / SSL to conceal their fine-grained malicious attack actions, such as stealing user information and spying on user interfaces. While encryption technology provides data security and attack cover for network attackers, it also brings new challenges to my country's cybersecurity supervision. Therefore, how to conduct refined identification of malicious Trojan attack behavior in encrypted traffic environments with dynamic networks and covert attack patterns has become a hot topic in current international research.

[0003] Compared to identifying the type of malicious Trojan, identifying fine-grained attack behaviors of malicious Trojans is more challenging. Most malicious Trojans are created and distributed by different attackers using unique injection methods and communication encodings; therefore, different malicious Trojan traffic may exhibit relatively obvious classification characteristics in the early stages of communication. However, fine-grained attack behaviors within the same malicious Trojan may use the same communication pattern. During the execution of fine-grained behaviors, they mostly manifest as data interactions between the attacker and the victim, making it difficult to extract distinctive traffic features. Furthermore, the dynamic nature of network environments adds to the difficulty of this fine-grained identification work.

[0004] In recent years, both domestically and internationally, the identification of fine-grained attacks by malicious Trojans has largely focused on delayed identification methods such as security log event analysis and attack API sequence matching. These methods can only identify the attacks after they have been executed, making it difficult to deploy targeted security solutions in the early stages. Encrypted traffic analysis has also been gradually applied to fine-grained behavior identification research. These methods mainly extract the features of encrypted traffic generated during the execution of attacks, including flow spatiotemporal features or mixed data packet features. The above methods can obtain relatively accurate fine-grained behavior identification results, but the existing methods have the following main problems: (1) For persistent malicious Trojans, simply using flow spatiotemporal features cannot achieve behavior identification because a single flow contains multiple data packet sequences generated by continuous attack behaviors; (2) In environments with network dynamics, it is difficult to extract stable and distinguishable early fine-grained behavior features in the early stages of behavior execution, making it impossible to achieve early and accurate identification of fine-grained attack behaviors.

[0005] Therefore, in order to achieve early and accurate identification of fine-grained attacks by persistent malicious Trojans, this invention identifies the behavior segmentation points of the traffic of persistent malicious Trojans' fine-grained attacks to obtain the complete fine-grained behavior segments. It then reconstructs TLS Fragments from the data packet sequences containing the fine-grained behavior segments and extracts early, stable, and distinguishable features of the n-TLS Fragments. Based on a 1D-CNN neural network, it achieves early and accurate identification of fine-grained malicious Trojan attacks. Summary of the Invention

[0006] To strengthen the supervision of cyberspace security and achieve accurate identification of fine-grained malicious Trojan attacks in dynamic network traffic environments, this invention proposes an early and accurate identification method for fine-grained malicious Trojan behavior in persistent connections. For fine-grained attack traffic from persistent encrypted malicious Trojans, the packet length sequence, direction sequence, and time sequence are extracted and input into a fine-grained behavior segmentation module to accurately identify attack behavior segmentation points. The packet sequence containing the complete behavior segment is reconstructed into a TLS Fragment. The first n TLS Fragments are selected, and m stable features are extracted from each to form an [n×m, 1]-dimensional sequence feature vector. Finally, the n-TLS Fragment stable feature sequence is input into a 1D-CNN classifier for training to identify fine-grained attack behavior.

[0007] To achieve the above objectives, the present invention provides the following technical solution:

[0008] A method for early and accurate identification of fine-grained malicious Trojan behavior for persistent connections includes the following steps:

[0009] (1) Extract the packet length sequence, packet direction sequence and packet timestamp sequence from the fine-grained attack traffic of the persistently connected encrypted malicious Trojan, and input them into the fine-grained behavior segmentation module to accurately identify the attack behavior segmentation point;

[0010] (2) Extract fine-grained attack behavior segments based on the segmentation points identified in step (1), restore the data packet sequence containing the behavior segments to the TLS Fragment sequence, and select the first n TLS Fragments as early samples of fine-grained attack behavior.

[0011] (3) Extract m statistical features from the n-TLS Fragment in step (2) and form an [n×m,1]-dimensional feature vector as an early identification fingerprint of fine-grained attack behavior;

[0012] (4) Input the n-TLS Fragment stable feature vector from step (3) into the 1D-CNN neural network for training;

[0013] (5) After training for an appropriate number of rounds, output a fine-grained attack behavior early identification model based on the stable features of n-TLS Fragment to accurately identify the fine-grained attack behavior categories of encrypted malicious Trojans.

[0014] Furthermore, step (1) specifically includes the following sub-steps:

[0015] (1.1) Capture (T1~T N The fine-grained attack traffic F(T1,T) of encrypted malicious Trojans within the time interval N )=

[0016] {frag1,frag2,frag3,..,frag N}, where frag N Let F represent the sequence of data packets containing the Nth attack segment, and let F represent a single stream with identical 5-tuples. A single encrypted stream F of a persistently connected malicious Trojan contains N consecutive and unseparated sequences of fine-grained attack packets.

[0017] (1.2) Based on the sliding window algorithm, extract the packet length sequence {tcp_len1,tcp_len2,...,tcp_len} of the traffic F of the above continuous attack behavior. M}, data packet direction sequence {d1,d2,..,d M}, the data packet timestamp sequence {T1,T2,..,T} M}, where tcp_len M T represents the TCP length of the Mth data packet. M This represents the arrival timestamp of the Mth data packet. The packet direction is defined as follows:

[0018]

[0019] (1.3) Calculate the values ​​of S on both sides of the sliding window respectively. L ,S R The packet length-direction-timestamp probability distribution of the attack traffic F is calculated, and the KL divergence value within the window is calculated based on the relative entropy (Kullback–Leibler, KL) algorithm. The sliding window is moved with a step size t and the KL divergence value within the window is calculated sequentially to obtain the similarity sequence of continuous fine-grained attack traffic F.

[0020] (1.4) The KL divergence value sequence is optimized by interpolation based on the piecewise cubic Hermit interpolation algorithm. Some interference values ​​are removed by setting the KL threshold, and the data packet index and timestamp of the maximum value are saved.

[0021] (1.5) The data packets corresponding to the index value and timestamp obtained in step (1.4) are the segmentation points of continuous fine-grained attack behavior segments. The behavior segment segmentation is accurately achieved through the pseudo segmentation point fusion algorithm.

[0022] Further, in step (1.2), the sliding window size is L (number of data packets), and the points in the window divide a continuous sequence of data packets within the window into left and right parts (S). L ,S R ).

[0023] Furthermore, step (1.3) specifically includes the following sub-steps:

[0024] (1.3.1) Calculate the discrete probability distribution of the data packet length sequence CDF on both sides of the sliding window. Discrete probability distribution of data packet direction sequence (CDF) and the discrete probability distribution of data packet timestamp sequences (CDF) The CDF discrete probability distribution is calculated as follows:

[0025]

[0026]

[0027] Where P represents the Poisson distribution, and S represents the CDF discrete probability distribution. n Let λ be the feature value of the nth data packet, such as length / direction / timestamp, e be the Euler number, and x be the probability variable.

[0028] (1.3.2) Calculate the KL divergence value for the above probability distributions based on the relative entropy algorithm to quantify the left and right windows S. L ,S R The similarity of the data packet sequence distribution. The calculation method is as follows:

[0029]

[0030]

[0031]

[0032] Where D(S) L ||S R ) indicates the left and right side windows (S) L ,S R The KL divergence value of ), where N represents the number of data packets in the window.

[0033] (1.3.3) Taking into account the KL divergence values ​​of three dimensions—data packet length, direction, and timestamp—and calculating the similarity Sim(S) on both sides of the sliding window. L ,S R The calculation method is as follows:

[0034]

[0035] Where i represents the i-th sliding window. The above formula yields the similarity sequence {Sim1, Sim2, ..., Sim...} of consecutive fine-grained attack behavior segments. n}, where n represents the number of sliding windows.

[0036] Furthermore, in step (1.4), the similarity sequence {Sim1,Sim2,...,Sim...} of the continuous fine-grained attack behavior segments obtained in step (1.3) is... n The interpolation optimization process is performed, and the interpolation calculation method is as follows:

[0037]

[0038] Where sim x This represents the value of the x-th node, which satisfies sim x ∈[Sim k-1 Sim k Sim k s represents the k-th similarity value. k (sim x This indicates that the interpolation condition (two nodes Sim) is met. k-1 Sim k A cubic polynomial whose function value and derivative value at a given point are equal to those of the original function.

[0039] Furthermore, in step (1.4), the local maxima (x, y) of the interpolation polynomial H(x) are calculated, all local maxima y are counted, and the non-zero mode y is calculated. threshold If the value is used as a threshold to filter fluctuation points x and the filtered x is saved, then point x is the corresponding fine-grained behavior segment segment of the persistently connected encrypted malicious Trojan. The corresponding data packet index and timestamp are saved.

[0040] Furthermore, step (1.5) specifically includes the following sub-steps:

[0041] (1.5.1) Based on the initially obtained sequence of split points {s1, s2, ..., s...} n Extract the fine-grained behavior segments corresponding to the segmentation points;

[0042] (1.5.2) Same as steps (1.3.1)-(1.3.3), calculate the behavior segment (frak ,fra k+1 Similarity value Where fra k For the dividing point (s) k ,s k+1 The extracted data packet sequence, k∈[1,n-1];

[0043] (1.5.3) When Less than or equal to y threshold At that time, it is considered as s k+1 This is a pseudo-segmentation point, and it is removed from the segmentation point sequence. Simultaneously, the behavior segments (fra) are merged. k ,fra k+1 ) for fra k ;

[0044] (1.5.4)k is continuously shifted to the right, and steps (1.5.1)-(1.5.3) are repeated until all the segmentation point sequences are traversed, and a new segmentation point sequence after merging the pseudo segmentation points is generated.

[0045] Further, in step (2), the corresponding fine-grained attack behavior segments {fra1,fra2,..,fra1,fra2,fra3,fra4,fra5,fra6,fra7,fra8,fra9,fra1,fra2 ... k}, which restores the packet sequence of each action segment to a TLS Fragment sequence.

[0046] Furthermore, the TLS Fragment restoration algorithm in step (2) specifically includes the following sub-steps:

[0047] (2.1) Iterate through fra sequentially i The sequence of data packets {packet1, packet2, ..., packet...} n Extract the Seq sequence number, Ack response number, and Len packet length for each data packet;

[0048] (2.2) When the data packet m ,packet m+1 )satisfy

[0049] packet m .Seq+packet m .Len = packet m+1 .Ack, and satisfies packet m .Ack = packet m+1 When using .Seq, (packet) m ,packet m+1 For the same TLS Fragment, set packetm+1 .Seq = packet m+2 .Ack, from the packet m+2 Continue iterating;

[0050] (2.3) When the data packet m ,packet m+1 The packet does not meet the requirements. m .Seq+packet m .Len=

[0051] packet m+1 .Ack, or does not meet the packet requirement m .Ack = packet m+1 When using .Seq, (packet) m ,packet m+1 If they are not from the same TLS Fragment, then (packet) needs to be separated. m-1 ,packet m Added to the TLS Fragment recordset from the packet. m+1 Continue iterating;

[0052] (2.4) Repeat steps (2.2)-(2.3) until the attack behavior segment fra is restored. i All TLSFragments;

[0053] (2.5) Repeat steps (2.1)-(2.4) to obtain the fine-grained attack behavior segment {fra1,fra2,..,fra k For each attack segment, the first n TLS Fragment sequences are selected as early samples for fine-grained attack behavior, i.e., fra i ={tls_frag1,tls_frag2,..,tls_frag n}

[0054] Furthermore, the TLS Fragment in step (2) consists of a TLS header, an upper-layer protocol header (such as an HTTP header), and application layer data. It operates on top of the TCP protocol, which provides reliable transmission. Therefore, the TLS Fragment still has stable characteristics in a dynamic network environment.

[0055] Furthermore, in step (3), the m-dimensional statistical features of the early sequence of the first n-TLS Fragments obtained in step (2) are extracted at the TLSFragment granularity, and the statistical features of the first n-TLS Fragments are merged to construct an [n×m,1]-dimensional feature vector.

[0056] Furthermore, step (4) specifically includes the following sub-steps:

[0057] (4.1) Standardize the above [n×m,1] dimensional TLS Fragment early stable feature vectors and remove the Nan and Inf values;

[0058] (4.2) Divide the early stable feature set of the first n-TLS Fragments with different fine-grained attack behaviors into training set and test set, and construct 1D-CNN neural network for training.

[0059] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0060] (1) The present invention can accurately segment the fine-grained behavior of persistent malicious Trojans, thereby completely dividing the fine-grained attack behavior segments in a continuous data packet sequence.

[0061] (2) Based on the stable features of TLS Fragment, the fine-grained attack behavior features extracted in this invention also have distinguishability and stability in dynamic network environments.

[0062] (3) This invention can accurately identify fine-grained attack behaviors in the early stages and provide network administrators with timely solutions. Attached Figure Description

[0063] Figure 1 This invention provides a framework for an early and accurate method for fine-grained identification of malicious Trojan behavior in persistent connections.

[0064] Figure 2 This invention demonstrates the accuracy and recall of identifying segmentation points in continuous attack behavior segments of different orders of magnitude.

[0065] Figure 3 An obfuscation matrix trained to extract the top 5 TLS Fragment features for seven fine-grained attack behaviors of Quasar.

[0066] Figure 4 The accuracy of early fine-grained attack behavior identification was tested in the first 10 rounds using different comparison methods. Detailed Implementation

[0067] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0068] This invention proposes a method for early and accurate identification of fine-grained malicious Trojan behavior for persistent connections, the model framework of which is as follows: Figure 1 As shown, it includes three parts. The first part is an algorithm for identifying segmentation points of continuous fine-grained attack behaviors of malicious Trojans. Specifically, it segments a continuous data packet sequence based on a sliding window and extracts the segments on both sides of the sliding window (S). L ,S R The first part is a data packet length sequence, direction sequence, and timestamp sequence. It calculates the CDF probability distribution in three dimensions and the KL divergence value on both sides of the window. It extracts the segmentation point sequence based on the KL divergence value and finally performs pseudo-segmentation point fusion to accurately segment fine-grained attack behavior segments. The second part is an n-TLS Fragment-based stable feature extraction algorithm. Specifically, it restores the data packet sequence within the fully segmented fine-grained attack behavior segment to a TLS Fragment, selects the first n TLS Fragments, and extracts m-dimensional stable features at the TLS Fragment granularity to form an [n×m,1] feature vector. The third part is an early recognition algorithm for fine-grained attack behavior. Specifically, it constructs a 1D-CNN neural network, inputs the above feature vector into the neural network for training, and outputs the model after appropriate training rounds to identify fine-grained attack behavior of malicious Trojans.

[0069] Specifically, the method of the present invention includes the following steps:

[0070] (1) Extract the packet length sequence, packet direction sequence and packet timestamp sequence from the fine-grained attack traffic of the persistently connected encrypted malicious Trojan, and input them into the fine-grained behavior segmentation module to accurately identify the attack behavior segmentation point;

[0071] The specific process for this step is as follows:

[0072] (1.1) Capture (T1~T N The fine-grained attack traffic F(T1,T) of encrypted malicious Trojans within the time interval N )=

[0073] {frag1,frag2,frag3,..,frag N}, where frag NLet F represent the sequence of data packets containing the Nth attack segment, and let F represent a single stream with identical 5-tuples. A single encrypted stream F of a persistently connected malicious Trojan contains N consecutive, non-separated sequences of fine-grained attack data packets. The fine-grained attack behaviors of the malicious Trojan and their descriptions are shown in Table 1 below:

[0074] Table 1. Seven Fine-Grained Attack Behaviors of the QuasarRAT Malware

[0075]

[0076] (1.2) Based on the sliding window algorithm, extract the packet length sequence {tcp_len1,tcp_len2,...,tcp_len} of the traffic F of the above continuous attack behavior. M}, data packet direction sequence {d1,d2,..,d M}, the data packet timestamp sequence {T1,T2,..,T} M}, where tcp_len M T represents the TCP length of the Mth data packet. M This represents the arrival timestamp of the Mth data packet. The sliding window size is L (number of data packets), and the points in the window divide a continuous sequence of data packets within the window into two parts (S1, S2, S3, S4, S5). L ,S R The direction of the data packet is defined as follows:

[0077]

[0078] (1.3) Calculate the values ​​of S on both sides of the sliding window respectively. L ,S R The packet length-direction-timestamp probability distribution is calculated, and the KL divergence value within a window is calculated based on the relative entropy (Kullback–Leibler, KL) algorithm. The sliding window is moved with a step size t, and the KL divergence value within the window is calculated sequentially to obtain the similarity sequence of continuous fine-grained attack traffic F. The specific process is as follows:

[0079] (1.3.1) Calculate the discrete probability distribution of the data packet length sequence CDF on both sides of the sliding window. Discrete probability distribution of data packet direction sequence (CDF) and the discrete probability distribution of data packet timestamp sequences (CDF) The CDF discrete probability distribution is calculated as follows:

[0080]

[0081]

[0082] Where P represents the Poisson distribution, and S represents the CDF discrete probability distribution. n Let λ be the feature value of the nth data packet, such as length / direction / timestamp, e be the Euler number, and x be the probability variable.

[0083] (1.3.2) Calculate the KL divergence value for the above probability distributions based on the relative entropy algorithm to quantify the left and right windows S. L ,S R The similarity of the data packet sequence distribution. The calculation method is as follows:

[0084]

[0085]

[0086]

[0087] Where D(S) L ||S R ) indicates the left and right side windows (S) L ,S R The KL divergence value of ), where N represents the number of data packets in the window.

[0088] (1.3.3) Taking into account the KL divergence values ​​of three dimensions—data packet length, direction, and timestamp—and calculating the similarity Sim(S) on both sides of the sliding window. L ,S R The calculation method is as follows:

[0089]

[0090] Where i represents the i-th sliding window. The above formula yields the similarity sequence {Sim1, Sim2, ..., Sim...} of consecutive fine-grained attack behavior segments. n}, where n represents the number of sliding windows.

[0091] (1.4) The KL divergence value sequence is optimized by interpolation using a piecewise cubic Hermitian interpolation algorithm. A KL threshold is set to remove some interference values, and the packet index and timestamp of the maximum value are saved. Specifically, the similarity sequence {Sim1, Sim2, ..., Sim...} of the continuous fine-grained attack behavior segments obtained in step (1.3) is used. n The interpolation optimization process is performed, and the interpolation calculation method is as follows:

[0092]

[0093] Where sim x This represents the value of the x-th node, which satisfies sim x ∈[Simk-1 Sim k Sim k s represents the k-th similarity value. k (sim x This indicates that the interpolation condition (two nodes Sim) is met. k-1 Sim k The function value and derivative value at the given point are equal to those of the original function. Calculate the local maxima (x, y) of the interpolation polynomial H(x), find all local maxima y, and calculate the non-zero mode y. threshold If the value is used as a threshold to filter fluctuation points x and the filtered x is saved, then point x is the corresponding fine-grained behavior segment segment of the persistent connection encrypted malicious Trojan. The corresponding data packet index and timestamp are saved.

[0094] (1.5) The data packets corresponding to the index values ​​and timestamps obtained in step (1.4) are the segmentation points for continuous fine-grained attack behavior segments. The behavior segment segmentation is accurately achieved through a pseudo-segmentation point fusion algorithm. The specific process is as follows:

[0095] (1.5.1) Based on the initially obtained sequence of split points {s1, s2, ..., s...} n Extract the fine-grained behavior segments corresponding to the segmentation points;

[0096] (1.5.2) Same as steps (1.3.1)-(1.3.3), calculate the behavior segment (fra k ,fra k+1 Similarity value Where fra k For the dividing point (s) k ,s k+1 The extracted data packet sequence, k∈[1,n-1];

[0097] (1.5.3) Less than or equal to y threshold At that time, it is considered as s k+1 This is a pseudo-segmentation point, and it is removed from the segmentation point sequence. Simultaneously, the behavior segments (fra) are merged. k ,fra k+1 ) for fra k ;

[0098] (1.5.4) k is continuously shifted to the right, and steps (1.5.1)-(1.5.3) are repeated until all segmentation point sequences are traversed, generating a new segmentation point sequence after fusing pseudo-segmentation points. After setting the sliding window size L to 20 and the sliding window step size to 1, multiple orders of magnitude of attack behavior segments are input into the segmentation point recognition module, and the segmentation point recognition algorithm is run. Its segmentation point recognition accuracy and recall are as follows: Figure 2As shown, since the sliding window continuously moves to the right to calculate similarity, and attack behavior data packet sequences are typically dynamic and diverse with network changes, as the number of attack behavior segment samples increases, different behavior segments may appear quite similar within the sliding window, or the same behavior segment may show significant differences within the sliding window, making segmentation point identification prone to confusion. As the number of consecutive attack behavior segments increases dramatically, from 10 consecutive attack behavior segment samples to 100 consecutive attack behavior segment samples, the precision and recall of the segmentation point identification algorithm decrease from 100% to 96% and 94.85%, respectively. However, even for 1000 consecutive attack behavior segments, this invention can still accurately segment fine-grained attack behavior segments with a precision exceeding 90% and a recall exceeding 85%.

[0099] (2) Extract fine-grained attack behavior segments based on the segmentation points identified in step (1), and reconstruct the data packet sequence containing the behavior segments into TLS Fragment sequences. Select the first n TLS Fragments as early samples of fine-grained attack behaviors. Here, n should be much smaller than the total number of TLS Fragment sequences obtained from the reconstruction of the entire fine-grained attack behavior segment, in order to achieve early identification of fine-grained attack behaviors. After reconstructing the TLS Fragments for the seven fine-grained attack behaviors of QuasarRAT, the average total number of TLS Fragments for each fine-grained attack behavior is shown in Table 2 below:

[0100] Table 2 shows the average total number of TLS Fragments for a single fine-grained attack segment.

[0101]

[0102] This step specifically includes the following processes:

[0103] (2.1) Iterate through fra sequentially i The sequence of data packets {packet1, packet2, ..., packet...} n Extract the Seq sequence number, Ack response number, and Len packet length for each data packet;

[0104] (2.2) When the data packet m ,packet m+1 )satisfy

[0105] packet m .Seq+packet m .Len = packet m+1 .Ack, and satisfies packet m .Ack = packet m+1 When using .Seq, (packet)m ,packet m+1 For the same TLS Fragment, set packet m+1 .Seq = packet m+2 .Ack, from the packet m+2 Continue iterating;

[0106] (2.3) When the data packet m ,packet m+1 The packet does not meet the requirements. m .Seq+packet m .Len=

[0107] packet m+1 .Ack, or does not meet the packet requirement m .Ack = packet m+1 When using .Seq, (packet) m ,packet m+1 If they are not from the same TLS Fragment, then (packet) needs to be separated. m-1 ,packet m Added to the TLS Fragment recordset from the packet. m+1 Continue iterating;

[0108] (2.4) Repeat steps (2.2)-(2.3) until the attack behavior segment fra is restored. i All TLSFragments;

[0109] (2.5) Repeat steps (2.1)-(2.4) to obtain the fine-grained attack behavior segment {fra1,fra2,..,fra k For each attack segment, the first n TLS Fragment sequences are selected as early samples for fine-grained attack behavior, i.e., fra i ={tls_frag1,tls_frag2,..,tls_frag n Since a TLS Fragment consists of a TLS header, upper-layer protocol headers (such as HTTP headers), and application-layer data, and operates on top of the TCP protocol that provides reliable transmission, a TLS Fragment still retains stable characteristics in dynamic network environments.

[0110] (3) Extract m statistical features from the n-TLS Fragments in step (2) to form an [n×m,1]-dimensional feature vector as an early identification fingerprint of fine-grained attack behavior. For the early sequence of the first n-TLS Fragments obtained in step (2), extract m-dimensional statistical features at the TLS Fragment granularity, merge the statistical features of the first n-TLS Fragments, and construct an [n×m,1]-dimensional feature vector. In order to fully explore the potential features of TLS Fragments of different fine-grained attack behaviors, including the spatiotemporal features of TLS Fragment granularity and the temporal features of n TLS Fragments within a single fine-grained attack behavior, 20 features based on TLS Fragments were extracted, and their features are shown in Table 3 below:

[0111] Table 3. 20-dimensional statistical features based on TLS Fragment granularity extraction

[0112] feature meaning F1 Number of packets in a TLS Fragment F2 The first packet transmission direction of a TLS Fragment (request 0 / response 1) F3 Minimum packet size of TLS Fragment F4 Maximum packet size of TLS Fragment F5 Average packet size of TLS Fragment F6 Standard deviation of TLS Fragment packet size F7 First packet size of a TLS Fragment F8 Size of the last packet in a TLS Fragment F9 Duration of TLS Fragment F10 Maximum duration interval of TLS Fragment packets F11 Minimum duration interval of TLS Fragment packets F12 Average duration of packets in a TLS Fragment F13 TLS Fragment packet standard deviation duration time interval F14 TLS Fragment packet transmission rate F15 TLS Fragment start time (time elapsed since the start of the action) F16 TLS Fragment end transmission time (time since the start of the action) F17 The longest time a TLS Fragment remains active before becoming idle. F18 The shortest time a TLS Fragment is active before it becomes idle. F19 The average time a TLS Fragment remains active before becoming idle. F20 The standard deviation of the time a TLS Fragment is active before it becomes idle

[0113] (4) Input the n-TLS Fragment stable feature vector from step (3) into the 1D-CNN neural network for training;

[0114] This step specifically includes the following process:

[0115] (4.1) Standardize the above [n×m,1] dimensional TLS Fragment early stable feature vectors and remove the Nan and Inf values;

[0116] (4.2) Divide the early stable feature set of the first n-TLS Fragments with different fine-grained attack behaviors into training set and test set, and construct 1D-CNN neural network for training.

[0117] (5) After training for an appropriate number of rounds, output a fine-grained attack behavior early identification model based on the stable features of n-TLS Fragment to accurately identify the fine-grained attack behavior categories of encrypted malicious Trojans.

[0118] To verify the early and accurate identification capability of this invention for fine-grained attacks by malicious Trojans, the average identification accuracy of the seven fine-grained attack behaviors of the 1D-CNN neural network was shown in Table 4 below, considering n = 5 / 10 / 20 respectively:

[0119] Table 4. Average recognition accuracy of seven fine-grained attacks by Quasar.

[0120] n 5 10 20 Average recognition accuracy 99.55％ 99.48％ 99.34％

[0121] As n increases, the dimension of the feature vector input to the 1D-CNN changes from [5×20,1] to [20×20,1]. The results show that the first 100 dimensions of the feature variables, i.e. when n=5, are sufficient to distinguish seven fine-grained attack behaviors in the early stage, while the 400-dimensional feature vector may contain some confusing features, at which point the recognition accuracy will slightly decrease from 99.55% to 99.34%.

[0122] To verify that when n is 5, i.e. only the first 5 TLS Fragments are needed (far fewer than the total number of TLS Fragments generated during a single action execution), the 1D-CNN neural network exhibits high precision and recall for each fine-grained action, as shown in the confusion matrix results. Figure 3 As shown, the recall rate of this invention for all fine-grained behaviors is close to or even exceeds 99%, demonstrating excellent early recognition performance.

[0123] To verify that this invention exhibits superior early detection performance compared to other inventions when n is 5 (the number of 5-TLS Fragment packets is less than 10), three comparative experiments were conducted: Experiment 1 used USTC-TK to extract the payload of the first ten packets of a single action segment, generating a 2D grayscale image of [28, 28] and training it with 1D-CNN; Experiment 2 used Cicflowmeter to extract the 76-dimensional statistical features of the first 10 packets of a single action segment and trained it with 1D-CNN; Experiment 3 used FS-Net to automatically extract features from the TCP length sequence of the first 10 packets of a single action segment, and tested the accuracy of fine-grained attack behavior recognition in the first 10 rounds. Figure 4 As shown, the present invention generally outperforms other comparative inventions in the first 10 rounds of testing. Furthermore, when the test results approach stability, the average recognition accuracy of the present invention is approximately 99.55%, compared to 99.28% for Cicflowmeter, 99.06% for USTC-TK, and 98.43% for FS-Net. The present invention demonstrates an accuracy advantage in early-stage recognition methods. Additionally, the TLS Fragment granular features extracted by the present invention exhibit stability advantages in dynamic network environments.

[0124] The technical means disclosed in this invention are not limited to those disclosed in the above embodiments, but also include technical solutions composed of any combination of the above technical features. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications are also considered within the scope of protection of this invention.

Claims

1. A method for early and accurate identification of fine-grained malicious Trojan behavior for persistent connections, characterized in that, Includes the following steps: (1) Extract the packet length sequence, packet direction sequence and packet timestamp sequence from the fine-grained attack traffic of the persistently connected encrypted malicious Trojan, and input them into the fine-grained behavior segmentation module to accurately identify the attack behavior segmentation point; (2) Extract fine-grained attack behavior segments based on the segmentation points identified in step (1), restore the data packet sequence containing the behavior segments to the TLS Fragment sequence, and select the first n TLS Fragments as early samples of fine-grained attack behavior. (3) Extract m statistical features from the n-TLS Fragment in step (2) and form an [n×m,1]-dimensional feature vector as an early identification fingerprint of fine-grained attack behavior; (4) Input the n-TLS Fragment stable feature vector from step (3) into the 1D-CNN neural network for training; (5) After training for an appropriate number of rounds, output a fine-grained attack behavior early identification model based on the stable features of n-TLS Fragment to accurately identify the fine-grained attack behavior categories of encrypted malicious Trojans. Step (1) specifically includes the following sub-steps: (1.1) Capture (T1~T) N The fine-grained attack traffic F(T1,T) of encrypted malicious Trojans within the time interval N )= {frag1,frag2,frag3,..,frag N }, where frag N This represents a sequence of data packets containing the Nth attack segment, and F represents a single stream with the same quintuple; a single encrypted stream F of a persistently connected malicious Trojan contains N consecutive and unseparated sequences of fine-grained attack packets. (1.2) Based on the sliding window algorithm, extract the packet length sequence {tcp_len1,tcp_len2,...,tcp_len} of the traffic F of the above continuous attack behavior. M }, data packet direction sequence {d1,d2,..,d M }, the data packet timestamp sequence {T1,T2,..,T} M }, where tcp_len M T represents the TCP length of the Mth data packet. M This represents the arrival timestamp of the Mth data packet; where the packet direction is defined as: (1.3) Calculate the values ​​of S on both sides of the sliding window respectively. L ,S R The packet length-direction-timestamp probability distribution is obtained, and the KL divergence value within the window is calculated based on the relative entropy KL algorithm. The sliding window is moved with a step size t and the KL divergence value within the window is calculated sequentially to obtain the similarity sequence of continuous fine-grained attack traffic F. (1.4) The KL divergence value sequence is optimized by interpolation based on the piecewise cubic Hermit interpolation algorithm. Some interference values ​​are removed by setting the KL threshold, and the data packet index and timestamp of the maximum value are saved. (1.5) The data packets corresponding to the index value and timestamp obtained in step (1.4) are the segmentation points of continuous fine-grained attack behavior segments. The behavior segment segmentation is accurately achieved through the pseudo segmentation point fusion algorithm.

2. The method for early and accurate identification of fine-grained malicious Trojan behavior for persistent connections according to claim 1, characterized in that, In step (1.2), the sliding window size is L, which is the number of data packets. Points within the window divide a continuous sequence of data packets into two parts (S1, S2, S3, S4, S5, S6, S7, S8, S9 ...8, S L ,S R ).

3. The method for early and accurate identification of fine-grained malicious Trojan behavior for persistent connections according to claim 1, characterized in that, Step (1.3) specifically includes the following sub-steps: (1.3.1) Calculate the discrete probability distribution of the data packet length sequence CDF on both sides of the sliding window. Discrete probability distribution of data packet direction sequence (CDF) and the discrete probability distribution of data packet timestamp sequences (CDF) The CDF discrete probability distribution is calculated as follows: Where P represents the Poisson distribution, S represents the CDF discrete probability distribution; k n Let be the feature value of the nth data packet, including length / direction / timestamp, λ be the setting parameter, e be the Euler number, and x be the probability variable; (1.3.2) Calculate the KL divergence value for the above probability distributions based on the relative entropy algorithm to quantify the left and right windows S. L ,S R The similarity of data packet sequence distributions; its calculation method is as follows: Where D(S) L ||S R ) indicates the left and right side windows (S) L ,S R The KL divergence value of ), where N represents the number of data packets in the window; (1.3.3) Taking into account the KL divergence values ​​of the three dimensions of data packet length, direction, and timestamp, and calculating the similarity Sim(S) on both sides of the sliding window. L ,S R The calculation method is as follows: Where i represents the i-th sliding window; the similarity sequence {Sim1, Sim2, ..., Sim...} is obtained by calculating the above formula. n }, where n represents the number of sliding windows.

4. The method for early and accurate identification of fine-grained malicious Trojan behavior for persistent connections according to claim 1, characterized in that, In step (1.4), the similarity sequence {Sim1,Sim2,...,Sim...} of the continuous fine-grained attack behavior segments obtained in step (1.3) is... n The interpolation optimization process is performed, and the interpolation calculation method is as follows: Where sim x This represents the value of the x-th node, which satisfies sim x ∈[Sim k-1 Sim k Sim k s represents the k-th similarity value; k (sim x () represents a cubic polynomial that satisfies the interpolation condition, where the interpolation condition is a two-node Sim. k-1 Sim k The function value and derivative value at the point are equal to those of the original function.

5. The method for early and accurate identification of fine-grained malicious Trojan behavior for persistent connections according to claim 1, characterized in that, In step (1.4), the local maxima (x, y) of the interpolation polynomial H(x) are calculated, all local maxima y are counted, and the non-zero mode y is calculated. threshold If the value is used as a threshold to filter fluctuation points x and the filtered x is saved, then point x is the corresponding fine-grained behavior segment segment of the persistently connected encrypted malicious Trojan. The corresponding data packet index and timestamp are saved.

6. The method for early and accurate identification of fine-grained malicious Trojan behavior for persistent connections according to claim 1, characterized in that, Step (1.5) specifically includes the following sub-steps: (1.5.1) Based on the initially obtained sequence of split points {s1, s2, ..., s...} n Extract the fine-grained behavior segments corresponding to the segmentation points; (1.5.2) Same as steps (1.3.1)-(1.3.3), calculate the behavior segment (fra k ,fra k+1 Similarity value Where fra k For the dividing point (s) k ,s k+1 The extracted data packet sequence, k∈[1,n-1]; (1.5.3) When Less than or equal to y threshold At that time, it is considered as s k+1 This is a pseudo-segmentation point, and it is removed from the segmentation point sequence. Simultaneously, the behavior segments (fra) are merged. k ,fra k+1 ) for fra k ; (1.5.4)k is continuously shifted to the right, and steps (1.5.1)-(1.5.3) are repeated until all the segmentation point sequences are traversed, and a new segmentation point sequence after merging the pseudo segmentation points is generated.

7. The method for early and accurate identification of fine-grained malicious Trojan behavior for persistent connections according to claim 1, characterized in that, In step (2), the corresponding fine-grained attack behavior segments {fra1,fra2,..,fra1,fra2,..,fra3, and fra4, are extracted based on the new segmentation point sequence generated in step (1). k The process involves restoring the packet sequence of each action segment into a TLS Fragment sequence; the restoration process includes the following sub-steps: (2.1) Iterate through fra sequentially i The sequence of data packets {packet1, packet2, ..., packet...} n Extract the Seq sequence number, Ack response number, and Len packet length for each data packet; (2.2) When the data packet m ,packet m+1 ) satisfies packet m .Seq+packet m .Len = packet m+1 .Ack, and satisfies packet m .Ack = packet m+1 When using .Seq, (packet) m ,packet m+1 For the same TLS Fragment, set packet m+1 .Seq = packet m+2 .Ack, from the packet m+2 Continue iterating; (2.3) When the data packet m ,packet m+1 The packet does not meet the requirements. m .Seq+packet m .Len = packet m+ 1. Ack, or packet not meeting the requirements. m .Ack = packet m+1 When using .Seq, (packet) m ,packet m+1 If they are not the same TLSFragment, then (packet) needs to be separated. m-1 ,packet m Added to the TLS Fragment recordset from the packet. m+1 Continue iterating; (2.4) Repeat steps (2.2)-(2.3) until the attack behavior segment fra is restored. i All TLS Fragments; (2.5) Repeat steps (2.1)-(2.4) to obtain the fine-grained attack behavior segment {fra1,fra2,..,fra k For each attack segment, the first n TLS Fragment sequences are selected as early samples for fine-grained attack behavior, i.e., fra i ={tls_frag1,tls_frag2,..,tls_frag n } 8. The method for early and accurate identification of fine-grained malicious Trojan behavior for persistent connections according to claim 1, characterized in that, In step (2), the TLS Fragment consists of the TLS header, the upper-layer protocol header, and the application layer data. It works on top of the TCP protocol that provides reliable transmission. Therefore, the TLS Fragment still has stable characteristics in a dynamic network environment. In step (3), the m-dimensional statistical features of the first n-TLS Fragment early sequence obtained in step (2) are extracted at the TLS Fragment granularity. The statistical features of the first n-TLS Fragments are merged to construct an [n×m,1]-dimensional feature vector.

9. The method for early and accurate identification of fine-grained malicious Trojan behavior for persistent connections according to claim 1, characterized in that, Step (4) specifically includes the following sub-steps: (4.1) Standardize the above [n×m,1] dimensional TLS Fragment early stable feature vectors and remove the Nan and Inf values; (4.2) Divide the early stable feature set of the first n-TLS Fragments with different fine-grained attack behaviors into training set and test set, and construct 1D-CNN neural network for training.

Images