A method, device, and detection method for constructing an early detection model of remote control Trojan horse traffic based on a convolutional neural network

Abstract

A method, device, and detection method for constructing an early detection model of remote control Trojan horse traffic based on a convolutional neural network, which relate to the technical fields of network and information security, intrusion detection, and deep learning. It solves the problem that there is an urgent need for an early detection system for remote control Trojan horse traffic that can detect a small amount of traffic at the initial stage of its operation, while meeting the fixed-size input of the convolutional neural network model and avoiding information loss caused by byte truncation or image compression. The method includes: obtaining TCP traffic samples and performing preprocessing, obtaining traffic data and constructing a data set; setting a threshold for the number of packets sent by a port, and extracting the TCP header and payload byte sequences within the threshold range; constructing a set of Markov matrices according to the TCP header and payload byte sequences; training the set of matrices using a deep learning model to obtain an early detection model for remote control Trojan horse traffic. The present invention is applied to the field of detecting network and information security.

Description

Technical Field

[0001] The present invention relates to the technical field of intrusion detection and deep learning, and particularly relates to a method for early detection of remote control Trojan traffic based on a convolutional neural network. Background Art

[0002] A remote control Trojan refers to an unauthorized remote control program that spreads through different channels and implants into a victim host, and then controls and steals user information. The Trojan program implanted into the victim host is called the "controlled end", and the program used by the attacker to communicate with the controlled end is called the "control end". The attacker only needs to issue an instruction to execute a certain function at the control end, and the controlled end can complete the corresponding operation and return the execution result. As a malicious software mainly intended for information stealing, it has strong concealment. After the remote control Trojan infects the victim host, it will control the victim host and steal relevant information for a long time before it is cleared, seriously damaging the data security of the victim host. Therefore, carrying out research on remote control Trojan detection is of great significance for protecting the data security of individuals and groups, and the timeliness and accuracy of detection are the keys to remote control Trojan detection.

[0003] According to different detection objects of remote control Trojans (files, host behaviors, and network traffic), existing methods can be classified into file-based detection methods, host-based detection methods, and network-based detection methods. File-based detection methods distinguish malicious software by extracting static features from file forms such as binary files, executable files, or decompiled files. However, malicious software often uses shelling or obfuscation techniques to avoid detection by security systems. Host-based detection methods record the behavior characteristics of remote control Trojan samples in a controlled environment, such as behavior logs, system calls, registry modifications, etc., and analyze the dynamic behavior differences between remote control Trojans and benign software by analyzing the dynamic behavior. Host-based detection methods focus on the dynamic behaviors such as system resource calls during the operation of remote control Trojans, and can more intuitively analyze their actual executed malicious behaviors, but this method also has certain limitations. For example, when remote control Trojans integrate technologies such as process hiding and anti-virtual machine, it is difficult to accurately detect these Trojans through host behaviors. Network-based detection methods focus on the differences existing in the traffic between remote control Trojans and benign software, and can be specifically divided into statistical feature-based and byte sequence-based detection methods. Statistical feature-based detection methods obtain the network features of Trojan traffic by analyzing the performance differences between the communication traffic of benign software and remote control Trojans; byte sequence-based methods determine whether a remote control Trojan attack has occurred by detecting the traffic load of remote control Trojans.

[0004] Generally speaking, detection methods based on statistical features are difficult to balance detection timeliness and high detection accuracy, and require time-consuming feature engineering. Existing detection methods based on byte sequences often discard traffic load sequences after a certain length threshold in order to adapt to the fixed-size input of the convolutional neural network model. Considering detection timeliness, losing the small amount of traffic that the remote control trojan has at the beginning of its operation is not conducive to obtaining high detection accuracy.

[0005] The existing patent CN102469103A was published on May 23, 2012, which discloses a method for predicting trojan events based on a BP neural network. By analyzing the sequence of trojan API calls during the classification process, the type of trojan is determined, and during the prediction process, the number of trojan events occurring in the network is predicted by using traffic data. It fails to solve the problem of quickly identifying remote control trojan traffic in network traffic.

[0006] Based on this, there is an urgent need for an early detection system for remote control trojan traffic that can detect a small amount of traffic at the beginning of the remote control trojan's operation, while meeting the fixed-size input of the convolutional neural network model and avoiding information loss caused by byte truncation or image compression. Summary of the Invention

[0007] The present invention solves the problem of urgently needing an early detection system for remote control trojan traffic that can detect a small amount of traffic at the beginning of the remote control trojan's operation, while meeting the fixed-size input of the convolutional neural network model and avoiding information loss caused by byte truncation or image compression.

[0008] A method for constructing an early detection model for remote control trojan traffic based on a convolutional neural network according to the present invention, the method includes:

[0009] Obtain TCP traffic samples;

[0010] Perform data preprocessing on the TCP traffic samples to obtain traffic data containing normal software and remote control trojans;

[0011] Set the threshold for the number of packets carrying the transport layer payload sent by the server, and extract the TCP header and payload byte sequences within the preset threshold in the traffic data;

[0012] Construct a set of Markov matrices for remote control trojans and normal software respectively according to the TCP header and payload byte sequences;

[0013] Use a deep learning model to train the set of Markov matrices to obtain an early detection model for remote control trojan traffic.

[0014] Further, a preferred implementation is also provided. The preprocessing of the TCP traffic sample to obtain traffic data including normal software and remote control Trojans includes:

[0015] Cut the TCP traffic sample into triple traffic sessions of {source IP address, destination IP address, transport layer protocol};

[0016] Filter the triple traffic sessions, and filter out the data with the number of packets carrying payloads sent by the server in the triple traffic sessions less than 1 to obtain the final traffic data.

[0017] Further, a preferred implementation is also provided. Set the threshold of the number of packets carrying the transport layer payload sent by the server to an integer greater than or equal to 1.

[0018] Further, a preferred implementation is also provided. The construction of the Markov matrix sets for normal software and remote control Trojans according to the TCP header and payload byte sequences further includes calculating the byte transition probability of the TCP header and payload byte sequences:

[0019]

[0020] Among them, P m,n represents the transition probability that the byte immediately following byte m is byte n.

[0021] Further, a preferred implementation is also provided. Training the matrix set using a deep learning model to obtain an early detection model for remote control Trojan traffic. The deep learning model includes: a deep convolutional neural network with 4 convolutional layers, 4 pooling layers, and 2 fully connected layers.

[0022] Based on the same inventive concept, the present invention also provides a device for constructing an early detection model for remote control Trojan traffic based on a convolutional neural network. The device includes:

[0023] A traffic sample acquisition unit for acquiring TCP traffic samples;

[0024] A traffic data acquisition unit for preprocessing the TCP traffic sample to obtain traffic data including normal software and remote control Trojans;

[0025] A TCP header and payload byte sequence extraction unit for setting the threshold of the number of packets carrying the transport layer payload sent by the server and extracting the TCP header and payload byte sequences within the preset threshold in the traffic data;

[0026] A Markov matrix set construction unit for constructing Markov matrix sets for remote control Trojans and normal software according to the TCP header and payload byte sequences;

[0027] The detection model acquisition unit trains the Markov matrix set using a deep learning model to obtain an early detection model for remote control Trojan horse traffic.

[0028] Furthermore, a preferred implementation is also provided. The traffic data acquisition unit includes:

[0029] Cut the TCP traffic samples into triple traffic sessions of {source IP address, destination IP address, transport layer protocol};

[0030] Filter the triple traffic sessions, and filter out the data with the number of packets carrying payloads sent by the server in the triple traffic sessions less than 1 to obtain the final traffic data.

[0031] Based on the same inventive concept, the present invention also provides an early detection method for remote control Trojan horse traffic based on a convolutional neural network. The method includes: performing detection based on the early detection model for remote control Trojan horse traffic constructed above.

[0032] Based on the same inventive concept, the present invention also provides a computer-readable storage medium for storing a computer program. The computer program executes an early detection model construction method for remote control Trojan horse traffic based on a convolutional neural network described in any one of the above or an early detection method for remote control Trojan horse traffic based on a convolutional neural network described above.

[0033] Based on the same inventive concept, the present invention also provides a computer device including a memory and a processor. A computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes an early detection model construction method for remote control Trojan horse traffic based on a convolutional neural network described in any one of the above or an early detection method for remote control Trojan horse traffic based on a convolutional neural network described above.

[0034] The beneficial effects of the present invention are as follows:

[0035] The present invention solves the problem that there is an urgent need for an early detection system for remote control Trojan horse traffic that can detect a small amount of traffic at the initial stage of the remote control Trojan horse's operation, while meeting the fixed-size input of the convolutional neural network model and avoiding information loss caused by byte truncation or image compression.

[0036] A method for constructing an early detection model of remote control trojan traffic based on convolutional neural network starts from the perspective of reducing the damage caused by remote control trojans to victim hosts, aims to limit the attack degree of the remote control trojan control end, and uses the traffic within the threshold of the number of data packets carrying transport layer load sent by the preset remote control trojan control end to carry out early detection of remote control trojans, which helps to improve the timeliness of remote control trojan detection.

[0037] A method for constructing an early detection model of remote control trojan traffic based on convolutional neural network uses a traffic representation method based on Markov transition probability matrix. This representation method can reflect the distribution characteristics of the byte sequence of remote control trojan traffic, without byte padding or traffic truncation, avoiding information loss caused by traffic truncation, and completely retaining the byte sequence information of the traffic in the early stage of remote control trojans, which helps to implement early detection of remote control trojans.

[0038] An early detection method for remote control trojan traffic based on deep learning. This method takes into account the timeliness and accuracy of remote control trojan detection, and can accurately detect remote control trojan traffic before or at the initial stage of the remote control trojan's substantial attack operation. This method was experimentally tested with the traffic sets generated by 54 remote control trojans and 54 multi-domain benign application software samples, and focused on testing the detection ability of this method for the traffic of "unknown remote control trojans" from a practical perspective. The experimental results show that this method can obtain a detection accuracy of 96.53% for the byte sequence of the traffic between the connection of the remote control trojan to the control end and the third data packet carrying the load on this traffic set.

[0039] The present invention is applied to the field of network and information security. Brief Description of the Drawings

[0040] Figure 1 A schematic diagram of a method for constructing an early detection model of remote control trojan traffic based on convolutional neural network described in Embodiment 1;

[0041] Figure 2 A schematic diagram of the deep learning model described in Embodiment 11;

[0042] Figure 3 A schematic diagram of a method for early detection of remote control trojan traffic based on convolutional neural network described in Embodiment 8. Detailed Embodiments

[0043] To make the technical solutions and advantages of the present invention more clearly expressed, the following further describes several embodiments of the present invention in detail with reference to the accompanying drawings. However, the following described embodiments are only several preferred embodiments of the present invention and are not used to limit the invention.

[0044] Embodiment 1. A method for constructing an early detection model of remote control Trojan traffic based on a convolutional neural network, the method comprising:

[0045] Obtain TCP traffic samples;

[0046] Perform data preprocessing on the TCP traffic samples to obtain traffic data containing normal software and remote control Trojans;

[0047] Set the threshold for the number of packets carrying the transport layer payload sent by the server, and extract the TCP header and payload byte sequences within the preset threshold in the traffic data;

[0048] Construct Markov matrix sets for remote control Trojans and normal software respectively according to the TCP header and payload byte sequences;

[0049] Use a deep learning model to train the Markov matrix sets to obtain an early detection model of remote control Trojan traffic.

[0050] Among them, the obtained TCP traffic samples include normal software network traffic and remote control Trojan network traffic.

[0051] This embodiment adopts a traffic representation method based on the Markov transition probability matrix, which can reflect the distribution characteristics of the byte sequences of remote control Trojan traffic, without byte padding or traffic truncation, avoiding information loss caused by traffic truncation. Combine the deep learning model to automatically learn the potential features in the byte transition probability matrix and detect the traffic of remote control Trojans and benign applications. The present invention effectively avoids the loss of load information caused by time-consuming feature engineering and traffic sequence truncation or image scaling methods, thus completely retaining the byte sequence information of the traffic in the early stage of remote control Trojans, which helps to further improve the timeliness and accuracy of the detection model for remote control Trojans.

[0052] Embodiment 2. This embodiment further limits the method for constructing an early detection model of remote control Trojan traffic based on a convolutional neural network described in Embodiment 1. The preprocessing of the TCP traffic samples to obtain traffic data containing normal software and remote control Trojans includes:

[0053] Cut the TCP traffic samples into triple traffic sessions of {source IP address, destination IP address, transport layer protocol};

[0054] Filter the triple traffic sessions, and filter out the data with the number of packets carrying the payload sent by the server less than 1 in the triple traffic sessions to obtain the final traffic data.

[0055] Specifically, the server includes a software server and a remote control Trojan control end. When the number of data packets carrying a payload sent by the software server or the remote control Trojan control end in a triple traffic session is less than 1, there is no substantial attack interaction between the remote control Trojan control end and the controlled end, and it can be directly filtered. The network traffic flow direction of the software server or the remote control Trojan control end is from the outside to the inside.

[0056] Embodiment 3: This embodiment further limits a method for constructing an early detection model for remote control Trojan traffic based on a convolutional neural network described in any one of Embodiment 1 or Embodiment 2. The threshold for the number of data packets carrying a transport layer payload sent by the server is set to an integer greater than or equal to 1.

[0057] Specifically, the threshold for the number of data packets carrying a transport layer payload sent by the server is set to an integer greater than or equal to 1. When setting the size of this integer, if the integer is less than the number of data packets carrying a transport layer payload sent by the server in the entire session traffic, the TCP header and payload byte sequence within this integer threshold are extracted; if the integer is greater than or equal to the number of data packets carrying a transport layer payload sent by the server in the entire session traffic, all TCP headers and payload byte sequences in the entire session traffic are extracted.

[0058] Embodiment 4: This embodiment further limits a method for constructing an early detection model for remote control Trojan traffic based on a convolutional neural network described in Embodiment 1. The method of constructing a Markov matrix set for normal software and remote control Trojans based on the TCP header and payload byte sequences further includes calculating the byte transition probability of the TCP header and payload byte sequences:

[0059]

[0060] Among them, P m,n represents the transition probability that the byte immediately following byte m is byte n.

[0061] Specifically, for the extracted traffic byte sequence Bytes = {Byte i : i > 0}, assuming that the probability of the appearance of the traffic byte Byte i is only related to Byte i-1 , the probability of the value of Byte i-1 under the condition of Byte i is called the transition probability P(Byte i |Byte i-1 ). Since each byte may take values from 0 to 255, a total of 256 states, and each state may transfer to any state, there are a total of 256 * 256 cases. Assume P m,nDenote the transition probability that byte n immediately follows byte m. Then for P m,n The calculation formula is as follows:

[0062]

[0063] Among them, f(m,n) represents the frequency after byte m is transmitted to the adjacent byte n, and m,n ∈ {0,1,2......,255}. The byte transition probability matrix is generated according to the following formula by calculating the transition probability of each byte to other bytes. The byte transition probability matrix M is:

[0064]

[0065] Calculate the transition probability matrix for the byte sequence of each session to generate a Markov matrix representing the distribution characteristics of the remote control Trojan byte sequence.

[0066] Embodiment 5. Refer to Figure 2 Describe this embodiment. This embodiment further limits the method for constructing an early detection model for remote control Trojan traffic based on a convolutional neural network described in Embodiment 1. The method uses a deep learning model to train a matrix set to obtain an early detection model for remote control Trojan traffic. The deep learning model includes: a deep convolutional neural network with 4 convolutional layers, 4 pooling layers, and 2 fully connected layers.

[0067] Specifically, the deep learning model is a convolutional neural network model, which includes 4 convolutional layers, 4 pooling layers, and 2 fully connected layers. The fully connected layer is directly connected to the output layer, and finally the class label of the traffic is output through the softmax function; the input layer dimension of the convolutional neural network structure is a two-dimensional matrix of 256*256.

[0068] This embodiment uses a deep learning toolkit to build a deep convolutional neural network model based on the Python language combined with keras and tensorflow.

[0069] The method of using a deep learning model to train a matrix set to obtain an early detection model for remote control Trojan traffic further includes setting preset hyperparameters to train the convolutional neural network model:

[0070] The learning rate of the preset hyperparameters is 4*10 -5 , and the learning rate decay is 3*10 -8, Dropout is 0.5, Epoch is 100, Batch size is 72, and one-dimensional convolution is used. The length of the convolution kernel is 3, and the initial value is randomly generated. The parameter values are continuously updated in real time until reasonable values are learned. The output dimension of the fully connected layer is 256, which is directly connected to the output layer, and the class labels of the byte transition probability matrix are output through the softmax function. Among them, the Adam optimization algorithm is used to iteratively update the neural network weights based on the training data, and the learning rate is gradually decreased in the later stage of iterative optimization through learning rate decay. The ReLU function is used as the activation function. And a Dropout layer is added to prevent overfitting and improve the generalization ability of the model. The cross-entropy loss function (CrossEntropy Loss) is used to evaluate the fitting effect of the model on the data.

[0071] Embodiment 6. A device for constructing an early detection model of remote control Trojan traffic based on a convolutional neural network according to this embodiment, the device includes:

[0072] A traffic sample acquisition unit for acquiring TCP traffic samples;

[0073] A traffic data acquisition unit for preprocessing the TCP traffic samples to obtain traffic data including normal software and remote control Trojans;

[0074] A TCP header and payload byte sequence extraction unit for setting a threshold for the number of packets carrying the transport layer payload sent by the server, and extracting the TCP header and payload byte sequence within the preset threshold in the traffic data;

[0075] A Markov matrix set construction unit for constructing Markov matrix sets of remote control Trojans and normal software respectively according to the TCP header and payload byte sequence;

[0076] A detection model acquisition unit for training the Markov matrix set using a deep learning model to obtain an early detection model of remote control Trojan traffic.

[0077] Embodiment 7. This embodiment further limits a device for constructing an early detection model of remote control Trojan traffic based on a convolutional neural network according to Embodiment 6. The traffic data acquisition unit includes:

[0078] Cut the TCP traffic samples into triple traffic sessions of {source IP address, destination IP address, transport layer protocol};

[0079] Filter the triple traffic sessions, and filter out the data with the number of packets carrying the payload sent by the server less than 1 in the triple traffic sessions to obtain the final traffic data.

[0080] Specifically, filter the triple traffic sessions. If the number of data packets carrying loads sent by the server is greater than or equal to 1, then retain the session for subsequent detection; otherwise, discard the session according to this principle, and construct a traffic data set containing normal software and remote control Trojans.

[0081] Embodiment 8. Refer to Figure 3 Describe this embodiment. The detection method of a remote control Trojan traffic early detection model based on a convolutional neural network described in this embodiment includes: performing detection based on the remote control Trojan traffic early detection model constructed in Embodiment 1.

[0082] Embodiment 9. A computer-readable storage medium described in this embodiment is used to store a computer program, and the computer program executes the method for constructing a remote control Trojan traffic early detection model based on a convolutional neural network described in any one of Embodiments 1 to 5 or the detection method of a remote control Trojan traffic early detection model described in Embodiment 8.

[0083] Embodiment 10. A computer device described in this embodiment includes a memory and a processor. A computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes the method for constructing a remote control Trojan traffic early detection model based on a convolutional neural network described in any one of Embodiments 1 to 5 or the detection method of a remote control Trojan traffic early detection model described in Embodiment 8.

[0084] Embodiment 11. This embodiment provides a specific example for Embodiment 1 and is also used to explain Embodiments 2 to 5. Specifically:

[0085] In this embodiment, a training set, a validation set, and a test set are constructed, and there is no intersection among them. Considering the current reality of the continuous emergence of new remote control Trojans, to evaluate the detection ability of this embodiment for the traffic of unknown remote control Trojans, the remote control Trojan traffic and normal application traffic in the test set of this embodiment have not appeared in the training set and the validation set, which makes this embodiment more difficult and realistic. At the same time, in the example of this embodiment, the set Tr = {Windows 7 32, Windows 7 64, Windows 8, Windows 10 Pro, Windows Server 2019} is used as the software sample running environment for the training set and the validation set, and the set Te = {Windows 10 Education Edition} is used as the software sample running environment for the test set. The Trojan traffic sessions generated by Tr are randomly divided into the training set and the validation set according to the ratio of 8:2, and the Trojan traffic sessions generated by Te belong to the test set.

[0086] As shown in Table 1, the Trojan samples numbered 1 to 43 active from 2013 to 2018 are randomly assigned to the Windows systems in Tr to capture the remote control Trojan traffic from different Windows versions. The traffic generated by the Trojan samples numbered 44 to 54 active from 2018 to 2021 in Tr is used for the test set of the remote control Trojan traffic to test the detection ability of this embodiment for unknown remote control Trojans. We considered the situation that the attacker will not attack immediately after the connection establishment stage. Therefore, after the connection establishment stage of the remote control Trojan, two traffic capture methods of randomly executing function commands and not executing any function commands are adopted. The number of traffic captures is determined by the number of functions integrated in each remote control Trojan control end. Each traffic capture takes about 5 minutes, and a total of 1855 remote control Trojan traffic is captured. The detailed dataset numbers are shown in Table 3.

[0087] Table 1 Remote control Trojan samples

[0088]

[0089]

[0090] The benign software samples used in this embodiment include representative applications such as common browsers, instant messaging, audio and video, online office, cloud services, remote control, security protection, online meetings, and online classes. As shown in Table 2, Tr runs the benign software numbered from 1 to 46 (ITunes cannot be used in Windows 8). Te runs the benign software numbered from 1 to 54. And the benign traffic datasets are all derived from the real session traffic that maintains communication within 5 minutes randomly selected from normal activities within one hour. The traffic sessions generated by Tr are divided into the training set and the validation set according to the ratio of 8:2. The traffic sessions generated by Te belong to the test set. The detailed dataset numbers are shown in Table 3.

[0091] Table 2 Benign Application Samples

[0092]

[0093]

[0094] Table 3 Detailed Number of Datasets

[0095]

[0096] Table 4 Performance Metrics of Different Methods on the Test Set

[0097]

[0098] Table 4 shows the comparison of the detection evaluation indexes between this embodiment and other remote control Trojan traffic detection methods when the number threshold of data packets carried in the normal software server / remote control Trojan control end is set to {3, 4, 5}. This embodiment uses the relatively active Trojan samples collected from 2018 to 2021 as the traffic source of the test set, and compares four types of detection methods respectively. For Method 1, the detection accuracy rate obtained when the data packet number threshold is 5 is 90.55%. Although its detection rate is slightly weaker, its detection timeliness is relatively better. For Method 2, the detection accuracy rate of 94.26% is obtained in the defined early stage, but within a short communication duration, the distinguishability of some of its features is weak, resulting in a recall rate of only 87.98%. The detection method based on statistical features is prone to the problem of poor detection timeliness when detecting the covert traffic behavior in the initial stage of the remote control Trojan operation. In particular, Method 3 is a detection method based on byte sequences (Bytes-based). Compared with the Bytes-based method, the detection accuracy (96.53%) of the method described in this embodiment only when the data packet number threshold is 3 exceeds the detection accuracy (75.71%) of the Bytes-based method when the data packet number threshold is 5, indicating that the traffic representation method based on the Markov transition probability matrix can obtain higher detection accuracy than the traffic representation method based on byte sequences. This is because even when the same convolutional neural network model is used in both methods, the Bytes-based method can only capture local features in the byte sequence during the training process, and these local features may be weakened or even lost after the pooling layer operation. Therefore, it is difficult to obtain the common features of different remote control Trojans from the training data, resulting in poor generalization ability of the model and insufficient to obtain high detection accuracy when facing new samples. The advantage of the method described in this embodiment is that the traffic representation method based on the Markov transition probability matrix can include the global distribution characteristics of the traffic byte sequence, and these global distribution characteristics will be captured by the convolutional layer, which can remove byte redundancy interfering with detection to highlight the common features of remote control Trojan traffic to a certain extent. This embodiment can effectively distinguish the traffic sessions of benign software and remote control Trojans through the early traffic byte sequences of remote control Trojans. It shows the effectiveness and necessity of retaining the complete early traffic byte sequence information of remote control Trojans, which is of great significance for achieving better early detection effect of remote control Trojans.

[0099] To implement the above embodiments, the present invention also proposes a computer device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, it implements the method for early detection of remote control Trojan traffic based on a convolutional neural network as described in the foregoing embodiments.

[0100] To implement the above embodiments, the present invention also provides a non-transitory computer-readable storage medium storing a computer program which, when executed by a processor, implements the method for early detection of remote control Trojan traffic based on convolutional neural network as described in the foregoing embodiments.

[0101] In the description of this specification, the descriptions with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples", etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or N embodiments or examples in a suitable manner. In addition, without conflict, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0102] In addition, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include at least one of such features. In the description of the present invention, the meaning of "N" is at least two, such as two, three, etc., unless otherwise specifically and clearly defined.

[0103] Any process or method description in a flowchart or described in other ways herein may be understood to represent a module, segment, or portion of code including one or more executable instructions for implementing a customized logical function or process, and the scope of the preferred embodiments of the present invention includes additional implementations where functions may be executed in a substantially simultaneous manner or in a reverse order according to the functions involved, rather than in the order shown or discussed, which should be understood by those skilled in the art to which the embodiments of the present invention pertain.

[0104] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a definite sequence list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other systems that can fetch and execute instructions from the instruction execution system, apparatus, or device), or used in combination with these instruction execution systems, apparatus, or devices. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection part (electronic device) having one or N wirings, a portable computer disk cartridge (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or other suitable media on which a program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other media, then editing, interpreting, or otherwise processing it as appropriate, and then storing it in a computer memory.

[0105] It should be understood that various parts of the present invention can be implemented by hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any one or a combination of the following techniques well known in the art can be used: discrete logic circuits having logic gate circuits for implementing logical functions on data signals, application-specific integrated circuits having appropriate combinational logic gate circuits, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0106] Those of ordinary skill in the art of this technology can understand that all or part of the steps carried by the methods of the above embodiments can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0107] In addition, in each embodiment of the present invention, each functional unit may be integrated in a processing module, may exist separately physically for each unit, or two or more units may be integrated in one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. When the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0108] The above-mentioned storage medium may be a read-only memory, a magnetic disk, an optical disc, etc. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those of ordinary skill in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for constructing an early detection model of remote control Trojan horse traffic based on a convolutional neural network, characterized in that, The method includes: Obtaining TCP traffic samples; Performing data preprocessing on the TCP traffic samples to obtain traffic data including normal software and remote control Trojans; Setting the threshold of the number of packets carrying the transport layer payload sent by the server, and extracting the TCP header and payload byte sequences within the preset threshold in the traffic data; the threshold of the number of packets carrying the transport layer payload is set to {3, 4, 5}; Respectively constructing Markov matrix sets for remote control Trojans and normal software according to the TCP header and payload byte sequences; Training the Markov matrix sets using a deep learning model to obtain an early detection model for remote control Trojan traffic; The preprocessing of the TCP traffic samples to obtain traffic data including normal software and remote control Trojans includes: Cutting the TCP traffic samples into triple traffic sessions of {source IP address, destination IP address, transport layer protocol}; Filtering the triple traffic sessions, and filtering out the data with the number of packets carrying the payload sent by the server in the triple traffic sessions less than 1 to obtain the final traffic data.

2. The method for constructing an early detection model for remote control Trojan horse traffic based on a convolutional neural network according to claim 1, characterized in that The respectively constructing Markov matrix sets for normal software and remote control Trojans according to the TCP header and payload byte sequences further includes calculating the byte transition probability of the TCP header and payload byte sequences: ， Among them, represents a byte m immediately followed by the transition probability of byte n and represents the frequency after byte m is transmitted to the adjacent byte n .

3. The method for constructing an early detection model for remote control Trojan traffic based on a convolutional neural network according to claim 1, characterized in that The training the matrix sets using a deep learning model to obtain an early detection model for remote control Trojan traffic, and the deep learning model includes: a deep convolutional neural network with 4 convolutional layers, 4 pooling layers and 2 fully connected layers.

4. An apparatus for constructing an early detection model for remote control Trojan horse traffic based on a convolutional neural network, characterized in that, The device includes: A traffic sample acquisition unit for obtaining TCP traffic samples; A traffic data acquisition unit for performing data preprocessing on the TCP traffic samples to obtain traffic data including normal software and remote control Trojans; A TCP header and payload byte sequence extraction unit for setting the threshold of the number of packets carrying the transport layer payload sent by the server, and extracting the TCP header and payload byte sequences within the preset threshold in the traffic data; the threshold of the number of packets carrying the transport layer payload is set to {3, 4, 5}; A Markov matrix set construction unit for respectively constructing Markov matrix sets for remote control Trojans and normal software according to the TCP header and payload byte sequences; A detection model acquisition unit for training the Markov matrix sets using a deep learning model to obtain an early detection model for remote control Trojan traffic; The traffic data acquisition unit includes: Cutting the TCP traffic samples into triple traffic sessions of {source IP address, destination IP address, transport layer protocol}; Filtering the triple traffic sessions, and filtering out the data with the number of packets carrying the payload sent by the server in the triple traffic sessions less than 1 to obtain the final traffic data.

5. A method for early detection of remote control Trojan horse traffic based on convolutional neural network, characterized in that, The method includes: Detecting based on the early detection model for remote control Trojan traffic constructed in claim 1.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program, and the computer program executes a method for constructing an early detection model of remote control Trojan traffic based on a convolutional neural network according to any one of claims 1-3 or a method for early detection of remote control Trojan traffic based on a convolutional neural network according to claim 5.

7. A computer device, characterized in that: It includes a memory and a processor. A computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes a method for constructing an early detection model of remote control Trojan traffic based on a convolutional neural network according to any one of claims 1-3 or a method for early detection of remote control Trojan traffic based on a convolutional neural network according to claim 5.

Images