A multi-session and multi-protocol based malicious traffic detection method and system

Abstract

The application discloses a malicious traffic detection method and system based on multiple sessions and multiple protocols, and belongs to the technical field of Internet. First, a heuristic algorithm is used to combine multiple related sessions into a session sequence, then states are extracted from the session, the session sequence is converted into a state sequence, and finally a Markov chain model is trained by using a large number of state sequences as network communication behavior fingerprints. In the detection stage, whether the malicious traffic is determined by calculating the matching degree of each sequence and the network communication behavior fingerprint. The application can fully mine the context features between multiple sessions generated by malicious software, and accurately and efficiently detect the traffic of the malicious software.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cyberspace security, the field of malicious traffic detection and the field of artificial intelligence, and in particular to a malicious traffic detection method and system based on multiple sessions and multiple protocols. BACKGROUND

[0002] In recent years, network attack events have occurred increasingly frequently, causing great negative impact on people's production and life and serious economic losses. People have to take various methods to defend against network attacks. Accurately and quickly finding malicious software traffic from massive network traffic is one of the keys to resist network attacks. Traditional network intrusion detection systems (such as Snort and Suricata) use signature-based detection methods. This method requires experts to manually extract signatures, which is not only inefficient but also difficult to cope with the increasing number of attack methods and increasing encrypted traffic, and has great limitations. With the continuous development and wide application of artificial intelligence technology, machine learning and deep learning are gradually used to detect malicious traffic. However, existing detection methods all take a single data packet or a single session as the smallest detection unit. With the upgrading of defense means, attackers have begun to use more advanced attack methods and more advanced malicious software. Usually, a malicious software will generate multiple sessions during operation, and there is a context association between multiple sessions. However, the existing detection methods do not consider the association between multiple sessions generated by the same malicious software, but only detect a single session in isolation. For example, Chinese invention patent CN105871832A discloses a network application encrypted traffic identification method and device based on protocol attributes, which detects a single session and only classifies encrypted traffic by using the TLS session message type as a feature, based on a second-order Markov chain for complete matching. First, it cannot cope with traffic detection of multiple protocols, and complete matching can make the variants of malicious software bypass detection. In this way, a lot of information is lost, which is easy to cause false negatives and false positives.

[0003] In addition, with the continuous evolution of malicious software, some advanced malicious software (such as SUNBURST) has begun to use the method of simulating normal traffic to evade detection. This makes it more difficult to distinguish between normal traffic and malicious traffic from the perspective of a single session. How to comprehensively use multiple sessions of different protocols generated by malicious software to accurately and quickly detect malicious traffic is a problem that needs to be solved at present. Therefore, the present application aims to fully exploit the association between multiple sessions generated by the same malicious software and accurately detect the traffic of malicious software using artificial intelligence technology. SUMMARY

[0004] The application aims to provide a malicious traffic detection method and system based on multiple sessions and multiple protocols, which is characterized by the communication of malicious software, mines the correlation between multiple sessions generated by the same malicious software, constructs a malicious software network communication behavior fingerprint by using a first-order homogeneous Markov chain, and finally realizes the purpose of accurately detecting malicious traffic.

[0005] To achieve the above-mentioned purpose, the application adopts the following technical solutions:

[0006] A malicious traffic detection method based on multiple sessions and multiple protocols comprises the following steps:

[0007] 1) Analyzing original traffic to generate traffic logs;

[0008] 2) Merging sessions associated with each other in the original traffic together and grouping them, and each group of sessions forms a session sequence in chronological order;

[0009] 3) Extracting the state of each session in each group of sessions, and converting each session sequence into a state sequence;

[0010] 4) Collecting malicious traffic generated by malicious software, processing it according to steps 1) to 3), obtaining the state sequence of the malicious software, and training a first-order homogeneous Markov chain by using the state sequence as the network communication behavior fingerprint of the malicious software;

[0011] 5) When detecting malicious traffic, processing the obtained to-be-detected traffic according to steps 1) to 3), obtaining the state sequence of the to-be-detected traffic, then calculating the probability that the state sequence of the to-be-detected traffic matches the network communication behavior fingerprint of different malicious software, and judging whether it is malicious traffic and which malicious software's malicious traffic according to the size relationship between the probability and the preset detection threshold.

[0012] Preferably, the traffic log comprises the following fields: source IP address, destination IP address, transport layer protocol type, transport layer sending payload byte size, and transport layer receiving payload byte size.

[0013] Preferably, if the application layer is a standard network protocol, the traffic log further comprises an application layer protocol field; if the application layer protocol is a DNS protocol, the traffic log further comprises three fields: request domain name, request type, and response quantity.

[0014] Preferably, the judgment condition of whether there is an association between sessions comprises:

[0015] The time interval between two sessions is less than two minutes, and both of them have the same source IP address and destination IP address; or

[0016] The time interval of the two DNS sessions is less than two minutes, and the domain names requested by the two sessions have the same second-level domain name; or

[0017] The time interval of the two sessions is less than two minutes, and one of the sessions is a DNS session, and the source IP address or the destination IP address of the other session is in the response of the DNS session.

[0018] Preferably, the heuristic union-find algorithm is used to merge the related sessions together.

[0019] Preferably, if the number of sessions in the same group exceeds 100, only the first 100 sessions are kept in the session sequence.

[0020] Preferably, when extracting the state of the session, for the DNS protocol, the protocol type, the DNS request type, and the number of answers in the DNS response are used as the state of the session; for other protocols, the protocol type, the number of bytes sent, and the number of bytes received are used as the state of the session.

[0021] Preferably, each state sequence includes a start state and an end state in addition to the session state.

[0022] Preferably, when detecting malicious traffic, the step of judging according to the size relationship between the probability and the preset detection threshold value comprises:

[0023] If the probability exceeds the detection threshold value, it is judged as malicious traffic, otherwise it is judged as non-malicious traffic;

[0024] If only one probability exceeds the detection threshold value, it is judged that the malicious traffic comes from the malware corresponding to the probability;

[0025] If there are multiple probabilities exceeding the detection threshold value, it is judged that the malicious traffic comes from the malware corresponding to the highest probability.

[0026] Preferably, when calculating the probability that the state sequence of the to-be-detected traffic matches the network communication behavior fingerprint of different malware, the similarity before and after the state transition is introduced, and the probability is calculated according to the similarity.

[0027] Preferably, the network communication behavior fingerprint is dynamically updated from the original state sequence to a new state sequence, and if the transition probability of each state in the original state sequence is p, the transition probability of each state in the new state sequence is p / (1+ur), where ur is a hyperparameter.

[0028] A malicious traffic detection system based on multiple sessions and multiple protocols, comprising:

[0029] A data preprocessing module is configured to parse original traffic to generate traffic logs, combine and group sessions associated with each other in the original traffic, and form a session sequence for each group of sessions in chronological order; and extract the state of each session in each group of sessions and convert each session sequence into a state sequence.

[0030] A fingerprint construction module is configured to collect malicious traffic generated by malware, input the malicious traffic into the data preprocessing module for processing, obtain a state sequence of the malware, and train a first-order homogeneous Markov chain using the state sequence as a network communication behavior fingerprint of the malware.

[0031] A malicious traffic detection module is configured to detect malicious traffic, input the detected traffic into the data preprocessing module for processing to obtain a state sequence of the detected traffic, calculate the probability that the state sequence of the detected traffic matches the network communication behavior fingerprints of different malware, and determine whether the detected traffic is malicious and which malware the detected traffic belongs to according to the size relationship between the probability and a preset detection threshold.

[0032] Compared with the prior art, the present application has the following advantages:

[0033] Existing malicious traffic detection methods take a single data packet or a single session as the smallest detection unit. However, malware often generates multiple sessions in network communication, and these sessions are associated with each other. Compared with existing detection methods, the present application fully mines the association information between adjacent sessions, and combines multiple sessions for detection. When combining sessions, the present application uses a heuristic union-find set algorithm to combine sessions, which enables sessions associated with each other but having different protocols and IP addresses to be combined together. When extracting states, the present application only uses the protocol type, the number of transmitted bytes, and the number of transmitted bytes as the state, which makes the present application applicable to encrypted protocols. When detecting, the present application introduces an approximate matching technique, which makes it difficult for variants of malware to bypass detection. When deploying, the present application introduces a dynamic updating technique, which enables the network communication behavior fingerprint of malware to be updated synchronously with the malware to cope with the continuous evolution of malware. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1 is a flowchart of a malicious traffic detection method based on multiple sessions and multiple protocols according to the present application;

[0035] Figure 2 is a flowchart of construction of a network communication behavior fingerprint of malware;

[0036] Figure 3 is a flowchart of malicious traffic detection;

[0037] Figure 4 is an example graph of session aggregation;

[0038] Figure 5 is an example graph of network communication behavior fingerprint of Upatre Trojan. DETAILED DESCRIPTION

[0039] In order to make the technical personnel in the technical field better understand the technical solutions in the embodiments of the present application, and make the purpose, features and advantages of the present application more apparent and easy to understand, the technical core in the present application is further described in detail below in conjunction with the drawings and examples.

[0040] A malicious traffic detection method based on multiple sessions and multiple protocols is provided, as shown in Figure 1 The method comprises the following steps:

[0041] Step 1: Analyzing original traffic. According to the RFC document, the original traffic is parsed into a traffic log. In order to complete the subsequent steps, the fields that must be included in the log are source IP address, destination IP address, transmission layer protocol type, transmission layer sending payload byte size, transmission layer receiving payload byte size. If the application layer is a standard network protocol (such as HTTP, TLS), the application layer protocol field needs to be added. If the application layer protocol is the DNS protocol, the request domain name, request type, and response quantity fields need to be added.

[0042] Step 2: Session aggregation. The purpose of session aggregation is to combine sessions that are different in protocol but associated with each other. There are three conditions to determine whether two sessions are associated:

[0043] 1) The time interval of the two sessions is less than two minutes, and they have the same source IP address and destination IP address;

[0044] 2) The time interval of the two DNS sessions is less than two minutes, and the domain names requested by them have the same second-level domain name;

[0045] 3) The time interval of the two sessions is less than two minutes, and one of the sessions is a DNS session, and the source IP address (or destination IP address) of the other session is in the response of the DNS session.

[0046] If two sessions meet any of the above conditions, the two sessions are associated sessions. The heuristic union-find algorithm is used to combine the associated sessions together, and the specific process is as follows:

[0047] Initialization: Let g[i] represent the group ID to which the ith session belongs, where g[i] = i;

[0048] Query the group that the ith session belongs to: if g[i] is equal to i, then the group that the ith session belongs to is g[i]; otherwise, recursively query the group that g[i] belongs to;

[0049] Merge the ith session and the jth session: if the groups that the ith session and the jth session belong to are different, then let g[i] = j.

[0050] Merge all the associated sessions according to the above steps. According to the group ID that the session belongs to (each group has only one ID, which can be composed of a number), all network sessions are divided into several groups. For the sessions of the same group, they are sorted according to the time sequence to form a session sequence. If the session length exceeds 100, only the first 100 sessions are retained.

[0051] Step 3: State extraction. After step 2, individual sessions are merged into multiple session sequences. Next, the state needs to be extracted from each session in each group of sessions, and then a session sequence is converted into a state sequence.

[0052] As a specific embodiment, for the DNS protocol, the protocol type, the DNS request type, and the number of answers in the DNS response are used as the corresponding states. For example, (DNS, A, 2) indicates that this is a DNS session; its request type is A; and there are 2 answers in the DNS response. The DNS request type can reflect the purpose of initiating the DNS request. Usually, the DNS request type is A and AAAA, indicating that the user hopes to obtain the IP address corresponding to the domain name. While the DNS tunnel usually requests the TXT type. The number of answers in the DNS response can reflect the type of the infrastructure of the target server. Usually, if it is a domain name used by an individual, there is only one answer in the DNS response. If there are multiple answers in the DNS response, this domain name is likely to be used by an institution or configured with a CDN.

[0053] As a specific embodiment, for other protocols, the protocol type, the number of bytes sent, and the number of bytes received are used as the corresponding states. If the application layer protocol can be identified, the application layer protocol type is used, otherwise the transmission layer protocol type is used. For example, (HTTP, 100, 500) indicates that this is an HTTP session; it has sent 100 bytes of data and received 500 bytes of data.

[0054] As a specific embodiment, before the beginning of the sequence, a special state Start is introduced to represent the beginning of the sequence; at the end of the sequence, a special state End is introduced to represent the end of the sequence. Let Seq represent a state sequence, and the discrete random variable X iLet Seqi denote the state sequence of the i-th session, n denote the number of sessions, then Seqi = {Start, X1, X2,..., Xn, End}. n

[0055] Step 4: Fingerprint construction. A large number of malicious traffic generated by each malware is collected for constructing the network communication behavior fingerprint of the malware. The malicious traffic of the malware is collected and processed by steps 1-3 above, as shown in FIG. 2, to obtain multiple state sequences of each malware. A first-order homogeneous Markov chain is trained using these state sequences as the network communication behavior fingerprint of the malware. Figure 2

[0056] A first-order Markov chain means that the current state is only related to the previous state, and is not related to other previous states, i.e.:

[0057] P(Xn | Xn-1, Xn-2,..., X1) = P(Xn | Xn-1) i {i-1} {i-2} i {i-1}

[0058] A homogeneous Markov chain means that its state transition probability is independent of time. Therefore, the probability that a sequence belongs to a certain fingerprint is:

[0059]

[0060] Step 5: Malicious traffic detection. In detecting malicious traffic, the collected traffic to be detected is first processed according to steps 1-3 above, as shown in FIG. 3, to obtain a state sequence, and then the probability that the state sequence matches a network communication behavior fingerprint of a certain malware is calculated. If the probability exceeds a detection threshold δ, then it belongs to this malware. If it can match multiple malwares, the malware with the highest probability is selected. If it cannot match any malware, it is considered as benign traffic. Figure 3

[0061] As a specific implementation, in a Markov chain, a new state sequence needs to be completely consistent with the state transition path to match. However, the malware will evolve over time, and its network communication behavior will also change. When the network behavior of the malware changes a little, it can bypass the detection of the fingerprint. Therefore, the present application uses an approximate matching method to alleviate the problem of malware variants. The similarity of states X = (p, b i o i o

[0062] ​​​​​​​​​​​​

[0063] where the clip function means to limit the first parameter in the range of [0, 1]; p represents the protocol type; bi represents the number of bytes sent; bo represents the number of bytes received. It should be noted that the similarity of two states does not satisfy the commutative law, i.e., sim(X, X') ≠ sim(X', X).

[0064] The formula for selecting the next state in a Markov chain is:

[0065]

[0066] where X t is the current state; X t+1 is the next state of X t in the Markov chain; and X' t+1 is the state to be matched in the new state sequence.

[0067] Finally, the probability of the state sequence matching a malware network communication behavior fingerprint (i.e., the probability of the state transition path in the Markov chain) is:

[0068]

[0069] As a specific implementation, for each malware family, the detection threshold is calculated according to the following formula:

[0070]

[0071] where prob(Seq) represents the transition probability of the sequence Seq in a Markov chain. The first half of the above formula represents the minimum transition probability in the sequence of the training set. Because the present application uses approximate matching when detecting, the error caused by approximate matching needs to be considered when selecting the detection threshold. 0.9 is the minimum acceptable similarity of two states. mean(sequence length) is the average sequence length in the training set. Therefore, the second half of the above formula 0.9 mean(sequence length) represents the approximate matching error.

[0072] Step 6: Dynamic update of the fingerprint. Approximate matching can solve the problem of slight deviation of the state sequence from the fingerprint. However, as the malware continuously evolves, the state sequence corresponding to its network behavior will continuously deviate from the fingerprint until it bypasses the fingerprint matching. Therefore, the fingerprint needs to be dynamically updated using the newly detected state sequence, so that the fingerprint can remain effective. Let X i represent the i-th state, and X iThe probability of transition to other states, i.e., transition probability, is {p1, p2, …, p n}. In the newly detected state sequence, the next state of X i is X j . Then, the transition probability is updated as where ur is a hyperparameter, usually taking 0.0001.

[0073] The malicious traffic detection system based on multiple sessions and multiple protocols provided by the application mainly includes three modules: a data preprocessing module, a fingerprint construction module, and a malicious traffic detection module. The functions of the three modules are as follows:

[0074] The data preprocessing module pre-processes the original traffic. The overall input of the system is the original traffic, and the protocol reorganization and session restoration are performed on the data packets therein to convert them into traffic logs. Then, a plurality of session sequences are obtained by merging a plurality of dispersed sessions using a plurality of merging conditions. Finally, features are extracted from each session as a state, and the session sequence is converted into a state sequence.

[0075] The fingerprint construction module constructs the network communication behavior fingerprint of each type of malware. For each type of malware, network communication traffic generated by the malware is collected, and then the data preprocessing module is used to convert the network communication traffic into a plurality of state sequences. Finally, a first-order homogeneous Markov chain model is trained as the network communication behavior fingerprint of the malware, and the network communication behavior fingerprint is stored in a fingerprint library.

[0076] The malicious traffic detection module detects the malicious traffic existing in the network in real time. For real-time network traffic, the data preprocessing module is used to obtain a state sequence, and then the fingerprint library is searched for a matching network communication behavior fingerprint of malware. If no fingerprint matches, the network traffic is considered to be normal traffic. If a match is found, an alarm is generated, and the network communication behavior fingerprint of the malware is dynamically updated using the state sequence, so that the network communication behavior fingerprint can maintain a high accuracy and a low false negative rate.

[0077] As a specific implementation, for the data preprocessing module, the input can be original traffic packets (pcap files) or real-time network traffic captured from a network card. When real-time network traffic is accessed, the system needs to cache the session sequence for a certain period of time to cope with possible subsequent sessions. When extracting the state, for the DNS protocol, the protocol type, DNS request type, and the number of answers in the DNS response are used as the corresponding state; for other protocols, the protocol type, the number of transmitted bytes, and the number of received bytes are used as the corresponding state.

[0078] As a specific embodiment, for the fingerprint construction module, there are multiple optional traffic collection methods. For example, open source malicious traffic data sets are collected from the Internet; a local malware running environment is built to simulate the running process of the malware and collect the generated traffic; and the captured in-the-wild malware is run in a sandbox and the generated traffic is collected.

[0079] As a specific embodiment, when the real-time traffic bandwidth is very large, the system may occupy too much memory, and the device memory may be insufficient. At this time, the system can use the least recently used algorithm to remove the cached state sequence in the memory to make room for the upcoming traffic. When updating the fingerprint dynamically, ur is generally a very small value, such as 0.0001. A too large ur will greatly change the fingerprint, which in turn will cause the detection false negative rate to increase.

[0080] A specific embodiment is listed below, which is processed by using the technical solutions provided by the application:

[0081] The original traffic packet (pcap file) is input, and the original traffic packet is first parsed into a traffic log. Then, a plurality of discrete sessions are merged into a plurality of session sequences according to a plurality of merging rules. Figure 4 is an example of session aggregation. The destination IP address of the second HTTP session is in the response of the first DNS session, which meets the merging condition, so they need to be merged. Similarly, the destination IP address of the fourth TLS session is in the response of the third DNS session, so they also need to be merged. The two DNS sessions have the same second-level domain name (example.com), which also meets the merging condition. Therefore, the two DNS sessions also need to be merged. Finally, the four sessions of different protocols can be merged into one session sequence.

[0082] Next is state extraction. For the DNS protocol, the protocol type, DNS request type, and the number of answers in the DNS response are used as its corresponding state. Therefore, Figure 2 The states of the two DNS sessions in are both (DNS, A, 1). For other protocols, the protocol type, the number of sent bytes, and the number of received bytes are used as its corresponding state. Therefore, Figure 2 The HTTP session in is converted to (HTTP, 100, 500); and the TLS session is converted to (TLS, 400, 1000). At the same time, a Start state is added at the beginning of the sequence, and an End state is added at the end of the sequence. Finally, Figure 4 The displayed session sequence can be converted to {Start, (DNS, A, 1), (HTTP, 100, 500), (DNS, A, 1), (TLS, 400, 1000), End}.

[0083] Finally, the fingerprint construction. In order to better understand the flow of the fingerprint construction, an example of the fingerprint construction is given below.

[0084] Here are four state sequences of the Upatre malware:

[0085] 1. {Start, (DNS, A, 1), (TLS, 500, 1000), (TLS, 300, 800), End}

[0086] 2. {Start, (DNS, A, 1), (TLS, 500, 1000), (TLS, 300, 700), End}

[0087] 3. {Start, (DNS, A, 1), (TLS, 500, 5000), (TLS, 300, 800), (TLS, 300, 800), End}

[0088] 4. {Start, (DNS, A, 1), (TLS, 500, 5000), (TLS, 300, 800), (TLS, 300, 800), End}

[0089] From these four sequences, the transition probabilities between different states of the Upatre malware can be calculated. For example, P (DNS,A,1)-(TLS,500,1000) = 50%, P (TLS,300,800)-End = 60%.

[0090] Figure 5 is an example of the network communication behavior fingerprint of the Upatre malware. As Figure 5 shown, almost all of the Upatres need to send a DNS request first. This indicates that the Upatre uses domain names to communicate with the command and control server. After resolving the domain name, it establishes multiple TLS sessions. The difference between (TLS, 500, 1000) and (TLS, 500, 5000) is that the certificates are different. In (TLS, 500, 1000), the server sends a self-signed TLS certificate to the client, and there is only one certificate in the certificate chain. However, in (TLS, 500, 5000), the server sends a legitimate TLS certificate to the client, and there are three certificates in the certificate chain. RFC 5077 specifies that when the time interval between two TLS sessions is relatively short, the following session can simplify the handshake process by using SessionID to directly resume the session. The following session of the Upatre directly resumes the previous TLS session, so the number of bytes received is relatively small.

[0091] In the malicious traffic detection, input real-time network traffic, and generate state sequence according to the data preprocessing process, and then search for the matching malware network behavior fingerprint in the fingerprint library. If the matching is successful, an alarm is generated and the corresponding fingerprint in the fingerprint library is updated.

[0092] The above only describes a preferred embodiment of the present application, and it should be noted that, for ordinary people in the art, without departing from the principles of the present application, several modifications and refinements can be made, and various substitutions, changes and modifications are possible without departing from the spirit and scope of the present application. The present application should not be limited to the content disclosed in the examples and drawings of the present application, and the protection scope of the present application is defined by the scope of the claims.

Claims

1. A method for detecting malicious traffic based on multi-session and multi-protocol, characterized in that, The method comprises the following steps: 1) parsing original traffic to generate traffic logs; If the application layer is a standard network protocol, the traffic logs further comprise an application layer protocol field; if the application layer protocol is a DNS protocol, the traffic logs further comprise three fields of request domain name, request type and response quantity; 2) merging sessions associated with each other in the original traffic together and grouping them, each group of sessions forms a session sequence in chronological order; the judgment conditions of whether there is an association between sessions include: the time interval of two sessions is less than two minutes, and both have the same source IP address and destination IP address; or the time interval of two DNS sessions is less than two minutes, and the domain names requested by both have the same second-level domain name; or the time interval of two sessions is less than two minutes, and one of the sessions is a DNS session, and the source IP address or the destination IP address of the other session is in the response of the DNS session; 3) extracting the state of each session in each group of sessions, and converting each session sequence into a state sequence; when extracting the state of the session, for the DNS protocol, the protocol type, the DNS request type and the number of answers in the DNS response are used as the state of the session; for other protocols, the protocol type, the number of sent bytes and the number of received bytes are used as the state of the session; 4) collecting malicious traffic generated by malware, processing the malicious traffic according to the above steps 1) to 3) to obtain a state sequence of the malware, and training a first-order homogeneous Markov chain using the state sequence as the network communication behavior fingerprint of the malware; 5) when detecting malicious traffic, processing the obtained to-be-detected traffic according to the above steps 1) to 3) to obtain a state sequence of the to-be-detected traffic, then calculating the probability that the state sequence of the to-be-detected traffic matches the network communication behavior fingerprint of different malware, and introducing the similarity before and after the state transition in the probability calculation process, which is expressed as: where clip denotes a function that limits the first argument to the range [0, 1], X = (p, b i ,b o ) and X' = (p, b' i ,b′ o ) denote the two states, p denotes the protocol type; b i ,b′ i denotes the number of bytes sent, b o ,b′ o denotes the number of bytes received; The next state is selected based on the joint index of the similarity and the state transition probability of the Markov chain, which is expressed as: wherein X t represents the current state; X t+1 represents the next state of X t in the Markov chain; X′ t+1 represents the state to be matched in the new state sequence, p(X t+1 |X t ) represents the state transition probability of the Markov chain; The probability that the state sequence matches the network communication behavior fingerprint of one malware is calculated, which is expressed as: Whether the traffic is malicious and which malware the traffic is from are determined according to the size relationship between the probability and a preset detection threshold.

2. The method of claim 1, wherein, The traffic logs comprise the following fields: source IP address, destination IP address, transport layer protocol type, transport layer sent payload byte size and transport layer received payload byte size.

3. The method of claim 1, wherein, The heuristic union-find set algorithm is used to merge the sessions associated with each other together.

4. The method of claim 1, wherein, Each state sequence comprises a start state and an end state in addition to the session state.

5. The method of claim 1, wherein, When detecting malicious traffic, the step of determining according to the size relationship between the probability and a preset detection threshold comprises: If the probability exceeds the detection threshold, the traffic is determined to be malicious, otherwise, the traffic is determined to be non-malicious; If only one probability exceeds the detection threshold, it is determined that the malicious traffic comes from the malware corresponding to the probability; If multiple probabilities exceed the detection threshold, it is determined that the malicious traffic comes from the malware corresponding to the highest probability.

6. The method of claim 1, wherein, The network communication behavior fingerprint is dynamically updated from an original state sequence to a new state sequence, if a transition probability of each state in the original state sequence is p, then a transition probability of each state in the new state sequence is p / (1+ur), wherein ur is a hyperparameter.

7. A multi-session and multi-protocol based malicious traffic detection system, performing the method of any of claims 1-6, characterized in that, Comprise: A data preprocessing module is configured to parse original traffic to generate traffic logs, merge and group sessions associated with each other in the original traffic, form a session sequence according to the time sequence of each group of sessions, extract the state of each session in each group of sessions, and convert each session sequence into a state sequence; A fingerprint construction module is configured to collect malicious traffic generated by malware, input the malicious traffic into the data preprocessing module for processing to obtain a state sequence of the malware, train a first-order homogeneous Markov chain using the state sequence, and use the first-order homogeneous Markov chain as a network communication behavior fingerprint of the malware; A malicious traffic detection module is configured to detect malicious traffic, input the obtained to-be-detected traffic into the data preprocessing module for processing to obtain a state sequence of the to-be-detected traffic, calculate the probability that the state sequence of the to-be-detected traffic matches the network communication behavior fingerprint of different malware, and determine whether the to-be-detected traffic is malicious traffic and which malware the to-be-detected traffic belongs to according to the size relationship between the probability and a preset detection threshold.

Images