A spyware network traffic detection method and device based on an induction mechanism

Abstract

The application discloses a spyware network flow detection method and device based on an induction mechanism, relates to the technical field of intrusion detection, and aims to solve the technical problem of quickly inducing spyware to generate network behavior and accurately detecting the spyware without relying on flow load information. The construction method of the detection model comprises the following steps: a mapping between a trigger condition and an effective induction operation is established; a two-stage induction operation set is constructed based on the effective induction operation; an induction operation is performed on a to-be-detected environment based on the two-stage induction operation set, and a TCP flow sample is obtained; a plurality of features are extracted from the TCP flow sample, and the extracted features are spliced and fused; genetic algorithm is used to select features from the spliced and fused features, so as to obtain an optimal feature subset; and a machine learning model is trained based on the optimal feature subset, so as to obtain a spyware network flow detection model. The method can induce the spyware to generate network behavior, and the spyware recognition accuracy is high.

Description

Technical Field

[0001] This invention relates to the field of intrusion detection technology. Background Technology

[0002] Spyware is a potentially malicious executable program that uses tracking capabilities to collect various sensitive information from victims. Spyware aims to infiltrate computers or mobile devices without the victim's knowledge to obtain data and then transfer it to third parties. It plays a significant role in numerous data breaches. Over the past decade, spyware has consistently been among the top ten most prevalent and harmful malware. As a data-stealing malware, spyware is highly stealthy and latent, and its behavior is characterized by triggered execution. Once infected, spyware will continuously monitor the victim's sensitive information and steal relevant data until it is completely removed, posing a serious threat to the data security of nations, businesses, and individuals. Therefore, conducting research on spyware detection is crucial for protecting the data security of individuals and teams, and the accuracy and timeliness of detection are key to successful spyware detection.

[0003] Depending on the target, spyware detection methods can be categorized into static analysis, host behavior analysis, and traffic analysis. Static analysis methods utilize the inherent properties of malware itself, requiring no runtime analysis of the executable file; they only focus on its structure and configuration. However, malware often employs packing or obfuscation techniques to evade detection. Host behavior analysis methods obtain software behavior data by executing the sample in a secure environment, such as API call sequences and registry modifications, effectively reflecting the spyware's true intent. Spyware integrates numerous evasion strategies, such as process hiding, anti-debugging, and triggered execution, making these methods ineffective in obtaining true spyware behavior information and easily bypassed, rendering detection methods ineffective. Traffic analysis methods focus on the behavioral differences between spyware and benign software on the network. They do not require capturing spyware behavior information in a debugging environment and can even be deployed outside the host being detected, making them difficult for spyware to bypass. These methods can be further divided into two categories: packet load analysis and communication behavior analysis. Packet load analysis methods determine whether the traffic is malicious by analyzing spyware traffic load information. Detection methods based on communication behavior focus more on the network behavior of spyware during communication, and calculate and statistically analyze the network characteristics of communication traffic for detection.

[0004] Generally, spyware integrates numerous escape strategies, making host-based detection methods easily bypassed. For example, analyzing the changes in the number of APIs called by spyware during and after the induction period reveals that spyware calls significantly more APIs during the induction period than during the non-induction period, leading to the proposal of a detection method based on the induction mechanism. However, even benign software can have its host behavior significantly affected by induction operations. For instance, antivirus software constantly records and analyzes user behavior, causing it to call more APIs during the induction period, rendering this detection method ineffective in distinguishing between spyware and antivirus software. Furthermore, this method requires capturing spyware's API information in a dynamic debugging environment, but current spyware employs various escape strategies, such as directly accessing low-level operating system resources using low-level code instructions (making API analysis impossible), rendering this method completely ineffective.

[0005] While network-based detection methods can be deployed directly outside the host being monitored, and network activity is a necessary pathway for spyware to transmit espionage data, making it difficult to bypass, increasingly more spyware is choosing to use encrypted traffic to transmit information, making analysis through packet payload difficult. Furthermore, spyware network activity has multiple triggering conditions; after stealing sensitive user information, spyware does not immediately initiate a network connection to transmit data, but rather lies dormant for a period, concealing its network activity within the user's normal traffic. The timing of network connection initiation is unpredictable and the duration is short, rendering traditional communication behavior-based detection methods ineffective.

[0006] Therefore, how to provide a detection method that can quickly induce spyware to generate network behavior and detect spyware with high accuracy without relying on traffic load information has become a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0007] To address the aforementioned technical problems, this invention provides a method and device for detecting spyware network traffic based on an inducement mechanism. This method induces spyware to quickly generate network behavior through inducement operations, and performs traffic feature fusion and feature selection in advance before using a machine learning model to classify and identify traffic data, thereby significantly improving the accuracy of spyware identification.

[0008] Based on the same inventive concept, this invention has four independent technical solutions:

[0009] 1. A method for constructing a spyware network traffic detection model based on an inducement mechanism, comprising:

[0010] S1. Establish a mapping between triggering conditions and effective induced operations;

[0011] S2. Based on effective induction operations, construct a two-stage induction operation set;

[0012] S3. Based on the two-stage induction operation set, perform induction operations on the environment to be detected and obtain TCP traffic samples;

[0013] S4. Extract features from the TCP traffic sample and then concatenate and fuse the extracted features.

[0014] S5. Based on the genetic algorithm, feature selection is performed on the spliced ​​and fused features to obtain the optimal feature subset;

[0015] S6. Train a machine learning model based on the optimal feature subset to obtain a spyware network traffic detection model.

[0016] Furthermore, a mapping is established between triggering conditions and effective induced operations, including:

[0017] By decompiling and reading the source code, the obtained spyware sample was analyzed, the triggering structure of the spyware sample was located, and the triggering condition set R1 was obtained;

[0018] In a controlled environment, the trigger condition set R1 is executed one by one, and the spyware is dynamically analyzed to obtain the valid trigger condition set R2.

[0019] In the set of valid triggering conditions R2, select triggering conditions where the number of successfully triggered samples is greater than a preset value, and map them as valid induction operations.

[0020] Furthermore, the two-stage induction operation set includes a rapid induction stage and a comprehensive induction stage;

[0021] The induction operation lasted for 12 hours, with the first 2 hours being the rapid induction phase and the following 10 hours being the full induction phase. The initial frequency of the induction operation was higher during the full induction phase than during the rapid induction phase.

[0022] Furthermore, after obtaining TCP traffic samples, preprocessing is required, including:

[0023] The TCP traffic sample is segmented into a five-tuple network session, including source IP address, destination IP address, source port number, destination port number, and transport layer protocol;

[0024] The five-tuple network sessions are aggregated into a network flow based on the source IP address, destination IP address, and transport layer protocol.

[0025] The network flow is filtered to remove network sessions that have failed to establish a TCP connection.

[0026] Set the maximum number of sessions threshold in the network flow.

[0027] Furthermore, feature extraction is performed within the maximum number of sessions threshold, and the extracted features include distribution features, statistical features, and trend features.

[0028] Extracting the distribution features includes the following steps: calculating the effective payload size of all data packets in each network flow, and designing multiple distribution intervals to calculate the inbound data packet payload distribution, outbound data packet payload distribution, and inbound and outbound data packet payload ratio distribution of each network flow in each distribution interval;

[0029] Extracting the statistical features includes the following steps: extracting inbound and outbound package load features, inbound and outbound package quantity features, and time interval features;

[0030] Extracting the trend features includes the following steps: Calculating the changing trends among various features in the network flow according to the following formula:

[0031] - 1;

[0032] in, The characteristic change trend, Features of the i-th session , The start time of the j-th session , where i and j represent the i-th session and the j-th session, respectively.

[0033] Further, step S3 includes:

[0034] S31. Create a population containing n chromosomes, where each chromosome represents a subset of features, and each gene of the chromosome corresponds to a feature;

[0035] S32. For each chromosome, the machine learning model is trained using the corresponding feature subset, and the classification accuracy is calculated as the fitness of the genetic algorithm.

[0036] S33. Use the roulette wheel selection algorithm to select two chromosomes from the population as parent chromosomes, use the crossover operator to generate new offspring chromosomes, and then use the mutation operator to perform mutation operations on the offspring chromosomes.

[0037] S34. Replace the chromosome with the lowest fitness in the original population with the offspring chromosome to form a new population. Repeat steps S31-S33 in the new population until the number of iterations reaches the maximum value and the chromosome with the highest fitness is output to obtain the optimal feature subset.

[0038] Furthermore, the machine learning models used are decision trees, random forests, K-nearest neighbors, or LightGBM.

[0039] 2. A device for constructing a spyware network traffic detection model based on an inducement mechanism, comprising:

[0040] The induction module is used to perform induction operations on the environment to be detected and obtain TCP traffic samples;

[0041] The feature extraction module is used to extract features from the TCP traffic sample and to concatenate and fuse the extracted features.

[0042] The feature selection module is used to select the optimal feature subset from the spliced ​​and fused features based on a genetic algorithm.

[0043] The model training module is used to train a machine learning model based on the optimal feature subset to obtain a spyware network traffic detection model.

[0044] 3. A spyware network traffic detection method based on an inducement mechanism, wherein the model obtained by the above construction method is used to detect spyware.

[0045] 4. An electronic device, comprising a processor and a storage device, wherein the storage device stores a plurality of instructions, and the processor is configured to read the plurality of instructions from the storage device and execute the above-described construction method.

[0046] The spyware network traffic detection method and device based on the inducement mechanism provided by this invention have at least the following beneficial effects:

[0047] (1) In the spyware network traffic detection method provided by the present invention, the genetic algorithm is used to select features when constructing the detection model, reduce the feature dimension, improve the quality of the feature set, and classify the input traffic features by combining machine learning algorithm, so as to detect spyware and benign application traffic. It can actively induce spyware to generate network behavior and extract network behavior features from the perspective of communication behavior. It does not depend on specific load information, avoids the problems of detection method failure and excessive detection time caused by spyware traffic encryption and network behavior trigger execution. It can effectively avoid the disadvantage that spyware does not generate or only generates a small amount of malicious behavior in the incubation stage, which makes it impossible to extract effective features of spyware for detection. It can induce spyware to generate richer network behavior in a shorter time, thereby extracting the real network features of spyware, which helps to further improve the timeliness and accuracy of spyware detection model.

[0048] (2) This invention utilizes induced operations to quickly induce spyware to generate network behavior and detect it, solving the problems of excessively long detection time and low detection accuracy of spyware. From the perspective of induced execution, it analyzes the triggering conditions and network behavior of spyware, maps the triggering conditions of spyware to corresponding user operation sequences, and satisfies the triggering conditions of spyware by simulating user operation sequences. It can effectively induce spyware to generate more network behavior in a shorter time, which helps to reduce information leakage caused by spyware;

[0049] (3) Compared with existing methods that identify spyware based on the number of API calls, the present invention identifies spyware based on network traffic. Its feature statistics are relatively simple. The detection system can even be deployed outside the host under test, making it impossible to bypass using escape behavior. Furthermore, the network behavior of benign software is basically unaffected by inducement operations. The network behavior of spyware and benign software has a good inducement distinction, and the identification accuracy is high.

[0050] (4) This invention constructs two different induction phases to perform induction operations. Since different spyware has different network behavior triggering mechanisms, it is difficult to balance the induction effect and induction duration of different spyware using only a single induction strategy, resulting in low spyware detection accuracy and low induction efficiency. The two-stage induction operation can adapt to spyware with different network behavior triggering mechanisms and information transmission mechanisms, and can induce spyware to generate network behavior earlier;

[0051] (5) The present invention is based on the feature selection algorithm of genetic algorithm. From the perspective of improving the classification quality of feature set, it uses the excellent search ability of genetic algorithm to construct feature subset. This method can effectively reduce the dimensionality of feature set while ensuring accuracy.

[0052] (6) The present invention has good detection capability for unknown spyware traffic. Experimental results show that the method can achieve a detection accuracy of 99.13% on the traffic set using only the first three network sessions of each flow. Attached Figure Description

[0053] Figure 1 A flowchart of one embodiment of the spyware network traffic detection model construction method based on inducement mechanism provided by the present invention;

[0054] Figure 2 A schematic diagram of an embodiment of the spyware network traffic detection model construction method based on inducement mechanism provided by the present invention;

[0055] Figure 3 This is a schematic diagram of an embodiment of the network flow and network session partitioning in the spyware network traffic detection model construction method based on the inducement mechanism provided by the present invention;

[0056] Figure 4 A schematic diagram illustrating the trend characteristics in the spyware network traffic detection model construction method based on the inducement mechanism provided by the present invention;

[0057] Figure 5 Histograms showing the distribution of inbound and outbound packet lengths for malicious and benign samples in different intervals. Detailed Implementation

[0058] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0059] Example 1:

[0060] See Figure 1 and Figure 2 In some embodiments, a method for constructing a spyware network traffic detection model based on an inducement mechanism is provided, including:

[0061] S1. Establish a mapping between triggering conditions and effective induced operations;

[0062] S2. Based on effective induction operations, construct a two-stage induction operation set;

[0063] S3. Based on the set of induced operations, perform induced operations on the environment to be detected and obtain TCP traffic samples;

[0064] S4. Extract features from the TCP traffic sample and then concatenate and fuse the extracted features.

[0065] S5. Based on the genetic algorithm, feature selection is performed on the spliced ​​and fused features to obtain the optimal feature subset;

[0066] S6. Train a machine learning model based on the optimal feature subset to obtain a spyware network traffic detection model.

[0067] In step S1, the effective inducement operation is mapped using the spyware's trigger conditions, thereby establishing a mapping between trigger conditions and inducement operations. Specifically, the trigger execution strategy integrated into the spyware is used to map user behavior into inducement operations. These inducement operations actively satisfy the spyware's trigger conditions, thereby inducing the spyware to generate more network behaviors in a shorter period of time. Spyware trigger conditions include both action-triggered and time-triggered types. The spyware trigger condition mapping method mentioned in this embodiment targets action-triggered trigger conditions. The eight most frequently used trigger conditions by spyware are mapped into effective inducement operations, specifically including keystrokes, clipboard changes, file behavior, social activities, webpage behavior, screen changes, and email activities.

[0068] Specifically, in step S1, establishing the mapping between triggering conditions and effective induced operations includes the following steps:

[0069] S11. By decompiling and reading the source code, analyze the obtained spyware sample, locate the trigger structure of the spyware sample, and obtain the trigger condition set R1;

[0070] S12. Execute the trigger condition set R1 one by one in the controlled environment, and perform dynamic analysis on the spyware to obtain the valid trigger condition set R2.

[0071] S13. In the set of valid triggering conditions R2, select the triggering condition where the number of successfully triggered samples is greater than a preset value, and map it as a valid induction operation.

[0072] Let's explain the above steps using a specific application scenario. First, analyze 100 spyware samples by decompiling and reading their source code, locate the trigger structures of the spyware samples, and record the trigger condition set R1 for all samples. Second, in a controlled environment, dynamically run the aforementioned 100 spyware samples, and use the trigger conditions in the trigger condition set R1 one by one to induce malicious behavior in the experimental samples. Record the induction effect of each type of trigger condition on the 100 spyware samples, as shown in Table 1.

[0073] Table 1

[0074]

[0075] The third step involves selecting eight triggering conditions from those that can successfully trigger spyware to perform malicious actions. These conditions have a success rate of more than 30 samples and are then mapped to inducement actions, including keystrokes, clipboard changes, social activities, web page activities, screen browsing, application activities, file activities, and email activities.

[0076] In step S2, the two-stage inducement operation set includes a rapid inducement stage and a comprehensive inducement stage. Before executing the inducement operation, a step of constructing the two-stage inducement operation set is also included. Different spyware programs have different network behavior triggering mechanisms. Using only a single inducement strategy makes it difficult to balance the inducement effect and duration of different spyware programs, resulting in low spyware detection accuracy and low inducement efficiency. To accommodate spyware with different network behavior triggering mechanisms and information transmission mechanisms, and to induce spyware to engage in network behavior earlier, two different inducement stages are constructed to execute the inducement operation.

[0077] The rapid induction phase lasts 0-2 hours, increasing the initial strength of the induction operation set and the rate of change of the induction operations. The full-scale induction phase lasts 2-12 hours, decreasing the initial strength and rate of change of the induction operation set and increasing the total induction duration. The induction operation set is mainly adjusted by manipulating the frequency of induction operation execution to control the induction intensity. The specific frequency changes are shown in Table 2.

[0078] Table 2

[0079]

[0080] The steps for constructing the set of two-stage induced operations include:

[0081] Effective inducement operations are broken down into inducement behaviors. ), induction time ( ), inducement content ( ), Induction frequency ( Construct a set of induction operations with increasing induction strength, where the induction strength can be expressed as:

[0082] ;

[0083] The formula for calculating the incremental induction time is as follows: = + ;

[0084] Incremental inducement content calculation formula: = + ;

[0085] Incremental induced frequency calculation formula: = + ;

[0086] in, The growth coefficient, Sensitivity coefficient w represents the number of times the induced behavior is executed, and w is the weighting factor.

[0087] In this system, parameter K controls the rate of change in the induced input, while S controls the sensitivity of the induced content. The higher the number of induced inputs, the longer the induced time and the higher the frequency, and the more abundant and sensitive the induced content becomes. More sensitive input content is more likely to be recognized by spyware; for example, browsing a bank's website is more likely to trigger malicious actions by spyware. Taking keystrokes as an example, in the first induced input during the full-scale induced phase, the keystroke induced time is 1 minute, the induced content is the input character "A", and the induced frequency is "5 minutes / time". By the 20th induced input, the induced time is 5 minutes, the induced content is the input character "ABCD ctrl enter alt EFG", and the induced frequency is 2 minutes / time.

[0088] After step S1, which involves obtaining TCP traffic samples, is completed, the TCP traffic samples need to be preprocessed to obtain traffic data containing both benign and spyware.

[0089] Specifically, the preprocessing operation includes the following steps:

[0090] S11. The TCP traffic sample is segmented into a five-tuple network session, including source IP address, destination IP address, source port number, destination port number, and transport layer protocol.

[0091] S12. Aggregate the five-tuple network sessions into a network flow based on the source IP address, destination IP address, and transport layer protocol;

[0092] S13. Filter the network flow to filter out network sessions that have not successfully established a TCP connection;

[0093] Specifically, the obtained TCP traffic samples include spyware samples and benign software samples. In a five-tuple network session, if a TCP connection is not fully established, it indicates that the spyware has not generated any substantial information exchange, and no data has been transmitted. This can be directly filtered, helping to reduce noise and improve computational efficiency. The network traffic flow of both benign and spyware is from the inside out.

[0094] S14. Set the maximum number of sessions threshold in the network flow.

[0095] After setting the maximum number of sessions threshold, subsequent steps extract the distribution characteristics, statistical characteristics, and trend characteristics of traffic within the set threshold range.

[0096] Figure 3 The diagram illustrates the interaction of a network flow with 4 sessions, represented by sessions 1 through 4. Figure 3The diagram is divided into two parts. The lower part represents a TCP network session interaction diagram between IP addresses 192.168.150.128 and 192.168.150.130, referred to as a network flow. Each session has a source port and a destination port; for example, in session 1, the source port number is 51164 and the destination port number is 443. The upper part is a detailed diagram of session 3, showing the details of session 3. P0-P5 represent the interactive data packets in the session. Data packets are divided into inbound and outbound packets; P1 and P4 are inbound packets, and the others are outbound packets. Inbound packets refer to data packets received by the source IP address, and outbound packets refer to data packets sent by the source IP address.

[0097] As a preferred implementation, the maximum number of sessions threshold is set to 3. Since trend features exhibit better differentiation when the number of sessions is greater than or equal to 3, and an increased number of sessions raises the risk of spyware leaking sensitive user information. Therefore, considering both detection effectiveness and reducing the risk of information leakage, the maximum number of sessions threshold is set to 3.

[0098] In step S2, feature extraction is performed within the maximum session count threshold. The extracted features include distribution features, statistical features, and trend features. Distribution and statistical features can effectively characterize the network behavior of spyware in a induced environment. Trend features can effectively characterize the changing trends of spyware's network behavior in an environment with increased induced intensity. For example... Figure 4 As shown, among the 10 spyware samples with different network behavior strategies, the number of data packets increased with the increase of induction time.

[0099] Extracting the distribution features includes the following steps: calculating the effective payload size of all data packets in each network flow, and designing multiple distribution intervals to calculate the inbound data packet payload distribution, outbound data packet payload distribution, and inbound and outbound data packet payload ratio distribution of each network flow in each distribution interval;

[0100] Specifically, we calculate the payload size (in bytes) of all packets in each network flow and design 11 distribution intervals: [0,50), [50,100), [100,200), [200,400), [400,600), [600,800), [800,1000), [1000,1500), [1500,2000), [2000,2500), [2500,+∞). We then calculate the inbound packet payload distribution, outbound packet payload distribution, and inbound and outbound packet payload ratio distribution for each network flow.

[0101] Extracting the statistical features includes the following steps: extracting inbound and outbound packet load features, inbound and outbound packet quantity features, and time interval features, and calculating the average value of these features in the session.

[0102] Extracting the trend features includes the following steps: calculating the changing trends among various features in the network flow according to the following formula. Specifically, within each flow, the changing trends between sessions, the total number of data packets, the data packet payload size, and the PUSH packet changing trends are calculated.

[0103] - 1;

[0104] in, The characteristic change trend, Features of the i-th session , The start time of the j-th session , where i and j represent the i-th session and the j-th session, respectively.

[0105] The advantages of selecting distribution features, statistical features, and trend features as the features to be extracted in this embodiment are explained below. Distribution features can effectively characterize the overall behavior of the software. For example, when uploading data, the amount of outbound (client → server) data is much greater than the amount of inbound data. Figure 5 Histograms are presented showing the distribution of inbound (server → client) and outbound packet lengths generated by malicious and benign samples in different time intervals. The horizontal axis represents the granularity range, and the vertical axis represents the proportion of packets belonging to a certain range. It can be seen that benign and malicious samples have different distribution characteristics in different time intervals; benign software tends to download resources from the server, while spyware tends to upload sensitive information to the server.

[0106] Statistical features can effectively characterize the unique network behavior of spyware. For spyware, its network behavior is primarily focused on transmitting stolen information and data, without needing to establish persistent connections. Therefore, its network behavior has the following characteristics: First, session duration is relatively short; second, within the same session, uplink packets account for a high proportion and carry more data; downlink packets are generally shorter and have smaller payloads; third, to complete information transmission as quickly as possible, spyware uses the PUSH flag more frequently. Therefore, spyware network behavior can be identified through statistical features such as inbound and outbound packet payload characteristics, inbound and outbound packet quantity characteristics, and time interval characteristics.

[0107] Trend characteristics can characterize the behavioral changes of spyware under induced operations. For example, in an induced environment, the network characteristics of spyware, such as the number of data packets and the data packet payload, are significantly increased.

[0108] In step S3, feature selection is performed on the concatenated and fused features using a genetic algorithm to obtain the optimal feature subset. When performing feature selection using the genetic algorithm, the classification accuracy of the classifier is used as the fitness of the genetic algorithm. Here, the classifier is a machine learning model used subsequently to distinguish between spyware traffic and benign application traffic. Step S3 specifically includes the following steps:

[0109] S31. Create a population containing n chromosomes, where each chromosome represents a subset of features, and each gene of the chromosome corresponds to a feature;

[0110] S32. For each chromosome, the machine learning model is trained using the corresponding feature subset, and the classification accuracy is calculated as the fitness of the genetic algorithm.

[0111] S33. Use the roulette wheel selection algorithm to select two chromosomes from the population as parent chromosomes, use the crossover operator to generate new offspring chromosomes, and then use the mutation operator to perform mutation operations on the offspring chromosomes.

[0112] S34. Replace the chromosome with the lowest fitness in the original population with the offspring chromosome to form a new population. Repeat steps S31-S33 in the new population until the number of iterations reaches the maximum value and the chromosome with the highest fitness is output to obtain the optimal feature subset.

[0113] In step S4, the feature subset is trained using a machine learning model to obtain a spyware network traffic detection model. The machine learning model used is a decision tree, random forest, K-nearest neighbor, or LightGBM.

[0114] The specific parameters for the four-class classification model are:

[0115] Decision tree DT: criterion='gini', splitter='best', max_depth=None;

[0116] Random Forest (RF): n_estimators=10,criterion='gini',min_samples_split=2;

[0117] K-Nearest Neighbors (KNN): n_neighbors=5, weight='uniform', algorithm='auto';

[0118] Lightgbm:boost_type='gbdt',learning_rate=0.2,objective='binary';

[0119] This implementation uses a machine learning toolkit, based on the Python language combined with Keras and sklearn, to build a machine learning classification model.

[0120] Example 2:

[0121] In some embodiments, an apparatus for constructing a spyware network traffic detection model based on an inducement mechanism is provided, comprising:

[0122] The induction module is used to perform induction operations on the environment to be detected and obtain TCP traffic samples;

[0123] The feature extraction module is used to extract features from the TCP traffic sample and to concatenate and fuse the extracted features.

[0124] The feature selection module is used to select the optimal feature subset from the spliced ​​and fused features based on a genetic algorithm.

[0125] The model training module is used to train a machine learning model based on the optimal feature subset to obtain a spyware network traffic detection model.

[0126] Example 3:

[0127] In some embodiments, a spyware network traffic detection method based on an inducement mechanism is provided, which detects spyware based on a model obtained by the construction method described in Embodiment 1.

[0128] Example 4:

[0129] In some embodiments, an electronic device is provided, including a processor and a storage device, the storage device storing a plurality of instructions, the processor being configured to read the plurality of instructions from the storage device and execute the method as described in Embodiment 1.

[0130] The following specific application scenario further illustrates the beneficial effects of the present invention.

[0131] In this embodiment, a training set and a test set are constructed, with no overlap between them. Considering the current reality of the continuous emergence of new spyware, to evaluate the detection capability of this embodiment against unknown spyware traffic, neither spyware traffic nor normal application traffic in the test set has appeared in the training set or the test set, making this embodiment more challenging and realistic. Furthermore, in this example, the set Tr = {Windows 7 32-bit, Windows 7 64-bit, Windows 8, Windows 10 Professional, Windows Server 2019} is used as the software sample runtime environment for the training set, and the set Te = {Windows 10 Education} is used as the software sample runtime environment for the test set.

[0132] Table 3 shows some of the spyware samples from different families and with different functions used. A total of 645 different spyware samples were used, and all samples were randomly distributed into the Tr and Te systems at a ratio of 7:3 to capture network traffic from different Windows versions of spyware. Considering the influence of human intervention, no additional operations were performed on any system after the two-stage induction operation. Network traffic of the experimental samples was captured in both Phase I and Phase II, resulting in a total of 2127 spyware network flows. Detailed dataset numbers are shown in Table 5.

[0133] Table 3

[0134]

[0135] The benign software samples used in this implementation include those from office, video, game, utility, antivirus, social networking, and other fields. Table 4 shows some of the benign software samples. All benign software samples were randomly assigned to the Tr and Te systems in a 7:3 ratio to capture benign software network traffic from different Windows versions.

[0136] Table 4

[0137]

[0138] Network traffic of the experimental samples in Phase I and Phase II was captured separately, and a total of 4437 benign software network flows were captured. The detailed number of datasets is shown in Table 5, which also shows the distribution of the training and test sets.

[0139] Table 5

[0140]

[0141] After acquiring the traffic data, this implementation method preprocesses the TCP traffic data. Three types of features—distribution features (DFs), statistical features (SFs), and trend features (TFs)—are extracted from the acquired traffic data, totaling 68 features. A genetic algorithm is then used for feature selection. Table 6 shows the feature selection results based on the genetic algorithm and the 16 selected features.

[0142] Table 6

[0143]

[0144] Table 7 shows the classification results of four classifiers in the test set when the maximum number of sessions in the network flow is set to 3 in this embodiment. The results include classification performance with and without feature selection (Have_GA). It can be seen that LightGBM performs best, with an accuracy of 99.09% and an F1 score of 98.42%. Furthermore, the performance of the feature subset obtained through feature selection is significantly better than the original feature set, with higher accuracy, FNR, and F1-score.

[0145] Table 7

[0146]

[0147] Table 8 compares the detection evaluation indicators of this embodiment with other spyware traffic detection methods when the maximum number of sessions in the network flow is set to 3.

[0148] Table 8

[0149]

[0150] This implementation uses samples of relatively active spyware collected from 2015 to 2022 as the traffic source for the test set and compares four detection methods. Method 1 analyzes network behavior based on network flow, achieving a detection accuracy of 90.32%. Although its detection rate is slightly lower, its detection timeliness is relatively better. Method 2 calculates the statistical characteristics of network behavior and combines them with machine learning methods for detection. Its detection accuracy is 91.45%, with slightly higher accuracy and recall than Method 1. Method 3 constructs a graph neural network based on network packet length to characterize network behavior in the form of packet interaction graphs, achieving an accuracy of 95.66%. However, it is not effective in detecting FTP and SMTP traffic, which are similar to spyware. Method 4 analyzes network traffic from three perspectives and utilizes the powerful feature extraction capabilities of deep learning. It does not require expert knowledge, but only achieves a detection accuracy of 93.75%, mainly because spyware traffic encryption makes it difficult to obtain effective features. Method 5 in this implementation achieves higher detection results than methods 1-4 in all aspects. Compared to other methods, SISND boasts higher detection accuracy. This is because SISND starts with the network behavior of spyware, analyzing its unique behaviors under induced conditions and designing the detection method accordingly. Secondly, SISND extracts network features from three perspectives and designs trend features to characterize the network behavior of spyware, effectively distinguishing between malicious and benign traffic. This implementation method can proactively induce spyware to generate network behavior, solving the problem of spyware not generating or generating only a small amount of malicious behavior during its incubation phase, which makes it difficult to detect. This is of great significance to the field of spyware detection. Furthermore, this implementation method detects spyware network traffic with a high accuracy of 99.13%, demonstrating excellent performance in spyware detection.

[0151] The proposed method was experimentally tested using traffic datasets generated from 645 spyware samples and 557 benign applications from various fields. The focus was on testing the method's ability to detect "unknown spyware" traffic in a real-world context. Experimental results show that the method achieves a detection accuracy of 99.13% on this traffic dataset, using only the first three network sessions for each flow, demonstrating high accuracy.

[0152] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0153] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0154] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more N executable instructions for implementing custom logic functions or processes, and the scope of preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of the invention pertain.

[0155] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0156] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any of the following techniques known in the art, or a combination thereof: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0157] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium. When executed, the program includes one or a combination of the steps of the method embodiments.

[0158] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0159] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

[0160] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if these modifications and modifications of the invention fall within the scope of the claims and their equivalents, the invention is also intended to include these modifications and modifications.

Claims

1. A method for constructing a spyware network traffic detection model based on an induction mechanism, characterized in that, The method comprises the following steps: S1, establishing a mapping between triggering conditions and effective induction operations; S2, constructing a two-stage induction operation set based on the effective induction operations; S3, performing induction operations on the environment to be detected based on the two-stage induction operation set and obtaining TCP traffic samples; S4, extracting features from the TCP traffic samples and splicing and fusing the extracted features; S5, selecting features from the spliced and fused features based on a genetic algorithm to obtain an optimal feature subset; S6, training a machine learning model based on the optimal feature subset to obtain a spyware network traffic detection model; The two-stage induction operation set comprises a fast induction stage and a comprehensive induction stage; The induction operations are performed for 12 hours, the first 2 hours being the fast induction stage and the last 10 hours being the comprehensive induction stage, and the initial frequency of the induction operations in the comprehensive induction stage is higher than that in the fast induction stage; Feature extraction is performed within a maximum session number threshold, and the extracted features include distribution features, statistical features, and trend features; Extracting the distribution features comprises calculating the size of all data packet payloads in each network flow and designing multiple distribution intervals to calculate the inbound data packet payload distribution, outbound data packet payload distribution, and inbound and outbound data packet payload ratio distribution of each network flow in each distribution interval; Extracting the statistical features comprises extracting inbound and outbound packet payload features, inbound and outbound packet number features, and time interval features; Extracting the trend features comprises calculating the trend between various features in the network flow according to the following formula: - 1； wherein, is a feature change trend, is a feature of the i-th session , is a start time of the j-th session , i, j represent the i-th session and the j-th session, respectively.

2. The method of claim 1, wherein, Establishing a mapping between triggering conditions and effective induction operations comprises: By decompiling and reading the source code, the obtained spyware samples are analyzed to locate the triggering structure of the spyware samples, and a triggering condition set R1 is obtained; Each triggering condition in the triggering condition set R1 is executed in a controlled environment, and the spyware is dynamically analyzed to obtain an effective triggering condition set R2; In the effective triggering condition set R2, the triggering conditions that successfully trigger a sample number greater than a preset value are selected and mapped as effective induction operations.

3. The method of claim 1, wherein, After obtaining the TCP traffic samples, preprocessing is required, including: Cutting the TCP traffic samples into five-tuple network sessions, including source IP address, destination IP address, source port number, destination port number, and transport layer protocol; Aggregating the five-tuple network sessions into network flows according to the source IP address, destination IP address, and transport layer protocol; Filtering the network flows to filter out network sessions that have not successfully established a TCP connection; Setting a maximum session number threshold for the network flows.

4. The method of claim 1, wherein, Step S3 comprises: S31, creating a population containing n chromosomes, each chromosome representing a feature subset, and each gene of the chromosome corresponding to a feature; S32, for each chromosome, training the machine learning model using the corresponding feature subset and calculating the classification accuracy as the genetic algorithm fitness; S33, using a roulette wheel selection algorithm to select two chromosomes as parent chromosomes from the population, using a crossover operator to generate new child chromosomes, and using a mutation operator to perform mutation operations on the child chromosomes; S34, replace the chromosome with the lowest fitness in the original population with the offspring chromosome to form a new population, repeat steps S31-S33 for the new population until the maximum number of iterations is reached and output the chromosome with the highest fitness to obtain the optimal feature subset.

5. The method of claim 1, wherein, The machine learning model used is a decision tree, random forest, K-nearest neighbor or Lightgbm.

6. A device for constructing a spyware network traffic detection model based on an inducement mechanism, characterized in that, The device is realized based on the spyware network traffic detection method of claim 1, comprising: an induction module for performing an induction operation on the environment to be detected to obtain a TCP traffic sample; a feature extraction module for extracting features from the TCP traffic sample and splicing and fusing the extracted features; a feature selection module for selecting features based on a genetic algorithm to obtain an optimal feature subset; a model training module for training a machine learning model based on the optimal feature subset to obtain a spyware network traffic detection model.

7. A method for detecting spyware network traffic based on an induced mechanism, characterized by, The model obtained based on the construction method of any one of claims 1-5 is used to detect spyware.

8. An electronic device comprising a processor and a storage device, characterized in that The storage device has a plurality of instructions, and the processor is used to read the plurality of instructions in the storage device and execute the method of any one of claims 1-5.

Images