Botnet payload sequence generation method and device based on generative adversarial network

Abstract

The present disclosure provides a botnet payload sequence generation method and device based on a generative adversarial network, comprising: obtaining communication payload data in a botnet, performing clustering processing on the communication payload data to obtain at least one clustering cluster; for each clustering cluster, performing segmentation processing on the communication payload data contained therein to obtain a first payload sub-sequence set. Construct a training data pool based on the first payload sub-sequence set, train an initial generative adversarial network according to the data in the training data pool to obtain a trained generative adversarial network; input the communication payload data into the trained generative adversarial network to output a second payload sub-sequence set; and splice the payload sub-sequences contained in the second payload sub-sequence set to obtain a payload sequence. The present disclosure realizes that the generated data conforms to the specification of the communication protocol and effectively improves the efficiency of subsequent fuzzy testing by using a generative adversarial network.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and in particular to a method and apparatus for generating botnet payload sequences based on generative adversarial networks. Background Technology

[0002] With the rapid development of distributed services, the number of botnets is also increasing year by year, and their spread may lead to large-scale and serious security incidents. Attacks targeting botnet communication protocols can force nodes offline, delaying and preventing the spread of botnets. Attacks on unknown botnets typically involve capturing and analyzing communication traffic, then sending randomly mutated payload data to the target node to suppress it. However, most of the traffic generated by random mutations in unknown botnets does not conform to their protocol specifications, making it impossible to pose an effective threat to the botnet.

[0003] Compared to random mutation methods, Generative Adversarial Networks (GANs) can automatically learn the semantic data of botnet protocol payloads, making the generated payloads more compliant with format specifications. When botnet nodes communicate, they need to mark the version and identity information of the control program, which includes a special sequence in the payload. When most payloads contain such a special sequence, GANs may incorrectly learn and emphasize the characteristics of this special sequence, causing the generator to produce a large number of such special sequences in the botnet communication payloads. This results in the generated botnet node communication payloads not conforming to the communication protocol format specifications, leading to low payload efficiency when sent to botnet nodes.

[0004] Therefore, how to utilize generative adversarial networks to generate data that not only conforms to communication protocol specifications but also improves the efficiency of subsequent fuzz testing has become an important research question. Summary of the Invention

[0005] In view of this, the purpose of this disclosure is to propose a method and apparatus for generating botnet payload sequences based on generative adversarial networks, so as to solve or partially solve the above problems.

[0006] To achieve the above objectives, the first aspect of this disclosure provides a method for generating botnet payload sequences based on generative adversarial networks, the method comprising:

[0007] Obtain communication payload data from the botnet, and perform clustering processing on the communication payload data to obtain at least one cluster.

[0008] For each of the at least one clusters, the communication payload data contained in each cluster is segmented to obtain a first payload subsequence set, wherein each cluster corresponds to a first payload subsequence set;

[0009] A training data pool is constructed based on the first payload subsequence set, and the initial generative adversarial network is trained according to the data in the training data pool to obtain the trained generative adversarial network.

[0010] The communication payload data is input into the trained generative adversarial network, and the trained generative adversarial network outputs a second payload subsequence set.

[0011] The load subsequences contained in the second load subsequence set are concatenated to obtain the load sequence.

[0012] Based on the same inventive concept, a second aspect of this disclosure proposes a botnet payload sequence generation device based on generative adversarial networks, comprising:

[0013] The clustering processing module is configured to acquire communication payload data in the botnet, perform clustering processing on the communication payload data, and obtain at least one cluster.

[0014] The segmentation processing module is configured to segment the communication payload data contained in each of the at least one cluster to obtain a first payload subsequence set, wherein each cluster corresponds to a first payload subsequence set.

[0015] The network training module is configured to construct a training data pool based on the first payload subsequence set, and train the initial generative adversarial network according to the data in the training data pool to obtain the trained generative adversarial network.

[0016] The set generation module is configured to input the communication payload data into the trained generative adversarial network and output a second payload subsequence set via the trained generative adversarial network.

[0017] The sequence generation module is configured to concatenate the load subsequences contained in the second load subsequence set to obtain a load sequence.

[0018] Based on the same inventive concept, a third aspect of this disclosure proposes an electronic device, including a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein the processor, when executing the computer program, implements the botnet payload sequence generation method based on generative adversarial networks as described above.

[0019] Based on the same inventive concept, a fourth aspect of this disclosure proposes a non-transitory computer-readable storage medium storing computer instructions for causing a computer to execute the botnet payload sequence generation method based on generative adversarial networks as described above.

[0020] As can be seen from the above, this disclosure proposes a method and apparatus for generating botnet payload sequences based on generative adversarial networks (GANs). By acquiring communication payload data from a botnet, the communication payload data is clustered to obtain at least one cluster. Payloads of the same type are grouped into the same cluster, and the payload data within the same cluster have similar characteristics and semantics. For each cluster, the communication payload data contained in each cluster is segmented to obtain a first set of payload subsequences, where each cluster corresponds to one first set of payload subsequences for subsequent training of the GAN. A training data pool is constructed based on the first set of payload subsequences, and the initial GAN ​​is trained using data from the training data pool to obtain a trained GAN. Each first set of payload subsequences is trained and generated separately, reducing the mutual influence between the second sets of payload subsequences generated in subsequent steps. The communication payload data is input into the trained generative adversarial network (GAN), which outputs a second set of payload subsequences. Because the trained GAN has learned the semantic rules of the first set of payload subsequences, the second set of payload subsequences output by the GAN better conforms to the format specifications of the original payload. By concatenating the payload subsequences contained in the second set of payload subsequences, a payload sequence is obtained. The concatenation of the payload subsequences in the second set of payload subsequences is random, therefore the payload sequence has the ability to detect unknown defects. Subsequently, the concatenated payload sequence can be used to perform defect testing on target botnet nodes to discover unknown protocol defects, thereby improving the effectiveness of the testing. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in this disclosure or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart of a botnet payload sequence generation method based on generative adversarial networks according to an embodiment of this disclosure;

[0023] Figure 2 This is a framework diagram of a botnet payload sequence generation method based on generative adversarial networks according to another embodiment of this disclosure;

[0024] Figure 3 This is a schematic diagram of clustering results in another embodiment of this disclosure;

[0025] Figure 4 This is a schematic diagram of the information entropy calculation result in another embodiment of this disclosure;

[0026] Figure 5 This is a structural block diagram of a botnet payload sequence generation device based on generative adversarial networks according to an embodiment of this disclosure;

[0027] Figure 6 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0029] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this disclosure should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar terms used in the embodiments of this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0030] The following is a definition of the terms used in this disclosure:

[0031] tcpdump is a data link layer network traffic capture tool that uses the libpcap library to capture network packets.

[0032] LSTM: Long Short-Term Memory (LSTM) is a type of recurrent neural network designed to address the long-term dependency problem inherent in general RNNs (Recurrent Neural Networks). All RNNs have a chain-like structure of repeating neural network modules.

[0033] textCNN: textCNN is a text classification model that uses a CNN network.

[0034] pcap file: pcap file is a commonly used datagram storage format. It can be understood as a file format, but the data inside is stored in a specific format.

[0035] Based on the above description, this embodiment proposes a method for generating botnet payload sequences based on generative adversarial networks, such as... Figure 1 As shown, the method includes:

[0036] Step 101: Obtain communication payload data from the botnet, and perform clustering processing on the communication payload data to obtain at least one cluster.

[0037] In practice, after acquiring communication payload data from the botnet using the data link layer network traffic capture tool tcpdump, a hierarchical clustering algorithm is employed to cluster the communication payload data. Since the hierarchical clustering algorithm does not require input parameters for the number of cluster categories, it clusters based on the semantic similarity of the input communication payload data, forming at least one cluster. Through this approach, after acquiring the communication payload data, clustering is performed to group communication payload data of the same state type together, allowing subsequent steps to use communication payload data from the same cluster to train the generative adversarial network.

[0038] Step 102: For each cluster in the at least one cluster, the communication payload data contained in each cluster is segmented to obtain a first payload subsequence set, wherein each cluster corresponds to a first payload subsequence set.

[0039] In practice, near the semantic segmentation points of the network protocol, there are significantly different control or segmentation characters or bytes, leading to increased data disorder in the sequence fragment. For each of the at least one cluster, the communication payload data contained in each cluster is segmented to obtain a first payload subsequence set. This first payload subsequence set contains at least one first payload subsequence, and each cluster corresponds to one first payload subsequence set, which is used for subsequent training of the generative adversarial network based on the first payload subsequence set.

[0040] Step 103: Construct a training data pool based on the first payload subsequence set, and train the initial generative adversarial network according to the data in the training data pool to obtain the trained generative adversarial network.

[0041] In practice, a training data pool is constructed based on the first payload subsequence set obtained in the above steps, and the initial generative adversarial network is trained using the data in the training data pool. Each first payload subsequence set contains first payload subsequences with similar formats and semantics. The generative adversarial network is trained using the first payload subsequence set to obtain the trained generative adversarial network.

[0042] For example, taking any first payload subsequence set as an example, the generative adversarial network includes a generator model and a discriminator model. In this embodiment, the generator model uses LSTM, and the discriminator model uses textCNN. During training, the generative adversarial network learns the features of the first payload subsequence set. After training, the generator model in the generative adversarial network has the ability to generate a set of similar semantic subsequences.

[0043] Step 104: Input the communication payload data into the trained generative adversarial network, and output the second payload subsequence set through the trained generative adversarial network.

[0044] In specific implementation, the trained generative adversarial network (GAN) is obtained through the above steps. The communication payload data is then input into the trained GAN, which outputs a second payload subsequence set. This second payload subsequence set has semantics similar to the first payload subsequence set. Through this scheme, because the trained GAN has learned the semantic rules of the first payload subsequence set, the second payload subsequence set output by the GAN better conforms to the format specifications of the original payload.

[0045] Step 105: Concatenate the load subsequences contained in the second load subsequence set to obtain the load sequence.

[0046] In specific implementation, the payload subsequences contained in the second payload subsequence set are concatenated using a Cartesian product algorithm. The payload subsequences in the second payload subsequence set are then paired and combined to form a complete payload sequence on the order of a power of the number of communication payload data. Through this scheme, the concatenation of the payload subsequences in the second payload subsequence set is random, thus the payload sequence has the ability to detect unknown defects. Subsequently, the concatenated payload sequence can be used to perform defect testing on target botnet nodes to discover unknown protocol defects.

[0047] By acquiring communication payload data from botnets, the data is clustered to obtain at least one cluster. Payloads of the same type are grouped into the same cluster, and the payload data within the same cluster share similar characteristics and semantics. For each cluster, the communication payload data is segmented to obtain a first payload subsequence set, where each cluster corresponds to one first payload subsequence set, which is used to train the generative adversarial network (GAN) subsequently. A training data pool is constructed based on the first payload subsequence set, and the initial GAN ​​is trained using data from the training data pool to obtain a trained GAN. Each first payload subsequence set is trained and generated separately, reducing the mutual influence between the second payload subsequence sets generated in subsequent steps. The communication payload data is input into the trained GAN, which outputs a second payload subsequence set. Because the trained GAN has learned the semantic rules of the first payload subsequence set, the second payload subsequence set output by the GAN is more consistent with the format specifications of the original payload. By concatenating the payload subsequences contained in the second payload subsequence set, a payload sequence is obtained. The concatenation of the payload subsequences in the second payload subsequence set is random, so the payload sequence has the ability to detect unknown defects. Subsequently, the concatenated payload sequence can be used to perform defect testing on the target botnet node to discover unknown protocol defects, thereby improving the effectiveness of the test.

[0048] In some embodiments, obtaining communication payload data from the botnet in step 101 specifically includes:

[0049] Step 1011: Obtain the local botnet node and the network communication line containing the local botnet node, and determine at least one remote botnet node based on the local botnet node and the network communication line.

[0050] In specific implementation, the local botnet node and the network communication line containing the local botnet node are obtained, and other network nodes that have network communication with the local botnet node are used as remote botnet nodes.

[0051] Step 1012: Generate at least one datagram based on the local botnet node, the network communication line, and the at least one remote botnet node.

[0052] In practice, the traffic data between the local botnet nodes and each remote botnet node is saved to a database. Based on the traffic data and the network communication lines, a complete data packet storage formatted document (pcap file) is generated. The pcap file format is a common data packet storage format and is the file format used by most network traffic sniffing software to record packet capture results. This embodiment uses the pcap file format because of its universality, enabling the sniffed network traffic to be read by network traffic analysis software and provided with an intuitive visualization.

[0053] Step 1013: Extract each datagram to obtain the communication payload data in the botnet.

[0054] In practice, each datagram is extracted based on the aforementioned pcap file to obtain the application layer payload data, which is the communication payload data in the botnet.

[0055] The above method identifies remote botnet nodes by connecting the local botnet node to the network communication line containing the local botnet node, making the identification of remote botnet nodes more accurate.

[0056] In some embodiments, step 101 involves clustering the communication payload data to obtain at least one cluster, specifically including:

[0057] Step 101A: Calculate the semantic similarity between any two of the communication payload data, wherein the semantic similarity is expressed by the formula:

[0058]

[0059] Where C1 is the first communication payload data, C2 is the second communication payload data, i is the sampling point number of the first communication payload data, and P i Here, j is the sampling point of the first communication payload data, and j is the sampling point number of the second communication payload data. j These are the sampling points for the second communication payload data.

[0060] Step 101B: Based on the hierarchical clustering algorithm, the communication payload data is clustered according to the semantic similarity to obtain at least one cluster.

[0061] In specific implementation, a hierarchical clustering algorithm is used to cluster the communication payload data. Since the hierarchical clustering algorithm does not require input parameters for the number of cluster categories, it clusters the data based on the semantic similarity of the input communication payload data, forming at least one cluster. Through this scheme, after obtaining the communication payload data, clustering is performed on the data to group communication payload data of the same state type together, so that subsequent steps can use communication payload data from the same cluster to train the generative adversarial network.

[0062] In some embodiments, step 102 specifically includes:

[0063] Step 1021: Obtain the pre-set information entropy threshold.

[0064] Step 1022: Traverse the communication payload data contained in each cluster to obtain at least one byte sequence.

[0065] In practice, the communication payload data contained in each cluster is traversed to obtain at least one byte sequence.

[0066] Step 1023: Calculate the information entropy value of each byte sequence and compare the information entropy value with the information entropy threshold.

[0067] In specific implementation, after traversing the communication payload data contained in each cluster to obtain at least one byte sequence, the information entropy value of each byte sequence is calculated, and the calculated information entropy value of each byte sequence is compared with the information entropy threshold to determine whether to perform segmentation.

[0068] Step 1024: In response to the information entropy value being greater than the information entropy threshold, the communication payload data is segmented to obtain a first payload subsequence set.

[0069] In specific implementation, in response to the calculated information entropy value being greater than the information entropy threshold, the communication payload data is segmented to obtain a first payload subsequence set.

[0070] The above scheme calculates the information entropy value of each byte sequence separately and compares the information entropy value with a pre-set information entropy threshold to determine whether segmentation is needed, resulting in more accurate segmentation.

[0071] In some embodiments, step 1022 specifically includes:

[0072] Step 10221: Based on the sliding window, traverse the communication payload data contained in each cluster to obtain at least one byte sequence.

[0073] In practice, each botnet payload binary data is provided with a sliding window. The communication payload data contained in each cluster is traversed based on the sliding window. The sliding window contains a partial binary byte sequence in the target botnet payload. The byte data in the window is dynamically increased or decreased as the sliding window slides backward.

[0074] In some embodiments, step 1023 specifically includes:

[0075] Step 10231: Obtain the number of bytes in the sliding window, and calculate the information entropy value of each byte sequence based on the number of bytes, wherein the information entropy value is expressed by the formula:

[0076]

[0077] Where H(X) is the information entropy value, n is the number of bytes in the sliding window, a is the byte sequence number, and x a This refers to the a-th byte in the sliding window.

[0078] Using the above scheme, by observing the changes in information entropy values ​​in the window as the sliding window slides to different positions of the load, the semantic segmentation points of the communication load between corresponding botnet nodes can be determined.

[0079] In some embodiments, step 105 is followed by:

[0080] Step 106: Send the payload sequence to at least one pre-defined target botnet node.

[0081] In practice, at least one pre-defined target botnet node is obtained, and the payload sequence is sent to at least one pre-defined target botnet node.

[0082] Step 107: For each target botnet node, the payload sequence is valid in response to the target botnet node responding to the payload sequence; or, the payload sequence is valid in response to the target botnet node receiving the payload sequence and failing to connect.

[0083] In specific implementation, after the payload sequence is sent to at least one pre-set target botnet node through the above steps, for each target botnet node, the payload sequence is valid in response to the target botnet node responding to the payload sequence or the target botnet node receiving the payload sequence and failing to connect, i.e., the node is inactive and offline.

[0084] Step 108: Count the number of valid load sequences and calculate the efficiency of the load sequences based on the number of valid load sequences.

[0085] In practice, the effective number of times the load sequence is valid is counted, and then the effectiveness rate of the load sequence is calculated.

[0086] In some embodiments, step 108 is followed by:

[0087] Step 109: Based on the Bayesian optimization algorithm, adjust the information entropy threshold according to the efficiency.

[0088] In practice, Bayesian optimization is used to dynamically adjust the information entropy threshold to a value that maximizes the efficiency of the payload sequence. Bayesian optimization finds the next interval of sampled data points with higher performance values ​​based on the known performance values ​​of the sampled data points; sampling in this next interval typically yields better results.

[0089] Based on the same inventive concept, this embodiment can be implemented in another application scenario, for example... Figure 2 As shown, it includes:

[0090] Step 201: Obtain the local botnet node and the network communication line containing the local botnet node, and determine at least one remote botnet node based on the local botnet node and the network communication line.

[0091] In specific implementation, the local botnet node and the network communication line containing the local botnet node are obtained, and other network nodes that have network communication with the local botnet node are used as remote botnet nodes.

[0092] Step 202: Generate at least one data packet based on the local botnet node, the network communication line, and the at least one remote botnet node; extract each data packet to obtain the communication payload data in the botnet.

[0093] In specific implementation, the traffic data between the local botnet nodes and each remote botnet node is saved to a database. Based on the traffic data and the network communication lines, a complete data packet storage formatted document (pcap file) is generated. The pcap file format is a common data packet storage format and is the file format used by most network traffic sniffing software to record packet capture results. This embodiment uses the pcap file format because of its universality, enabling the sniffed network traffic to be read by network traffic analysis software and provided with intuitive visualization. Based on the pcap file, each data packet is extracted to obtain the application layer payload data, i.e., the communication payload data in the botnet.

[0094] Step 203: Perform clustering processing on the communication payload data to obtain at least one cluster.

[0095] In specific implementation, a hierarchical clustering algorithm is used to cluster the communication payload data. Since the hierarchical clustering algorithm does not require input parameters for the number of cluster categories, it clusters the data based on the semantic similarity of the input communication payload data, forming at least one cluster. Through this scheme, after obtaining the communication payload data, clustering is performed on the data to group communication payload data of the same state type together, so that subsequent steps can use communication payload data from the same cluster to train the generative adversarial network.

[0096] Based on the above example Figure 3 The diagram shows one clustering result, where some loads are clustered as loads of the ping1 state type, and others as loads of the ping2 state type. Other loads are clustered as find_nodes1, find_nodes2, and other types.

[0097] Step 204: Based on the sliding window, traverse the communication payload data contained in each cluster to obtain at least one byte sequence.

[0098] In practice, each botnet payload binary data is provided with a sliding window. The communication payload data contained in each cluster is traversed based on the sliding window. The sliding window contains a partial binary byte sequence in the target botnet payload. The byte data in the window is dynamically increased or decreased as the sliding window slides backward.

[0099] Step 205: Calculate the information entropy value of each byte sequence and compare the information entropy value with the information entropy threshold; in response to the information entropy value being greater than the information entropy threshold, segment the communication payload data to obtain a first payload subsequence set.

[0100] In specific implementation, the communication payload data contained in each cluster is traversed to obtain at least one byte sequence. After obtaining at least one byte sequence from the communication payload data contained in each cluster, the information entropy value of each byte sequence is calculated. The calculated information entropy value of each byte sequence is compared with the information entropy threshold to determine whether segmentation is necessary. In response to the calculated information entropy value being greater than the information entropy threshold, the communication payload data is segmented to obtain a first payload subsequence set.

[0101] Based on the above examples, such as Figure 4 As shown, the sliding window traverses the communication payload data contained in the cluster and calculates the information entropy value of the byte sequence.

[0102] Step 206: Construct a training data pool based on the first payload subsequence set, and train the initial generative adversarial network according to the data in the training data pool to obtain the trained generative adversarial network.

[0103] In practice, a training data pool is constructed based on the first payload subsequence set obtained in the above steps, and the initial generative adversarial network is trained using the data in the training data pool. Each first payload subsequence set contains first payload subsequences with similar formats and semantics. The generative adversarial network is trained using the first payload subsequence set to obtain the trained generative adversarial network.

[0104] For example, taking any first payload subsequence set as an example, the generative adversarial network includes a generator model and a discriminator model. In this embodiment, the generator model uses LSTM, and the discriminator model uses textCNN. During training, the generative adversarial network learns the features of the first payload subsequence set. After training, the generator model in the generative adversarial network has the ability to generate a set of similar semantic subsequences.

[0105] Step 207: Input the communication payload data into the trained generative adversarial network, and output the second payload subsequence set through the trained generative adversarial network.

[0106] In specific implementation, the trained generative adversarial network (GAN) is obtained through the above steps. The communication payload data is then input into the trained GAN, which outputs a second payload subsequence set. This second payload subsequence set has semantics similar to the first payload subsequence set. Through this scheme, because the trained GAN has learned the semantic rules of the first payload subsequence set, the second payload subsequence set output by the GAN better conforms to the format specifications of the original payload.

[0107] Step 208: Concatenate the load subsequences contained in the second load subsequence set to obtain the load sequence.

[0108] In specific implementation, the payload subsequences contained in the second payload subsequence set are concatenated using a Cartesian product algorithm. The payload subsequences in the second payload subsequence set are then paired and combined to form a complete payload sequence on the order of a power of the number of communication payload data. Through this scheme, the concatenation of the payload subsequences in the second payload subsequence set is random, thus the payload sequence has the ability to detect unknown defects. Subsequently, the concatenated payload sequence can be used to perform defect testing on target botnet nodes to discover unknown protocol defects.

[0109] It should be noted that the method of this disclosure embodiment can be executed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method of this disclosure embodiment, and the multiple devices will interact with each other to complete the method described.

[0110] It should be noted that the above description describes some embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0111] Based on the same inventive concept, and corresponding to any of the above embodiments, this disclosure also provides a botnet payload sequence generation device based on generative adversarial networks.

[0112] refer to Figure 5 , Figure 5 The botnet payload sequence generation apparatus based on generative adversarial networks, as described in this embodiment, includes:

[0113] Clustering processing module 501 is configured to acquire communication payload data in the botnet, perform clustering processing on the communication payload data, and obtain at least one cluster.

[0114] The segmentation processing module 502 is configured to segment the communication payload data contained in each of the at least one cluster to obtain a first payload subsequence set, wherein each cluster corresponds to a first payload subsequence set.

[0115] The network training module 503 is configured to construct a training data pool based on the first payload subsequence set, and train the initial generative adversarial network according to the data in the training data pool to obtain the trained generative adversarial network.

[0116] The set generation module 504 is configured to input the communication payload data into the trained generative adversarial network and output a second payload subsequence set via the trained generative adversarial network.

[0117] The sequence generation module 505 is configured to concatenate the load subsequences contained in the second load subsequence set to obtain a load sequence.

[0118] In some embodiments, the clustering processing module 501 specifically includes:

[0119] The node determination unit is configured to acquire a local botnet node and a network communication line containing the local botnet node, and determine at least one remote botnet node based on the local botnet node and the network communication line.

[0120] The datagram generation unit is configured to generate at least one datagram based on the local botnet node, the network communication line, and the at least one remote botnet node;

[0121] The data extraction unit is configured to extract each datagram to obtain the communication payload data in the botnet.

[0122] In some embodiments, the clustering processing module 501 further includes:

[0123] The similarity calculation unit is configured to calculate the semantic similarity between any two of the communication payload data, wherein the semantic similarity is expressed by the formula:

[0124]

[0125] Where C1 is the first communication payload data, C2 is the second communication payload data, i is the sampling point number of the first communication payload data, and P i Here, j is the sampling point of the first communication payload data, and j is the sampling point number of the second communication payload data. j These are the sampling points for the second communication payload data;

[0126] The clustering processing unit is configured to perform clustering processing on the communication payload data based on the semantic similarity using a hierarchical clustering algorithm to obtain at least one cluster.

[0127] In some embodiments, the segmentation processing module 502 specifically includes:

[0128] The threshold acquisition unit is configured to acquire a pre-set information entropy threshold.

[0129] The traversal processing unit is configured to traverse the communication payload data contained in each cluster to obtain at least one byte sequence;

[0130] An entropy comparison unit is configured to calculate the information entropy value of each byte sequence and compare the information entropy value with the information entropy threshold.

[0131] A segmentation unit is configured to segment the communication payload data in response to the information entropy value being greater than the information entropy threshold, wherein each cluster corresponds to a first payload subsequence set.

[0132] In some embodiments, the traversal processing unit specifically includes:

[0133] The sub-units are configured to traverse the communication payload data contained in each cluster based on the sliding window to obtain at least one byte sequence.

[0134] In some embodiments, the entropy comparison unit specifically includes:

[0135] An entropy calculation subunit is configured to obtain the number of bytes in the sliding window, and calculate the information entropy value of each byte sequence based on the number of bytes, wherein the information entropy value is expressed by the formula:

[0136]

[0137] Where H(X) is the information entropy value, n is the number of bytes in the sliding window, a is the byte sequence number, and x a This refers to the a-th byte in the sliding window.

[0138] In some embodiments, after obtaining the load sequence, the apparatus further includes:

[0139] A sequence sending module is configured to send the payload sequence to at least one pre-defined target botnet node;

[0140] The validity determination module is configured to, for each target botnet node, determine whether the payload sequence is valid in response to the target botnet node responding to the payload sequence; or, determine whether the payload sequence is valid in response to the target botnet node receiving the payload sequence and failing to establish a connection.

[0141] The efficiency calculation module is configured to count the number of effective times of the load sequence and calculate the efficiency of the load sequence based on the number of effective times.

[0142] The apparatus of the above embodiments is used to implement the corresponding botnet payload sequence generation method based on generative adversarial networks in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0143] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the botnet payload sequence generation method based on generative adversarial networks described in any of the above embodiments.

[0144] Figure 6 This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0145] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0146] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0147] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0148] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0149] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0150] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0151] The electronic devices described in the above embodiments are used to implement the corresponding botnet payload sequence generation method based on generative adversarial networks in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0152] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this disclosure also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the botnet payload sequence generation method based on generative adversarial networks as described in any of the above embodiments.

[0153] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0154] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the botnet payload sequence generation method based on generative adversarial networks as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0155] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this disclosure (including the claims) is limited to these examples; within the framework of this disclosure, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this disclosure as described above, which are not provided in detail for the sake of brevity.

[0156] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this disclosure, the provided drawings may or may not show well-known power / ground connections to integrated circuit (IC) chips and other components. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this disclosure, and this also takes into account the fact that the details of implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this disclosure will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuitry) have been set forth to describe exemplary embodiments of this disclosure, it will be apparent to those skilled in the art that the embodiments of this disclosure may be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0157] Although this disclosure has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0158] This disclosure is intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for generating botnet payload sequences based on generative adversarial networks, characterized in that, include: Obtain communication payload data from the botnet, and perform clustering processing on the communication payload data to obtain at least one cluster. For each of the at least one clusters, the communication payload data contained in each cluster is segmented to obtain a first payload subsequence set, wherein each cluster corresponds to a first payload subsequence set; A training data pool is constructed based on the first payload subsequence set, and the initial generative adversarial network is trained according to the data in the training data pool to obtain the trained generative adversarial network. The communication payload data is input into the trained generative adversarial network, and the trained generative adversarial network outputs a second payload subsequence set. The load subsequences contained in the second load subsequence set are concatenated to obtain the load sequence; For each of the at least one cluster, the communication payload data contained in each cluster is segmented to obtain a first payload subsequence set, wherein each cluster corresponds to a first payload subsequence set, including: Obtain a pre-set information entropy threshold; By traversing the communication payload data contained in each cluster, at least one byte sequence is obtained; Calculate the information entropy value for each byte sequence, and compare the information entropy value with the information entropy threshold; In response to the information entropy value being greater than the information entropy threshold, the communication payload data is segmented, wherein each cluster corresponds to a first payload subsequence set; The communication payload data includes a sliding window. Traversing the communication payload data contained in each cluster yields at least one byte sequence, including: Based on the sliding window, the communication payload data contained in each cluster is traversed to obtain at least one byte sequence; After concatenating the subsequences contained in the first subsequence set to obtain the payload sequence, the method further includes: The payload sequence is sent to at least one pre-defined target botnet node; For each target botnet node, the payload sequence is valid in response to the target botnet node responding to the payload sequence; or, The payload sequence is valid in response to the target botnet node receiving the payload sequence and failing to connect. The number of effective times of the load sequence is counted, and the effectiveness rate of the load sequence is calculated based on the number of effective times. Based on the Bayesian optimization algorithm, the information entropy threshold is adjusted according to the efficiency.

2. The method according to claim 1, characterized in that, The acquisition of communication payload data in the botnet includes: Acquire local botnet nodes and network communication lines containing the local botnet nodes, and determine at least one remote botnet node based on the local botnet nodes and the network communication lines. At least one datagram is generated based on the local botnet node, the network communication line, and the at least one remote botnet node; Each datagram is extracted to obtain the communication payload data of the botnet.

3. The method according to claim 1, characterized in that, The clustering process of the communication payload data to obtain at least one cluster includes: Calculate the semantic similarity between any two of the communication payload data, wherein the semantic similarity is expressed by the formula: in, This is the first communication payload data. The first communication payload data is the second communication payload data, and i is the sampling point number of the first communication payload data. Here, j represents the sampling point of the first communication payload data, and j represents the sampling point number of the second communication payload data. These are the sampling points for the second communication payload data; Based on the semantic similarity, the communication payload data is clustered using a hierarchical clustering algorithm to obtain at least one cluster.

4. The method according to claim 1, characterized in that, The calculation of the information entropy value for each of the byte sequences includes: Obtain the number of bytes in the sliding window, and calculate the information entropy value of each byte sequence based on the number of bytes, wherein the information entropy value is expressed by the formula: in, Here, is the information entropy value, n is the number of bytes in the sliding window, and a is the byte sequence number. This refers to the a-th byte in the sliding window.

5. A botnet payload sequence generation device based on generative adversarial networks, characterized in that, include: The clustering processing module is configured to acquire communication payload data in the botnet, perform clustering processing on the communication payload data, and obtain at least one cluster. The segmentation processing module is configured to segment the communication payload data contained in each of the at least one cluster to obtain a first payload subsequence set, wherein each cluster corresponds to a first payload subsequence set. The network training module is configured to construct a training data pool based on the first payload subsequence set, and train the initial generative adversarial network according to the data in the training data pool to obtain the trained generative adversarial network. The set generation module is configured to input the communication payload data into the trained generative adversarial network and output a second payload subsequence set via the trained generative adversarial network. The sequence generation module is configured to concatenate the load subsequences contained in the second load subsequence set to obtain a load sequence; For each of the at least one cluster, the communication payload data contained in each cluster is segmented to obtain a first payload subsequence set, wherein each cluster corresponds to a first payload subsequence set, including: Obtain a pre-set information entropy threshold; By traversing the communication payload data contained in each cluster, at least one byte sequence is obtained; Calculate the information entropy value for each byte sequence, and compare the information entropy value with the information entropy threshold; In response to the information entropy value being greater than the information entropy threshold, the communication payload data is segmented, wherein each cluster corresponds to a first payload subsequence set; The communication payload data includes a sliding window. Traversing the communication payload data contained in each cluster yields at least one byte sequence, including: Based on the sliding window, the communication payload data contained in each cluster is traversed to obtain at least one byte sequence; After concatenating the subsequences contained in the first subsequence set to obtain the payload sequence, the method further includes: The payload sequence is sent to at least one pre-defined target botnet node; For each target botnet node, the payload sequence is valid in response to the target botnet node responding to the payload sequence; or, The payload sequence is valid in response to the target botnet node receiving the payload sequence and failing to connect. The number of effective times of the load sequence is counted, and the effectiveness rate of the load sequence is calculated based on the number of effective times. Based on the Bayesian optimization algorithm, the information entropy threshold is adjusted according to the efficiency.

6. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the botnet payload sequence generation method based on any one of generative adversarial networks as described in any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium storing computer instructions for causing a computer to execute the botnet payload sequence generation method based on generative adversarial networks as described in any one of claims 1 to 4.

Images