An intrusion detection method and system for multi-protocol layer network attacks

Abstract

This invention discloses an intrusion detection method for multi-protocol layer network attacks, comprising: Step 1, acquiring local area network traffic information and parsing the traffic information to obtain the corresponding protocol type; Step 2, classifying and detecting the traffic information according to the protocol type; Step 3, based on the detection results obtained in the previous step, intercepting or passing the traffic information through trust processing, and recording the detection schedule. This invention also provides an intrusion detection system. The method provided by this invention can effectively detect various types of attacks, and based on machine learning algorithms, it reduces the reliance on domain expertise, significantly ensuring the detection effect for different types of attacks.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to an intrusion detection method and system for multi-protocol layer network attacks. Background Technology

[0002] Network technology has developed rapidly over the past few decades, and network attack methods have become increasingly diversified along with this development. Intrusion detection systems (IDS), as a proactive security technology, have become an indispensable part of information system security. Traditional rule-based intrusion detection algorithms have poor generalization performance. However, existing machine learning-based intrusion detection systems have high false positive rates, with few truly effective ones, placing a burden on security personnel. While reducing alerts alleviates the burden on security personnel, the trade-off is the potential for some intrusions to go undetected. Current technologies struggle to balance the trade-off between false positives and false negatives.

[0003] Patent document CN 115834238 A discloses a network attack detection method, apparatus, system, and storage medium. This method acquires traffic information of a target network device; performs hierarchical detection processing on the traffic information; and when any detection level determines an attack, stops the next level of detection processing and sends a blocking signal to the target network device. This method utilizes a rule-based approach to extract features from application-layer fields, making it unable to handle unseen or untrained attack types.

[0004] Patent document CN115883226 A discloses a method, apparatus, device, and storage medium for analyzing vehicle network attacks. The method includes: performing layered decoding processing on vehicle network data based on a preset data processing layer to obtain layered network data, wherein the data processing layer includes a network layer, a transport layer, and an application layer; determining target data information corresponding to the layered network data for each data processing layer; and determining the network attack vehicle network data based on the target data information and a preset set of network attack rules. This method designs a detection algorithm for closed and regular vehicle networks, and can only detect targeted network intrusions. Summary of the Invention

[0005] The purpose of this invention is to provide an intrusion detection method and system for multi-protocol layer network attacks, which can effectively detect various types of attacks. At the same time, based on machine learning algorithms, it reduces the reliance on domain expertise and significantly ensures the detection effect of different types of attacks.

[0006] To achieve the first objective, this invention provides an intrusion detection method for multi-protocol layer network attacks, comprising:

[0007] Step 1: Obtain the traffic information of the local area network and parse the traffic information to obtain the corresponding protocol type. The protocol type includes non-HTTP protocol data and HTTP protocol data.

[0008] Step 2: When the traffic information belongs to non-HTTP protocol data, extract the session features from the traffic information and input them into the gradient boosting tree model based on ensemble learning for detection, so as to output the detection results.

[0009] When the traffic information belongs to HTTP protocol data, the HTTP request features in the traffic information are extracted to generate corresponding word vectors, and the detection results are obtained through a pre-built text convolutional model. The text convolutional model includes a one-dimensional convolutional layer, a max-pooling layer, and an output layer. The one-dimensional convolutional layer performs word vector multiplication on the combined text of the input word vectors with a fixed stride to obtain superimposed word vectors. The max-pooling layer is used to extract the features of the superimposed word vectors to obtain semantic features. The output layer predicts the detection results based on the obtained semantic features.

[0010] Step 3: Based on the detection results obtained in the previous step, intercept or process the traffic information through trusted methods, and record the detection schedule.

[0011] Specifically, the session features are obtained by aggregating network data packets by extracting the source IP, destination IP, source port, destination port, and protocol from the traffic information, and then extracting three types of features from the aggregated network data packets to obtain the corresponding session features. The three types of features include basic information of data packets and flows, statistical information of data packets, and state information of flows.

[0012] Specifically, the gradient boosting tree model includes a CART decision tree composed of multiple small machine learning sub-models. The XGBoost voting algorithm is used to fuse the prediction vectors of the CART decision tree sub-models to obtain a fused prediction result. The fused result is mapped into a six-dimensional vector for traffic behavior classification. The traffic behavior classification includes normal, DDoS, C&C, port scanning, DoS, and brute-force attacks. This gradient boosting tree model improves robustness by introducing regularization terms and column sampling, and also greatly improves the model's running speed by adopting a parallelization strategy when each sub-model makes predictions.

[0013] Specifically, the HTTP request characteristics include the request type, request domain name, and request body in the HTTP request.

[0014] Specifically, the word vectors are processed by using the N-Gram natural language preprocessing method to perform word embedding on the request URL obtained by concatenating HTTP request features, and the completed request URL is transformed into a matrix to obtain the corresponding word vectors.

[0015] Specifically, the process of stacking word vectors from the one-dimensional convolutional layer is as follows:

[0016] A one-dimensional convolution kernel of length k is used to move along the length of the text containing the word vectors with a stride of 1. Each time the kernel moves, it is multiplied by the word vector group of length k at the corresponding position, and then the sum is stored sequentially until the one-dimensional convolution kernel reaches the end of the text. The stored value is then output as the superimposed word vector.

[0017] Specifically, the output layer includes a fully connected layer containing multiple sub-fully connected neural networks, which makes predictions by mapping superimposed word vectors to a result convolutional kernel of length 2.

[0018] To achieve the second objective, the present invention also provides an intrusion detection system based on the above-described intrusion detection method for multi-protocol layer network attacks, including a firewall module, a classification module, a feature extraction module, a detection module, and an output recording module.

[0019] The firewall module is used to capture traffic information entering the local area network.

[0020] The classification module is used to classify the captured traffic information to obtain the protocol type corresponding to the traffic information.

[0021] The feature extraction module is used to extract features from the captured traffic information according to the protocol type in order to obtain the corresponding feature values.

[0022] The detection module is used to predict and analyze the input feature values ​​based on the protocol type of the traffic information in order to obtain the detection results of the traffic information.

[0023] The output recording module intercepts or processes traffic information based on the input detection results and records the detection schedule.

[0024] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0025] Network attacks were categorized based on the attack plane, and corresponding detection algorithms were designed for attacks with different characteristics, achieving effective detection of various types of attacks. At the same time, based on machine learning algorithms, the reliance on domain expertise was reduced, and the detection effect of different types of attacks was significantly guaranteed. Attached Figure Description

[0026] Figure 1 This embodiment provides a flowchart of an intrusion detection method for multi-protocol layer network attacks;

[0027] Figure 2 A schematic diagram of the framework of the text convolution model provided in this embodiment;

[0028] Figure 3 This is a schematic diagram of an intrusion detection system provided in this embodiment. Detailed Implementation

[0029] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application.

[0030] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0031] like Figure 1 As shown, an intrusion detection method for multi-protocol layer network attacks includes:

[0032] Step 1: Obtain the traffic information of the local area network and parse the traffic information to obtain the corresponding protocol type. The protocol type includes non-HTTP protocol data and HTTP protocol data.

[0033] Step 2: When the traffic information belongs to non-HTTP protocol data, extract the session features from the traffic information and input them into the gradient boosting tree model based on ensemble learning for detection, so as to output the detection results.

[0034] More specifically, network data is acquired by listening to network ports or reading data files, and the five-tuple (source IP, destination IP, source port, destination port, protocol) of network packets is analyzed as an identifier, and network packets are aggregated based on the five-tuple.

[0035] Stream features are extracted from sessions composed of 5-tuples, which include three types of features: basic information of packets and streams, such as ports and protocols; statistical information of packets, such as the number of packets, packet length, and number of bytes in the stream; and state information of the stream, such as duration and active time, to generate structured feature data, as shown in Table 1.

[0036] Table 1

[0037] Basic IP Information Basic packet timing information Packet count information Packet length information Flag Statistics src_ip flow_duration tot_fwd_pkts totlen_fwd_pkts fin_flag_cnt dst_ip flow_byts_s tot_bwd_pkts totlen_bwd_pkts syn_flag_cnt src_port flow_pkts_s fwd_pkt_len_max rst_flag_cnt dst_port fwd_pkts_s fwd_pkt_len_min psh_flag_cnt

[0038] The generated structured feature data is used for classification using an ensemble learning-based gradient boosting tree model. When there is little training data, the XGBoost model can be used, while when there is a lot of training data, an ensemble model of Transformer and XGBoost can be used. Different granularities of classification can be achieved based on the label granularity of the training data.

[0039] The generated structured feature data is then used for classification using a gradient boosting tree model based on ensemble learning. Different granularities of classification can be achieved based on the label granularity of the training data.

[0040] The model's output determines whether the quintuple is an attack; if it is, the source IP is reported as an abnormal IP.

[0041] like Figure 2 As shown, when the traffic information belongs to HTTP protocol data, the HTTP request features in the traffic information are extracted to generate corresponding word vectors, and the detection results are obtained through a pre-built text convolutional model. The text convolutional model includes a one-dimensional convolutional layer, a max-pooling layer, and an output layer. The one-dimensional convolutional layer performs word vector multiplication on the combined text of the input word vectors with a fixed stride to obtain superimposed word vectors. The max-pooling layer is used to extract the features of the input superimposed word vectors to obtain semantic features. The output layer predicts the detection results based on the obtained semantic features.

[0042] More specifically, the reverse proxy service deployed at the server application layer captures HTTP requests in real time and extracts key fields, including request type, request domain name, and request body.

[0043] The request type, request domain name, and request body string are concatenated to form a complete request URL. The natural language preprocessing method N-Gram is used to perform word embedding on each character in the request URL, and the request URL is transformed into a matrix of word vector combinations.

[0044] The word vector combination first passes through the model's first structure, a one-dimensional convolutional layer: a one-dimensional tensor (convolutional kernel) of length k moves along the text length direction of the word vector combination with a stride of 1. Each time the convolutional kernel moves, it is multiplied by the corresponding word vector group of length k and then summed. The resulting values ​​are stored sequentially into a new one-dimensional tensor. Finally, when it moves to the end of the text length, a new word vector group is generated, which contains the semantic information of the request URL.

[0045] Based on the length of the feature fields in the actual attack text, the size of the convolution kernel k in the first step is changed. The first step is repeated, and the results are combined along the text length direction to improve the model's generalization ability, enabling the model to extract abnormal features of different lengths from the request URL.

[0046] The output structure of the one-dimensional convolutional layer is fed into the second structure of the model, the Max-pooling layer. The Max-pooling layer combines the semantic information extracted in the previous step to extract more complex semantic features.

[0047] The output of Max-pooling is then passed through the third fully connected layer of the model. The fully connected layer contains multiple fully connected neural networks, and the final output is a tensor of length 2, which indicates whether the model predicts whether the requested URL is abnormal. If it is abnormal, it will be blocked.

[0048] Step 3: Based on the detection results obtained in the previous step, intercept or process the traffic information through trusted methods, and record the detection schedule.

[0049] like Figure 3 As shown, this embodiment also provides an intrusion detection system, which is based on the intrusion detection method for multi-protocol layer network attacks provided in the above embodiment, including a firewall module, a classification module, a feature extraction module, a detection module, and an output recording module.

[0050] The firewall module is used to capture traffic information entering the local area network.

[0051] The classification module is used to classify the captured traffic information to obtain the protocol type corresponding to the traffic information.

[0052] The feature extraction module is used to extract features from the captured traffic information according to the protocol type in order to obtain the corresponding feature values.

[0053] The detection module is used to predict and analyze the input feature values ​​based on the protocol type of the traffic information in order to obtain the detection results of the traffic information.

[0054] The output recording module intercepts or processes traffic information based on the input detection results and records the detection schedule.

[0055] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0056] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. An intrusion detection method for multi-protocol layer network attacks, characterized in that, include: Step 1: Obtain the traffic information of the local area network and parse the traffic information to obtain the corresponding protocol type. The protocol type includes non-HTTP protocol data and HTTP protocol data. Step 2: When the traffic information belongs to non-HTTP protocol data, extract the session features from the traffic information and input them into the gradient boosting tree model based on ensemble learning for detection, so as to output the detection results; When the traffic information belongs to HTTP protocol data, the HTTP request features in the traffic information are extracted to generate corresponding word vectors, and the detection results are obtained through a pre-built text convolution model. The text convolution model includes a one-dimensional convolutional layer, a max-pooling layer and an output layer. The one-dimensional convolutional layer performs word vector multiplication on the combined text of the input word vectors with a fixed stride to obtain superimposed word vectors. The max-pooling layer is used to extract the features of the superimposed word vectors to obtain semantic features. The output layer predicts the detection results based on the obtained semantic features. The word vectors are processed by the N-Gram natural language preprocessing method to embed the request URL obtained by concatenating HTTP request features, and the completed request URL is transformed into a matrix to obtain the corresponding word vectors. The specific process of the one-dimensional convolutional layer outputting superimposed word vectors is as follows: A one-dimensional convolution kernel of length k is moved along the length of the text containing the word vectors with a stride of 1. Each time the kernel moves, it is multiplied by the word vector group of length k at the corresponding position, and the sum is stored sequentially until the one-dimensional convolution kernel reaches the end of the text. The stored value is then output as the superimposed word vector. Step 3: Based on the detection results obtained in Step 2, intercept or process the traffic information through trust, and record the detection schedule.

2. The intrusion detection method for multi-protocol layer network attacks according to claim 1, characterized in that, The session features are obtained by aggregating network data packets by extracting source IP, destination IP, source port, destination port and protocol from traffic information, and extracting three types of features from the aggregated network data packets to obtain the corresponding session features. The three types of features include basic information of data packets and flows, statistical information of data packets and state information of flows.

3. The intrusion detection method for multi-protocol layer network attacks according to claim 1, characterized in that, The gradient boosting tree model includes a CART decision tree composed of multiple small machine learning sub-models. The XGBoost voting algorithm is used to fuse the prediction vectors of the CART decision tree sub-models to obtain a fused prediction result. The fused result is mapped into a six-dimensional vector for traffic behavior classification. The traffic behavior classification includes normal, DDoS, C&C, port scanning, DoS, and brute-force attacks.

4. The intrusion detection method for multi-protocol layer network attacks according to claim 1, characterized in that, The HTTP request characteristics include the request type, request domain name, and request body.

5. The intrusion detection method for multi-protocol layer network attacks according to claim 1, characterized in that, The output layer includes a fully connected layer containing multiple sub-fully connected neural networks, which makes predictions by mapping superimposed word vectors to a result convolutional kernel of length 2.

6. An intrusion detection system, characterized in that, The intrusion detection method for multi-protocol layer network attacks as described in any one of claims 1 to 5 includes a firewall module, a classification module, a feature extraction module, a detection module, and an output recording module. The firewall module is used to capture traffic information entering the local area network; The classification module is used to classify the captured traffic information to obtain the protocol type corresponding to the traffic information. The feature extraction module is used to extract features from the captured traffic information according to the protocol type in order to obtain the corresponding feature values. The detection module is used to perform predictive analysis on the input feature values ​​based on the protocol type of the traffic information in order to obtain the detection results of the traffic information. The output recording module intercepts or processes traffic information based on the input detection results and records the detection schedule.

Images