Model training method, encrypted data processing method, and related devices

Abstract

The application discloses a model training method, an encrypted data processing method and related equipment, and relates to the technical field of computer security, and the method comprises the following steps: collecting historical encrypted data, the historical encrypted data being malicious encrypted data or non-malicious encrypted data; based on process information of a historical process sending the historical encrypted data, statistically analyzing the number of occurrences of the historical process to obtain statistical analysis data; taking the historical encrypted data and the statistical analysis data as training data samples, training a machine learning model, so that the machine learning model is applicable to predicting the prediction probability of the historical process sending the historical encrypted data, and outputting a judgment label for indicating whether the historical encrypted data is malicious encrypted data. The application solves the problem that a large amount of resources are consumed when a simulated environment is constructed to identify malicious encrypted traffic.

Description

Technical Field

[0001] This application relates to the field of computer security technology, specifically to a model training method, an encrypted data processing method, and related equipment. Background Technology

[0002] This section is intended to provide background or context for the embodiments of the invention set forth in the claims. It should not be construed as an admission that the description herein is prior art.

[0003] With the continuous escalation of internet attack and defense, new network technologies are constantly iterating, and network structures are becoming increasingly complex. At the same time, the widespread application of encryption technology has led to an explosive growth in encrypted traffic. While protecting user privacy, encryption technology has also profoundly changed the nature of cybersecurity threats, allowing viruses, botnets, and Trojans that utilize encryption to spread widely. Traditional detection techniques are often ineffective against malicious encrypted traffic.

[0004] To better identify malicious encrypted traffic, traditional methods rely on sandboxing to tag encrypted traffic. This involves uploading legitimate / malicious executable files, selecting appropriate execution environments, and simulating the user's real-world environment to prevent executable file escape or resistance. The uploaded file is then executed to obtain encrypted traffic data generated under the same real-world conditions. However, this approach requires constructing simulated environments, and depending on the executable file type, version, and execution environment, various operating systems such as Windows, Windows Server, Linux, and Android need to be built, along with different versions of environments such as Windows XP, Windows 7, and Windows 10, and different types of software such as Adobe PDF, Adobe Flash, and Office Word. This consumes significant human and material resources, and if the conditions for executable file execution / triggering cannot be accurately predicted / judged, communication between executable files / encrypted traffic / malicious encrypted traffic may not be triggered, directly impacting subsequent traffic analysis results. Summary of the Invention

[0005] This application provides a model training method, an encrypted data processing method, and related equipment to at least solve the problem in the prior art that identifying malicious encrypted traffic requires building a simulation environment and consumes a lot of resources.

[0006] According to one aspect of this application, a model training method is also provided, comprising:

[0007] Collect historical encrypted data, which may be malicious or non-malicious encrypted data;

[0008] Based on the process information of the historical process that issued the historical encrypted data, statistical analysis is performed on the number of times the historical process occurred to obtain statistical analysis data.

[0009] The historical encrypted data and the statistical analysis data are used as training data samples to train the machine learning model, so that the machine learning model is suitable for predicting the probability of the historical encrypted data being sent by the historical process, and outputting a judgment label to indicate whether the historical encrypted data is malicious encrypted data.

[0010] In some embodiments, before performing statistical analysis on the frequency of occurrence of the historical process based on the process information of the historical process that issued the historical encrypted data, the method further includes:

[0011] Collect the process information of the historical process;

[0012] The step of statistically analyzing the frequency of occurrence of the historical process based on the process information of the historical process that issued the encrypted data includes:

[0013] The historical encrypted data from the historical process is associated with the process information to obtain the association relationship between the historical encrypted data and the process information;

[0014] Based on the aforementioned correlation, a statistical analysis is performed on the frequency of occurrence of the historical processes corresponding to the historical encrypted data.

[0015] In some embodiments, the process information includes first network communication information of the historical process, and when collecting historical encrypted data, the method further includes:

[0016] The second network communication information for determining the historical encrypted data;

[0017] The step of associating the historical encrypted data from the historical process with the process information includes:

[0018] Based on the consistency between the second network communication information and the first network communication information, it is determined whether the historical encrypted data comes from the historical process. If so, the historical encrypted data is associated with the process information.

[0019] In some embodiments, the process information includes multiple process features, including features of first network communication information describing the historical process, and / or features of host information describing the historical process. The step of obtaining the statistical analysis data includes:

[0020] Based on the aforementioned association, statistical analysis is performed on the frequency of occurrence of the historical process corresponding to the historical encrypted data, and statistical analysis is performed on the frequency of occurrence of the process feature under the historical process corresponding to the historical encrypted data, thereby obtaining the statistical analysis data.

[0021] Then, the historical encrypted data and the statistical analysis data are used as training data samples to train the machine learning model, so that the machine learning model is suitable for predicting the probability of the historical process sending the historical encrypted data and outputting a judgment label indicating whether the historical encrypted data is malicious encrypted data, and also outputting the process characteristics of the historical process.

[0022] In some embodiments, the process information includes multiple process characteristics. The steps of statistically analyzing the frequency of occurrence of the historical process corresponding to the historical encrypted data, and statistically analyzing the frequency of occurrence of the process characteristics under the historical process corresponding to the historical encrypted data, include:

[0023] Determine the number of times one of the historical processes corresponding to the historical encrypted data occurs, and based on the number of occurrences, determine the total number of occurrences of the various historical processes corresponding to the historical encrypted data;

[0024] Determine the number of features of the process features under one of the historical processes corresponding to the historical encrypted data, and based on the number of features, determine the total number of features of the process features under multiple historical processes corresponding to the historical encrypted data;

[0025] Based on the number of occurrences and the total number of occurrences, the process occurrence ratio of the historical process is determined, and based on the number of features and the total number of features, the feature occurrence ratio of the process feature is determined, so as to obtain the statistical analysis data including the process occurrence ratio and the feature occurrence ratio;

[0026] The steps of using the historical encrypted data and the statistical analysis data as training data samples to train the machine learning model include:

[0027] The historical encrypted data, the process occurrence ratio, and the feature occurrence ratio are used as training data samples to train the machine learning model, so that the machine learning model is suitable for predicting the probability of the historical process sending the historical encrypted data and outputting a judgment label indicating whether the historical encrypted data is malicious encrypted data, and also outputting the process features of the historical process.

[0028] In some embodiments, during the training of the machine learning model using the historical encrypted data, the process occurrence ratio, and the feature occurrence ratio as training data samples, the method further includes:

[0029] Based on the predicted probability, a first weight is calculated for the historical encrypted data sent by the historical process, and a second weight is calculated for each process feature under the historical process.

[0030] The predicted probability predicted by the machine learning model is updated based on the first weight, the second weight, the process occurrence ratio, and the feature occurrence ratio.

[0031] According to another aspect of this application, an encrypted data processing method is also provided, comprising:

[0032] Encrypted data is input into a machine learning model, which predicts the process of sending the encrypted data and outputs a judgment label indicating whether the encrypted data is malicious. The machine learning model is a model trained according to the model training method described above.

[0033] Based on the evaluation tags, the encrypted data, which is malicious encrypted data, is statistically analyzed to obtain statistical information. During the statistical analysis, the process name of the predicted process is used to identify the encrypted data.

[0034] In some embodiments, the step of statistically analyzing the encrypted data as malicious encrypted data based on the evaluation tags further includes:

[0035] Detect malicious scores in the encrypted data and record the malicious scores in the statistical information.

[0036] According to another aspect of this application, a computer device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described method steps.

[0037] According to another aspect of this application, a computer-readable storage medium is also provided, the computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method steps.

[0038] According to another aspect of this application, a computer program product is also provided, the computer program product comprising a computer program that, when executed by a processor, implements the above-described method steps.

[0039] This application embodiment statistically analyzes a large number of historical processes that send encrypted data. Based on the historical encrypted data sent by the historical processes with added evaluation labels and the statistical analysis data, a machine learning model is trained. This enables the machine learning model to predict the probability of historical encrypted data being sent by historical processes and output evaluation labels indicating whether the historical encrypted data is malicious. Subsequently, newly emerging encrypted data can be input into the machine learning model to achieve the purpose of automated labeling of encrypted data, thereby accurately identifying which process sent the normal or malicious encrypted data. This replaces the original sandbox-based encrypted data labeling method, which can improve the real-time performance and accuracy of malicious encrypted data detection without the need for a simulated environment, and reduces resource consumption. Attached Figure Description

[0040] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0041] Figure 1 This is a schematic flowchart of a model training method provided in an embodiment of the present invention;

[0042] Figure 2 This is a schematic diagram of a statistical analysis process provided in an embodiment of the present invention;

[0043] Figure 3 This is a schematic diagram of the process for obtaining statistical analysis data according to an embodiment of the present invention;

[0044] Figure 4 This is a schematic diagram of the update process of a machine learning model provided in an embodiment of the present invention;

[0045] Figure 5 This is a flowchart illustrating an embodiment of the encrypted data processing method provided by the present invention;

[0046] Figure 6 This is a schematic diagram illustrating the association between encrypted traffic fingerprints and processes, provided in an embodiment of the present invention.

[0047] Figure 7 This is a statistical analysis diagram provided in an embodiment of the present invention;

[0048] Figure 8 This is a schematic diagram of a training data sample provided in an embodiment of the present invention. Detailed Implementation

[0049] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0050] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0051] Traditional methods for tagging encrypted traffic using sandboxes require simulating the user's real environment, resulting in high resource consumption. To address this, the first embodiment of this invention provides a model training method, such as... Figure 1 As shown, the method includes the following steps:

[0052] Step S11: Collect historical encrypted data. This historical encrypted data can be malicious or non-malicious. Non-malicious encrypted data refers to normal encrypted data under normal communication conditions, excluding malicious encrypted data related to viruses, botnets, Trojans, etc., that utilize encryption technology. In other words, this invention collects both normal and malicious historical encrypted data to input into a machine learning model for training. This embodiment of the invention can collect and store encrypted data in real time on the network side. This encrypted data can be in formats such as JA3 (a technology for identifying clients establishing encrypted connections), Mercury (a network fingerprinting standard), and Hassh (a network fingerprinting standard used to identify specific client or server-side Secure Shell protocol SSH implementations, using the MD5 algorithm to store its fingerprint), etc., representing encrypted traffic fingerprints.

[0053] Step S12: Based on the process information of the historical processes that issue historical encrypted data, perform statistical analysis on the number of occurrences of the historical processes to obtain statistical analysis data.

[0054] Step S13: Use historical encrypted data and statistical analysis data as training data samples to train the machine learning model, so that the machine learning model is suitable for predicting the probability of historical encrypted data being sent by historical processes, and outputs a judgment label indicating whether the historical encrypted data is malicious. Machine learning models are divided into two main categories according to the data types that can be used: supervised learning and unsupervised learning. Among them, supervised learning mainly includes models for classification and regression, while unsupervised learning mainly includes data clustering (K-means) / data dimensionality reduction (PCA), etc. This embodiment of the invention mainly uses a linear model for regression to predict the probability of historical encrypted data being sent by historical processes.

[0055] This invention, through statistical analysis of historical processes that send large amounts of encrypted data, trains a machine learning model based on the historical encrypted data with added evaluation labels and the statistical analysis data. This enables the machine learning model to predict the probability of sending normal or malicious encrypted data from historical processes and to label the predicted historical encrypted data with evaluation labels indicating whether it is malicious or normal. Subsequently, newly emerging encrypted data can be input into the machine learning model to achieve automated labeling of encrypted data, thereby accurately identifying which process sent the normal or malicious encrypted data. This replaces the original sandbox-based encrypted data labeling method, improving the real-time performance and accuracy of malicious encrypted data detection without requiring a simulated environment, and reducing resource consumption.

[0056] In step S12, before performing statistical analysis on the frequency of occurrence of historical processes based on the process information of historical processes that send historical encrypted data, the method provided in this embodiment of the invention further includes:

[0057] Collect historical process information. This information can be collected in real-time on the host side. It includes the process name, destination IP address, destination port, source port, and basic host information such as the operating system type and host IP address. For example... Figure 2 As shown, step S12, which involves statistically analyzing the frequency of occurrence of historical processes based on the process information of historical processes that send historical encrypted data, includes the following steps:

[0058] Step S21: Associate the historical encrypted data from the historical process with the process information to obtain the association relationship between the historical encrypted data and the process information. Based on the association relationship, the historical encrypted data sent by the historical process can be obtained.

[0059] Step S22: Based on the correlation, perform statistical analysis on the frequency of occurrence of historical processes corresponding to historical encrypted data. Therefore, this embodiment of the invention, based on a large amount of historical process data on the host, performs statistical analysis on the occurrence of historical processes that send corresponding historical encrypted data. In the next step of model training, it utilizes the multi-dimensional features of big data to train a machine learning model to reverse-engineer the process of a certain encrypted data, thereby enabling the machine learning model to predict which process originates from newly appearing malicious or normal encrypted data.

[0060] In this embodiment of the invention, the process information includes first network communication information of historical processes. The first network communication information includes information such as the destination IP, destination port, and source port accessed by the historical processes. When collecting historical encrypted data, the method further includes: determining second network communication information of the historical encrypted data. The second network communication information is the destination IP, destination port, and source port corresponding to the historical encrypted data. The step of associating historical encrypted data from historical processes with the process information includes: determining whether the historical encrypted data comes from a historical process based on the consistency between the second network communication information and the first network communication information; if so, associating the historical encrypted data with the process information. During association, the destination IP, destination port, and source port of the encrypted data must be consistent with the destination IP, destination port, and source port of the historical process, i.e., the second network communication information is consistent with the first network communication information, indicating that the historical encrypted data comes from the corresponding historical process.

[0061] In this embodiment of the invention, process information includes various process features, including the process name, features describing the first network communication information of the historical process, such as destination IP, destination port, source port, etc., and / or features describing the host information of the historical process, such as operating system, host user, host IP, etc. Before obtaining statistical analysis data, the method provided in this embodiment of the invention further includes: statistically analyzing the occurrence frequency of historical processes corresponding to historical encrypted data according to the correlation, and statistically analyzing the occurrence frequency of process features under the historical processes corresponding to historical encrypted data to obtain statistical analysis data. In step S13 of this embodiment of the invention, the historical encrypted data and statistical analysis data are used as training data samples to train the machine learning model so that the machine learning model is suitable for predicting the probability of historical processes sending historical encrypted data and outputting a judgment label indicating whether the historical encrypted data is malicious encrypted data, and also outputting the process features of the historical process. Therefore, embodiments of the present invention can collect hundreds of thousands of process characteristics such as process names, destination ports, and operating systems on the host. When training the model, the multi-dimensional characteristics of big data can be used to reverse-engineer process characteristics such as process names and operating systems of a certain malicious or normal encrypted data. The larger the host scale and the more data, the more accurate the final output of the machine learning model, thereby achieving accurate identification of encrypted data.

[0062] like Figure 3 As shown, the steps for statistically analyzing the occurrence frequency of historical processes corresponding to historical encrypted data, and statistically analyzing the occurrence frequency of process characteristics under historical processes corresponding to historical encrypted data, include:

[0063] Step S31: Determine the number of times one type of historical process corresponding to the historical encrypted data appears, and based on the number of appearances, determine the total number of appearances of various historical processes corresponding to the historical encrypted data. For example, if the Chrome process corresponding to the historical encrypted data appears ten times, and the historical encrypted data also corresponds to processes such as Scrapy and WebKit, and if the Scrapy process appears twice and the WebKit process appears three times, then the total number of appearances of various historical processes corresponding to the historical encrypted data is fifteen times (this data is only an example; the more processes there are, the greater the total number of appearances).

[0064] Step S32: Determine the feature count of the process feature under one type of historical process corresponding to the historical encrypted data, and based on the feature count, determine the total feature count of the process feature under multiple historical processes corresponding to the historical encrypted data. For example, if the number of "Windows" operating systems corresponding to the historical encrypted data is 11, then the feature count of the "Windows" process feature is 11. Then, based on the feature count of each operating system under multiple historical processes, obtain the total feature count.

[0065] Step S33: Based on the number of occurrences and the total number of occurrences, determine the process occurrence ratio of the historical process, and based on the number of features and the total number of features, determine the feature occurrence ratio of the process features to obtain statistical analysis data including the process occurrence ratio and the feature occurrence ratio. Wherein, the process occurrence ratio is the ratio of the number of occurrences to the total number of occurrences, and the feature occurrence ratio is the ratio of the number of features to the total number of features. Based on the above steps S31 to S33, in this embodiment of the invention, step S13, which uses historical encrypted data and statistical analysis data as training data samples to train the machine learning model, includes: using historical encrypted data, the process occurrence ratio, and the feature occurrence ratio as training data samples to train the machine learning model so that the machine learning model is suitable for predicting the probability of a historical process sending historical encrypted data, and outputting a judgment label indicating whether the historical encrypted data is malicious encrypted data, and also outputting the process features of the historical process.

[0066] Therefore, by statistically analyzing a large number of historical processes that send encrypted data, and training a machine learning model based on the historical encrypted data with added evaluation labels and statistical analysis data sent by the historical processes, the machine learning model can be used to predict the probability of sending normal or malicious encrypted data by historical processes. Evaluation labels are then added to the predicted historical encrypted data. Subsequently, the encrypted data can be input into the machine learning model to achieve the purpose of automatic labeling of encrypted data, thereby accurately identifying which process sent the normal or malicious encrypted data. This can improve the real-time performance and accuracy of detecting malicious encrypted data without the need for a simulated environment.

[0067] like Figure 4 As shown, in the process of training the machine learning model using historical encrypted data, process occurrence ratio, and feature occurrence ratio as training data samples, the method provided in this embodiment of the invention further includes the following steps:

[0068] Step S41: Based on the predicted probability, calculate the first weight of the historical encrypted data sent by the historical process, and calculate the second weight of each process feature under the historical process. In this embodiment of the invention, a linear regression algorithm can be used to calculate each weight. After correcting the predicted probability using a loss function and the true value, the predicted probability corrected by the loss function is solved through a normal equation to obtain the value of each weight. Here, the true value is the value "1", which represents whether the historical encrypted data was actually malicious or normal encrypted data.

[0069] Step S42: Update the predicted probability of the machine learning model based on the first weight, the second weight, the process occurrence ratio, and the feature occurrence ratio. In this embodiment, the feature occurrence ratio varies depending on the process feature, such as the host IP occurrence ratio, the operating system occurrence ratio, and so on, including the occurrence ratio of process feature N. The second weight also varies depending on the process feature, such as the second weight of the host IP (represented as weight B for ease of calculation), the second weight of the operating system (weight C), and the second weight of process feature N (weight N). Therefore, when updating the predicted probability of the machine learning model in step S42, the model updates its predicted probability of historical encrypted data being sent by historical processes based on the first weight, the second weight, the process occurrence ratio, and the feature occurrence ratio. The updated predicted probability = process occurrence ratio * first weight + host IP occurrence ratio * weight B + operating system occurrence ratio * weight C + ... + occurrence ratio of process feature N * weight N. This makes the predicted probability of the machine learning model more accurate during the training process, allowing the predicted probability to gradually approach the true value. When new encrypted data is subsequently input, the probability that the corresponding process will send such encrypted data becomes more accurate.

[0070] Through the operations of steps S41 to S42 described above, the machine learning model is updated, enabling the trained machine to perform reverse analysis of encrypted data, such as process names and operating systems, and the final prediction output of the machine learning model is more accurate, thereby achieving accurate identification of newly emerging encrypted data.

[0071] The second embodiment of the present invention also provides a method for encrypting data processing, such as... Figure 5 As shown, the method includes the following steps:

[0072] Step S51: Input the encrypted data into the machine learning model, predict the process of sending the encrypted data through the machine learning model, and output a judgment label indicating whether the encrypted data is malicious. The machine learning model is a model trained according to the model training method. For details of the model training method, please refer to the content provided in the first embodiment of the present invention, which will not be repeated here.

[0073] Step S52: Based on the evaluation label, perform statistics on the encrypted data that is malicious encrypted data to obtain statistical information. During the statistics, the process name of the predicted process is used to identify the encrypted data.

[0074] Therefore, this invention uses a trained machine learning model to reverse-engineer newly emerging encrypted data. After inferring the process to which the encrypted data belongs through the machine learning model, the malicious encrypted data is identified by the process name of the corresponding process. This accurately identifies which process issued the normal or malicious encrypted data. The obtained software process name is displayed on the designated product console to assist enterprises in determining which specific process issued the external encrypted data, thereby pinpointing potential security issues. This replaces the original sandbox-based encrypted data tagging method, improving the real-time performance and accuracy of malicious encrypted data detection without requiring a simulated environment, while reducing resource consumption. Furthermore, this invention avoids the drawbacks of sandbox-based encrypted data tagging methods, such as the risk of secondary software re-execution and the inability to effectively capture packets for analysis, which affect the effectiveness of the method.

[0075] In step S52, the step of statistically analyzing encrypted data that is malicious based on the evaluation tags further includes: detecting the maliciousness score of the encrypted data and recording the maliciousness score in the statistical information. The maliciousness score is obtained by using detection software to detect the degree of malice in encrypted data that is considered malicious, based on the evaluation tags (which indicate whether the encrypted data is malicious). The higher the score, the greater the threat level. Therefore, the threat intelligence database can intercept malicious encrypted traffic in real time based on the maliciousness scores of each encrypted data.

[0076] This invention achieves automated labeling of encrypted data by associating a large amount of process data with encrypted network data and then using a machine learning model to infer the process to which the corresponding encrypted data belongs. This replaces the previous method of requiring a simulated environment to execute malware, eliminating the need for additional environment setup and execution of malware, thus reducing the risks of malware reuse and virtual environment escape. Furthermore, it eliminates the need for additional packet capture analysis; a machine learning model trained using historical encrypted data and its corresponding host processes can be used to label the encrypted data.

[0077] The third embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements a model training method and an encrypted data processing method. For details of the model training method, please refer to the content provided in the first embodiment of the present invention. For the encrypted data processing method, please refer to the content provided in the second embodiment of the present invention. The embodiments of the present invention will not be described again here.

[0078] The fourth embodiment of the present invention also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements a model training method and an encrypted data processing method. For details of the model training method, please refer to the content provided in the first embodiment of the present invention. For the encrypted data processing method, please refer to the content provided in the second embodiment of the present invention. The embodiments of the present invention will not be described again here.

[0079] The fifth embodiment of the present invention also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements a model training method and an encrypted data processing method. For details of the model training method, please refer to the content provided in the first embodiment of the present invention. For the encrypted data processing method, please refer to the content provided in the second embodiment of the present invention. The embodiments of the present invention will not be described again here.

[0080] The sixth embodiment of the present invention, based on the above five embodiments, further provides an application embodiment of the encrypted data processing method. Specifically, the encrypted data is an encrypted traffic fingerprint collected from the network side, and the method includes the following steps:

[0081] Step 1: Collect and store encrypted traffic fingerprint information of normal and malicious traffic in real time on the network side. The encrypted traffic fingerprint format is JA3, Mercury, Hassh, etc.

[0082] Step 2: Collect process information in real time on the host side. The process information includes the destination IP, destination port, source port and other first network communication information accessed by the process, as well as host information such as operating system type and host IP.

[0083] Step 3: Perform correlation analysis between the encrypted traffic fingerprints collected from the network side and the process information collected from the host side, such as... Figure 6As shown, during the association process, the destination IP, destination port, and source port of the encrypted traffic fingerprint must match the destination IP, destination port, and source port of the process. This means the second network communication information must match the first network communication information, indicating that the historical encrypted data originated from the corresponding historical process. For example, if the encrypted traffic fingerprint "f8b2cebce1ded615674781e705c16cc2" has a destination port of 443, a destination IP of aaaa, and a source port of 1234, and a comparison reveals that the process "Chrome Browser" has the same destination port, destination IP, and source port of 1234, then the "Chrome Browser" process is associated with the encrypted traffic fingerprint "f8b2cebce1ded615674781e705c16cc2". This results in a merged association analysis table showing the relationship between each encrypted traffic fingerprint and its corresponding process. The next step is to perform statistical analysis based on the data in the association analysis table.

[0084] Step 4: As Figure 7 As shown, statistical analysis is performed on the correlated data to obtain the number of times a specific process corresponding to the encrypted traffic fingerprint appears, the total number of times each process corresponding to the encrypted traffic fingerprint appears, the number of operating systems appearing (i.e., the number of features of the process characteristic of the operating system), the total number of operating systems (the total number of features of the process characteristic of the operating system), the number of users appearing (the number of features of users), the total number of users (the total number of features corresponding to users), the number of host IPs (the number of features of the process characteristic of the host IP), and the total number of host IPs (the total number of features of the process characteristic of the host IP), etc. Then, based on the statistical data, the process occurrence ratio, the feature occurrence ratio of each process characteristic, etc., are calculated. The feature occurrence ratio varies depending on the process characteristic, such as the occurrence ratio of host IP, the occurrence ratio of operating system, and so on, and so on, for process characteristic N, etc. The second weight varies depending on the process characteristic, such as the second weight of host IP (for ease of calculation and distinction, this weight is represented as weight B), the second weight of operating system (weight C), the second weight of process characteristic N (weight N), etc.

[0085] Step 5: As Figure 8As shown, based on some known encrypted traffic fingerprints with malicious or normal evaluation labels and statistical analysis data as training data samples, the machine learning model is trained. During the training process, a linear regression algorithm is used to calculate the weights of the process and its features (as mentioned above, the first weight, weight B, weight C, weight N, etc.). Specifically, after correcting the prediction probability using a loss function, the predicted probability after the loss function correction is solved through the normal equation to obtain the value of each weight. Thus, the predicted probability of the process sending malicious or normal encrypted traffic fingerprints is adjusted according to each weight. This predicted probability = process occurrence ratio * first weight + host IP occurrence ratio * weight B + operating system occurrence ratio * weight C + ... + occurrence ratio of process feature N * weight N.

[0086] Step 6: Statistically analyze the software process names to which the malicious encrypted traffic fingerprints predicted by the machine learning model belong, and detect the corresponding maliciousness score for the malicious encrypted traffic fingerprints.

[0087] Step 7: Display the obtained software process name and encrypted traffic fingerprint on the designated product console to help enterprises determine which specific process issued the external encrypted traffic fingerprint, thereby locating potential security issues. The threat intelligence database uses the maliciousness score of each encrypted traffic fingerprint to intercept malicious encrypted traffic in real time.

[0088] This invention, through association of a large amount of collected process data with network encrypted traffic fingerprints, and then using a machine learning model to infer the process to which the corresponding encrypted data belongs, achieves automated tagging of encrypted data. It replaces the original sandbox-based encrypted traffic tagging method, significantly improving the real-time performance and accuracy of malicious encrypted traffic detection without requiring a simulated environment, execution, or specific packet capture analysis, while significantly reducing resource consumption and false positive rates.

[0089] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0090] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A model training method, characterized in that, include: Collect historical encrypted data, which may be malicious or non-malicious encrypted data; Based on the process information of the historical process that issued the historical encrypted data, statistical analysis is performed on the number of times the historical process occurred to obtain statistical analysis data. The historical encrypted data and the statistical analysis data are used as training data samples to train the machine learning model, so that the machine learning model is suitable for predicting the probability of the historical encrypted data being sent by the historical process, and outputs a judgment label to indicate whether the historical encrypted data is malicious encrypted data. The process information includes multiple process characteristics, including features for describing the first network communication information of the historical process, and / or features for describing the host information of the historical process. The steps for obtaining the statistical analysis data include: Based on the correlation between the historical encrypted data and the process information, statistical analysis is performed on the number of occurrences of the historical process corresponding to the historical encrypted data, and statistical analysis is performed on the number of occurrences of the process characteristics under the historical process corresponding to the historical encrypted data, to obtain the statistical analysis data. Then, the historical encrypted data and the statistical analysis data are used as training data samples to train the machine learning model, so that the machine learning model is suitable for predicting the probability of the historical process sending the historical encrypted data and outputting a judgment label indicating whether the historical encrypted data is malicious encrypted data, and also outputting the process characteristics of the historical process.

2. The method according to claim 1, characterized in that, Before performing statistical analysis on the frequency of occurrence of the historical processes based on the process information of the historical processes that issued the encrypted data, the method further includes: Collect the process information of the historical process; The step of statistically analyzing the frequency of occurrence of the historical process based on the process information of the historical process that issued the encrypted data includes: The historical encrypted data from the historical process is associated with the process information to obtain the association relationship between the historical encrypted data and the process information; Based on the aforementioned correlation, a statistical analysis is performed on the frequency of occurrence of the historical processes corresponding to the historical encrypted data.

3. The method according to claim 2, characterized in that, The process information includes the first network communication information of the historical process. When collecting historical encrypted data, the method further includes: The second network communication information for determining the historical encrypted data; The step of associating the historical encrypted data from the historical process with the process information includes: Based on the consistency between the second network communication information and the first network communication information, it is determined whether the historical encrypted data comes from the historical process. If so, the historical encrypted data is associated with the process information.

4. The method according to claim 1, characterized in that, The process information includes various process characteristics. The steps of statistically analyzing the frequency of occurrence of the historical process corresponding to the historical encrypted data, and statistically analyzing the frequency of occurrence of the process characteristics under the historical process corresponding to the historical encrypted data, include: Determine the number of times one of the historical processes corresponding to the historical encrypted data occurs, and based on the number of occurrences, determine the total number of occurrences of the various historical processes corresponding to the historical encrypted data; Determine the number of features of the process features under one of the historical processes corresponding to the historical encrypted data, and based on the number of features, determine the total number of features of the process features under multiple historical processes corresponding to the historical encrypted data; Based on the number of occurrences and the total number of occurrences, the process occurrence ratio of the historical process is determined, and based on the number of features and the total number of features, the feature occurrence ratio of the process feature is determined, so as to obtain the statistical analysis data including the process occurrence ratio and the feature occurrence ratio; The steps of using the historical encrypted data and the statistical analysis data as training data samples to train the machine learning model include: The historical encrypted data, the process occurrence ratio, and the feature occurrence ratio are used as training data samples to train the machine learning model, so that the machine learning model is suitable for predicting the probability of the historical process sending the historical encrypted data and outputting a judgment label indicating whether the historical encrypted data is malicious encrypted data, and also outputting the process features of the historical process.

5. The method according to claim 4, characterized in that, in, The method further includes using the historical encrypted data, the process occurrence ratio, and the feature occurrence ratio as training data samples to train the machine learning model: Based on the predicted probability, a first weight is calculated for the historical encrypted data sent by the historical process, and a second weight is calculated for each process feature under the historical process. The predicted probability predicted by the machine learning model is updated based on the first weight, the second weight, the process occurrence ratio, and the feature occurrence ratio.

6. A method for encrypting data processing, characterized in that, include: Encrypted data is input into a machine learning model, the machine learning model predicts the process of sending the encrypted data, and outputs a judgment label indicating whether the encrypted data is malicious encrypted data. The machine learning model is a model trained by any of the model training methods according to claims 1 to 5. Based on the evaluation tags, the encrypted data, which is malicious encrypted data, is statistically analyzed to obtain statistical information. During the statistical analysis, the process name of the predicted process is used to identify the encrypted data.

7. The method according to claim 6, characterized in that, The step of statistically analyzing the encrypted data, which is malicious encrypted data, based on the evaluation tags further includes: Detect malicious scores in the encrypted data and record the malicious scores in the statistical information.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1 to 7.

Images