HTTP tunnel detection method, device and electronic equipment

Abstract

The application provides an HTTP tunnel detection method and device and electronic equipment, applied to the network security technical field, wherein the HTTP tunnel detection method comprises: obtaining feature data corresponding to HTTP traffic data; wherein the HTTP traffic data is traffic data collected by the HTTP tunnel after being detected by an HTTP tunnel detection model; inputting the feature data into an HTTP tunnel tool detection model to obtain a first detection result output by the HTTP tunnel tool detection model; wherein the first detection result comprises a probability value of the HTTP traffic data being generated by each HTTP tunnel tool. In the above scheme, compared with detection only according to the detection result output by the HTTP tunnel detection model, the HTTP tunnel detection method provided by the application has higher reliability.

Description

TECHNICAL FIELD

[0001] The present application relates to the network security technical field, and in particular to an HTTP tunnel detection method and device and electronic equipment. BACKGROUND

[0002] With the development of Internet technology, the difficulty of maintaining network security is gradually increasing. Although the Trojan detection technology is constantly developing, the anti-detection means of Trojan is also constantly improving. Among them, the tunnel technology makes the Trojan communication have a high degree of concealment, and also makes the traditional detection method unable to detect, so as to be attacked by malicious software or stolen information.

[0003] In the tunnel technology, the Hypertext Transfer Protocol (HTTP) tunnel is designed based on the HTTP protocol and uses the same port as the HTTP protocol data, which can easily penetrate the firewall and make the traditional port control method invalid. In the prior art, the credibility of Trojan detection on the HTTP tunnel is low. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide an HTTP tunnel detection method, device and electronic equipment, which can solve the technical problem of low credibility of Trojan detection on the HTTP tunnel in the prior art.

[0005] In a first aspect, the embodiments of the present application provide an HTTP tunnel detection method, comprising: obtaining feature data corresponding to HTTP flow data; wherein the HTTP flow data is flow data collected by the HTTP tunnel after being detected by an HTTP tunnel detection model; inputting the feature data into an HTTP tunnel tool detection model to obtain a first detection result output by the HTTP tunnel tool detection model; wherein the first detection result comprises a probability value of the HTTP flow data being generated by each HTTP tunnel tool.

[0006] In the above scheme, after the HTTP tunnel detection model is used to detect the to-be-detected flow data, the HTTP tunnel tool detection model can be further used to detect the HTTP tunnel tool corresponding to the HTTP flow data, so as to determine whether the HTTP flow data is flow data collected by the HTTP tunnel based on the detection result output by the HTTP tunnel detection model and the detection result output by the HTTP tunnel tool detection model. Compared with the detection result output by the HTTP tunnel detection model, the credibility of the HTTP tunnel detection method provided by the embodiments of the present application is higher.

[0007] In an optional implementation, the obtaining the feature data corresponding to the HTTP traffic data comprises: obtaining to-be-detected traffic data; inputting the to-be-detected traffic data into the HTTP tunnel detection model to obtain a second detection result output by the HTTP tunnel detection model; wherein the second detection result comprises a probability value of the to-be-detected traffic data belonging to the HTTP traffic data; performing feature processing on the HTTP traffic data in the to-be-detected traffic data to obtain the feature data corresponding to the HTTP traffic data. In the foregoing scheme, the HTTP tunnel detection model can be used to perform HTTP tunnel detection on to-be-detected traffic data, and the HTTP tunnel tool detection model can be used to perform HTTP tunnel tool detection on the HTTP traffic data in the to-be-detected traffic data, so as to determine, based on the detection result output by the HTTP tunnel detection model and the detection result output by the HTTP tunnel tool detection model, whether the HTTP traffic data is traffic data collected by the HTTP tunnel. Compared with detection based only on the detection result output by the HTTP tunnel detection model, the HTTP tunnel detection method provided in the embodiments of the present application has higher credibility.

[0008] In an optional implementation, the feature processing comprises at least one of the following processing manners: neural network learning processing, feature normalization processing, and one-hot encoding processing. In the foregoing scheme, the original data can be converted into uniform numerical features by performing feature processing on the HTTP traffic data, so that the HTTP tunnel tool detection can be performed on the HTTP traffic data.

[0009] In an optional implementation, after the inputting the feature data into the HTTP tunnel tool detection model to obtain the first detection result output by the HTTP tunnel tool detection model, the method further comprises: updating the second detection result according to the feature data and / or the first detection result to obtain a corresponding third detection result; and outputting the third detection result. In the foregoing scheme, on the basis of the HTTP tunnel detection and the HTTP tunnel tool detection on the HTTP traffic data, the second detection result can be updated according to the feature data corresponding to the HTTP traffic data and the first detection result, so that the credibility of the HTTP tunnel detection can be further improved.

[0010] In an optional implementation, the updating the second detection result according to the feature data and / or the first detection result to obtain a corresponding third detection result comprises: performing variance analysis on the first detection result to obtain a corresponding variance analysis result; and updating the second detection result according to the variance analysis result to obtain the third detection result. In the foregoing solution, by performing variance analysis on the first detection result, the significant difference between the probability values of the HTTP traffic data generated by each HTTP tunnel tool can be known, and the second detection result is updated according to the significant difference, which can further improve the credibility of HTTP tunnel detection.

[0011] In an optional implementation, the updating the second detection result according to the feature data and / or the first detection result to obtain a corresponding third detection result comprises: comparing the feature data with a tool feature corresponding to an HTTP tunnel tool with the highest probability value in the first detection result to obtain a corresponding comparison result; and updating the second detection result according to the comparison result to obtain the third detection result. In the foregoing solution, by comparing the feature data with a tool feature corresponding to an HTTP tunnel tool, it can be known whether the HTTP traffic data hits the feature corresponding to the HTTP tunnel tool, and the second detection result is updated according to the comparison result, which can further improve the credibility of HTTP tunnel detection.

[0012] In an optional implementation, the updating the second detection result according to the feature data and / or the first detection result to obtain a corresponding third detection result comprises: updating the second detection result according to a domain name or an IP address in the feature data to obtain the third detection result. In the foregoing solution, according to the domain name or the IP address in the feature data, it can be known whether the HTTP traffic data belongs to the traffic data in the white list, thereby further improving the credibility of HTTP tunnel detection.

[0013] In a second aspect, an embodiment of the present application provides an HTTP tunnel detection device, comprising: an acquisition module configured to acquire feature data corresponding to HTTP traffic data; wherein the HTTP traffic data is traffic data collected by an HTTP tunnel after being detected by an HTTP tunnel detection model; and an input module configured to input the feature data into an HTTP tunnel tool detection model to obtain a first detection result output by the HTTP tunnel tool detection model; wherein the first detection result comprises probability values of the HTTP traffic data generated by each HTTP tunnel tool.

[0014] In the above scheme, after the HTTP tunnel detection model is used to detect the HTTP tunnel of the to-be-detected traffic data, the HTTP tunnel tool detection model can be further used to detect the HTTP tunnel tool corresponding to the HTTP traffic data, so that whether the HTTP traffic data is traffic data collected by the HTTP tunnel can be determined based on the detection result output by the HTTP tunnel detection model and the detection result output by the HTTP tunnel tool detection model. Compared with the detection result output by the HTTP tunnel detection model, the HTTP tunnel detection method provided by the embodiment of the application has higher reliability.

[0015] In an optional embodiment, the acquisition module is specifically configured to: acquire to-be-detected traffic data; input the to-be-detected traffic data into the HTTP tunnel detection model to obtain a second detection result output by the HTTP tunnel detection model; and perform feature processing on the HTTP traffic data in the to-be-detected traffic data to obtain the feature data corresponding to the HTTP traffic data. In the above scheme, the HTTP tunnel detection model can be used to detect the HTTP tunnel of the to-be-detected traffic data, and the HTTP tunnel tool detection model can be used to detect the HTTP tunnel tool of the HTTP traffic data in the to-be-detected traffic data, so that whether the HTTP traffic data is traffic data collected by the HTTP tunnel can be determined based on the detection result output by the HTTP tunnel detection model and the detection result output by the HTTP tunnel tool detection model. Compared with the detection result output by the HTTP tunnel detection model, the HTTP tunnel detection method provided by the embodiment of the application has higher reliability.

[0016] In an optional embodiment, the feature processing includes at least one of the following processing modes: neural network learning processing, feature normalization processing, and one-hot encoding processing. In the above scheme, the original data can be converted into uniform numerical features through feature processing on the HTTP traffic data, so that the HTTP tunnel tool detection can be performed on the HTTP traffic data.

[0017] In an optional implementation, the HTTP tunnel detection apparatus further comprises: an updating module, configured to update the second detection result according to the feature data and / or the first detection result, to obtain a corresponding third detection result; and an output module, configured to output the third detection result. In the foregoing scheme, on the basis of the HTTP tunnel detection and the HTTP tunnel tool detection, the second detection result can be updated according to the feature data corresponding to the HTTP flow data and the first detection result, so that the credibility of the HTTP tunnel detection can be further improved.

[0018] In an optional implementation, the updating module is specifically configured to: perform variance analysis on the first detection result, to obtain a corresponding variance analysis result; and update the second detection result according to the variance analysis result, to obtain the third detection result. In the foregoing scheme, by performing variance analysis on the first detection result, the significant difference between the probability values of the HTTP flow data generated by the HTTP tunnel tools can be known, and the second detection result can be updated according to the significant difference, so that the credibility of the HTTP tunnel detection can be further improved.

[0019] In an optional implementation, the updating module is specifically configured to: compare the feature data with tool features corresponding to the HTTP tunnel tool with the highest probability value in the first detection result, to obtain a corresponding comparison result; and update the second detection result according to the comparison result, to obtain the third detection result. In the foregoing scheme, by comparing the feature data with the tool features corresponding to the HTTP tunnel tools, it can be known whether the HTTP flow data hits the features corresponding to the HTTP tunnel tools, and the second detection result can be updated according to the comparison result, so that the credibility of the HTTP tunnel detection can be further improved.

[0020] In an optional implementation, the updating module is specifically configured to: update the second detection result according to the domain name or the IP address in the feature data, to obtain the third detection result. In the foregoing scheme, according to the domain name or the IP address in the feature data, it can be known whether the HTTP flow data belongs to the flow data in the white list, so that the credibility of the HTTP tunnel detection can be further improved.

[0021] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory and a bus; the processor and the memory complete mutual communication through the bus; the memory stores computer program instructions executable by the processor, and the processor calling the computer program instructions can execute the HTTP tunnel detection method in the first aspect.

[0022] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium storing computer program instructions, which, when executed by a computer, cause the computer to perform the HTTP tunnel detection method according to the first aspect.

[0023] In order to make the above objectives, characteristics and advantages of the present application more apparent, clear and easy to understand, the following will specifically describe embodiments of the present application with reference to the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be considered as a limitation to the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0025] Figure 1 A flow chart of the HTTP tunnel detection method provided by an embodiment of the present application;

[0026] Figure 2 A tool feature database diagram corresponding to the HTTP tunnel tool provided by an embodiment of the present application;

[0027] Figure 3 A structural block diagram of the HTTP tunnel detection device provided by an embodiment of the present application;

[0028] Figure 4 A structural block diagram of the electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0029] Traditional Trojans basically communicate through ports higher than 1024. For such Trojans, many antivirus software and firewalls only need to strictly check the port restrictions, so as to reduce the threat of this part of Trojans. However, the tunnel technology is based on common ports to build, and the HTTP tunnel has the characteristics of easy implementation and difficult detection, so the detection of the HTTP tunnel becomes a more tricky problem in network security detection.

[0030] The HTTP tunnel is designed based on the HTTP protocol, uses the same port as the HTTP protocol data, can easily penetrate the firewall, and makes the traditional port control method invalid. However, the technology of detecting the HTTP tunnel according to the HTTP protocol standard specification is gradually ineffective with the development of network communication technology, the increasing concealment of network tunnel and the increasing complexity of disguise.

[0031] Based on the above analysis, the embodiment of the present application provides an HTTP tunnel detection method. In the HTTP tunnel detection method, on the basis of detecting the to-be-detected traffic data by using the HTTP tunnel detection model, the to-be-detected traffic data can also be detected by using the HTTP tunnel tool detection model, so that the credibility of the HTTP tunnel detection can be improved. The technical solutions in the embodiment of the present application will be described below with reference to the drawings in the embodiment of the present application.

[0032] Please refer to Figure 1 , Figure 1 A flowchart of an HTTP tunnel detection method provided by the embodiment of the present application can include the following steps:

[0033] Step S101: Obtain feature data corresponding to HTTP traffic data.

[0034] Step S102: Input the feature data into the HTTP tunnel tool detection model to obtain a first detection result output by the HTTP tunnel tool detection model.

[0035] Specifically, in the above step S101, the to-be-detected traffic data is detected by using the HTTP tunnel detection model, so that the traffic data collected by the HTTP tunnel in the to-be-detected traffic can be detected. The to-be-detected traffic data can include traffic data collected by the HTTP tunnel and traffic data not collected by the HTTP tunnel. Therefore, the HTTP traffic data is traffic data collected by the HTTP tunnel after being detected by the HTTP tunnel detection model.

[0036] It should be noted that the specific implementation of the HTTP tunnel detection model and the specific implementation of detecting the to-be-detected traffic data by using the HTTP tunnel detection model are not specifically limited in the embodiment of the present application, and a person skilled in the art can make appropriate adjustments according to the actual situation.

[0037] The feature data corresponding to the HTTP traffic data refers to data obtained by performing feature processing on the HTTP traffic data.

[0038] Similarly, the specific implementation of the feature data and the specific implementation of performing feature processing on the HTTP traffic data are also not specifically limited in the embodiment of the present application, and a person skilled in the art can make appropriate adjustments according to the actual situation. For example, the feature data can include the domain name, the five-tuple, the Server Header, the Client Header, and the like of the HTTP traffic data; and the feature processing on the HTTP traffic data can include feature extraction, encoding processing on the extracted features, normalization processing on the extracted features, and the like.

[0039] Further, the embodiments of the present application do not make specific limitations on the specific implementation of the step S101 of obtaining the feature data corresponding to the HTTP traffic data, and the person skilled in the art can make appropriate adjustments according to the actual situation. For example, the feature data sent by the external device can be received; or the pre-stored feature data can be read from the local or cloud; or the feature data can be obtained by feature processing on the HTTP traffic data, etc.

[0040] It can be understood that, as an implementation, before performing the above step S101, the HTTP tunnel detection model can be used to detect the to-be-detected traffic data, so as to filter the HTTP traffic data from the to-be-detected traffic data; then, the HTTP traffic data can be processed to obtain the above feature data.

[0041] In the above step S102, the HTTP tunnel tool detection model is used to detect the category of the HTTP tunnel tool used to collect the HTTP traffic data, so that the feature data obtained in the above step S101 is input into the HTTP tunnel tool detection model, and the first detection result output by the HTTP tunnel tool detection model can be obtained.

[0042] The first detection result includes the probability value of the HTTP traffic data generated by each HTTP tunnel tool. For example, assuming that there are three categories of HTTP tunnel tools, the first detection result can include: the probability value of the HTTP traffic data generated by the first HTTP tunnel tool is 0.1, the probability value of the HTTP traffic data generated by the second HTTP tunnel tool is 0.2, and the probability value of the HTTP traffic data generated by the third HTTP tunnel tool is 0.7.

[0043] It should be noted that the embodiments of the present application do not make specific limitations on the specific implementation of the above HTTP tunnel tool detection model, and the person skilled in the art can make appropriate adjustments according to the actual situation. For example, the HTTP tunnel tool detection model can adopt a random forest model, a decision tree model, an XGBoost model, a lightGBM model, etc.

[0044] As an implementation, the following steps can be used to train the above HTTP tunnel tool detection model:

[0045] First, sample collection: the source of sample collection can include two parts, which are the historical traffic data accumulated before and the traffic data captured from the environment built by the tool; by obtaining the traffic data generated by each HTTP tunnel tool from the above two parts of data and capturing the pcap package, the training sample is obtained.

[0046] Second step, feature processing: corresponding feature processing is performed on the training samples, so as to obtain the feature data corresponding to the training samples; wherein the implementation of feature processing on the training samples should be the same as the implementation of feature processing on the HTTP traffic data.

[0047] Third step, model training: the feature data corresponding to the above training samples is input into the network model, the parameters of the network model are trained through iterative optimization, and finally the HTTP tunnel tool detection model in the embodiment of the application is obtained.

[0048] In addition, the category of the above HTTP tunnel tool is not specifically limited in the embodiment of the application, and those skilled in the art can also make appropriate adjustments according to the actual situation. For example, the HTTP tunnel tool can include reGeory, neo_regeorg, HTTP_Tunnel, abptts, EarthWorm, LCX, netsh, ssocks, tunna, CobaltStrike, etc.

[0049] After the above step S102, the probability value of the HTTP traffic data generated by each HTTP tunnel tool can be obtained. Based on the above probability value and the detection result output by the HTTP tunnel detection model, it can be determined whether the HTTP traffic data is collected by the HTTP tunnel, and the name of the HTTP tunnel tool generating the HTTP traffic data.

[0050] In the above scheme, after the HTTP tunnel detection model is used to detect the HTTP tunnel of the to-be-detected traffic data, the HTTP tunnel tool detection model can be further used to detect the HTTP tunnel tool corresponding to the HTTP traffic data, so that the HTTP traffic data can be determined to be collected by the HTTP tunnel based on the detection result output by the HTTP tunnel detection model and the detection result output by the HTTP tunnel tool detection model. Compared with the detection result output by the HTTP tunnel detection model, the credibility of the HTTP tunnel detection method provided by the embodiment of the application is higher.

[0051] Further, on the basis of the above embodiment, the above step S101 can specifically include the following steps:

[0052] Step 1), obtaining to-be-detected traffic data.

[0053] Step 2), inputting the to-be-detected traffic data into the HTTP tunnel detection model to obtain the second detection result output by the HTTP tunnel detection model.

[0054] Step 3), performing feature processing on the HTTP traffic data in the to-be-detected traffic data to obtain feature data corresponding to the HTTP traffic data.

[0055] Specifically, in the above step 1), the to-be-detected traffic data refers to traffic data that needs to be detected by the HTTP tunnel, and in the embodiments of the present application, the to-be-detected traffic data can include traffic data collected by the HTTP tunnel and traffic data collected by the non-HTTP tunnel.

[0056] It should be noted that the specific implementation of obtaining the to-be-detected traffic data is not specifically limited in the embodiments of the present application, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, the to-be-detected traffic data sent by an external device can be received; or the to-be-detected traffic data stored in advance can be read from the local or cloud; or real-time to-be-detected traffic data can be captured, etc.

[0057] In the above step 2), the HTTP tunnel detection model is used to detect whether the to-be-detected traffic data is traffic data collected by the HTTP tunnel, so that the to-be-detected traffic data obtained in the above step 1) is input into the HTTP tunnel detection model, and the second detection result output by the HTTP tunnel detection model can be obtained.

[0058] The second detection result includes a probability value of the to-be-detected traffic data belonging to the HTTP traffic data. For example, the second detection result can include a probability value of the to-be-detected traffic data belonging to the HTTP traffic data being 0.1, and a probability value of the to-be-detected traffic data belonging to the HTTP traffic data being 0.9.

[0059] It should be noted that the specific implementation of the above HTTP tunnel detection model is not specifically limited in the embodiments of the present application, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, the HTTP tunnel detection model can adopt a random forest model, a decision tree model, etc.

[0060] It can be understood that before the to-be-detected traffic data is input into the HTTP tunnel detection model, the to-be-detected traffic data can also be first processed for features, and then the feature data obtained by processing the features is input into the HTTP tunnel detection model.

[0061] Similar, the embodiments of the present application do not make specific limitations on the specific implementation of the feature data corresponding to the to-be-detected traffic data and the specific implementation of the feature processing of the to-be-detected traffic data, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, the feature data corresponding to the to-be-detected traffic data can include the domain name of the to-be-detected traffic data, five-tuple, etc.; the feature processing of the to-be-detected traffic data can include feature extraction, encoding processing of the extracted features, normalization processing of the extracted features, processing of missing values, etc.

[0062] As an implementation, the HTTP tunnel detection model can be trained by the following steps:

[0063] First step, sample collection: The source of sample collection can include two parts, which are historical traffic data accumulated before and traffic data captured from the environment built by using tools; a plurality of traffic data is obtained from the two parts of data, and a training sample is obtained.

[0064] Second step, feature processing: the training sample is processed according to the corresponding features, so as to obtain the feature data corresponding to the training sample; wherein the implementation of the feature processing of the training sample should be the same as the implementation of the feature processing of the to-be-detected traffic data.

[0065] Third step, model training: the feature data corresponding to the training sample is input into the network model, the parameters of the network model are trained by iterative optimization, and finally the HTTP tunnel detection model in the embodiments of the present application is obtained.

[0066] In the above scheme, the HTTP tunnel detection model can be used to detect the to-be-detected traffic data, and the HTTP tunnel tool detection model can be used to detect the HTTP traffic data in the to-be-detected traffic data, so as to determine whether the HTTP traffic data is the traffic data collected by the HTTP tunnel based on the detection results output by the HTTP tunnel detection model and the detection results output by the HTTP tunnel tool detection model. Compared with the detection based on only the detection result output by the HTTP tunnel detection model, the credibility of the HTTP tunnel detection method provided by the embodiments of the present application is higher.

[0067] Further, on the basis of the above embodiments, the feature processing can include at least one of the following processing methods: neural network learning processing, feature normalization processing, and one-hot encoding processing.

[0068] Specifically, as an implementation form, the pcap packets in the HTTP traffic data can be processed, the five-tuple is used for shunting, and the required metadata such as text data of a Server Header and a Client Header and protocol metadata are extracted.

[0069] Then, the metadata extracted in the previous stage can be further processed, the metadata is converted into numerical features, for example, the gated recurrent unit (GRU) neural network can be used to learn and generate numerical features for the metadata of the Server Header and the Client Header, or the return state and other metadata features can be encoded by using the one-hot encoding method, and finally the feature values of the model to be trained are obtained.

[0070] In the above scheme, the original data can be converted into unified numerical features by processing the HTTP traffic data, so that the HTTP tunnel tool detection on the HTTP traffic data can be performed.

[0071] Further, on the basis of the above embodiment, after the step S102, the HTTP tunnel detection method provided by the embodiment of the application can further include the following steps:

[0072] Step 1), updating the second detection result according to the feature data and / or the first detection result to obtain a corresponding third detection result.

[0073] Step 2), outputting the third detection result.

[0074] Specifically, in the above step 1), in order to improve the accuracy and reliability of the HTTP tunnel detection, the second detection result can be updated according to the feature data and / or the first detection result, so as to obtain a corresponding third detection result.

[0075] It should be noted that the specific implementation form of updating the second detection result is not specifically limited in the embodiment of the application, and a person skilled in the art can make appropriate adjustments according to the actual situation. For example, it can be determined according to the feature data whether the HTTP traffic data belongs to a white list, so as to update the second detection result; or the second detection result can be updated based on the numerical value of the first detection result.

[0076] In the above step 2), the third detection result obtained after updating can be output, so that the user can determine whether the HTTP traffic data is collected by the HTTP tunnel based on the third detection result.

[0077] It can be understood that in addition to the third detection result (i.e., the probability value of the HTTP traffic data being collected by the HTTP tunnel) can be output, other data can also be output according to different actual needs. For example, the name of the HTTP tunnel tool to which the HTTP traffic data belongs, the probability value of the HTTP tunnel tool to which the HTTP traffic data belongs, the five-tuple of the HTTP traffic data, etc.

[0078] Through the above-mentioned alarm after step 1) and step 2), not only can the invalid alarm be greatly reduced, but also it has great significance for the landing of the whole model. The model used in the product will not cause the situation that a large number of alarms cannot be started. If the alarm still has a very high score after the above-mentioned step 1) and step 2), it needs to be focused on. For the very high score, it can be directly disposed. In addition, after the above-mentioned step 1) and step 2), the number of alarms is greatly reduced, each alarm has corresponding basis and credentials, which reduces the workload of the operation and maintenance personnel, finds more valuable attacks, and can quickly dispose the attacks to get rid of the mass of alarms.

[0079] In the above scheme, on the basis of the HTTP tunnel detection and the HTTP tunnel tool detection of the HTTP traffic data, the second detection result can be updated according to the feature data corresponding to the HTTP traffic data and the first detection result, so as to further improve the credibility of the HTTP tunnel detection.

[0080] Further, on the basis of the above-mentioned embodiment, the step of updating the second detection result according to the feature data and / or the first detection result to obtain the corresponding third detection result can specifically include the following steps:

[0081] Step 1), variance analysis is performed on the first detection result to obtain a corresponding variance analysis result.

[0082] Step 2), the second detection result is updated according to the variance analysis result to obtain the third detection result.

[0083] Specifically, in the above-mentioned step 1), the purpose of performing variance analysis on the first detection result is to analyze the result of the HTTP tunnel tool detection, and to perform significance calculation on the probability values of various HTTP tunnel tools obtained by the HTTP tunnel tool detection model.

[0084] If the significance score of the first detection result is high, it indicates that the scores of the HTTP traffic data belonging to various tools are different, the HTTP traffic data obviously belongs to a certain tool, and the tool classification of the HTTP traffic data is reliable; if the significance score of the first detection result is low, it indicates that the scores of the HTTP traffic data belonging to various tools are small, the model result is relatively fuzzy, and therefore the second detection result can be appropriately reduced in step 2) above, thereby improving the reliability of the HTTP tunnel detection.

[0085] In step 1) above, the first detection result can be analyzed by variance to obtain a corresponding variance analysis result by using the following formula:

[0086]

[0087] Wherein, SS is the variance analysis result, n is the number of categories of HTTP tunnel tools, X is the probability value corresponding to the HTTP tunnel tool of a certain category, is the average probability value corresponding to all categories of HTTP tunnel tools.

[0088] In step 2) above, the second detection result can be updated according to the variance analysis result to obtain a third detection result by using the following formula:

[0089]

[0090] Wherein, f(x) is the third detection result, x is the second detection result, α1, α2, α3 are probability value adjustment threshold parameters, and δ1, δ2, δ3 are variance analysis threshold parameters.

[0091] As an implementation, α1=0.1, α2=0.2, α3=0.3, δ1=0.08, δ2=0.05, and δ3=0.02.

[0092] In the above scheme, by analyzing the first detection result by variance, the significant difference between the probability values of the HTTP traffic data generated by various HTTP tunnel tools can be known, and the second detection result can be updated according to the above significant difference, thereby further improving the reliability of the HTTP tunnel detection.

[0093] Further, on the basis of the above embodiment, the step of updating the second detection result according to the feature data and / or the first detection result to obtain a corresponding third detection result can specifically include the following steps:

[0094] Step 1), comparing the feature data with the tool features corresponding to the HTTP tunnel tool with the highest probability value in the first detection result to obtain a corresponding comparison result.

[0095] Step 2), updating the second detection result according to the comparison result to obtain a third detection result.

[0096] Specifically, for some HTTP tunnel tools, most attackers will not make comprehensive modifications, and some default features of the tool will exist in the attack process, and therefore, the features can assist in determining the result of HTTP tunnel detection.

[0097] In step 1) described above, various HTTP tunnel tools can be analyzed and obvious features can be extracted to obtain tool features corresponding to the HTTP tunnel tools. Then, the feature data is compared with tool features corresponding to the HTTP tunnel tool with the highest probability value in the first detection result to obtain a corresponding comparison result.

[0098] In step 2) described above, the second detection result can be updated according to the comparison result, thereby obtaining an updated third detection result.

[0099] For example, for the abptts tool, if the webshell file name is not modified and is directly used, the http uri will appear the abptts string, and the post request body feature is “[two word strings] = [a segment of encrypted string ending with %3d]”. Therefore, if the second detection result represents that the HTTP tunnel tool corresponding to the HTTP traffic data is the abptts tool, the feature data corresponding to the HTTP traffic data can be compared with the tool features corresponding to the abptts tool.

[0100] If the feature data corresponding to the HTTP traffic data conforms to the tool features corresponding to the abptts tool, the second detection result can be appropriately adjusted by adding points; if the feature data corresponding to the HTTP traffic data does not conform to the tool features corresponding to the abptts tool, the second detection result can be appropriately adjusted by subtracting points. After such operation, the score of the third detection result will be different, the high-score alarm is processed quickly, and when the score is still very high after subtraction, it indicates that the probability value of the HTTP traffic data belonging to this category is very large, and also indicates that the classification credibility of the model is very large.

[0101] Please refer to Figure 2 , Figure 2 An HTTP tunnel tool corresponding tool feature library schematic diagram provided by the embodiment of the present application, based on the schematic diagram, the second detection result can be updated according to the following formula:

[0102]

[0103] Wherein, f(x) is the third detection result, x is the second detection result, β ＜t＞a score of a tool feature corresponding to a HTTP tunnel tool of a certain category, β <o>< / o> a score to be deducted when no feature in any tool feature library is hit; β <t>< / t> The score can be calculated according to the following formula:

[0104]

[0105] wherein, a score to be added when a feature in a tool feature library is hit.

[0106] In the above scheme, by comparing the feature data with the tool features corresponding to the HTTP tunnel tool, it can be known whether the HTTP traffic data hits the features corresponding to the HTTP tunnel tool, and the second detection result is updated according to the above comparison result, which can further improve the credibility of the HTTP tunnel detection.

[0107] Further, on the basis of the above embodiment, the step of updating the second detection result according to the feature data and / or the first detection result to obtain the corresponding third detection result can specifically include the following steps:

[0108] The second detection result is updated according to the domain name or Internet Protocol (IP) address in the feature data to obtain the third detection result.

[0109] Specifically, as an implementation manner, the domain name of the HTTP traffic data can be filtered by a white list, if the domain name hits the white list, for example, the host or url in the sample contains baidu.com, the second detection result can be processed by deduction, and the output score is reduced, so that the operation and maintenance personnel can concentrate on processing high-score alarms, and the high-score alarms are not submerged in a large number of alarms.

[0110] Wherein, the second detection result can be updated according to the domain name in the feature data to obtain the third detection result by using the following formula:

[0111]

[0112] Wherein, f(x) is the third detection result, x is the second detection result, and ε is the score to be fine-tuned after hitting the domain name white list. Wherein, ε can be determined by the position in the domain name white list, the entire domain name white list is ranked by credibility, and different credibility corresponds to different scores.

[0113] As another implementation, the IP address of the HTTP traffic data can also be whitelisted filtered. This is because some HTTP tunnels are built within enterprises or some HTTP tunnels are used legally, and such HTTP tunnels do not want to cause a large number of alarms, so these HTTP tunnels can be set through IP whitelisting, and after setting, the detection of such samples will be automatically ignored, further reducing alarms and focusing on finding high-value attacks.

[0114] In the above scheme, according to the domain name or IP address in the feature data, it can be known whether the HTTP traffic data belongs to the traffic data in the whitelist, so as to further improve the credibility of the HTTP tunnel detection.

[0115] Further, on the basis of the above embodiment, a log storage module can be added for storing data in the HTTP tunnel detection process, so that the detection process and scoring basis can be traced back.

[0116] Further, on the basis of the above embodiment, the HTTP tunnel detection method provided by the embodiment of the application can be independently implemented by the HTTP tunnel detection system, and the specific process can include the following steps:

[0117] Step 1), the detection system supports bypass mode or offline mode, which does not affect the user's network environment.

[0118] Step 2), start the HTTP tunnel detection system, input the offline pcap or bypass network traffic into the HTTP tunnel detection system, and extract features from the pcap or network traffic.

[0119] Step 3), feature engineering is performed on the extracted feature data, metadata is created, feature extraction is performed, numerical processing is performed on the features, and feature data to be input into the model is generated.

[0120] Step 4), input the feature data into the HTTP tunnel detection model, output the second detection result, determine whether it belongs to the HTTP tunnel according to the set threshold, if it belongs, continue to transmit the feature data to the HTTP tunnel tool detection model for detection.

[0121] Step 5), update the second detection result according to the first detection result output by the HTTP tunnel tool detection model and the feature data, and obtain the third detection result.

[0122] Step 6), output and store the following data: the comprehensive probability score of the detection sample being an HTTP tunnel, the tool name to which the detection sample belongs, the score of the tool category to which the detection sample belongs, the five-tuple of the detection sample, the detection sample name, and the detailed score in the detection result updating process.

[0123] Further, on the basis of the above-mentioned embodiments, the HTTP tunnel detection method provided by the embodiments of the present application can also be applied to existing network security detection products, coupled with the products quickly, and add HTTP tunnel detection function to the security detection products. The specific process can include the following steps:

[0124] Step 1), the network security detection product is started, traffic analysis is performed, and features are extracted.

[0125] Step 2), feature engineering is performed on the extracted feature data, feature creation is performed on the metadata, feature extraction is counted, and the feature data to be input into the model is numerically processed.

[0126] Step 3), the feature data is input into the HTTP tunnel detection model, a second detection result is output, whether it belongs to the HTTP tunnel is determined according to the set threshold, if it belongs to the HTTP tunnel, the feature data is continuously transmitted to the HTTP tunnel tool detection model for detection.

[0127] Step 4), the second detection result is updated according to the first detection result output by the HTTP tunnel tool detection model and the feature data, and a third detection result is obtained.

[0128] Step 5), the following data is output and stored: the comprehensive probability score of the detection sample being an HTTP tunnel, the tool name to which the detection sample belongs, the score of the tool category to which the detection sample belongs, the five-tuple of the detection sample, the detection sample name, and the detailed score in the detection result updating process.

[0129] Please refer to Figure 3 , Figure 3 The structure block diagram of the HTTP tunnel detection device provided by the embodiments of the present application is shown in the figure. The HTTP tunnel detection device 300 can include: an acquisition module 301, configured to acquire feature data corresponding to HTTP traffic data; wherein the HTTP traffic data is traffic data collected by HTTP tunnels after being detected by an HTTP tunnel detection model; an input module 302, configured to input the feature data into an HTTP tunnel tool detection model to obtain a first detection result output by the HTTP tunnel tool detection model; wherein the first detection result includes probability values of the HTTP traffic data being generated by each HTTP tunnel tool.

[0130] In the above scheme, after the HTTP tunnel detection model is used to detect the HTTP tunnel of the to-be-detected traffic data, the HTTP tunnel tool detection model can be further used to detect the HTTP tunnel tool corresponding to the HTTP traffic data, so that whether the HTTP traffic data is traffic data collected by the HTTP tunnel can be determined based on the detection result output by the HTTP tunnel detection model and the detection result output by the HTTP tunnel tool detection model. Compared with the detection result output by the HTTP tunnel detection model, the HTTP tunnel detection method provided in the embodiment has higher reliability.

[0131] Further, based on the above embodiment, the acquisition module 301 is specifically configured to: acquire to-be-detected traffic data; input the to-be-detected traffic data into the HTTP tunnel detection model to obtain a second detection result output by the HTTP tunnel detection model; wherein the second detection result includes a probability value of the to-be-detected traffic data belonging to the HTTP traffic data; and perform feature processing on the HTTP traffic data in the to-be-detected traffic data to obtain the feature data corresponding to the HTTP traffic data.

[0132] In the above scheme, the HTTP tunnel detection model can be used to detect the HTTP tunnel of the to-be-detected traffic data, and the HTTP tunnel tool detection model can be used to detect the HTTP tunnel tool of the HTTP traffic data in the to-be-detected traffic data, so that whether the HTTP traffic data is traffic data collected by the HTTP tunnel can be determined based on the detection result output by the HTTP tunnel detection model and the detection result output by the HTTP tunnel tool detection model. Compared with the detection result output by the HTTP tunnel detection model, the HTTP tunnel detection method provided in the embodiment has higher reliability.

[0133] Further, based on the above embodiment, the feature processing includes at least one of the following processing methods: neural network learning processing, feature normalization processing, and one-hot encoding processing.

[0134] In the above scheme, the original data can be converted into uniform numerical features by performing feature processing on the HTTP traffic data, so that the HTTP tunnel tool detection can be performed on the HTTP traffic data.

[0135] Further, based on the above embodiment, the HTTP tunnel detection apparatus 300 further includes: an updating module configured to update the second detection result according to the feature data and / or the first detection result to obtain a corresponding third detection result; and an output module configured to output the third detection result.

[0136] In the above scheme, on the basis of the HTTP tunnel detection and the HTTP tunnel tool detection on the HTTP traffic data, the second detection result can be updated according to the feature data corresponding to the HTTP traffic data and the first detection result, so that the credibility of the HTTP tunnel detection can be further improved.

[0137] Further, on the basis of the above embodiment, the updating module is specifically configured to: perform variance analysis on the first detection result to obtain a corresponding variance analysis result; and update the second detection result according to the variance analysis result to obtain the third detection result.

[0138] In the above scheme, by performing variance analysis on the first detection result, the significant difference between the probability values of the HTTP traffic data generated by each HTTP tunnel tool can be known, and the second detection result can be updated according to the significant difference, so that the credibility of the HTTP tunnel detection can be further improved.

[0139] Further, on the basis of the above embodiment, the updating module is specifically configured to: compare the feature data with tool features corresponding to the HTTP tunnel tool with the highest probability value in the first detection result to obtain a corresponding comparison result; and update the second detection result according to the comparison result to obtain the third detection result.

[0140] In the above scheme, by comparing the feature data with the tool features corresponding to the HTTP tunnel tool, it can be known whether the HTTP traffic data hits the features corresponding to the HTTP tunnel tool, and the second detection result can be updated according to the comparison result, so that the credibility of the HTTP tunnel detection can be further improved.

[0141] Further, on the basis of the above embodiment, the updating module is specifically configured to: update the second detection result according to the domain name or the IP address in the feature data to obtain the third detection result.

[0142] In the above scheme, according to the domain name or the IP address in the feature data, it can be known whether the HTTP traffic data belongs to the traffic data in the white list, so that the credibility of the HTTP tunnel detection can be further improved.

[0143] Please refer to Figure 4 , Figure 4A structural block diagram of an electronic device is provided in an embodiment of the present application. The electronic device 400 includes at least one processor 401, at least one communication interface 402, at least one memory 403, and at least one communication bus 404. The communication bus 404 is configured to enable direct connection and communication among the components. The communication interface 402 is configured to perform signaling or data communication with other node devices. The memory 403 stores machine-readable instructions executable by the processor 401. When the electronic device 400 is running, the processor 401 communicates with the memory 403 through the communication bus 404, and the machine-readable instructions are executed by the processor 401 to perform the HTTP tunnel detection method described above.

[0144] For example, the processor 401 of the embodiment of the present application reads a computer program from the memory 403 through the communication bus 404 and executes the computer program to implement the following method: step S101: obtaining feature data corresponding to HTTP traffic data; and step S102: inputting the feature data into an HTTP tunnel tool detection model to obtain a first detection result output by the HTTP tunnel tool detection model.

[0145] The processor 401 includes one or more integrated circuit chips, which have the ability to process signals. The processor 401 can be a general-purpose processor, including a central processing unit (CPU), a micro controller unit (MCU), a network processor (NP), or other conventional processors. The processor 401 can also be a special-purpose processor, including a neural network processing unit (NPU), a graphics processing unit (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. When the processor 401 includes multiple processors, some of the processors can be general-purpose processors, and some of the processors can be special-purpose processors.

[0146] The memory 403 includes one or more, which can be, but are not limited to, a Random Access Memory (RAM), a Read Only Memory (ROM), a Programmable Read-Only Memory (PROM), an Erasable Programmable Read-Only Memory (EPROM), an Electric Erasable Programmable Read-Only Memory (EEPROM), and the like.

[0147] It can be understood that, Figure 4 The structure shown is only schematic, and the electronic device 400 can further include more or less components than those shown, or have a different configuration of components than those shown. Figure 4 The components shown in the foregoing embodiments can be realized in hardware, software, or a combination thereof. In the embodiments of the present application, the electronic device 400 can be, but is not limited to, a desktop computer, a notebook computer, a smart phone, a smart wearable device, a vehicle-mounted device, and the like, and can also be a virtual machine or the like. In addition, the electronic device 400 is not necessarily a single device, but can also be a combination of multiple devices, such as a server cluster, and the like. Figure 4 Figure 4 The embodiments of the present application also provide a computer readable storage medium, which stores computer program instructions, and the computer program instructions make the computer execute the HTTP tunnel detection method when the computer runs.

[0148] The embodiments of the present application also provide a computer readable storage medium, which stores computer program instructions, and the computer program instructions make the computer execute the HTTP tunnel detection method when the computer runs.

[0149] In the embodiments provided by the present application, it should be understood that the disclosed device and method can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division, and there can be another division manner in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0150] ​In addition, the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, i.e. may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0151] Furthermore, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0152] It should be noted that if the function is realized in the form of a software function module and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, and various program code storage media.

[0153] In this paper, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations.

[0154] The above is only an embodiment of the present application and does not limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method of HTTP tunnel detection, the method comprising: The method comprises the steps of: obtaining feature data corresponding to HTTP traffic data; wherein the HTTP traffic data is traffic data collected by an HTTP tunnel after being detected by an HTTP tunnel detection model; inputting the feature data into an HTTP tunnel tool detection model to obtain a first detection result output by the HTTP tunnel tool detection model; wherein the first detection result comprises probability values of the HTTP traffic data being generated by each HTTP tunnel tool; The method comprises the steps of: obtaining feature data corresponding to HTTP traffic data; wherein the HTTP traffic data is traffic data collected by an HTTP tunnel after being detected by an HTTP tunnel detection model; inputting the feature data into an HTTP tunnel tool detection model to obtain a first detection result output by the HTTP tunnel tool detection model; wherein the first detection result comprises probability values of the HTTP traffic data being generated by each HTTP tunnel tool; The method further comprises the steps of: updating the second detection result according to the feature data and / or the first detection result to obtain a corresponding third detection result; outputting the third detection result. The feature processing comprises at least one of the following processing modes: neural network learning processing, feature normalization processing, and one-hot encoding processing.

2. The HTTP tunnel detection method of claim 1, wherein, The step of updating the second detection result according to the feature data and / or the first detection result to obtain a corresponding third detection result comprises the steps of:

3. The HTTP tunnel detection method of claim 1, wherein, performing variance analysis on the first detection result to obtain a corresponding variance analysis result; updating the second detection result according to the variance analysis result to obtain the third detection result. The step of updating the second detection result according to the feature data and / or the first detection result to obtain a corresponding third detection result comprises the steps of:

4. The HTTP tunnel detection method of claim 1, wherein, comparing the feature data with tool features corresponding to an HTTP tunnel tool with the highest probability value in the first detection result to obtain a corresponding comparison result; updating the second detection result according to the comparison result to obtain the third detection result. The step of updating the second detection result according to the feature data and / or the first detection result to obtain a corresponding third detection result comprises the steps of:

5. The HTTP tunnel detection method of claim 1, wherein, updating the second detection result according to a domain name or an IP address in the feature data to obtain the third detection result. The method comprises the steps of:

6. An HTTP tunnel detection apparatus characterized by comprising: an obtaining module configured to obtain feature data corresponding to HTTP traffic data; wherein the HTTP traffic data is traffic data collected by an HTTP tunnel after being detected by an HTTP tunnel detection model; ​ The input module is configured to input the feature data into the HTTP tunnel tool detection model to obtain a first detection result output by the HTTP tunnel tool detection model, wherein the first detection result comprises a probability value of the HTTP traffic data being generated by each HTTP tunnel tool; The acquisition module is specifically configured to: acquire to-be-detected traffic data; input the to-be-detected traffic data into the HTTP tunnel detection model to obtain a second detection result output by the HTTP tunnel detection model, wherein the second detection result comprises a probability value of the to-be-detected traffic data belonging to the HTTP traffic data; perform feature processing on the HTTP traffic data in the to-be-detected traffic data to obtain the feature data corresponding to the HTTP traffic data; The HTTP tunnel detection device further comprises: an update module configured to update the second detection result according to the feature data and / or the first detection result to obtain a corresponding third detection result; an output module configured to output the third detection result.

7. An electronic device, comprising: comprise: a processor, a memory and a bus; the processor and the memory complete mutual communication through the bus; the memory stores computer program instructions executable by the processor, and the processor calling the computer program instructions can execute the HTTP tunnel detection method according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer program instructions, and when the computer program instructions are run by a computer, the computer is caused to execute the HTTP tunnel detection method according to any one of claims 1-5.

Images