A method for association analysis discovery of a hop-on node

Abstract

The application relates to a method for discovering associated nodes of a springboard node. By analyzing the flow data of the springboard node in a botnet, nodes with highly similar behaviors are discovered from the nodes connected to the springboard node, thereby discovering multiple associated nodes belonging to the same botnet, positioning the C&C server node possibly at the upper level, and providing help for subsequent trace analysis, discovery and prevention of botnet threats. The application can extract important features representing the behaviors of network nodes through analysis of network flow data, input the features into a well-constructed program after pretreatment, complete the discovery of nodes with similar behaviors, and output the results. By drawing a flow curve of the communication between highly suspicious nodes and the springboard node and visually displaying the flow curve, the upper and lower control relationship of the suspicious IP pair is further verified, and the discovery of associated nodes of the same botnet and attack prevention are realized.

Description

Technical Field

[0001] This invention relates to a botnet analysis method in the field of network security technology, particularly involving...

[0002] And a method for correlation analysis and discovery of jump board nodes. Background Technology

[0003] The main characteristic of botnets is that they control a large number of devices to carry out malicious activities such as large-scale attacks. Due to their ease of use and stealth, they are widely exploited by malicious actors. With the rapid development of technology today, devices connected to the Internet are no longer limited to computers and mobile phones. Home appliances such as routers and printers are also increasingly providing users with more services via the Internet.

[0004] Early botnet detection technologies focused on identifying botnet-related behaviors in individual network nodes or devices. For example, Buriya et al. proposed a protocol-feature-based detection method based on deep packet inspection (DPI). By analyzing the characteristics of each application layer protocol and building a feature database, they achieved high detection efficiency. This type of research has been around for over a decade and is effective in detecting anomalous nodes in the network. However, given the sheer number of network devices and the stealth of botnet hosts, simply finding and shutting down individual nodes is insufficient to combat the entire botnet. Recent graph-based botnet detection technologies overcome the limitations of traditional methods in fully capturing network communication patterns, effectively simulating the connectivity between hosts and the botnet topology. Lagraa et al. used Graphic EditDistance (GED) to discover anomalous substructures. The edit distance is calculated by comparing editing operations—insertion or deletion of vertices and edges—and the number of relabeled vertices. GED can identify anomalous IPs that are significantly different from other structures. A patent has proposed a visualization analysis method for multi-level control relationships in botnets.

[0005] In summary, the main shortcomings of existing botnet analysis methods are: most botnet detection technologies can only detect single bot nodes and lack understanding of the behavioral relationships between nodes; current research lacks further analysis of known jumper nodes and their associated nodes.

[0006] In view of the shortcomings of the existing botnet analysis methods, the inventors, through continuous research, design, and repeated trials and improvements, have finally created this invention with practical value. Summary of the Invention

[0007] The main objective of this invention is to overcome the limitation of existing botnet analysis methods, which can only detect...

[0008] The shortcomings of a single zombie node, which lacks understanding of the behavioral relationships between nodes, thus providing a new approach.

[0009] A method for discovering associations between jump node nodes aims to address the technical problem of enabling the understanding of behavioral relationships between nodes and allowing for further analysis of known jump node associations, making it highly practical.

[0010] Another objective of this invention is to provide a new method for correlation analysis and discovery of jump node. The technical problem to be solved is to enable the discovery of upstream node information by utilizing the flow data of the discovered jump node, thereby discovering the real attacker. This method plays an important role in strengthening network device threat monitoring, identification, and tracing, and is therefore more suitable for practical use.

[0011] Another objective of this invention is to provide a novel method for the correlation analysis and discovery of jumper nodes. The technical problem to be solved is a method for analyzing flow data based on three characteristics: time, space, and time. This method effectively discovers and derives IP pairs that exhibit similar inflow / outflow behavior within similar time periods, making it more suitable for practical application.

[0012] Another objective of this invention is to provide a new method for correlation analysis and discovery of jump node. The technical problem to be solved is to use a traffic curve analysis method to draw traffic curves of all IP pairs with similar active times into / out of jump node to analyze the similarity of transmission traffic, and further clarify the hierarchical control relationship between IP pairs and jump node, so as to be more practical and have industrial application value.

[0013] In botnets, the real attackers are often in a hidden state. When they launch attacks using botnets, they usually use jump devices instead of the attacking organization's control server to directly connect to the target. This means that most of the nodes detected by botnet node detection are controlled jump nodes rather than the real control server. How to use the stream data of the discovered jump nodes to mine the information of the superior nodes and then find the real attackers is of great importance for strengthening network device threat monitoring, identification, and tracing.

[0014] To address the technical problems existing in the prior art, this invention provides a method for analyzing jump node nodes in a botnet to identify peer nodes with similar behavior, and further discover the superior control node. This method, based on streaming data, determines which nodes connected to the jump node exhibit similar behavior, thereby identifying superior and inferior nodes that use the jump node to implement malicious behaviors such as multi-level control. It further identifies multiple nodes that may belong to the same botnet, aiding in finding the superior node in the entire multi-level control chain and subsequent source tracing analysis.

[0015] The objective of this invention and the technical problem it solves are achieved through the following technical solution. A method for correlation analysis and discovery of jump board nodes proposed in this invention comprises the following steps:

[0016] Step 1: Raw Data Processing

[0017] Network features are extracted from bidirectional network flow data stored in the form of streaming data. The behavior of all nodes connected to the jump node is sorted out. This streaming data carries the basic IP layer information required to forward data packets from one network node to another. The seven most representative features are extracted from the streaming data to form a seven-tuple. Based on the features of the seven-tuple, the inbound and outbound IP and traffic information in each time slice is sorted out according to the time slice.

[0018] Step 2: Identify suspicious IPs

[0019] By analyzing the temporal behavior similarity between different nodes connected to the jump node based on the time dimension, it was found that IPs with similar inflow / outflow traffic behavior exist in similar time periods. IPs that appear consecutively are counted, and IP pairs with high traffic overlap are filtered out.

[0020] Step 3: Plot flow rate curves for analysis

[0021] All suspicious IPs were sorted according to their degree of suspicion and their inflow and outflow curves with the jump node were plotted to further clarify the hierarchical control relationship of the suspicious IPs in the synchronization behavior.

[0022] Furthermore, the specific steps of step 1 are as follows:

[0023] Step 1.1: Seven-tuple feature extraction

[0024] The flow data containing the IP addresses of jump devices in the botnet is extracted. This flow data carries the basic IP layer information required to forward data packets from one network node to another. The seven-tuple used includes source IP, source port, destination IP, destination port, number of packets, number of bytes, and start time. The source port, destination IP, destination port, number of packets, number of bytes, and start time are used as the characteristics of the flow data. The start time feature is sliced ​​into 10-minute intervals, and the IP and traffic information appearing in each time period is summarized by an inverted index.

[0025] Step 1.2: Create an inverted index

[0026] In network data analysis, depending on the analysis requirements, the raw data needs to be processed differently to reflect the impact of different characteristics. The focus is on the communication characteristics of host IPs that have connections with known jump server IPs, including: temporal characteristics (activity time and spatial characteristics (data volume); among which:

[0027] First, considering the time characteristics, the streaming data needs to be divided into time windows of a certain width, and the default time window size is set to 10 minutes.

[0028] Then, considering spatial characteristics, it is necessary to calculate the total data volume of each IP connected to the jump server in each time slice. For a certain jump server node IP0, assume there is IP1→IP0→IP2, where the arrow indicates the direction of data flow. IP1 is more likely to be in the position of the superior command in the botnet, so it is necessary to distinguish the direction of data flow through the jump server IPs. InIPList and OutIPList are established for the jump server IPs being analyzed. For the inIP list, firstly, the records with the jump server IP as the "destination IP" in the seven-tuple features of the data flow are filtered. Then, according to the time window length of 10 minutes, the filtered seven-tuples are further divided. The "byte count" of data with the same "source IP" in the same time window is accumulated to obtain the inIP list of the entire data flow:

[0029] InIPList =( , ,…)

[0030] in For the x-th time window, for The cumulative traffic within that time slice; similarly, swapping the "source / destination IPs" yields the OutIPList.

[0031] Simultaneously, inverted indexes InInverList and OutInverList are created based on the inbound and outbound IP tables, respectively:

[0032] InInverList =( , ,…)

[0033] in express The j-th occurrence time window.

[0034] Furthermore, the specific steps of step 2 are as follows:

[0035] Step 2.1: Filtering based on the number of overlapping windows

[0036] First, filter out nodes that are unrelated to the botnet as much as possible, as well as nodes that are continuous. IPs appearing within a specific time window are considered synchronous IPs; all non-consecutive IPs are filtered out. IPs appearing within a time window The default value is 2;

[0037] Then, by comparing the inverted and outverted indexes, the number of overlapping windows among potential IPs that is greater than the threshold of 1 is calculated. All IP pairs, to obtain the set of IP pairs that satisfy the overlapping window number.

[0038] =( , ,…)

[0039] in This represents the time window in which the j-th common occurrence of the i-th IP pair occurs;

[0040] Step 2.2: Filtering based on overlap window ratio

[0041] Introducing the concept of Coincident Window Ratio (CWR), defined as follows:

[0042] =

[0043] Where n is the number of overlapping time slices. This represents the total number of time slices in which the incoming IPs appear. To determine the total number of time slices in which outgoing IPs appear, for each pair of overlapping IPs obtained in the previous step, calculate the overlap window ratio (CWR) within the overlapping time slices between the IP pairs. If the CWR is greater than the threshold... These are considered potentially suspicious IP pairs, and the output file format is as follows:

[0044] Step 2.3: Filtering based on average flow ratio

[0045] The two parameters of the overlapping window count represent the similarity of two IPs in terms of active time. Further judgment is needed based on the similarity of traffic volume. First, the average traffic overlap ratio (BSR) is introduced as a preliminary judgment parameter, defined as follows:

[0046] BSR =

[0047] Where n is the number of overlapping time slices. Let be the inbound traffic size of the IP pair in the i-th overlapping time slice. To determine the outgoing traffic volume, for each pair of overlapping IPs obtained in the previous step, calculate the average traffic overlap ratio (BSR) within the overlapping time slice between the IP pairs. If the BSR value is greater than the threshold... These are considered suspicious IP pairs and will be subject to further filtering.

[0048] Step 2.4: Filtering based on traffic correlation coefficient

[0049] The flow correlation coefficient (BRR) is introduced and defined as follows:

[0050] BRR =

[0051] =

[0052]

[0053] Where n is the number of overlapping time slices. Let be the inbound traffic size of the IP pair in the i-th overlapping time slice. For outbound traffic size, if the traffic of two suspicious IPs completely overlaps, the traffic correlation coefficient (BRR) is 1; if they do not overlap at all, the traffic correlation coefficient (BRR) is 0. The calculated BRR value between IP pairs is greater than the threshold. These are considered highly suspicious IP pairs, and the output file format is as follows:

[0054] In IP pairs that appear consecutively within a time slice are classified as synchronous IP pairs. Among these IP pairs, those with an overlap window ratio greater than [missing information] are further classified. These are considered potentially suspicious IP pairs, and the traffic overlap ratio within the same time slice between these potentially suspicious IP pairs is greater than [a certain value]. These are considered suspicious IP pairs.

[0055] Furthermore, filter traffic with a correlation coefficient greater than IP pairs that are considered highly suspicious are plotted, and traffic curves for overlapping periods of highly suspicious IP pairs are drawn. Based on the similarity of the curves, similar IP pairs are filtered and control relationships are sorted out.

[0056] This invention, based on the flow data of known jump node in a botnet, integrates multiple dimensions such as communication characteristics and abnormal traffic to achieve botnet upstream threat monitoring capabilities for network devices.

[0057] Compared with the prior art, the present invention has significant advantages and beneficial effects. Through the above technical solution, the present invention has at least the following advantages:

[0058] 1. This invention achieves the ability to monitor upstream threats to network devices by integrating multiple dimensions such as communication characteristics and abnormal traffic based on the flow data of known jump node nodes in botnets.

[0059] 2. This invention can extract key features representing the behavior of network nodes by analyzing network flow data. After preprocessing, these features are input into a pre-built program for analysis, enabling the discovery of nodes with similar behaviors and outputting results. By plotting and visualizing the communication patterns between highly suspicious nodes and jump server nodes, the hierarchical control relationship of suspicious IP pairs is further verified, achieving the discovery and attack prevention of related nodes within the same botnet.

[0060] 3. This invention can adapt well to the jump device flow data found in real network environments and can effectively identify malicious control hosts in the data.

[0061] This invention relates to a method for identifying a botnet node being used as a jump host by analyzing its traffic data. The specific method is detailed in the following embodiments and accompanying drawings. Attached Figure Description

[0062] Figure 1 This invention provides a system structure diagram for analyzing the association between springboard nodes in a botnet.

[0063] Figure 2 :Diagram illustrating the structure of the IP table file in this invention.

[0064] Figure 3 : This invention's IP provides an explanation of the structure of overlapping time slice files. Detailed Implementation

[0065] To further illustrate the technical means and functions adopted by the present invention to achieve the intended inventive objective

[0066] The following description, in conjunction with the accompanying drawings and preferred embodiments, illustrates an embodiment of the present invention for a jump board node.

[0067] The methods for discovering associations, including their specific implementation methods, steps, characteristics, and effects, are detailed below.

[0068] Please see Figure 1 , Figure 2 , Figure 3 As shown, a preferred embodiment of the present invention provides a method for correlation analysis and discovery of jump board nodes, which mainly includes the following steps:

[0069] 1. Raw data processing

[0070] 1) Seven-tuple feature extraction

[0071] Since the purpose of this method is to discover multiple groups of IPs with similar behavioral characteristics to known jump server devices that communicate with them, to ensure the effectiveness of the analysis, flow data containing jump server device IPs within the botnet is used. This flow data carries the basic IP layer information required to forward packets from one network node to another. The seven features used in this method are shown in the table below.

[0072]

[0073] In this flow record, "Source / Destination IP" represents the IP addresses of the sender and receiver, respectively. An IP address is a logical address assigned to every network or host on the Internet. In network traffic analysis, this characteristic is often used to represent a network node, i.e., using the IP address of a particular node to represent that node. "Source / Destination Port" represents the ports used by the sender and receiver in this flow record. Port numbers represent specific services provided by specific processes on a host. In network traffic analysis, different port numbers in two flow records often indicate that the two flows use different services. This characteristic can be used to distinguish the network behavior of malicious processes from normal processes. "Packet Count" and "Byte Count" represent the number of network packets contained in the flow data and the total amount of data (in bytes) transmitted. The amount of data transmitted per transmission often varies between different protocols, so this characteristic is also commonly used to distinguish different network behaviors. "Start Time" displays the time period during which the flow data is transmitted. The occurrence time of the same type of network behavior often follows a pattern. The time of a single flow record in the flow data is recorded with precision down to the second.

[0074] 2) Create an inverted index

[0075] In network data analysis, depending on the analysis requirements, the raw data needs to be processed differently to reflect the impact of different characteristics. In this system, we focus on the communication characteristics of host IPs that have connection behavior with known jump device IPs, including time characteristics (activity time) and spatial characteristics (data volume).

[0076] The first step is to consider the temporal characteristics, which requires dividing the streaming data into time windows of a certain width. If the time window is too small, it will result in too many windows, reducing computational efficiency. Conversely, if the window is too large, it may contain multiple different session processes within the same window, leading to a decrease in the characteristic differences between different windows. In most cases, normal network communication continuous request behavior will not exceed 10 minutes. Therefore, in this system, the default time window size is set to 10 minutes.

[0077] The second step considers spatial characteristics, requiring the calculation of the total data volume for each IP connected to the jump server in each time slice. Since in the multi-level control relationship of a botnet, the IP at the higher level is often more likely to be the command server, for a jump node IP0, assuming there is IP1→IP0→IP2, where the arrows indicate the direction of data flow, IP1 is more likely to be at the higher command level in the botnet. Therefore, distinguishing the direction of data flow through the jump server IPs is crucial. We need to create InIPList and OutIPList for the jump server IPs being analyzed. For the InIPList, firstly, we filter records with the jump server IP as the "destination IP" from the seven-tuple features of the data flow. Then, based on the 10-minute time window length, we further divide the filtered seven-tuples, summing the "byte count" of data with the same "source IP" within the same time window to obtain the InIPList for the entire data flow.

[0078] InIPList =( , ,…)

[0079] in For the x-th time window, for The cumulative traffic within that time slice. Similarly, swapping the "source / destination IP" yields the OutIPList. The IP table format is as follows: Figure 2 As shown.

[0080] To improve subsequent data processing efficiency, this system also establishes inverted indexes InInverList and OutInverList based on the inbound and outbound IP tables respectively:

[0081] InInverList =( , ,…)

[0082] in express The j-th occurrence time window.

[0083] 2. Suspicious IP Discovery

[0084] 1) Filtering based on the number of overlapping windows

[0085] To reduce system runtime and improve analysis efficiency, nodes unrelated to the botnet are filtered out as much as possible. Since the time window size is set based on the assumption that, in most cases, continuous communication requests do not exceed ten minutes, there is a possibility of continuous... IPs appearing within a given time window are considered synchronous IPs; all non-consecutive IPs are filtered out. IPs appearing within a time window The default setting is 2.

[0086] Then, by comparing the inverted and outverted indexes, the number of overlapping windows in potential IPs that is greater than the threshold of 1 is calculated. For all IP pairs, obtain the set of IP pairs that satisfy the overlapping window number.

[0087] =( , ,…)

[0088] in This represents the time window in which the j-th co-occurrence of the i-th IP pair occurs.

[0089] 2) Filtering based on overlap window ratio

[0090] In rare cases, a jump server may provide normal service to another device for an extended period. During this time, if another device establishes a short-lived connection with the jump server that exceeds the time window threshold, these two IP actions, though unrelated, will be retained as synchronous IPs based on the overlap window ratio filter, resulting in false positives. To avoid this, the concept of Overlap Window Ratio (CWR) is introduced, defined as follows:

[0091] =

[0092] Where n is the number of overlapping time slices. This represents the total number of time slices in which the incoming IPs appear. To determine the total number of time slices in which outgoing IPs appear, for each pair of overlapping IPs obtained in the previous step, calculate the CWR value within the overlapping time slices between the IP pairs. If the CWR value is greater than the threshold... These are considered potentially suspicious IP pairs, and the output file format is as follows: Figure 3 As shown.

[0093] 3) Filtering based on average flow ratio

[0094] The two parameters of the overlapping window count represent the similarity of two IPs in terms of their active time. If the devices belonging to two IPs connect to the jump device at similar times, it could be related malicious behavior within the same botnet, or it could be two unrelated normal connections that happen to occur simultaneously. Therefore, further judgment is needed based on the similarity of traffic volume. First, we introduce the average traffic overlap ratio (BSR) as a preliminary judgment parameter, defined as follows:

[0095] BSR =

[0096] Where n is the number of overlapping time slices. Let be the inbound traffic size of the IP pair in the i-th overlapping time slice. This refers to the outbound traffic volume. For each pair of overlapping IPs obtained in the previous step, calculate the BSR value within the overlapping time slice between the IP pairs. If the value is greater than the threshold... These are then considered suspicious IP pairs and subjected to further filtering.

[0097] 4) Filtering based on flow correlation coefficient

[0098] To further increase filtering accuracy and reduce the differences in suspicious IP pairs across different time windows within overlapping time periods, a traffic correlation coefficient (BRR) is introduced, defined as follows:

[0099] BRR =

[0100] =

[0101]

[0102] Where n is the number of overlapping time slices. Let be the inbound traffic size of the IP pair in the i-th overlapping time slice. The traffic volume is the outgoing traffic size. If the traffic of two suspicious IPs completely overlaps, the traffic correlation coefficient (BRR) = 1; if they do not overlap at all, the traffic correlation coefficient (BRR) = 0. Calculate the traffic correlation coefficient (BRR) value between IP pairs; if it is greater than the threshold... These are considered highly suspicious IP pairs.

[0103] 3. Analyze flow rate curves.

[0104] The discovered highly suspicious IP pairs ( ) Draw the overlapping time period through the jumper IP ( tbip The flow curves of ) were plotted respectively. ,and If the two traffic curves are highly similar, it indicates that they are an abnormal IP pair in synchronization.

[0105] After analyzing the multi-level control relationships of a botnet, network nodes that act as stepping stones for the botnet are usually identified. These nodes serve functions such as forwarding commands within the botnet. The real attackers are hidden within the network, and when they launch an attack, they typically use stepping stone devices to issue instructions. Therefore, analyzing the traffic of these stepping stone nodes is crucial for identifying the real attackers.

[0106] The system input is network flow data related to the jump node. The system first preprocesses the raw data, dividing the overall flow data into different time slices according to the time window size. It then analyzes the list of IPs appearing in each time slice and the total traffic within that time slice, generating an IP table file with the following structure: Figure 2 As shown, an inverted index is then generated based on the IP table to facilitate subsequent data analysis.

[0107] Next, suspicious IPs are detected based on temporal and spatial similarity. First, IP pairs with high temporal similarity are filtered, and then a threshold is set based on the number of overlapping windows and the overlap window ratio (CWR). , Initially, IP pairs that highly overlap with the communication time slots of the jump server IP are selected. The IP pairs and overlapping time slices are output to a file, and the file content is as follows: Figure 3 As shown. Further filtering is then applied based on the similarity of traffic volume, using thresholds for the input average traffic overlap ratio (BSR) and traffic correlation coefficient (BRR). and Filter out IP pairs with high similarity to the host IP in terms of communication time and traffic, and output the IP pair and traffic overlap ratio to a file. Plot highly suspicious IP pairs ( ) Draw the overlapping time period through the jumper IP ( tbip The flow curves of ) were plotted respectively. ,and Comparing the traffic curves, the two curves show a high degree of consistency in their fluctuation patterns, with peaks and troughs indicating a high degree of overlap in traffic volume, suggesting similar behavior. While the curves in the lower graph show less overlap than the upper one, the active times of the IPs in both graphs are essentially the same. Therefore, it can be preliminarily determined that both IPs are active within the botnet. The control relationship.

[0108] Security experts can then extract the analysis results, search for packet data of highly suspicious IP pairs, and use methods such as comprehensive packet analysis to discover related attack behaviors from overlapping time periods. They can further determine the role of each node in the same botnet community, thus achieving a higher accuracy rate. Simultaneously, the results can be compared with those from previous multi-level control relationship analysis systems to identify communication between nodes in the same community appearing in the visualization interface, determining whether there are any connections with nodes not detected by the system, thereby discovering similar botnet attack events occurring at other times.

[0109] The association analysis and discovery method for jump node proposed in this invention allows those skilled in the art to discover the upper and lower level botnet nodes that use the device as a jump node for botnet association activities by knowing the flow data information of the exploited jump node, thus better discovering the hidden upper-level command server and providing assistance for subsequent sampling and tracing work.

[0110] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

[0111] Furthermore, the above examples include sequential exemplary steps, but these steps need not be performed in the order shown. Performing these steps in different orders is within the scope of this invention. Within the spirit and scope of the embodiments of this invention, these steps may be added, substituted, changed in order, and / or omitted as appropriate.

[0112] Although the present invention has been disclosed above with reference to embodiments, it is not intended to limit the scope of the invention. Any person skilled in the art can make various modifications and refinements without departing from the spirit and scope of the invention. Therefore, the scope of protection of the present invention shall be determined by the claims.

Claims

1. A method for discovering associations of jump board nodes, comprising the following steps: Step 1: Raw Data Processing Network features are extracted from bidirectional network flow data recorded and stored in the form of streaming data. The behavior of all nodes connected to the jumper node is analyzed. This streaming data carries the basic IP layer information required to forward data packets from one network node to another. The seven most representative features are extracted from the streaming data to form a seven-tuple. Based on the features of this seven-tuple, the inbound and outbound IP and traffic information within each time slice is analyzed according to time period slices. The specific steps of step 1 are as follows: Step 1.1: Seven-tuple feature extraction The flow data containing the IP addresses of jump devices in the botnet is extracted. This flow data carries the basic IP layer information required to forward data packets from one network node to another. The seven-tuple used includes source IP, source port, destination IP, destination port, number of packets, number of bytes, and start time. The source IP, source port, destination IP, destination port, number of packets, number of bytes, and start time are used as the characteristics of the flow data. The start time feature is sliced ​​into 10-minute intervals, and the IP and traffic information appearing in each time period is summarized by an inverted index. Step 1.2: Create an inverted index In network data analysis, depending on the specific analytical requirements, the raw data needs to be processed differently to reflect the impact of different characteristics. The focus is on the communication characteristics of host IPs that have connections with known jump server IPs, including: Temporal characteristics refer to both active time and spatial characteristics refer to the amount of data; among which: First, considering the time characteristics, the streaming data needs to be divided into time windows of a certain width, and the default time window size is set to 10 minutes. Then, considering spatial characteristics, it is necessary to calculate the total data volume of each IP connected to the jump server device in each time slice. For a certain jump server node IP0, assume there is IP1→IP0→IP2, where the arrow indicates the direction of data flow. IP1 is more likely to be in the position of the superior command in the botnet, so it is necessary to distinguish the direction of data flow through the jump server IPs. Establish inbound and outbound IP tables InIPList and OutIPList for the jump server IPs to be analyzed. For the inbound IP table, firstly, filter the records with the jump server IP as the "destination IP" in the seven-tuple features of the data flow. Then, according to the time window length of 10 minutes, further divide the filtered seven-tuples. Accumulate the "byte count" of data with the same "source IP" in the same time window to obtain the inbound IP table of the entire data flow: InIPList =( , ,…) in For the x-th time window, for The cumulative traffic within this time slice; similarly, swapping the "source / destination IP" yields the OutIPList. Simultaneously, inverted indexes InInverList and OutInverList are created based on the inbound and outbound IP tables, respectively: InInverList =( , ,…) in express The j-th occurrence time window; Step 2: Identify suspicious IPs Based on time-dimensional analysis, the similarity of temporal behavior among different nodes connected to the jump node is analyzed. IPs exhibiting similar inflow / outflow traffic behavior within similar time periods are identified. Consecutive IPs are statistically analyzed, and IP pairs with high traffic overlap are selected. The specific steps of step 2 are as follows: Step 2.1: Filtering based on the number of overlapping windows First, filter out nodes that are unrelated to the botnet as much as possible, as well as nodes that are continuous. IPs appearing within a given time window are considered synchronous IPs; all non-consecutive IPs are filtered out. IPs appearing within a time window The default value is 2; Then, by comparing the inverted and outverted indexes, the number of overlapping windows in the synchronization IP is calculated to be greater than the threshold of 1. For all IP pairs, obtain the set of IP pairs that satisfy the overlapping window number: =( , ,…) in This represents the time window in which the j-th common occurrence of the i-th IP pair occurs; Step 2.2: Filtering based on overlap window ratio Introducing the concept of Coincident Window Ratio (CWR), defined as follows: = Where n is the number of overlapping time slices. This represents the total number of time slices in which the incoming IPs appear. To determine the total number of time slices in which outgoing IPs appear, for each pair of overlapping IPs obtained in the previous step, calculate the overlap window ratio (CWR) within the overlapping time slices between the IP pairs. If the CWR is greater than the threshold... These are considered potentially suspicious IP pairs, and the output file format is as follows: Step 2.3: Filtering based on average flow ratio The two parameters of the overlapping window count represent the similarity of two IPs in terms of active time. Further judgment is needed based on the similarity of traffic volume. First, the average traffic overlap ratio (BSR) is introduced as a preliminary judgment parameter, defined as follows: BSR = Where n is the number of overlapping time slices. Let be the inbound traffic size of the IP pair in the i-th overlapping time slice. To determine the outgoing traffic volume, for each pair of overlapping IPs obtained in the previous step, calculate the average traffic overlap ratio (BSR) within the overlapping time slice between the IP pairs. If the BSR value is greater than the threshold... These are considered suspicious IP pairs and will be subject to further filtering. Step 2.4: Filtering based on traffic correlation coefficient The flow correlation coefficient (BRR) is introduced and defined as follows: BRR = = Where n is the number of overlapping time slices. Let be the inbound traffic size of the IP pair in the i-th overlapping time slice. For outbound traffic size, if the traffic of two suspicious IPs completely overlaps, the traffic correlation coefficient (BRR) is 1; if they do not overlap at all, the traffic correlation coefficient (BRR) is 0. The calculated BRR value between IP pairs is greater than a threshold. These are considered highly suspicious IP pairs, and the output file format is as follows: In IP pairs that appear consecutively within a time slice are classified as synchronous IP pairs. Among these IP pairs, those with an overlap window ratio greater than [missing information] are further classified. These are considered potentially suspicious IP pairs, and the traffic overlap ratio within the same time slice between these potentially suspicious IP pairs is greater than [a certain value]. These are considered suspicious IP pairs; Step 3: Plot flow rate curves for analysis All suspicious IPs were sorted according to their degree of suspicion and their inflow and outflow curves with the jump node were plotted to further clarify the hierarchical control relationship of the suspicious IPs in the synchronization behavior.

2. A method for detecting associations of jump-board nodes according to claim 1, characterized in that, Further filtering by traffic correlation coefficient greater than IP pairs that are considered highly suspicious are plotted, and traffic curves for overlapping periods of highly suspicious IP pairs are drawn. Based on the similarity of the curves, similar IP pairs are filtered and control relationships are sorted out.

Images