A network traffic generation method based on host behavior characteristics

Abstract

The application relates to the technical field of network security and network simulation, and discloses a network traffic generation method based on host behavior characteristics. By importing a pcap or pcapng file of sample traffic, application layer protocol characteristics, host behavior characteristics and communication behavior characteristics of the sample traffic are extracted, the imported sample traffic is analyzed, host types are identified through a host type identification method according to the characteristics, and identity identification marks are labeled; a traffic generation template is configured, a generation target is determined, correlation coefficients between hosts are sequentially calculated from the same identity identification mark, IP addresses of target hosts are updated according to the correlation coefficients, and an IP address change mapping table is formed. The application can generate network traffic with high fidelity of network topology structure, has self-defining capability, can meet the growing demand in the field of network space security, can help improve the authenticity and reliability of network traffic data sets, and can help resist the constantly evolving network threats.

Description

Technical Field

[0001] This invention relates to the fields of network security and network simulation technology, specifically a method for generating network traffic based on host behavior characteristics. Background Technology

[0002] Cybersecurity is becoming increasingly important in today's world as our daily lives and work become more and more reliant on the internet. However, with the continuous development of the internet, cyber threats are also constantly evolving, making cybersecurity exceptionally crucial. In the field of cybersecurity, data plays a vital role in anomaly detection, intrusion detection, threat intelligence, and other security tasks. However, due to privacy concerns and legal constraints, obtaining accurate attack data and target context traffic has become extremely difficult.

[0003] Currently, existing datasets are widely used in the field of cybersecurity, but they have several limitations. These limitations include limited dataset size, lack of diversity, limited data collection scenarios, excessive data cleaning, and potential legal and ethical restrictions. Network analysts often use multiple datasets from different sources for analysis, but these datasets suffer from fragmented network topology. Therefore, finding an effective method to fuse traffic samples from multiple sources to generate network traffic data is crucial. Summary of the Invention

[0004] To address the aforementioned problems, the present invention aims to provide a network traffic generation method based on host behavior characteristics. This method can generate network traffic with highly realistic network topology, while also possessing customization capabilities. This meets the growing demands of the cybersecurity field and helps improve the authenticity and reliability of network traffic datasets, thus aiding in mitigating evolving network threats. The technical solution is as follows:

[0005] A method for generating network traffic based on host behavior characteristics includes the following steps:

[0006] Step 1: Extract application layer protocol features, host behavior features, and communication behavior features from multiple sample traffic pcap or pcapng files; specifically:

[0007] Application layer protocol characteristics: The distribution of network flow protocols, protocol activity time, active port numbers, and the number of hosts corresponding to application layer protocols within a unit of time.

[0008] Host behavior characteristics: the number of active ports, port numbers, and number of port interactions of a host within a unit of time;

[0009] Communication behavior characteristics: Extracting communication characteristics of network traffic, including: network flow length and its statistical characteristics, data packet length and its statistical characteristics in the network flow, network flow statistical characteristics, and data packet interval sequence and its statistical characteristics in the network flow;

[0010] Step 2: Analyze the imported sample traffic. Based on its application layer protocol characteristics, host behavior characteristics, and communication behavior characteristics, identify the host type using the host type identification method and mark it with an identification identifier.

[0011] Step 3: Based on the application layer protocol features, host behavior features, and communication behavior features extracted from each sample traffic, configure the traffic generation template, determine the generation target, and the key configuration items for generating traffic include: selecting the scenario for generating traffic, setting the traffic network traffic scale and duration, selecting one traffic sample as the background sample traffic, and the rest as the sample traffic to be merged, and initially determining whether the background sample traffic can be merged with the sample traffic to be merged. If they cannot be merged, they need to be reconfigured.

[0012] Step 4: Based on the generated traffic template configured in Step 3, the feature vector formed by the three features of the background sample traffic and the sample traffic to be fused extracted in Step 1, combined with the identity identification identifier in Step 2, the correlation coefficient between hosts is calculated sequentially from the same identity identification identifier using the host similarity algorithm, and the IP address of the target host in the sample traffic to be fused is updated according to the correlation coefficient.

[0013] An IP address change mapping table is generated for all hosts in the sample traffic to be merged. Based on this table, the host IP addresses and IP layer checksums in the original pcap packets are modified. The background sample traffic and the sample traffic to be merged are reordered according to time sequence. The pcap file and the IP address change mapping table are exported, with the IP address mapping table serving as an explanatory file.

[0014] Further methods for identifying machine types include:

[0015] Step 2.1: Define the host type

[0016] Host types are divided into three main categories: clients, servers, and other devices. Clients are internet access terminals, including personal computers and smartphones. Servers refer to the server side in a client / server architecture, including web servers, FTP servers, email servers, and database servers. Other devices include routers, firewalls, P2P servers, and proxy servers.

[0017] Step 2.2: Identify Host Type

[0018] A host to be detected that meets the following conditions is a server, and is specifically determined to be a C / S architecture server based on its characteristics:

[0019] 1) When the host under test interacts with another host, it reuses a certain port;

[0020] 2) The other host communicating with the host under test uses a random port;

[0021] 3) There are multiple hosts communicating with the host under test;

[0022] After identifying a server as a C / S architecture server, servers with well-known ports are labeled by comparing their port numbers, while servers with unknown ports are uniformly labeled as C / S architecture servers, serving as identification identifiers.

[0023] Furthermore, the key indicators for determining whether the background sample traffic can be fused with the sample traffic to be fused in step 3 include:

[0024] 1) The number of hosts in the sample traffic to be fused shall not exceed 40% of the background sample traffic;

[0025] 2) The total duration of the sample traffic to be fused does not exceed the background sample traffic;

[0026] 3) The byte length of the sample traffic to be merged shall not exceed 50% of the background sample traffic, except for DDoS attacks.

[0027] Furthermore, in step 4, the calculation of the correlation coefficient between hosts using the host similarity algorithm specifically involves:

[0028] Calculate the Pearson correlation coefficient between the target host X in the foreground traffic and the host Y under the same label in the sample traffic:

[0029]

[0030] In the formula, X i Let i be the i-th observation of the sample flow to be fused. Y is the mean vector of the traffic of the samples to be fused. i For the i-th observation of the background sample, This is the mean vector of the background samples;

[0031] The specific steps for updating the target host's IP address based on the correlation coefficient are as follows: select the IP address of host Y with the highest Pearson correlation coefficient as the new IP address of target host X; if the Pearson correlation coefficients of all hosts Y are less than 0, then keep the original IP address of target host X unchanged.

[0032] The beneficial effects of this invention are:

[0033] 1) The present invention is a network traffic generation method based on host behavior characteristics. It extracts the communication behavior characteristics of multiple sample traffic, analyzes the host behavior characteristics of the sample traffic, configures a traffic generation template, and merges multiple sample traffic to generate network traffic data that meets the needs of data analysts.

[0034] 2) This invention overcomes the shortcomings of the fragmented topology structure of multiple network traffic datasets from different sources in the prior art, generates a highly realistic network topology structure for network traffic, and has customization capabilities to meet the ever-growing needs in the field of cyberspace security.

[0035] 3) The development of this invention will help improve the authenticity and reliability of network traffic datasets and help defend against ever-evolving network threats. Attached Figure Description

[0036] Figure 1 This is an overall flowchart of the network traffic fusion generation method based on host behavior of the present invention. Detailed Implementation

[0037] The technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. It is understood that the specific embodiments described herein are merely for explaining the relevant application and not for limiting the application. Furthermore, it should be noted that, for ease of description, only the parts relevant to the application are shown in the accompanying drawings.

[0038] Step 1: Import the pcap or pcapng file of the sample traffic and extract the application layer protocol features, host behavior features, and communication behavior features of the sample traffic, specifically including:

[0039] Application layer protocol characteristics: characteristics such as protocol distribution of network flow per unit time, protocol active time, active port number, and number of hosts corresponding to application layer protocols.

[0040] Host behavior characteristics: the number of active ports, port numbers, and number of port interactions of a host within a unit of time.

[0041] Communication characteristics: Extracting communication characteristics of network traffic, including: network flow length and its statistical characteristics, packet length and its statistical characteristics in the network flow, network flow statistical characteristics, packet interval sequence and its statistical characteristics in the network flow, etc. Table 1 provides a detailed description of a feature vector.

[0042] Table 1. Detailed description of eigenvectors

[0043]

[0044] Step Two: To facilitate topology fusion, it is necessary to identify the server type of the background sample traffic and map the host IP address of the target traffic to the background sample traffic. Therefore, it is necessary to analyze the imported background sample traffic and, based on its application layer protocol characteristics, host behavior characteristics, and communication behavior characteristics, identify the host type using host type identification methods.

[0045] Host type definition: Host types are divided into three main categories: clients, servers, and other devices. Clients mainly include internet access terminals such as personal computers and smartphones; servers mainly refer to the server side in a client / server architecture, including web servers, FTP servers, email servers, and database servers; other devices include routers, firewalls, P2P servers, and proxy servers.

[0046] Server Type: In client / server (C / S) architecture communication, the party with a single or few active ports is usually the server, while the party with more active ports and randomized port numbers is the client. Common C / S architecture protocols identify the server by its port number and key protocol fields. Non-C / S architecture protocols, such as P2P protocols, often reuse a single port during communication. Therefore, this invention considers a host to be a server if it meets the following conditions, and specifically determines it to be a C / S architecture server based on its characteristics:

[0047] (1) When the host under test interacts with another host, it reuses a certain port;

[0048] (2) Another host communicating with the host under test uses a random port;

[0049] (3) There are multiple hosts communicating with the host to be detected.

[0050] After identifying a server as a C / S architecture server, servers with well-known ports are labeled by comparing their port numbers, while servers with unknown ports are uniformly labeled as C / S architecture servers, serving as identification identifiers.

[0051] Step 3: Based on step 1), configure the traffic generation template and determine the generation target. Key configuration items for generating traffic include: selecting the scenario for generating traffic, setting the traffic network traffic scale and duration, selecting the background sample traffic and the target sample traffic to be merged, and initially determining whether the background sample traffic can be merged with the target network traffic environment. If it cannot be merged, it needs to be reconfigured.

[0052] The sample flow includes background sample flow and sample flow to be fused. The features of the background sample flow serve as a blueprint and do not participate in subsequent feature transformations; the sample flow to be fused is the flow that requires feature transformations and will be integrated into the background sample flow after feature transformations.

[0053] Key indicators for determining whether background sample traffic and sample traffic to be fused can be fused include:

[0054] (1) The number of hosts in the sample traffic to be fused shall not exceed 40% of the background sample traffic;

[0055] (2) The total duration of the sample flow to be fused does not exceed the background sample flow;

[0056] (3) The byte length of the sample traffic to be fused shall not exceed 50% of the background sample traffic (except for DDoS attacks).

[0057] Step 4: Based on the generated traffic template configured in Step 3, combined with the host feature vectors of the target traffic and sample traffic in Step 1, and combined with the identity identification tags in Step 2, calculate the correlation coefficient between hosts sequentially from the same identity identification tag using the host similarity algorithm.

[0058] Host similarity algorithm: Calculate the Pearson correlation coefficient between the target host X in the foreground traffic and the host Y with the same label in the sample traffic.

[0059]

[0060] In the formula, X i Let i be the i-th observation of the sample flow to be fused. Y is the mean vector of the traffic of the samples to be fused. i For the i-th observation of the background sample, This is the mean vector of the background samples.

[0061] The IP address of host Y with the highest Pearson correlation coefficient is selected as the new IP address of the target host X to be merged; if the Pearson correlation coefficients of all hosts Y are less than 0, the original IP address of host X is kept unchanged.

[0062] An IP address change mapping table is generated for all hosts in the sample traffic to be merged. Based on this table, the host IP addresses and IP layer checksums in the original pcap packets are modified. The background sample traffic and the sample traffic to be merged are reordered according to time sequence. The pcap file and the IP address change mapping table are exported, with the IP address mapping table serving as an explanatory file.

Claims

1. A method for generating network traffic based on host behavior characteristics, characterized in that, Includes the following steps: Step 1: Extract application layer protocol features, host behavior features, and communication behavior features from multiple sample traffic pcap or pcapng files; Specifically: Application layer protocol characteristics: The distribution of network flow protocols, protocol activity time, active port numbers, and the number of hosts corresponding to application layer protocols within a unit of time. Host behavior characteristics: the number of active ports, port numbers, and number of port interactions of a host per unit of time; Communication behavior characteristics: Extracting communication characteristics of network traffic, including: network flow length and its statistical characteristics, data packet length and its statistical characteristics in the network flow, network flow statistical characteristics, and data packet interval sequence and its statistical characteristics in the network flow; Step 2: Analyze the imported sample traffic. Based on its application layer protocol characteristics, host behavior characteristics, and communication behavior characteristics, identify the host type using the host type identification method and mark it with an identification identifier. Step 3: Based on the application layer protocol features, host behavior features, and communication behavior features extracted from each sample traffic, configure the traffic generation template, determine the generation target, and the key configuration items for generating traffic include: selecting the scenario for generating traffic, setting the traffic network traffic scale and duration, selecting one traffic sample as the background sample traffic, and the rest as the sample traffic to be merged, and initially determining whether the background sample traffic can be merged with the sample traffic to be merged. If they cannot be merged, they need to be reconfigured. Step 4: Based on the generated traffic template configured in Step 3, the feature vector formed by the three features of the background sample traffic and the sample traffic to be fused extracted in Step 1, combined with the identity identification identifier in Step 2, the correlation coefficient between hosts is calculated sequentially from the same identity identification identifier using the host similarity algorithm, and the IP address of the target host in the sample traffic to be fused is updated according to the correlation coefficient. A change IP address mapping table is generated for all hosts in the sample traffic to be merged. Based on this table, the host IP address and IP layer checksum in the original pcap packet are modified. The background sample traffic and the sample traffic to be merged are reordered according to the time sequence. The pcap file and the change IP address mapping table are exported, with the IP address mapping table serving as an explanatory file. In step 4, the correlation coefficient between hosts is calculated using a host similarity algorithm as follows: Calculate the Pearson correlation coefficient between the target host X in the traffic samples to be fused and the host Y under the same label in the background traffic samples: ； In the formula, Let i be the i-th observation of the sample flow to be fused. Let be the mean vector of the traffic of the samples to be fused. For the i-th observation of the background sample, This is the mean vector of the background samples; The specific steps for updating the target host's IP address based on the correlation coefficient are as follows: select the IP address of host Y with the highest Pearson correlation coefficient as the new IP address of target host X; if the Pearson correlation coefficients of all hosts Y are less than 0, then keep the original IP address of target host X unchanged.

2. The network traffic generation method based on host behavior characteristics according to claim 1, characterized in that, The host type identification method specifically includes: Step 2.1: Define the host type Host types are divided into three main categories: clients, servers, and other devices. Clients are internet access terminals, including personal computers and smartphones. Servers refer to the server side in a client / server architecture, including web servers, FTP servers, email servers, and database servers. Other devices include routers, firewalls, P2P servers, and proxy servers. Step 2.2: Identify Host Type A host to be detected that meets the following conditions is a server, and is specifically determined to be a C / S architecture server based on its characteristics: 1) When the host under test interacts with another host, it reuses a certain port; 2) The other host communicating with the host under test uses a random port; 3) There are multiple hosts communicating with the host under test; After identifying a server as a C / S architecture server, servers with well-known ports are labeled by comparing their port numbers, while servers with unknown ports are uniformly labeled as C / S architecture servers, serving as identification identifiers.

3. The network traffic generation method based on host behavior characteristics according to claim 1, characterized in that, The key indicators for determining whether the background sample traffic can be fused with the sample traffic to be fused in step 3 include: 1) The number of hosts in the sample traffic to be fused shall not exceed 40% of the background sample traffic; 2) The total duration of the sample traffic to be fused does not exceed the background sample traffic; 3) The byte length of the sample traffic to be merged shall not exceed 50% of the background sample traffic, except for DDoS attacks.

Images