A method, system, device, and storage medium for detecting hybrid port scanning behavior.

Abstract

This invention proposes a method, system, device, and storage medium for detecting hybrid port scanning behavior, belonging to the field of network security technology. The method includes: acquiring port traffic data; cleaning the acquired traffic data; acquiring all traffic data within a time window T; aggregating the traffic data using three methods and extracting corresponding feature indicators; determining the mean value of each feature indicator based on the extracted feature indicators; calculating the Euclidean distance between each feature indicator for each IP and its corresponding mean value; determining whether the Euclidean distance is greater than a distance threshold; when the Euclidean distance is greater than the distance threshold, identifying the corresponding operation event and determining whether the distance threshold is incorrect based on the identification result; if the distance threshold is incorrect, updating the distance threshold by executing a threshold incentive update strategy. This invention improves the accuracy and rigor of hybrid port scanning behavior detection, while also enabling maintenance for erroneous cases.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically to a method, system, device, and storage medium for detecting hybrid port scanning behavior. Background Technology

[0002] To prevent attackers from exploiting network ports (the channels through which computers transmit data) to intrude into systems, port scanning is often necessary to detect port vulnerabilities. The main purpose of port scanning is to attempt to establish a connection with the target host. If the target host responds with appropriate information, it indicates whether the port is open or closed. Port scanning is categorized into horizontal scanning, vertical scanning, and hybrid scanning. Existing port scanning methods often utilize Snort and PortSentry.

[0003] Snort can detect the number of packets sent from the same source IP to different destinations within a time window of T seconds. If this number exceeds a predetermined number, it is judged as a scanning behavior. PortSentry can detect the number of connections sent from the same source IP in the most recent connections. If this number exceeds a predetermined number, it is judged as a scanning behavior.

[0004] However, the above methods are only applicable to vertical scanning (i.e., the attacker communicates with multiple ports of a specific target host) and cannot detect mixed scanning (scanning multiple ports of multiple different target hosts) and horizontal scanning behavior (i.e., the attacker communicates with multiple IP addresses in the same subnet on the same port). In addition, they are not applicable to slow scanning and periodic scanning behavior.

[0005] Moreover, in the above methods, the setting of a certain number needs to be combined with the actual situation of the data. If the threshold is set too low, false alarms are likely to occur, and if it is set too high, false alarms will occur. Summary of the Invention

[0006] To address the above problems, the present invention aims to provide a method, system, device, and storage medium for detecting hybrid port scanning behavior, which can effectively detect port slow scanning, fast scanning, horizontal scanning, vertical scanning, and block scanning behavior by selecting the coverage period of the data.

[0007] To achieve the above objectives, this invention provides the following technical solution: a hybrid port scanning behavior detection method, comprising: Acquire port traffic data and perform data cleaning on the acquired traffic data; Acquire all traffic data within time window T, aggregate traffic data with the same source IP, traffic data with the same source IP and destination IP, and traffic data with the same source IP and destination port number, and extract the corresponding feature indicators. The mean value of each feature indicator is determined based on the extracted feature indicators; Calculate the Euclidean distance between each characteristic metric of each IP and the corresponding mean metric; Determine if the Euclidean distance is greater than a distance threshold; When the Euclidean distance is greater than the distance threshold, the corresponding operation event is identified, and the distance threshold is determined to be incorrect based on the identification result. If the distance threshold is incorrect, the distance threshold is updated by executing a threshold incentive update strategy.

[0008] Furthermore, the acquisition of port traffic data, including data cleaning of the acquired traffic data, includes: Traffic data is filtered by protocol, retaining traffic data using TCP, UDP, and ICMP protocols, and filtering out traffic data using other protocols; Perform data stream filtering on the traffic data, retaining data streams with fewer than 300 bytes sent by the client.

[0009] Furthermore, the acquisition of all traffic data within the time window T involves aggregating traffic data with the same source IP, traffic data with the same source IP and destination IP, and traffic data with the same source IP and destination port number, and extracting corresponding feature indicators, including: Get all traffic data within the last ten minutes; Traffic data with the same source IP is aggregated, and the following parameters are extracted: access count small_num (packet length less than 128 bytes), average uplink traffic up from source IP, average downlink traffic down, average packet size pkt_avg, minimum uplink traffic min_up, maximum uplink traffic max_up, minimum downlink traffic min_down, and maximum downlink traffic max_down. Aggregate traffic data with the same source IP and destination IP, and calculate the source IP access frequency (tf), the total number of access ports (max_port), and the average number of access ports (mean_port). Traffic data with the same source IP and destination port number are aggregated to calculate the number of destination IPs accessed (dip_num) and the maximum number of destination IPs corresponding to the port number (sim_port_ip).

[0010] Furthermore, the step of determining the mean index of each feature index based on the extracted feature index includes: Calculate the mean of each characteristic metric for all IPs, and map the mean to the 0-1 interval using the sigmoid function to generate the weekly mean metric for the characteristic metrics.

[0011] Furthermore, the calculation of the Euclidean distance between each feature metric of each IP and the corresponding mean metric includes: Each characteristic metric of each IP is mapped using the sigmoid function to generate the corresponding calculated metric; Using formula Calculate the Euclidean distance between each characteristic metric of each IP and the corresponding mean metric. ; in, This represents the i-th calculated metric of the IP index. is the corresponding mean indicator, and k is the total number of indicators.

[0012] Furthermore, the calculation of the Euclidean distance between each feature metric of each IP and the corresponding mean metric includes: Each characteristic metric of each IP is mapped using the sigmoid function to generate the corresponding calculated metric; Using formula Calculate the Euclidean distance between each characteristic metric of each IP and the corresponding mean metric. ; This represents the i-th calculated metric of the IP index. is the corresponding mean indicator, and k is the total number of indicators.

[0013] Furthermore, the threshold incentive update strategy includes: When the operation event is a non-port scan behavior, the current Euclidean distance will be... As a new distance threshold; When the operation event is an uncaught port scan behavior, calculate the Euclidean distance of the normal port scan behavior during the period in which the operation event occurred. ; According to the formula Calculate the distance difference A, and then... The result is used as the new distance threshold; After determining the new distance threshold, use the formula Calculate the mean offset vector between the K historical distance thresholds and the new distance threshold. ; Among them, S h Let x be a set of k historical distance thresholds. i Let x be the i-th historical distance threshold, and x be the new distance threshold; judge Is it greater than the sum of the mean of k historical values ​​and twice the standard deviation? If so, it means that the new threshold is far from the historical sample points, and the corresponding operation events should be re-evaluated to determine whether the distance threshold is incorrect; If not, update the current distance threshold using the new distance threshold.

[0014] Accordingly, the present invention also discloses a hybrid port scanning behavior detection system, comprising: The data cleaning module is configured to acquire port traffic data and perform data cleaning on the acquired traffic data. The data aggregation module is configured to acquire all traffic data within a time window T, and aggregate traffic data with the same source IP, traffic data with the same source IP and destination IP, and traffic data with the same source IP and destination port number, and extract the corresponding feature indicators. The benchmark determination module is configured to determine the mean index of each feature index based on the extracted feature indexes. The calculation module is configured to calculate the Euclidean distance between each feature metric and the corresponding mean metric for each IP. The judgment module is configured to determine whether the Euclidean distance is greater than a distance threshold. The recognition module is configured to recognize the corresponding operation event when the Euclidean distance is greater than the distance threshold, and determine whether the distance threshold is incorrect based on the recognition result. The threshold update module is configured to update the distance threshold by executing a threshold incentive update strategy when the distance threshold is incorrect.

[0015] Accordingly, the present invention discloses a hybrid port scanning behavior detection device, comprising: Memory, used to store the mixed port scan behavior detection program; A processor, configured to implement the steps of the hybrid port scan behavior detection method as described above when executing the hybrid port scan behavior detection program.

[0016] Accordingly, the present invention discloses a readable storage medium storing a hybrid port scan behavior detection program, which, when executed by a processor, implements the steps of the hybrid port scan behavior detection method described in any of the above descriptions.

[0017] Compared with existing technologies, the advantages of this invention are as follows: This invention discloses a method, system, device, and storage medium for detecting mixed port scanning behavior, which can realize the detection and verification of mixed port scanning behavior anomalies. When detecting mixed port scanning behavior anomalies, slow scanning, fast scanning, horizontal scanning, vertical scanning, and block scanning are effectively detected by selecting the coverage period of the data. This strategy uses sigmoid to normalize the features and calculate the mean, and then calculates the Euclidean distance between the two for judgment. During result verification, an excitation control threshold offset is used, and mean offset is used to control excessive offset. The accuracy of the threshold is verified through testing, achieving real-time monitoring and sustainable maintenance.

[0018] This invention extracts 13 data features through three data aggregation methods: source IP aggregation, source IP-destination IP aggregation, and source IP-destination port aggregation. These features are mapped to the 0-1 range to construct a distance index for anomaly detection. Simultaneously, it can detect slow scanning behavior by modifying the time period of the acquired data. It also supports fast scanning, slow scanning, horizontal scanning, vertical scanning, and block scanning, improving the accuracy and rigor of mixed port scanning behavior detection, and providing maintenance for erroneous cases.

[0019] Therefore, it is evident that the present invention has outstanding substantive features and significant progress compared with the prior art, and the beneficial effects of its implementation are also obvious. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating a specific embodiment of the present invention.

[0022] Figure 2 This is a system structure diagram of a specific embodiment of the present invention.

[0023] In the diagram, 1 is the data cleaning module; 2 is the data aggregation module; 3 is the baseline determination module; 4 is the calculation module; 5 is the judgment module; 6 is the identification module; and 7 is the threshold update module. Detailed Implementation

[0024] To enable those skilled in the art to better understand the present invention, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] See Figure 1 As shown, the present invention provides a method for detecting hybrid port scanning behavior, comprising the following steps: S1: Obtain port traffic data and perform data cleaning on the obtained traffic data.

[0026] In a specific implementation, the acquired traffic data undergoes protocol filtering and data stream filtering. Protocol filtering removes traffic data from protocols other than TCP, UDP, and ICMP; data stream filtering retains only data streams with fewer than 300 bytes sent by the client.

[0027] S2: Obtain all traffic data within the time window T, aggregate traffic data with the same source IP, traffic data with the same source IP and destination IP, and traffic data with the same source IP and destination port number, and extract the corresponding feature indicators.

[0028] In a specific implementation, firstly, since the duration of the sip-dip combination of horizontal and vertical scanning usually exceeds 10 minutes, the time window T is set to 10 minutes for acquiring traffic data.

[0029] Then, data aggregation and feature indicator extraction are performed from the following three aspects: 1. Aggregate traffic data with the same source IP and extract the following data: access count small_num (packet length less than 128 bytes), average uplink traffic up from source IP (up), average downlink traffic down, average packet size pkt_avg, minimum uplink traffic min_up, maximum uplink traffic max_up, minimum downlink traffic min_down, and maximum downlink traffic max_down.

[0030] 2. Aggregate traffic data with the same source IP and destination IP, and calculate the source IP access frequency (tf), the total number of access ports (max_port), and the average number of access ports (mean_port).

[0031] 3. Aggregate traffic data with the same source IP and destination IP, and calculate the source IP access frequency (tf), the total number of access ports (max_port), and the average number of access ports (mean_port).

[0032] The aforementioned features include those corresponding to vertical scanning, horizontal scanning, and block scanning, enabling a more comprehensive capture of mixed scanning behavior.

[0033] S3: Determine the mean value of each feature indicator based on the extracted feature indicators.

[0034] In a specific implementation, the mean of each characteristic indicator for all IPs is calculated, and the mean is mapped to the 0-1 interval using the sigmoid function to generate the weekly mean indicator, which is used as the benchmark for calculating the distance between each indicator.

[0035] S4: Calculate the Euclidean distance between each feature metric of each IP and the corresponding mean metric.

[0036] In a specific implementation, firstly, each characteristic metric of each IP is mapped using the sigmod function to generate corresponding calculated metrics.

[0037] Then, using the formula Calculate the Euclidean distance between each characteristic metric of each IP and the corresponding mean metric. .in, This represents the i-th calculated metric of the IP index. is the corresponding mean indicator, and k is the total number of indicators.

[0038] S5: Determine if the Euclidean distance is greater than the distance threshold of 0.7. If yes, proceed to the next step; otherwise, end the detection.

[0039] S6: Identify the corresponding operation events and determine whether the distance threshold is incorrect based on the identification results.

[0040] In a specific implementation, it is determined whether the corresponding operation event is a non-port scanning behavior or an uncaptured port scanning behavior. When either of these two behaviors exists, it can be determined that the distance threshold is incorrect and needs to be adjusted and updated.

[0041] S7: Use excitation to offset the distance threshold to generate a new distance threshold.

[0042] Specifically, non-port scanning behaviors that exceed the distance threshold require positive incentives, i.e., after calculating the distance, the distance threshold is increased to that Euclidean distance; for uncaptured port scanning behaviors, negative incentives are applied by calculating the distance difference between the occurrence of the behavior and normal behavior, thereby reducing the distance threshold below the uncaptured port scanning behavior.

[0043] In a specific implementation: When the operation event is a non-port scan behavior, the current Euclidean distance will be... As a new distance threshold.

[0044] When the operation event is an uncaught port scan behavior, first calculate the Euclidean distance of the normal port scan behavior during the period in which the operation event occurred. Then according to the formula Calculate the distance difference A, and then... The result is used as the new distance threshold.

[0045] S8: Calculate the mean offset vector between the K historical distance thresholds and the new distance threshold.

[0046] In a specific implementation, the formula is used. Calculate the mean offset vector between the K historical distance thresholds and the new distance threshold. Among them, Sh Let x be a set of k historical distance thresholds. i Let x be the i-th historical distance threshold, and let x be the new distance threshold.

[0047] S9: Determine whether the offset mean vector is far away from the historical sample points. If yes, proceed to step S6; otherwise, proceed to step S10.

[0048] In a specific implementation, the judgment is... Is the new threshold greater than the sum of the mean of k historical values ​​and twice the standard deviation? If yes, it means the new threshold is far from the historical sample points, and the corresponding operation events need to be re-evaluated to determine if the distance threshold is incorrect; if no, the distance threshold can be updated.

[0049] S10: Update the current distance threshold with the new distance threshold and proceed to step S5.

[0050] Therefore, this invention provides a method for detecting hybrid port scan behavior. By selecting the coverage period of the data, it effectively detects slow scans, fast scans, horizontal scans, vertical scans, and block scans. It can use excitation to control threshold offset and mean offset to control excessive offset, and the accuracy of the threshold can be verified through testing. This method improves the accuracy and rigor of hybrid port scan behavior detection, while also enabling maintenance for erroneous cases.

[0051] Based on the above embodiments, see Figure 2 As shown, the present invention also discloses a hybrid port scanning behavior detection system, including: a data cleaning module 1, a data aggregation module 2, a benchmark determination module 3, a calculation module 4, a judgment module 5, an identification module 6, and a threshold update module 7.

[0052] Data cleaning module 1 is configured to acquire port traffic data and perform data cleaning on the acquired traffic data.

[0053] Data aggregation module 2 is configured to acquire all traffic data within a time window T, and aggregate traffic data with the same source IP, traffic data with the same source IP and destination IP, and traffic data with the same source IP and destination port number, and extract the corresponding feature indicators.

[0054] The benchmark determination module 3 is configured to determine the mean index of each feature index based on the extracted feature indexes.

[0055] Calculation module 4 is configured to calculate the Euclidean distance between each feature metric of each IP and the corresponding mean metric.

[0056] Module 5 is configured to determine whether the Euclidean distance is greater than the distance threshold.

[0057] The identification module 6 is configured to identify the corresponding operation event when the Euclidean distance is greater than the distance threshold, and determine whether the distance threshold is incorrect based on the identification result.

[0058] Threshold update module 7 is configured to update the distance threshold by executing a threshold incentive update strategy when the distance threshold is incorrect.

[0059] The specific implementation of the hybrid port scanning behavior detection system in this embodiment is basically the same as the specific implementation of the hybrid port scanning behavior detection method described above, and will not be repeated here.

[0060] The present invention also discloses a hybrid port scanning behavior detection device, including a processor and a memory; wherein, when the processor executes the hybrid port scanning behavior detection program stored in the memory, it implements the steps of the hybrid port scanning behavior detection method described in any of the above.

[0061] Furthermore, the hybrid port scanning behavior detection device in this embodiment may also include: The input interface is used to acquire imported hybrid port scanning behavior detection programs and save them to the memory. It can also acquire various instructions and parameters transmitted from external terminal devices and transmit them to the processor, allowing the processor to perform corresponding processing using these instructions and parameters. In this embodiment, the input interface may specifically include, but is not limited to, a USB interface, a serial interface, a voice input interface, a fingerprint input interface, and a hard disk read interface.

[0062] An output interface is used to output various data generated by the processor to connected terminal devices, so that other terminal devices connected to the output interface can obtain the various data generated by the processor. In this embodiment, the output interface may include, but is not limited to, a USB interface, a serial interface, etc.

[0063] A communication unit is used to establish a remote communication connection between the hybrid port scanning behavior detection device and an external server, so that the hybrid port scanning behavior detection device can mount the image file to the external server. In this embodiment, the communication unit may include, but is not limited to, a remote communication unit based on wireless communication technology or wired communication technology.

[0064] The keyboard is used to acquire various parameter data or commands input by the user through real-time keystrokes.

[0065] The display is used to show relevant information in real time during the mixed port scan behavior detection process.

[0066] A mouse can be used to assist users in inputting data and simplifying user operations.

[0067] This invention also discloses a readable storage medium, which includes random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable hard disk, CD-ROM, or any other form of storage medium known in the art. The readable storage medium stores a mixed port scan behavior detection program, which, when executed by a processor, implements the steps of the mixed port scan behavior detection method as described in any of the preceding claims.

[0068] In summary, this invention can effectively detect port slow scan, fast scan, horizontal scan, vertical scan, and block scan behavior by selecting the coverage period of the data.

[0069] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. The methods disclosed in the embodiments are described simply because they correspond to the systems disclosed in the embodiments; relevant details can be found in the method section.

[0070] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0071] In the embodiments provided by this invention, it should be understood that the disclosed systems, methods, and approaches can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between systems or units may be electrical, mechanical, or other forms.

[0072] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0073] In addition, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit.

[0074] Similarly, in the various embodiments of the present invention, each processing unit can be integrated into a functional module, or each processing unit can exist physically, or two or more processing units can be integrated into a functional module.

[0075] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0076] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0077] The hybrid port scanning behavior detection method, system, apparatus, and readable storage medium provided by the present invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of the present invention. It should be noted that those skilled in the art can make several improvements and modifications to the present invention without departing from the principles of the present invention, and these improvements and modifications also fall within the protection scope of the claims of the present invention.

Claims

1. A method for detecting hybrid port scanning behavior, characterized in that, include: Acquire port traffic data and perform data cleaning on the acquired traffic data; Acquire all traffic data within time window T, aggregate traffic data with the same source IP, traffic data with the same source IP and destination IP, and traffic data with the same source IP and destination port number, and extract the corresponding feature indicators. The mean value of each feature indicator is determined based on the extracted feature indicators; Calculate the Euclidean distance between each characteristic metric of each IP and the corresponding mean metric; Determine if the Euclidean distance is greater than a distance threshold; When the Euclidean distance is greater than the distance threshold, the corresponding operation event is identified, and the distance threshold is determined to be incorrect based on the identification result. If the distance threshold is incorrect, the distance threshold is updated by executing a threshold incentive update strategy. The threshold incentive update strategy includes: When the operation event is a non-port scan behavior, the current Euclidean distance will be... As a new distance threshold; When the operation event is an uncaught port scan behavior, calculate the Euclidean distance of the normal port scan behavior during the period in which the operation event occurred. ; According to the formula Calculate the distance difference A, and then... The result is used as the new distance threshold; After determining the new distance threshold, use the formula Calculate the mean offset vector between the K historical distance thresholds and the new distance threshold. ; Among them, S h Let x be a set of k historical distance thresholds. i Let x be the i-th historical distance threshold, and x be the new distance threshold; judge Is it greater than the sum of the mean of k historical values ​​and twice the standard deviation? If so, it means that the new threshold is far from the historical sample points, and the corresponding operation events should be re-evaluated to determine whether the distance threshold is incorrect; If not, update the current distance threshold using the new distance threshold.

2. The hybrid port scanning behavior detection method according to claim 1, characterized in that, The process of acquiring port traffic data and cleaning the acquired traffic data includes: Traffic data is filtered by protocol, retaining traffic data using TCP, UDP, and ICMP protocols, and filtering out traffic data using other protocols; Perform data stream filtering on the traffic data, retaining data streams with fewer than 300 bytes sent by the client.

3. The hybrid port scanning behavior detection method according to claim 1, characterized in that, The process involves acquiring all traffic data within a time window T, aggregating traffic data with the same source IP, traffic data with the same source IP and destination IP, and traffic data with the same source IP and destination port number, and extracting corresponding feature indicators, including: Get all traffic data within the last ten minutes; Traffic data with the same source IP is aggregated, and the following parameters are extracted: access count small_num (packet length less than 128 bytes), average uplink traffic up from source IP, average downlink traffic down, average packet size pkt_avg, minimum uplink traffic min_up, maximum uplink traffic max_up, minimum downlink traffic min_down, and maximum downlink traffic max_down. Aggregate traffic data with the same source IP and destination IP, and calculate the source IP access frequency (tf), the total number of access ports (max_port), and the average number of access ports (mean_port). Traffic data with the same source IP and destination port number are aggregated to calculate the number of destination IPs accessed (dip_num) and the maximum number of destination IPs corresponding to the port number (sim_port_ip).

4. The hybrid port scanning behavior detection method according to claim 1, characterized in that, The step of determining the mean index of each feature index based on the extracted feature index includes: Calculate the mean of each characteristic metric for all IPs, and map the mean to the 0-1 interval using the sigmoid function to generate the weekly mean metric for the characteristic metrics.

5. The hybrid port scanning behavior detection method according to claim 1, characterized in that, The calculation of the Euclidean distance between each feature metric of each IP and its corresponding mean metric includes: Each characteristic metric of each IP is mapped using the sigmoid function to generate the corresponding calculated metric; Using formula Calculate the Euclidean distance between each characteristic metric of each IP and its corresponding mean metric. ; in, This represents the i-th calculated metric of the IP index. is the corresponding mean indicator, and k is the total number of indicators.

6. The hybrid port scanning behavior detection method according to claim 5, characterized in that, The determination of Euclidean distance Is it greater than the distance threshold? When the Euclidean distance exceeds a distance threshold, the corresponding operation event is identified, and the accuracy of the distance threshold is determined based on the identification result, including: Determine if the Euclidean distance is greater than 0.7; If so, then identify whether the corresponding operation event is a non-port scanning behavior or an uncaptured port scanning behavior; If so, then the distance threshold is incorrect.

7. A hybrid port scanning behavior detection system, characterized in that, include: The data cleaning module is configured to acquire port traffic data and perform data cleaning on the acquired traffic data. The data aggregation module is configured to acquire all traffic data within a time window T, and aggregate traffic data with the same source IP, traffic data with the same source IP and destination IP, and traffic data with the same source IP and destination port number, and extract the corresponding feature indicators. The benchmark determination module is configured to determine the mean index of each feature index based on the extracted feature indexes. The calculation module is configured to calculate the Euclidean distance between each feature metric and the corresponding mean metric for each IP. The judgment module is configured to determine whether the Euclidean distance is greater than a distance threshold. The recognition module is configured to recognize the corresponding operation event when the Euclidean distance is greater than the distance threshold, and determine whether the distance threshold is incorrect based on the recognition result. The threshold update module is configured to update the distance threshold by executing a threshold incentive update strategy when the distance threshold is incorrect. The threshold incentive update strategy includes: When the operation event is a non-port scan behavior, the current Euclidean distance will be... As a new distance threshold; When the operation event is an uncaught port scan behavior, calculate the Euclidean distance of the normal port scan behavior during the period in which the operation event occurred. ; According to the formula Calculate the distance difference A, and then... The result is used as the new distance threshold; After determining the new distance threshold, use the formula Calculate the mean offset vector between the K historical distance thresholds and the new distance threshold. ; Among them, S h Let x be a set of k historical distance thresholds. i Let x be the i-th historical distance threshold, and x be the new distance threshold; judge Is it greater than the sum of the mean of k historical values ​​and twice the standard deviation? If so, it means that the new threshold is far from the historical sample points, and the corresponding operation events should be re-evaluated to determine whether the distance threshold is incorrect; If not, update the current distance threshold using the new distance threshold.

8. A hybrid port scanning behavior detection device, characterized in that, include: Memory, used to store the mixed port scan behavior detection program; A processor, configured to implement the steps of the hybrid port scan behavior detection method as claimed in any one of claims 1 to 6 when executing the hybrid port scan behavior detection program.

9. A readable storage medium, characterized in that: The readable storage medium stores a hybrid port scan behavior detection program, which, when executed by a processor, implements the steps of the hybrid port scan behavior detection method as described in any one of claims 1 to 6.

Images