A method and device for identifying encrypted traffic behavior based on behavior sequence comparison

Abstract

The present invention discloses a method and device for identifying encrypted traffic behavior based on behavior sequence comparison, which integrates deep learning, state transition diagram and conditional probability algorithm to perform fine-grained traffic behavior detection, predict traffic state based on deep learning, detect user behavior according to the transfer relationship and transfer frequency of each node in the state transition diagram, and the analysis process does not require too much prior knowledge of the protocol, so as to realize behavior recognition according to traffic in a restricted network environment. Analyzing the communication process of a specific client-server, extracting key clues and state transition diagrams in the communication process, building a deep learning model to pre-train the communication traffic, using the test environment to statistically determine the average accuracy of the model of each behavior, using the logical correlation of the state transition diagram to model, building a behavior sequence model for each state in the reasoning process, and mining the inclusion relationship between each behavior sequence and the state transition diagram, to achieve accurate recognition of encrypted traffic with low computational complexity.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and device for identifying encrypted traffic behavior based on behavior sequence comparison. Background Art

[0002] With the development of Internet technology, the scale and complexity of networks are constantly increasing, and massive complex network data has become an important object and challenge for network research and application. The complexity of network data is manifested in many aspects, such as the wide variety of data, huge data volume, complex data structure, and rapid data changes. At present, massive complex network data has been widely used in social network analysis, search engine optimization, advertising recommendation, financial risk assessment, medical diagnosis and other fields, becoming an important support for data-driven decision-making and services. However, the processing and analysis of massive complex network data faces huge challenges, such as how to process data quickly and effectively, and how to mine valuable information in the data.

[0003] In view of the massive and complex network data, traditional network traffic behavior recognition technologies have some limitations, including recognition methods based on port number matching, payload and transport layer behavior patterns, and methods based on deep learning. The port number matching classification method distinguishes different types of network applications based on the port number in the message header. As new network applications (such as P2P, passive FTP, etc.) use random port technology for data transmission, the traditional port number matching method is not accurate and is easily interfered. The load classification method, also known as deep packet inspection (DPI), classifies by detecting the packet features in the message, with high recognition rate and accuracy, but it has high computational complexity, large memory consumption, and cannot recognize encrypted data streams. The classification method based on transport layer behavior patterns uses the behavior characteristics of known network applications to match the behavior characteristics of unknown traffic, thereby classifying the type of network traffic application. However, if the message header is encrypted, this method cannot be used, and the classification accuracy is affected by network address translation, resulting in insufficient flow classification. Encrypted traffic based on deep learning has problems such as weak generalization and poor interpretability.

[0004] In the paper "Research on Encrypted Traffic Identification Based on Deep Learning (Master's Thesis of University of Science and Technology of China, Tong Xinxin, Chapter 4, Section 4.2-4.3, Pages 45-48)", the characteristics of the encrypted flow are analyzed and processed with the session flow as the basic unit of identification, and different model algorithms are used for training for different characteristics. The identification system mainly includes three modules: collection of network encrypted flow, extraction and preprocessing of encrypted data flow features, and selection of appropriate algorithm model training for different features to select features for different identification tasks. Traffic data collection mainly uses packet capture tools to obtain the pcap file of the network encrypted flow, and divides the captured pcap object according to the identification unit (flow level, session level, etc.), and the data after segmentation is usually used as an identification object; feature extraction and preprocessing are to extract relevant features and perform corresponding preprocessing work according to different identification tasks for the object to be identified; model training mainly selects appropriate algorithm models for training according to features with different meanings and different forms, so as to select appropriate features for identification of different tasks. Regarding the construction of encrypted network traffic feature representation, the above technologies mainly discuss feature representation methods from the perspective of data flow level and encryption protocol SSL / TLS. Although they have achieved the characterization of encrypted network nuisance behavior to a certain extent, they are not comprehensive and granular enough. In addition, the capture environment of the experimental data of the above technologies is roughly the same. In the actual network environment, factors such as changes in network topology, location, time, and the increase of unknown applications will cause changes in network data, thereby causing a decrease in recognition accuracy.

[0005] In the paper "Research on the Feature Representation and Identification of Network Nuisance Behavior in Encrypted Traffic (Northern Jiaotong University, Master's Thesis, Wu Yueting, Chapter 3, Section 3.4, Pages 27-31)", a data stream-level encrypted network nuisance traffic detection model is constructed, which consists of three parts: encrypted network nuisance traffic collection, feature representation and processing, and model construction. Encrypted network nuisance traffic collection is to reproduce network nuisance behavior in a virtual environment and capture encrypted traffic based on packet capture software as a sample data set for subsequent analysis. In the feature representation and processing part, the clustering idea is combined and the deep learning model is used to construct a feature self-learning network. Through iteration, the network will learn the low-dimensional embedding representation of the feature and use it as a sample correlation feature to fuse it with the original traffic feature as the final feature representation of the encrypted network nuisance traffic. Finally, a classifier module is constructed, and the expanded traffic features are input into the classifier module to finally classify the input traffic. The above technology can identify behaviors, but it is not comprehensive enough. It can only identify public nuisance traffic. It cannot effectively identify encrypted traffic that is not in the public nuisance category. Moreover, this technology is also mainly aimed at communication protocols such as TLS, and does not cover other encryption protocols.

[0006] Therefore, how to establish a method for analyzing massive mixed traffic in multiple protocol formats and states and perform fine-grained traffic behavior detection is an urgent problem that technical personnel in this field need to solve. Summary of the invention

[0007] In view of this, the present invention provides an encrypted traffic behavior identification method and device based on behavior sequence comparison, which is used to establish a massive mixed traffic analysis method for multi-protocol formats and states to perform fine-grained traffic behavior detection.

[0008] Therefore, the present invention provides an encrypted traffic behavior identification method based on behavior sequence comparison, comprising the following steps:

[0009] S1: Collect the traffic to be detected, obtain the characteristic information of each data packet in the traffic to be detected, and generate a traffic set;

[0010] S2: Preprocess the content of each data packet in the traffic set and extract the protocol field information of each data packet; divide the traffic set according to the time interval of the session behavior, and calculate the statistical characteristics of each traffic segment according to the protocol field information of each segment of the traffic;

[0011] S3: Take the statistical features of each traffic segment as input, take the actual communication state of each traffic segment as a label, and train the deep learning model; use the deep learning model to calculate the state of each traffic segment and generate a state sequence; retain the arrival timestamp of the first data packet of each traffic segment and generate a timestamp sequence; combine the state sequences corresponding to each session behavior into a state set; for the state whose state probability predicted by deep learning is higher than the threshold, directly output the session behavior recognition result; for the state whose state probability predicted by deep learning is lower than the threshold, execute steps S4 to S6;

[0012] S4: Calculate the state transfer matrix and the transfer frequency matrix according to the state set, state sequence and timestamp sequence, and generate a state transfer graph according to the state transfer matrix and the transfer frequency matrix. The state set includes all nodes of the state transfer graph, and the transfer frequency matrix includes all edges of the state transfer graph. Correct the state sequence according to the state transfer relationship and transfer frequency of each node in the state transfer graph.

[0013] S5: Divide the state set into multiple sub-periods according to the state transition relationship and transition frequency of each state in the state set, and determine the state order in each sub-period to generate a new state set; construct a finite automaton for each sub-period in the new state set; merge two sub-periods with state intersections, and replace the two sub-periods with the merged set if the false alarm rate decreases, and cancel the fusion if the false alarm rate increases;

[0014] S6: Based on the new state set and the edge relationship in the state transition graph, a new state transition graph is constructed; based on the sequence graph matching algorithm, the new state transition graph is compared with the graph sequence constructed by the finite automaton to realize the recognition of conversation behavior.

[0015] In a possible implementation, in the above-mentioned encrypted traffic behavior identification method based on behavior sequence comparison provided by the present invention, step S1, collecting the traffic to be detected, obtaining the characteristic information of each data packet in the traffic to be detected, and generating a traffic set, specifically includes the following steps:

[0016] S11: Collect the traffic to be detected, and obtain the arrival time and transport layer protocol field information of each data packet in the traffic to be detected;

[0017] S12: Extract the source IP, destination IP and port number from the transport layer protocol field information of each data packet, and determine the sending and receiving direction of each data packet according to the extracted information; combine the information extracted from each data packet, the sending and receiving direction of each data packet and the arrival time of each data packet to generate a traffic set, and store it as a txt file with the content format of {{packet number 1, packet arrival time 1, packet content 1}; {packet number 2, packet arrival time 2, packet content 2}; ...; {packet number N, packet arrival time N, packet content N}}, and output the Traffic.txt file.

[0018] In a possible implementation, in the above-mentioned encrypted traffic behavior identification method based on behavior sequence comparison provided by the present invention, step S2, preprocessing the content of each data packet in the traffic set, extracting the protocol field information of each data packet; dividing the traffic set according to the session behavior time interval, and calculating the statistical characteristics of each segment of traffic according to the protocol field information of each segment of traffic, specifically includes the following steps:

[0019] S21: Perform full-segment parsing of the transport layer protocol for each data packet in the traffic set, extract the entire segment from the first field to the last field, store each data packet as a line, and store them as a protocol field file Traffic_oneline.txt according to the order of the data packets in the traffic set;

[0020] S22: Treat each line in the Traffic_oneline.txt file as a sample, convert the original characters in each sample into ASCII codes, analyze and mark the fields used to indicate the characteristics of network communication behavior, and output the marked set file Traffic_boundary.txt;

[0021] S23: Divide the traffic set according to the time interval of the session behavior, calculate the statistical characteristics of each traffic segment according to the protocol field information of each traffic segment, and store them in the file Traffic_statistical.txt.

[0022] In a possible implementation, in the above-mentioned encrypted traffic behavior identification method based on behavior sequence comparison provided by the present invention, in step S4, the state transition matrix is ​​represented by the matrix StatesTrans, where StatesTrans[i][j] represents the number of transitions from the i-th state to the j-th state in the state set States; the transition frequency matrix is ​​represented by the matrix StatesF, where StatesF[i][j] represents the frequency of transitions from the i-th state to the j-th state in the state set States, and StatesF[i][j] is the quotient of StatesTrans[i][j] and the sum of all time intervals of transitions from state i to state j; when StatesF[i][j] and StatesF[j][i] are both 0, it means that there is no connectivity between state i and state j;

[0023] In step S4, according to the state transition relationship and transition frequency of each node in the state transition diagram, the state sequence is corrected, which is specifically achieved in the following way:

[0024] Select the state whose state probability predicted by deep learning is lower than the threshold. Assume that the behavior corresponding to this state is X. According to the state transition relationship and transition frequency of each node in the state transition diagram, the predicted behavior probability P(X|a), P(X|b), P(X|c),... after the state is replaced by other states is calculated based on the Viterbi algorithm. Among them, a, b, c,... represent states. Select the state with the largest behavior probability to cover this state.

[0025] In a possible implementation, in the above-mentioned encrypted traffic behavior identification method based on behavior sequence comparison provided by the present invention, step S5, according to the state transition relationship and transition frequency of each state in the state set, divides the state set into multiple sub-periods, and determines the state order in each sub-period to generate a new state set; for each sub-period in the new state set, constructs a finite automaton; merges two sub-periods with state intersections, and replaces the two sub-periods with the merged set if the false alarm rate is reduced, and cancels the fusion if the false alarm rate is increased; specifically includes the following steps:

[0026] S51: Divide the state set into multiple sub-periods according to the state transition relationship and transition frequency of each state in the state set, and obtain a set C = {S1, S2, S3, ..., Sn}, where Si represents the state subset of the i-th sub-period, 1≤i≤n;

[0027] S52: for each sub-period, determine the first state character according to the original state sequence, and determine the next state symbol based on the transition frequency of the state character in the transition frequency matrix, until all states in the sub-period are traversed; after determining the state sequence in each sub-period, generate a new state set;

[0028] S53: For each sub-cycle in the new state set, construct a finite automaton;

[0029] S54: Find two sub-cycles with state intersection based on the finite automaton, merge the two sub-cycles with state intersection, replace the two sub-cycles with the merged set if the false alarm rate decreases, and cancel the fusion if the false alarm rate increases.

[0030] The present invention also provides an encrypted traffic behavior identification device based on behavior sequence comparison, comprising: a traffic collection module, a preprocessing module, a deep learning module, a state transition diagram generation module, a finite automaton selection module and a behavior identification module; wherein,

[0031] The flow collection module is used to collect the flow to be detected, obtain the characteristic information of each data packet in the flow to be detected, and generate a flow set;

[0032] The preprocessing module is used to preprocess the content of each data packet in the traffic set and extract the protocol field information of each data packet; divide the traffic set according to the time interval of the session behavior, and calculate the statistical characteristics of each segment of traffic according to the protocol field information of each segment of traffic;

[0033] The deep learning module is used to take the statistical features of each section of traffic as input, take the actual communication state of each section of traffic as a label, and train the deep learning model; use the deep learning model to calculate the state of each section of traffic and generate a state sequence; retain the arrival timestamp of the first data packet of each section of traffic and generate a timestamp sequence; combine the state sequences corresponding to each session behavior into a state set; directly send the state predicted by deep learning with a probability higher than a threshold to the behavior recognition module; and send the state predicted by deep learning with a probability lower than a threshold to the state transition diagram generation module;

[0034] The state transition diagram generation module is used to calculate the state transition matrix and the transition frequency matrix according to the state set, the state sequence and the timestamp sequence, and generate the state transition diagram according to the state transition matrix and the transition frequency matrix, wherein the state set includes all nodes of the state transition diagram and the transition frequency matrix includes all edges of the state transition diagram; and perform error correction on the state sequence according to the state transition relationship and the transition frequency of each node in the state transition diagram;

[0035] The finite automaton selection module is used to divide the state set into multiple sub-periods according to the state transition relationship and transition frequency of each state in the state set, and determine the state order in each sub-period to generate a new state set; for each sub-period in the new state set, construct a finite automaton; merge two sub-periods with state intersections, and replace the two sub-periods with the merged set if the false alarm rate decreases, and cancel the fusion if the false alarm rate increases;

[0036] The behavior recognition module is used to directly output the session behavior recognition result for the state whose state probability predicted by deep learning is higher than the threshold; for the state whose state probability predicted by deep learning is lower than the threshold, based on the new state set and combined with the edge relationship in the state transition graph, a new state transition graph is constructed, and the new state transition graph is compared with the graph sequence constructed by the finite automaton based on the sequence graph matching algorithm to realize the recognition of session behavior.

[0037] In a possible implementation, in the above-mentioned encrypted traffic behavior identification device based on behavior sequence comparison provided by the present invention, the traffic collection module is specifically used to collect the traffic to be detected, obtain the arrival time and transport layer protocol field information of each data packet in the traffic to be detected; extract the source IP, destination IP and port number from the transport layer protocol field information of each data packet, and determine the sending and receiving direction of each data packet according to the extracted information; merge the information extracted from each data packet, the sending and receiving direction of each data packet, and the arrival time of each data packet to generate a traffic set, which is stored as a txt file with a content format of {{packet number 1, packet arrival time 1, packet content 1}; {packet number 2, packet arrival time 2, packet content 2};...; {packet number N, packet arrival time N, packet content N}}, and output the Traffic.txt file.

[0038] In a possible implementation, in the above-mentioned encrypted traffic behavior identification device based on behavior sequence comparison provided by the present invention, the preprocessing module is specifically used to perform full-segment transport layer protocol parsing on each data packet in the traffic set, extract the entire segment from the first field to the last field, store each data packet as a line, and store them as a protocol field file Traffic_oneline.txt according to the order of the data packets in the traffic set; regard each line in the Traffic_oneline.txt file as a sample, convert the original characters in each sample into ASCII codes, analyze and mark the fields used to indicate the characteristics of network communication behavior, and output the marked set file Traffic_boundary.txt; divide the traffic set according to the session behavior time interval, calculate the statistical characteristics of each segment of traffic according to the protocol field information of each segment of traffic, and store them as the file Traffic_statistical.txt.

[0039] In a possible implementation, in the above-mentioned encrypted traffic behavior identification device based on behavior sequence comparison provided by the present invention, the state transition matrix is ​​represented by the matrix StatesTrans, where StatesTrans[i][j] represents the number of transitions from the i-th state to the j-th state in the state set States; the transition frequency matrix is ​​represented by the matrix StatesF, where StatesF[i][j] represents the frequency of transitions from the i-th state to the j-th state in the state set States, and StatesF[i][j] is the quotient of StatesTrans[i][j] and the sum of all time intervals of transitions from state i to state j; when StatesF[i][j] and StatesF[j][i] are both 0, it means that there is no connectivity between state i and state j;

[0040] The state transition diagram generation module is specifically used to select a state whose state probability predicted by deep learning is lower than a threshold, assuming that the behavior corresponding to the state is X, and calculate the predicted behavior probability P(X|a), P(X|b), P(X|c),... after the state is replaced by other states based on the Viterbi algorithm according to the state transition relationship and transition frequency of each node in the state transition diagram, where a, b, c,... represent states, and the state with the largest behavior probability is selected to cover the state.

[0041] In a possible implementation, in the above-mentioned encrypted traffic behavior identification device based on behavior sequence comparison provided by the present invention, the finite automaton selection module is specifically used to divide the state set into multiple sub-periods according to the state transition relationship and transition frequency of each state in the state set, and obtain a set C = {S1, S2, S3, ..., Sn}, where Si represents the state subset of the i-th sub-period, 1≤i≤n; for each sub-period, determine the first state character according to the original state sequence, and determine the next state symbol based on the transition frequency of the state character in the transition frequency matrix until all states in the sub-period are traversed; after determining the state order in each sub-period, generate a new state set; for each sub-period in the new state set, construct a finite automaton; based on the finite automaton, find two sub-periods with state intersection, merge the two sub-periods with state intersection, and if the false alarm rate is reduced, replace the two sub-periods with the fused set; if the false alarm rate is increased, cancel the fusion.

[0042] The above-mentioned encrypted traffic behavior identification method and device based on behavior sequence comparison provided by the present invention integrates deep learning methods, traffic state diagrams and conditional probability algorithms to perform fine-grained traffic behavior detection, predict traffic states based on deep learning, and detect user behaviors based on the transfer relationship and transfer frequency of each node in the traffic state transfer diagram. The analysis process does not require too much protocol prior knowledge, and can achieve behavior identification tasks based on traffic under limited network environment conditions. In the traffic preprocessing stage, according to the relationship between the protocol communication format and traffic behavior, the input traffic set is preprocessed, the protocol field is extracted, the traffic information of all data packets is generated, and the traffic segments are divided according to the time intervals, and the statistical information of each traffic segment is calculated, which is equivalent to a custom traffic feature set, which can break through the limitations of fixed network protocols, and will not cause the flow classification to be not fine enough due to protocol changes. It can also mark any software behavior, breaking through the limitation that only malicious behaviors of malware can be identified. In the deep learning stage, we use deep learning methods to learn the statistical features of each segment of traffic to infer its corresponding traffic state, train a deep learning model based on multi-layer Transformer, calculate the state transition relationship based on the communication state and construct a state transition diagram, which can break the limitation that feature matching can only match specific data sets, and train any behavior of any software to form a state transition diagram for subsequent models. In the state transition diagram generation stage, we input statistical features into the deep learning model to infer the state type of each segment of traffic. Based on the generated set of all state events and the state sequence corresponding to the collected traffic segment, we manually extract the real state logical relationship and correct the state sequence, which can ensure that the corresponding data can be extracted from incomplete data packets and generate a state transition diagram. The present invention analyzes the specific client-server communication process, extracts the key clues and state transition diagrams in the communication process, constructs a deep learning model to pre-train the traffic of the communication software, and uses the test environment to statistically determine the average accuracy of the model of each behavior, uses the logical correlation of the state transition diagram to build a model, and uses the conditional probability algorithm to construct a behavior action sequence model for each behavior state during the reasoning process, and explores the inclusion relationship between each behavior sequence and the state transition diagram, thereby realizing accurate identification of encrypted traffic with low computational complexity. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A flow chart of the encrypted traffic behavior identification method based on behavior sequence comparison provided by the present invention;

[0044] Figure 2 A schematic diagram of the structure of the encrypted traffic behavior identification device based on behavior sequence comparison provided by the present invention. DETAILED DESCRIPTION

[0045] The following is a detailed description of the specific implementation of an encrypted traffic behavior identification method and device based on behavior sequence comparison provided by the present invention in conjunction with the accompanying drawings.

[0046] The present invention provides a method for identifying encrypted traffic behavior based on behavior sequence comparison, such as Figure 1 As shown, the following steps may be included:

[0047] Step 1: Collect the traffic to be detected, obtain the characteristic information of each data packet in the traffic to be detected, generate a traffic set, and divide the traffic set according to the time interval of the session behavior.

[0048] In the specific implementation, the traffic collection stage may include the following steps:

[0049] (1) Collect the traffic to be detected and obtain the arrival time and transport layer protocol field information of each data packet in the traffic to be detected;

[0050] Specifically, the traffic collection function can be completed by building a data collector using PF_Ring or DPDK;

[0051] (2) Extract the source IP, destination IP and port number from the transport layer protocol field information of each data packet, and determine the sending and receiving direction of each data packet based on the extracted information; combine the information extracted from each data packet, the sending and receiving direction of each data packet and the arrival time of each data packet to generate a traffic set, which is stored as a txt file with the content format of {{packet number 1, packet arrival time 1, packet content 1}; {packet number 2, packet arrival time 2, packet content 2}; ...; {packet number N, packet arrival time N, packet content N}}, and output the Traffic.txt file; the traffic set contains all request data packets and response data packets on the communication channel.

[0052] Session behaviors, including file uploads, sensitive behaviors, malicious traffic behaviors, malware encrypted traffic communication behaviors, worm propagation behaviors, etc.

[0053] Step 2: Based on the relationship between the protocol communication format and traffic behavior, pre-process the content of each data packet in the traffic set and extract the protocol field information of each data packet; divide the traffic set according to the time interval of the session behavior, and calculate the statistical characteristics of each segment of traffic based on the protocol field information of each segment of traffic.

[0054] In specific implementation, the traffic preprocessing stage may include the following steps:

[0055] (1) Perform full transport layer protocol parsing on each data packet in the traffic set, extract the entire segment from the first field to the last field, store each data packet as a line, and store them in the order of the data packets in the traffic set as a protocol field file Traffic_oneline.txt;

[0056] (2) Treat each line in the Traffic_oneline.txt file as a sample, convert the original characters in each sample into ASCII codes, analyze and annotate the fields used to indicate network communication behavior characteristics (such as data segment length, protocol status, etc.), and output the annotation set file Traffic_boundary.txt;

[0057] (3) Divide the traffic set according to the time interval of the session behavior, calculate the statistical characteristics of each traffic segment based on the protocol field information of each traffic segment, and store them in the file Traffic_statistical.txt.

[0058] During the traffic preprocessing stage, the input traffic set is preprocessed according to the relationship between the protocol communication format and the traffic behavior, the protocol fields are extracted, the traffic information of all data packets is generated, the traffic segments are divided according to the time intervals, and the statistical information of each traffic segment is calculated. This is equivalent to a custom traffic feature set, which can break through the limitations of fixed network protocols. It can not only process IPv4 version protocols, but also IPv6 version protocols. In this way, the flow classification will not be insufficiently refined due to protocol changes, and any software behavior can be marked, breaking through the limitation that only malicious behaviors of malware can be identified.

[0059] Step 3: Take the statistical features of each traffic segment as input, take the actual communication state of each traffic segment as a label, and train the deep learning model; use the deep learning model to calculate the state of each traffic segment and generate the state sequence StateSeq; retain the arrival timestamp of the first data packet of each traffic segment and generate the timestamp sequence TimeSeq; combine the state sequences corresponding to each session behavior into a state set States. The state set States contains all the elements that appear in the state sequence StateSeq.

[0060] It is worth noting that for states where the probability of the state predicted by deep learning is higher than the threshold, the session behavior recognition result can be directly output; for states where the probability of the state predicted by deep learning is lower than the threshold, steps 4 to 6 need to be continued. The threshold can be selected according to business analysis needs, and 0.8 is generally selected.

[0061] In specific implementation, the deep learning network can adopt a recurrent neural network, or the deep learning network can also adopt a long short-term memory network, or the deep learning network can also adopt a convolutional neural network, etc. The present invention can use various deep learning methods to model and analyze traffic data, which is not limited here.

[0062] In the deep learning stage, deep learning methods are used to learn the statistical characteristics of each segment of traffic to infer its corresponding traffic status (such as configuration update, data upload, data download, etc.), and to train a deep learning model based on a multi-layer Transformer.

[0063] Step 4: Calculate the state transfer matrix and transfer frequency matrix based on the state set, state sequence and timestamp sequence. Generate a state transfer graph based on the state transfer matrix and transfer frequency matrix. The state set contains all nodes of the state transfer graph, and the transfer frequency matrix contains all edges of the state transfer graph. Correct the state sequence based on the state transfer relationship and transfer frequency of each node in the state transfer graph.

[0064] User behavior (such as watching videos, receiving emails, etc.) is generally composed of a combination of multiple states. This step generates a state transition diagram based on the real state sequence, and integrates the transition relationship and transition frequency of each state node in the state transition diagram, and then corrects the state sequence obtained by deep learning. Specifically, the hidden Markov method, or the conditional random field method, or the Markov random field method, etc. can be used to correct the state sequence obtained by deep learning.

[0065] In specific implementation, the state transition matrix can be represented by the matrix StatesTrans, where StatesTrans[i][j] represents the number of transitions from the i-th state to the j-th state in the state set States; the transition frequency matrix can be represented by the matrix StatesF, where StatesF[i][j] represents the frequency of transitions from the i-th state to the j-th state in the state set States, and StatesF[i][j] is the quotient of StatesTrans[i][j] and the sum of all time intervals for transitions from state i to state j; when StatesF[i][j] and StatesF[j][i] are both 0, it means that there is no connectivity between state i and state j.

[0066] In the specific implementation, in order to complete the fixed production and work flow, the state transition of the network communication system has a certain logical basis, and the deep learning prediction results have a certain uncertainty. Therefore, it is necessary to correct the state sequence according to the state transition relationship and transition frequency of each node in the state transition diagram. It is specifically achieved in the following way: select the state whose state probability predicted by deep learning is lower than the threshold (generally 0.8), and assume that the behavior corresponding to the state is X. According to the state transition relationship and transition frequency of each node in the state transition diagram, the behavior probability predicted after the state is replaced by other states is calculated based on the Viterbi algorithm. P(X|a), P(X|b), P(X|c),..., where a, b, c,... represent states, and the state with the largest behavior probability is selected to cover the state.

[0067] In the state transition diagram generation phase, the statistical features are input into the deep learning model to infer the state type of each traffic segment (such as configuration update, data flow transmission, system self-update, manual operation, etc.). Based on the generated set of all state events and the state sequence corresponding to the collected traffic segment, the real state logical relationship is manually extracted and the state sequence is corrected. This ensures that the corresponding data can be extracted from incomplete pcap packages and a state transition diagram is generated. By learning the statistical features of each traffic segment through deep learning methods, inferring its corresponding traffic state, training a deep learning model based on multi-layer Transformer, calculating the state transition relationship based on the communication state and constructing a state transition diagram, it is possible to break through the limitation that feature matching can only match specific data sets, and train any behavior of any software to form a state transition diagram for subsequent models.

[0068] Step 5: According to the state transition relationship and transition frequency of each state in the state set, the state set is divided into multiple sub-periods, and the state order in each sub-period is determined to generate a new state set; for each sub-period in the new state set, a finite automaton is constructed; two sub-periods with state intersections are merged, and if the false alarm rate decreases, the two sub-periods are replaced with the merged set; if the false alarm rate increases, the fusion is cancelled.

[0069] In specific implementation, the finite automaton construction phase may include the following steps:

[0070] (1) Since the diversity of network communication behaviors may lead to multiple cycles in the state sequence, the state set can be divided into multiple sub-periods according to the state transition relationship and transition frequency of each state in the state set, and the set C = {S1, S2, S3, ..., Sn} is obtained, where Si represents the state subset of the i-th sub-period, 1≤i≤n;

[0071] The specific division process is as follows: (a) For nodes V with both in-degree and out-degree of 1, classify them into state sets with similar transition frequencies according to their transition frequencies. If the set does not exist, create a new set with a transition frequency of Fv and add node V to it. (b) Select nodes V with an out-degree or in-degree of 1 from the node set remainV that has not been fully assigned, assign them to existing sets with similar transition frequencies according to the node transition frequency, and remove node V from remainV. (c) A node can belong to multiple sets at the same time. If the sum of the transition frequencies of the sets where all in-nodes or out-nodes of node V are located is similar to the transition frequency of node V, add node V to all related sets respectively and remove node V from remainV; otherwise, consider whether the sum of the transition frequencies of the sets where all in-nodes and out-nodes of node V are located is similar to the transition frequency of node V. If so, add node V to all related sets respectively and remove node V from remainV. Otherwise, retain node V. (d) If at least one of the adjacent outgoing or incoming nodes of node V already exists in the known set, and the out-degree or in-degree of the adjacent node is 1, then add node V to the set and modify the transition frequency of node V to Fv = Fv-Fs. If the value of Fv is 0, then remove node V from the remaining node set remainV. (e) If there are still nodes in the remaining node set remainV, find the node with the smallest transition frequency, create a new set and add the node to it, then add the remaining nodes to the set and modify the transition frequency of each node accordingly. If the node's transition frequency is less than the threshold FT, then remove node V from remainV. (f) Finally, add the nodes in the remaining node set remainV to the known similar set according to the transition frequency.

[0072] (2) For each sub-period, the first state character is determined according to the original state sequence, and the next state symbol is determined based on the transition frequency of the state character in the transition frequency matrix, until all states in the sub-period are traversed; after determining the state sequence in each sub-period, a new state set is generated;

[0073] (3) For each sub-cycle in the new state set, construct a finite automaton;

[0074] The finite automaton tuple includes a state set, a state alphabet set, a transition function, and a unique initial state, where the start state is the first state of the traffic pattern in the sub-cycle. For each sub-cycle, a finite automaton is constructed separately. The known symbol set is the set of states observed in the learning phase. The state that has a unique correspondence with the behavior type can be directly used to determine the behavior without subsequent operations. Otherwise, the state transition is defined as a form, and the transition in accordance with the normal sequence is normal (Normal), the transition in accordance with the reverse sequence is response (Response), and the transition to the same state is retransmission (Retransmission).

[0075] (4) For complex long-term behavior types, a single sub-cycle classification method may not be able to detect them. Therefore, a sub-cycle fusion method is further designed. Based on the finite automaton, two sub-cycles with state intersections are found. The supervised learning method is used to fuse the two sub-cycles with state intersections. If the false alarm rate decreases, the two sub-cycles are replaced with the fused set. If the false alarm rate increases, the fusion is cancelled. Sub-cycle fusion can improve the detection effect of complex behavior types.

[0076] By building finite automata, we can achieve the effect of a wider range of behavior types that can be detected.

[0077] Step 6: Based on the new state set and the relationship between the edges in the state transition graph, a new state transition graph is constructed; based on the sequence graph matching algorithm, the new state transition graph is compared with the graph sequence constructed by the finite automaton to realize the recognition of session behavior.

[0078] The above-mentioned model used in the present invention can take into account more complex contextual relationships and dependencies, improve the modeling and prediction capabilities of traffic behavior, and can also combine multiple models and algorithms to form a comprehensive analysis system. In short, the traffic analysis method based on the traffic state transition diagram can analyze the behavior of the software in a complex environment. Finally, a finite automaton is generated to set the set of states observed in the deep learning stage as a known symbol set, and directly determine the state that has a unique correspondence with the behavior type, or the state that transfers according to the normal sequence is normal, the state that transfers according to the reverse sequence is a response, and the state that transfers to the same state is a retransmission, to achieve the final behavior recognition.

[0079] The specific implementation of the encrypted traffic behavior identification method based on behavior sequence comparison provided by the present invention is described in detail below through a specific embodiment.

[0080] Embodiment 1:

[0081] For industrial control networks, the Ethernet TCP / IP protocol is used as the underlying protocol, and embodiment 1 of the present invention is deployed to analyze the type and time of traffic behavior.

[0082] Step 1: Traffic collection stage.

[0083] Traffic is collected on the core switch of the intranet control layer network. The total number of collected traffic messages is 600,000, including control traffic and data traffic. First, the underlying protocol information of all traffic is parsed based on the OSI model to extract the source IP, destination IP and port number. The data packet sending and receiving direction is determined based on the IP and port information, and the traffic set is generated by merging with the data packet arrival time and stored as a txt file. Its content format is: {{packet number 1, packet arrival time 1, packet content 1}; {packet number 2, packet arrival time 2, packet content 2};...; {packet number N, packet arrival time N, packet content N}}, and the Traffic.txt file is output.

[0084] Step 2: Traffic preprocessing stage.

[0085] According to the transport layer S7 protocol (a private protocol developed by Siemens) used by industrial control network equipment, the parameter fields related to functions and command control are extracted, including DataLength, ItemCount, FunctionCode, ROSCTR, ParameterLength, and ProtocolId. The traffic segments are divided into 3s time intervals, and the statistical information of these 6 fields in each traffic segment is calculated and stored.

[0086] Step 3: Deep learning stage.

[0087] The statistical information is input into the deep learning model based on the multi-layer Transformer to infer the state type of each section of traffic (configuration update, data flow transmission, system self-update, manual operation, etc.). Among them, for the state probability predicted by deep learning higher than 0.8, that is, the state that can uniquely correspond to the behavior, the session behavior recognition result is directly output; for the state probability predicted by deep learning lower than 0.8, the fourth to sixth steps are executed.

[0088] Step 4: State transition diagram generation phase.

[0089] According to the generated set of all state events, combined with the state sequence corresponding to the collected traffic segment, the real state logical relationship is manually extracted and the state sequence is corrected, and the state transition relationship of the traffic sequence and its corresponding transition frequency matrix are calculated. The state transition relationship is represented by the matrix StatesTrans, where StatesTrans[i][j] corresponds to the number of transitions from the i-th state to the j-th state in the state set States; the transition frequency matrix is ​​represented by the matrix StatesF, where StatesF[i][j] corresponds to the frequency of transitions from the i-th state to the j-th state in the state set States, and StatesF[i][j] is the quotient of StatesTrans[i][j] and the sum of all time intervals from state i to state j. The points of the state transition graph are composed of the state set States, and the edges of the state transition graph are composed of the transition frequency matrix StatesF.

[0090] Step 5: Finite automaton construction phase.

[0091] The finite automaton tuple includes a state set, a state alphabet set, a transition function, and a unique initial state, where the start state is the first state of the traffic pattern in the sub-cycle. A finite automaton model is constructed for each sub-cycle. The known symbol set is a set of states observed in the learning phase. The state that has a unique correspondence with the behavior type can be directly used to determine the behavior without subsequent operations. Otherwise, the state transition is defined as a form, and the transition in accordance with the normal sequence is normal (Normal), the transition in accordance with the reverse sequence is response (Response), and the transition to the same state is retransmission (Retransmission). The finite automaton is used for final behavior recognition.

[0092] For the identification of long-term and complex industrial control system processing flow, a sub-cycle fusion method is further designed. Based on the generated sub-cycle set C = {S1, S2, S3, ..., Sn}, two sub-cycles with state intersection are found based on finite automata, and supervised learning methods are used to fuse Si and Sj with state intersection. If the false alarm rate decreases, Si and Sj are replaced with the fused set. If the false alarm rate increases, the fusion is cancelled. Sub-cycle fusion can improve the detection effect of complex behavior types.

[0093] Step 6: Behavior identification stage.

[0094] For states where the probability of a state predicted by deep learning is higher than the threshold, it is a state that uniquely corresponds to the behavior, and the session behavior recognition result can be directly output; for states where the probability of a state predicted by deep learning is lower than the threshold, it is a state that cannot be matched and will be identified as unknown behavior. The transfer in the normal sequence is normal, the transfer in the reverse sequence is a response, and the transfer to the same state is a retransmission. Encrypted traffic behavior recognition provides industrial control workers with a complete system behavior form for subsequent processing and analysis.

[0095] Based on the same inventive concept, the present invention also provides an encrypted traffic behavior identification device based on behavior sequence comparison, such as Figure 2 As shown, it includes: a traffic collection module 1, a preprocessing module 2, a deep learning module 3, a state transition diagram generation module 4, a finite automaton selection module 5 and a behavior recognition module 6; wherein,

[0096] Traffic collection module 1, used to collect the traffic to be detected, obtain the characteristic information of each data packet in the traffic to be detected, and generate a traffic set;

[0097] Preprocessing module 2 is used to preprocess the content of each data packet in the traffic set and extract the protocol field information of each data packet; divide the traffic set according to the time interval of the session behavior, and calculate the statistical characteristics of each segment of traffic according to the protocol field information of each segment of traffic;

[0098] The deep learning module 3 is used to take the statistical features of each section of traffic as input, take the actual communication state of each section of traffic as a label, and train the deep learning model; use the deep learning model to calculate the state of each section of traffic and generate a state sequence; retain the arrival timestamp of the first data packet of each section of traffic and generate a timestamp sequence; combine the state sequences corresponding to each session behavior into a state set; for the state whose state probability predicted by deep learning is higher than the threshold, directly send it to the behavior recognition module 6; for the state whose state probability predicted by deep learning is lower than the threshold, send it to the state transition diagram generation module 4;

[0099] The state transition diagram generation module 4 is used to calculate the state transition matrix and the transition frequency matrix according to the state set, the state sequence and the timestamp sequence, and generate the state transition diagram according to the state transition matrix and the transition frequency matrix, wherein the state set includes all nodes of the state transition diagram and the transition frequency matrix includes all edges of the state transition diagram; and perform error correction on the state sequence according to the state transition relationship and the transition frequency of each node in the state transition diagram;

[0100] The finite automaton selection module 5 is used to divide the state set into multiple sub-periods according to the state transition relationship and transition frequency of each state in the state set, and determine the state order in each sub-period to generate a new state set; for each sub-period in the new state set, a finite automaton is constructed; two sub-periods with state intersections are merged, and if the false alarm rate is reduced, the two sub-periods are replaced by the merged set, and if the false alarm rate is increased, the fusion is cancelled;

[0101] Behavior recognition module 6 is used to directly output the session behavior recognition result for the state whose state probability predicted by deep learning is higher than the threshold; for the state whose state probability predicted by deep learning is lower than the threshold, based on the new state set and combined with the edge relationship in the state transition graph, a new state transition graph is constructed, and the new state transition graph is compared with the graph sequence constructed by the finite automaton based on the sequence graph matching algorithm to realize the recognition of session behavior.

[0102] In a specific implementation, in the above-mentioned encrypted traffic behavior identification device based on behavior sequence comparison provided by the present invention, for example Figure 2 As shown, the traffic collection module 1 deploys a switch or router between the client and its server, and is located at the network layer to capture data packets in a real environment. Specifically, it can be used to collect the traffic to be detected, obtain the arrival time and transport layer protocol field information of each data packet in the traffic to be detected; extract the source IP, destination IP and port number from the transport layer protocol field information of each data packet, and determine the sending and receiving direction of each data packet according to the extracted information; merge the information extracted from each data packet, the sending and receiving direction of each data packet, and the arrival time of each data packet to generate a traffic set, which is stored as a txt file with a content format of {{packet number 1, packet arrival time 1, packet content 1}; {packet number 2, packet arrival time 2, packet content 2}; ...; {packet number N, packet arrival time N, packet content N}}, and output the Traffic.txt file.

[0103] In a specific implementation, in the above-mentioned encrypted traffic behavior identification device based on behavior sequence comparison provided by the present invention, for example Figure 2As shown, the preprocessing module 2 is deployed after the traffic collection module 1 and before the deep learning module 3. It can be specifically used to perform full-segment parsing of the transport layer protocol for each data packet in the traffic set, extract the entire segment from the first field to the last field, store each data packet as a line, and store them as a protocol field file Traffic_oneline.txt in the order of the data packets in the traffic set; regard each line in the Traffic_oneline.txt file as a sample, convert the original characters in each sample into ASCII codes, analyze and mark the fields used to indicate the characteristics of network communication behavior, and output the marked set file Traffic_boundary.txt; divide the traffic set according to the time interval of the session behavior, calculate the statistical characteristics of each segment of traffic according to the protocol field information of each segment of traffic, and store them as the file Traffic_statistical.txt.

[0104] In a specific implementation, in the above-mentioned encrypted traffic behavior identification device based on behavior sequence comparison provided by the present invention, the state transition matrix is ​​represented by the matrix StatesTrans, where StatesTrans[i][j] represents the number of transitions from the i-th state to the j-th state in the state set States; the transition frequency matrix is ​​represented by the matrix StatesF, where StatesF[i][j] represents the frequency of transitions from the i-th state to the j-th state in the state set States, and StatesF[i][j] is the quotient of StatesTrans[i][j] and the sum of all time intervals of transitions from state i to state j; S When tatesF[i][j] and StatesF[j][i] are both 0, it means that there is no connectivity between state i and state j. The state transition diagram generation module is deployed after the deep learning module and before the finite automaton selection module. Specifically, it can be used to select the state whose state probability predicted by deep learning is lower than the threshold. Assuming that the behavior corresponding to the state is X, according to the state transition relationship and transition frequency of each node in the state transition diagram, the behavior probability P(X|a), P(X|b), P(X|c),... after the state is replaced by other states is calculated based on the Viterbi algorithm, where a, b, c,... represent states, and the state with the largest behavior probability is selected to cover the state.

[0105] In specific implementation, in the above-mentioned encrypted traffic behavior identification device based on behavior sequence comparison provided by the present invention, the finite automaton selection module selects a sub-period finite automaton adapted to the state type and distinguishes its behavior. Specifically, it can be used to divide the state set into multiple sub-periods according to the state transition relationship and transition frequency of each state in the state set, and obtain a set C = {S1, S2, S3, ..., Sn}, where Si represents the state subset of the i-th sub-period, 1≤i≤n; for each sub-period, the first state character is determined according to the original state sequence, and the next state symbol is determined based on the transition frequency of the state character in the transition frequency matrix until all states in the sub-period are traversed; after determining the state order in each sub-period, a new state set is generated; for each sub-period in the new state set, a finite automaton is constructed, and the state types that cannot be matched will be identified as unknown behaviors; based on the finite automaton, two sub-periods with state intersection are found, and the two sub-periods with state intersection are merged. If the false alarm rate is reduced, the two sub-periods are replaced with the merged set, and if the false alarm rate is increased, the fusion is cancelled.

[0106] In a specific implementation, in the above-mentioned encrypted traffic behavior identification device based on behavior sequence comparison provided by the present invention, for example Figure 2 As shown, the behavior recognition module 6 is deployed after the finite automaton selection module 5, and is also connected to the deep learning module 3. For the state uniquely corresponding to the behavior, the session behavior recognition result is directly output. For unknown behaviors, the transfer according to the normal sequence is normal, the transfer according to the reverse sequence is a response, and the transfer to the same state is a retransmission.

[0107] The specific implementation of the above-mentioned encrypted traffic behavior identification device based on behavior sequence comparison provided by the present invention is similar to the implementation of the above-mentioned encrypted traffic behavior identification method based on behavior sequence comparison provided by the present invention, and will not be repeated here.

[0108] The present invention provides a method and device for identifying encrypted traffic behavior based on behavior sequence comparison, which integrates deep learning methods, traffic state diagrams and conditional probability algorithms to perform fine-grained traffic behavior detection, predict traffic states based on deep learning, and detect user behaviors based on the transfer relationship and transfer frequency of each node in the traffic state transfer diagram. The analysis process does not require too much protocol prior knowledge, and can achieve behavior recognition tasks based on traffic under limited network environment conditions. In the traffic preprocessing stage, the input traffic set is preprocessed according to the relationship between the protocol communication format and the traffic behavior, the protocol field is extracted, the traffic information of all data packets is generated, and the traffic segments are divided according to the time intervals, and the statistical information of each traffic segment is calculated, which is equivalent to a custom traffic feature set, which can break through the limitations of fixed network protocols, and will not cause the flow classification to be not fine enough due to protocol changes. It can also mark any software behavior, breaking through the limitation that only malicious behaviors of malware can be identified. In the deep learning stage, we use deep learning methods to learn the statistical features of each segment of traffic to infer its corresponding traffic state, train a deep learning model based on multi-layer Transformer, calculate the state transition relationship based on the communication state and construct a state transition diagram, which can break the limitation that feature matching can only match specific data sets, and train any behavior of any software to form a state transition diagram for subsequent models. In the state transition diagram generation stage, we input statistical features into the deep learning model to infer the state type of each segment of traffic. Based on the generated set of all state events and the state sequence corresponding to the collected traffic segment, we manually extract the real state logical relationship and correct the state sequence, which can ensure that the corresponding data can be extracted from incomplete data packets and generate a state transition diagram. The present invention analyzes the specific client-server communication process, extracts the key clues and state transition diagrams in the communication process, constructs a deep learning model to pre-train the traffic of the communication software, and uses the test environment to statistically determine the average accuracy of the model of each behavior, uses the logical correlation of the state transition diagram to build a model, and uses the Markov chain to construct a behavior action sequence model for each behavior state during the reasoning process, and mines the inclusion relationship between each behavior sequence and the state transition diagram, thereby realizing accurate identification of encrypted traffic with low computational complexity.

[0109] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for identifying encrypted traffic behavior based on behavior sequence comparison, characterized in that: The steps include: S1: Collect the traffic to be detected, obtain the characteristic information of each data packet in the traffic to be detected, and generate a traffic set; S2: Preprocess the content of each data packet in the traffic set and extract the protocol field information of each data packet; divide the traffic set according to the time interval of the session behavior, and calculate the statistical characteristics of each traffic segment according to the protocol field information of each segment of the traffic; S3: Take the statistical features of each traffic segment as input, take the actual communication status of each traffic segment as a label, and train the deep learning model; use the deep learning model to calculate the status of each traffic segment and generate a state sequence; The arrival timestamp of the first data packet of each traffic segment is retained to generate a timestamp sequence; the state sequences corresponding to each session behavior are combined into a state set; for the state whose state probability predicted by deep learning is higher than the threshold, the session behavior recognition result is directly output; for the state whose state probability predicted by deep learning is lower than the threshold, steps S4 to S6 are executed; S4: Calculate the state transfer matrix and the transfer frequency matrix according to the state set, the state sequence and the timestamp sequence, and generate a state transfer graph according to the state transfer matrix and the transfer frequency matrix. The state set includes all nodes of the state transfer graph, and the transfer frequency matrix includes all edges of the state transfer graph. According to the state transition relationship and transition frequency of each node in the state transition graph, the state sequence is corrected; S5: Divide the state set into multiple sub-periods according to the state transition relationship and transition frequency of each state in the state set, and determine the state order in each sub-period to generate a new state set; construct a finite automaton for each sub-period in the new state set; merge two sub-periods with state intersections, and replace the two sub-periods with the merged set if the false alarm rate decreases, and cancel the fusion if the false alarm rate increases; S6: Based on the new state set and the edge relationship in the state transition graph, a new state transition graph is constructed; based on the sequence graph matching algorithm, the new state transition graph is compared with the graph sequence constructed by the finite automaton to realize the recognition of conversation behavior.

2. The encrypted traffic behavior identification method based on behavior sequence comparison according to claim 1 is characterized in that: Step S1, collecting the traffic to be detected, obtaining the characteristic information of each data packet in the traffic to be detected, and generating a traffic set, specifically includes the following steps: S11: Collect the traffic to be detected, and obtain the arrival time and transport layer protocol field information of each data packet in the traffic to be detected; S12: extract the source IP, destination IP and port number from the transport layer protocol field information of each data packet, and determine the sending and receiving direction of each data packet according to the extracted information; combine the information extracted from each data packet, the sending and receiving direction of each data packet and the arrival time of each data packet to generate a traffic set, and store it as a txt file with the content format of {{packet number 1, packet arrival time 1, packet content 1}; {packet number 2, packet arrival time 2, packet content 2};...; {packet number N, packet arrival time N, packet content N}}, output Traffic.txt file.

3. The encrypted traffic behavior identification method based on behavior sequence comparison according to claim 1 is characterized in that: Step S2, preprocessing the content of each data packet in the traffic set, extracting the protocol field information of each data packet; dividing the traffic set according to the time interval of the session behavior, and calculating the statistical characteristics of each segment of traffic according to the protocol field information of each segment of traffic, specifically including the following steps: S21: Perform full-segment parsing of the transport layer protocol for each data packet in the traffic set, extract the entire segment from the first field to the last field, store each data packet as a line, and store them as a protocol field file Traffic_oneline.txt according to the order of the data packets in the traffic set; S22: Treat each line in the Traffic_oneline.txt file as a sample, convert the original characters in each sample into ASCII codes, analyze and mark the fields used to indicate the characteristics of network communication behavior, and output the marked set file Traffic_boundary.txt; S23: Divide the traffic set according to the time interval of the session behavior, calculate the statistical characteristics of each traffic segment according to the protocol field information of each traffic segment, and store them in the file Traffic_statistical.txt.

4. The encrypted traffic behavior identification method based on behavior sequence comparison according to claim 1 is characterized in that: In step S4, the state transition matrix is ​​represented by the matrix StatesTrans, where StatesTrans[i][j] represents the number of transitions from the i-th state to the j-th state in the state set States; the transition frequency matrix is ​​represented by the matrix StatesF, where StatesF[i][j] represents the frequency of transitions from the i-th state to the j-th state in the state set States, and StatesF[i][j] is the quotient of StatesTrans[i][j] and the sum of all time intervals from state i to state j; when StatesF[i][j] and StatesF[j][i] are both 0, it means that there is no connectivity between state i and state j; In step S4, according to the state transition relationship and transition frequency of each node in the state transition diagram, the state sequence is corrected, which is specifically achieved in the following way: Select the state whose state probability predicted by deep learning is lower than the threshold. Assume that the behavior corresponding to this state is X. According to the state transition relationship and transition frequency of each node in the state transition diagram, the predicted behavior probability P(X|a), P(X|b), P(X|c),... after the state is replaced by other states is calculated based on the Viterbi algorithm. Among them, a, b, c,... represent states. Select the state with the largest behavior probability to cover this state.

5. The encrypted traffic behavior identification method based on behavior sequence comparison according to claim 1 is characterized in that: Step S5, according to the state transition relationship and transition frequency of each state in the state set, divide the state set into multiple sub-periods, determine the state order in each sub-period, and generate a new state set; for each sub-period in the new state set, construct a finite automaton; merge two sub-periods with state intersections, and replace the two sub-periods with the merged set if the false alarm rate decreases, and cancel the fusion if the false alarm rate increases; specifically, the following steps are included: S51: Divide the state set into multiple sub-periods according to the state transition relationship and transition frequency of each state in the state set, and obtain a set C = {S1, S2, S3, ..., Sn}, where Si represents the state subset of the i-th sub-period, 1≤i≤n; S52: for each sub-period, determine the first state character according to the original state sequence, and determine the next state symbol based on the transition frequency of the state character in the transition frequency matrix, until all states in the sub-period are traversed; after determining the state sequence in each sub-period, generate a new state set; S53: For each sub-cycle in the new state set, construct a finite automaton; S54: Find two sub-cycles with state intersection based on the finite automaton, merge the two sub-cycles with state intersection, replace the two sub-cycles with the merged set if the false alarm rate decreases, and cancel the fusion if the false alarm rate increases.

6. An encrypted traffic behavior identification device based on behavior sequence comparison, characterized in that: include: Traffic collection module, preprocessing module, deep learning module, state transition diagram generation module, finite automaton selection module and behavior recognition module; among them, The flow collection module is used to collect the flow to be detected, obtain the characteristic information of each data packet in the flow to be detected, and generate a flow set; The preprocessing module is used to preprocess the content of each data packet in the traffic set and extract the protocol field information of each data packet; divide the traffic set according to the time interval of the session behavior, and calculate the statistical characteristics of each segment of traffic according to the protocol field information of each segment of traffic; The deep learning module is used to take the statistical features of each section of traffic as input, take the actual communication state of each section of traffic as a label, and train the deep learning model; use the deep learning model to calculate the state of each section of traffic and generate a state sequence; retain the arrival timestamp of the first data packet of each section of traffic and generate a timestamp sequence; combine the state sequences corresponding to each session behavior into a state set; directly send the state predicted by deep learning with a probability higher than a threshold to the behavior recognition module; and send the state predicted by deep learning with a probability lower than a threshold to the state transition diagram generation module; The state transition diagram generation module is used to calculate the state transition matrix and the transition frequency matrix according to the state set, the state sequence and the timestamp sequence, and generate the state transition diagram according to the state transition matrix and the transition frequency matrix, wherein the state set includes all nodes of the state transition diagram and the transition frequency matrix includes all edges of the state transition diagram; and perform error correction on the state sequence according to the state transition relationship and the transition frequency of each node in the state transition diagram; The finite automaton selection module is used to divide the state set into multiple sub-periods according to the state transition relationship and transition frequency of each state in the state set, and determine the state order in each sub-period to generate a new state set; for each sub-period in the new state set, construct a finite automaton; merge two sub-periods with state intersections, and replace the two sub-periods with the merged set if the false alarm rate decreases, and cancel the fusion if the false alarm rate increases; The behavior recognition module is used to directly output the session behavior recognition result for the state whose state probability predicted by deep learning is higher than the threshold; for the state whose state probability predicted by deep learning is lower than the threshold, based on the new state set and combined with the edge relationship in the state transition graph, a new state transition graph is constructed, and the new state transition graph is compared with the graph sequence constructed by the finite automaton based on the sequence graph matching algorithm to realize the recognition of session behavior.

7. The encrypted traffic behavior identification device based on behavior sequence comparison according to claim 6 is characterized in that: The flow collection module is specifically used to collect the flow to be detected, obtain the arrival time and transport layer protocol field information of each data packet in the flow to be detected; extract the source IP, destination IP and port number from the transport layer protocol field information of each data packet, and determine the sending and receiving direction of each data packet based on the extracted information; The information extracted from each data packet, the sending and receiving direction of each data packet, and the arrival time of each data packet are combined to generate a traffic set, which is stored as a txt file with the content format of {{packet number 1, packet arrival time 1, packet content 1}; {packet number 2, packet arrival time 2, packet content 2};...; {packet number N, packet arrival time N, packet content N}}, output Traffic.txt file.

8. The encrypted traffic behavior identification device based on behavior sequence comparison according to claim 6 is characterized in that: The preprocessing module is specifically used to perform full-segment transport layer protocol parsing on each data packet in the traffic set, extract the entire segment from the first field to the last field, store each data packet as a line, and store them as a protocol field file Traffic_oneline.txt according to the order of the data packets in the traffic set; regard each line in the Traffic_oneline.txt file as a sample, convert the original characters in each sample into ASCII codes, analyze and mark the fields used to indicate the characteristics of network communication behavior, and output the marked set file Traffic_boundary.txt; divide the traffic set according to the time interval of the session behavior, calculate the statistical characteristics of each segment of traffic according to the protocol field information of each segment of traffic, and store them as the file Traffic_statistical.txt.

9. The encrypted traffic behavior identification device based on behavior sequence comparison according to claim 6, characterized in that: The state transition matrix is ​​represented by the matrix StatesTrans, where StatesTrans[i][j] represents the number of transitions from the i-th state to the j-th state in the state set States; the transition frequency matrix is ​​represented by the matrix StatesF, where StatesF[i][j] represents the frequency of transitions from the i-th state to the j-th state in the state set States, and StatesF[i][j] is the quotient of StatesTrans[i][j] and the sum of all time intervals from state i to state j; when StatesF[i][j] and StatesF[j][i] are both 0, it means that there is no connectivity between state i and state j; The state transition diagram generation module is specifically used to select a state whose state probability predicted by deep learning is lower than a threshold, assuming that the behavior corresponding to the state is X, and calculate the predicted behavior probability P(X|a), P(X|b), P(X|c),... after the state is replaced by other states based on the Viterbi algorithm according to the state transition relationship and transition frequency of each node in the state transition diagram, where a, b, c,... represent states, and the state with the largest behavior probability is selected to cover the state.

10. The encrypted traffic behavior identification device based on behavior sequence comparison according to claim 6, characterized in that: The finite automaton selection module is specifically used to divide the state set into multiple sub-periods according to the state transition relationship and transition frequency of each state in the state set, and obtain a set C = {S1, S2, S3, ..., Sn}, where Si represents the state subset of the i-th sub-period, 1≤i≤n; for each sub-period, determine the first state character according to the original state sequence, and determine the next state symbol based on the transition frequency of the state character in the transition frequency matrix until all states in the sub-period are traversed; after determining the state sequence in each sub-period, generate a new state set; for each sub-period in the new state set, construct a finite automaton; Based on the finite automaton, two sub-cycles with state intersection are found, and the two sub-cycles with state intersection are merged. If the false alarm rate is reduced, the two sub-cycles are replaced by the merged set. If the false alarm rate is increased, the fusion is cancelled.

Images