A method for detecting abnormal behavior of network attacks on mailboxes

Abstract

The present invention belongs to the field of network attack detection, and specifically discloses a network attack abnormal behavior detection method for mailboxes, which specifically includes: S1: capturing network traffic PCAP data packets; S2: parsing the captured network traffic PCAP data packets, filtering the encrypted traffic of the mail receiving protocol; S3: performing deep detection on the encrypted traffic of the mail receiving protocol, extracting non-encrypted metadata and the time of the session; S4: screening effective interactive sessions according to the extracted non-encrypted metadata and the time of the session, and supplementing the unit information of the source IP and the destination IP; S5: automatically generating an alarm based on the mode of the source IP accessing multiple different destination IPs at a specific time. The present invention starts from the perspective of the attacker, establishes a model of abnormal behavior of receiving mail through statistical analysis of encrypted mail traffic, so as to effectively discover APT attack events lurking under the encrypted mail transmission traffic.

Description

Technical Field

[0001] The present invention belongs to the field of network attack detection, and in particular relates to a method for detecting abnormal network attack behavior targeting a mailbox. Background Art

[0002] Currently, email has become an indispensable part of people's daily life and work. However, the widespread use of email also brings security risks. Email attacks have become the most commonly used attack method by APT organizations. When APT organizations obtain the user's email account and password, in order to lurk for a long time and steal sensitive information, they usually obtain emails through the pop3s / imaps encrypted communication protocol at specific times (such as non-working hours).

[0003] Existing email security monitoring solutions mainly focus on SSL / TLS offloading detection, machine learning classification based on known threat features, and feature collision matching based on threat intelligence.

[0004] Dependence on decryption or fingerprint construction: Some solutions require decryption of encrypted traffic or construction of specific fingerprints, which may not only lead to compliance risks but also become invalid due to the update of encryption algorithms or the use of custom encryption methods by attackers.

[0005] Reliance on known threat features: Machine learning classification methods based on known threat features have limited ability to identify unknown or variant APT attacks, and are unable to cope with the high degree of customization and concealment of APT attacks.

[0006] Reliance on threat intelligence: The detection effect of the feature collision matching method based on threat intelligence is greatly reduced when the intelligence is not updated in a timely manner or the attacker uses unrecorded attack methods. Summary of the invention

[0007] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a method for detecting abnormal behavior of network attacks on mailboxes. From the perspective of the attacker, through statistical analysis of encrypted email traffic, an abnormal behavior model of receiving emails is established to effectively discover APT attack incidents lurking under the encrypted email transmission traffic.

[0008] To achieve the above object, the present invention adopts the following technical solution:

[0009] A method for detecting abnormal behavior of network attacks on mailboxes, specifically comprising:

[0010] S1: Capture network traffic PCAP packets;

[0011] S2: Parse the captured network traffic PCAP data packets and filter the encrypted traffic of the email receiving protocol;

[0012] S3: Performing deep inspection on the encrypted traffic of the email receiving protocol to extract non-encrypted metadata and session time;

[0013] S4: Filter valid interactive sessions based on the extracted non-encrypted metadata and the time of the session, and supplement the unit information of the source IP and destination IP;

[0014] S5: Automatically generate an alarm based on the pattern of a source IP accessing multiple different destination IPs at a specific time.

[0015] Furthermore, the specific steps of filtering the encrypted traffic of the email receiving protocol in step S2 are:

[0016] According to the characteristics of the mail receiving protocols IMAPS and POP3S, which use TCP ports 993 and 995 respectively, filtering the traffic of TCP ports 993 and 995 means filtering the encrypted traffic of the mail receiving protocols.

[0017] Furthermore, the non-encrypted metadata in step S3 includes: number of packets, session size, source IP address, destination IP address and port, and the number of packets refers to the number of data packets from the source IP address to the destination IP address and the number of data packets from the destination IP address to the source IP address.

[0018] Furthermore, the specific steps of step S4 are:

[0019] Establish a support vector machine learning model with Gaussian kernel function;

[0020] Nearly 1,000 session feature data were extracted from the encrypted email receiving protocol network traffic data as samples, and labeled one by one as valid or invalid sessions;

[0021] Standardize the session feature data, divide it into training data and test data, take out 20% of the data in the sample as the test set, and use the remaining 80% for training;

[0022] Use the trained model to identify traffic features. For traffic features that are valid interactive sessions, query the unit information of the destination IP and store the retrieved unit information in the log database.

[0023] Furthermore, the specific steps of step S5 are:

[0024] Constructing a basic early warning model:

[0025]

[0026] in, Indicates the source IP address. Indicates the source IP address The number of different destination IP addresses accessed within the time range T; N represents the destination IP address number threshold,

[0027] Count all the destination IP addresses that a single source IP address has normally visited within a specific time range T. When a source IP address ( )of( ) is greater than or equal to the threshold N, it is suspected that there is centralized control behavior.

[0028] Furthermore, the basic warning model also adds a whitelist mechanism, and when collecting session data statistics, the source IP addresses in the whitelist are filtered out, or session data whose source IP addresses are overseas and whose destination IP addresses are domestic are monitored.

[0029] The beneficial effects of the present invention are as follows: Starting from the attacker's perspective, the present invention establishes an abnormal behavior model for receiving emails through statistical analysis of encrypted email traffic, so as to effectively discover APT attack events lurking under the encrypted email transmission traffic. APT events are advanced persistent threat events. APT attackers usually use encrypted transmission protocols (such as SSL / TLS) to access the email accounts that they control and intend to control for a long time to hide their activity traces. Although the encrypted traffic cannot directly parse the email content, the attacker's unique access behavior pattern can still be identified by analyzing the non-content attributes of the encrypted traffic. The present invention focuses on the specific network behavior characteristics exhibited by such mailboxes to enhance the ability to identify and track the activities of APT attackers. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Attached Figure 1 The present invention is a flow chart of the method. DETAILED DESCRIPTION

[0031] Below, the present invention is further described in conjunction with the accompanying drawings and specific embodiments: Example

[0032] like Figure 1 As shown, a method for detecting abnormal behavior of network attacks on mailboxes specifically includes:

[0033] S1: Capture network traffic PCAP packets;

[0034] S2: Parse the captured network traffic PCAP data packets and filter the encrypted traffic of the email receiving protocol;

[0035] According to the characteristics of the mail receiving protocols IMAPS and POP3S, which use TCP ports 993 and 995 respectively, filtering the traffic of TCP ports 993 and 995 means filtering the encrypted traffic of the mail receiving protocols.

[0036] S3: Performing deep inspection on the encrypted traffic of the email receiving protocol to extract non-encrypted metadata and session time;

[0037] Unencrypted metadata includes: Packet number, session size, source IP address, destination IP address and port. The packet number refers to the number of packets from the source IP address to the destination IP address and the number of packets from the destination IP address to the source IP address.

[0038] S4: Filter valid interactive sessions based on the extracted non-encrypted metadata and the time of the session, and supplement the unit information of the source IP and destination IP;

[0039] Establish a support vector machine learning model with Gaussian kernel function;

[0040] The first step is to select key features. The following are the conversation features we selected:

[0041] Nearly 1,000 session feature data were extracted from the encrypted email receiving protocol network traffic data as samples, and labeled one by one as valid sessions or invalid sessions; the data was written into a csv file, which contains the feature names mentioned in the feature table: PktCnt, BTrf, SRC_DST_PktCnt, DST_SRC_PktCnt, SRC_DST_BTrf, DST_SRC_BTrf and the label column Label.

[0042] Name the csv file containing the feature and label data "network_traffic.csv".

[0043] Standardize the session feature data, divide it into training data and test data, take out 20% of the data in the sample as the test set, and use the remaining 80% for training;

[0044] Use the trained model to identify traffic features. If the traffic features are identified as valid interactive sessions, query the unit information of the destination IP and store the obtained unit information in the log database.

[0045] The main fields of the log database are as follows:

[0046] The prediction accuracy of the test set reached above 0.9.

[0047] In this step, the session data is preliminarily cleaned to extract valid interactive sessions, which is a key step that affects the accuracy of the alarm. Because the monitoring scenario to be solved is that the email account is compromised and controlled by others, successful login and access to emails are possible traffic behaviors. For plain text traffic monitoring, it is easy to determine whether the login is successful and whether there is data exchange. However, because the traffic of the email receiving encryption protocol cannot monitor the session content, it is necessary to predict it through session behavior feature modeling.

[0048] S5: Automatically generate an alarm based on the pattern of the source IP accessing multiple different destination IPs at a specific time. The specific steps are as follows:

[0049] Constructing a basic early warning model:

[0050]

[0051] in, Indicates the source IP address. Indicates the source IP address The number of different destination IP addresses accessed within the time range T; N represents the destination IP address number threshold,

[0052] Count all the destination IP addresses that a single source IP address has normally visited within a specific time range T. When a source IP address ( )of( ) is greater than or equal to the threshold N, it is suspected that there is centralized control behavior.

[0053] The basic warning model can also add a whitelist mechanism to filter out the source IP addresses in the whitelist when collecting session data, or monitor session data where the source IP address is overseas and the destination IP address is domestic.

[0054] When a source IP that meets the conditions appears, the system immediately generates an alarm for abnormal receiving behavior so that security personnel can further study and analyze it.

[0055] For those skilled in the art, various other corresponding changes and deformations can be made according to the technical solutions and concepts described above, and all of these changes and deformations should fall within the protection scope of the claims of the present invention.

Claims

1. A method for detecting abnormal behavior of network attacks on mailboxes, characterized in that: Specifically include: S1: Capture network traffic PCAP packets; S2: Parse the captured network traffic PCAP data packets and filter the encrypted traffic of the email receiving protocol; S3: Performing deep inspection on the encrypted traffic of the email receiving protocol to extract non-encrypted metadata and session time; S4: Filter valid interactive sessions based on the extracted non-encrypted metadata and the time of the session, and supplement the unit information of the source IP and destination IP; S5: Automatically generate an alarm based on the pattern of a source IP accessing multiple different destination IPs at a specific time; The specific steps of step S4 are: Establish a support vector machine learning model with Gaussian kernel function; Nearly 1,000 session feature data were extracted from the encrypted email receiving protocol network traffic data as samples, and labeled one by one as valid or invalid sessions; Standardize the session feature data, divide it into training data and test data, take out 20% of the data in the sample as the test set, and use the remaining 80% for training; Use the trained model to identify traffic features, identify the traffic features as valid interactive sessions, query the destination IP's unit information, and store the found unit information in the log database; The specific steps of step S5 are: Constructing a basic early warning model: Among them, src ip Indicates the source IP address, count company (src ip ) indicates the source IP address src ip The number of different destination IP addresses accessed within the time range T; N represents the destination IP address number threshold, Count all the destination IP addresses that a single source IP address has normally visited within a specific time range T. When a source IP address (src ip ) of (count company (src ip )) is greater than or equal to the threshold N, it is suspected that there is centralized control behavior; The basic warning model also adds a whitelist mechanism or monitors session data whose source IP address is overseas and whose destination IP address is domestic.

2. The method for detecting abnormal network attack behavior against a mailbox as claimed in claim 1, characterized in that: The specific steps of filtering the encrypted traffic of the email receiving protocol in step S2 are: According to the characteristics of the mail receiving protocols IMAPS and POP3S, which use TCP ports 993 and 995 respectively, filtering the traffic of TCP ports 993 and 995 means filtering the encrypted traffic of the mail receiving protocols.

3. The method for detecting abnormal network attack behavior against a mailbox as claimed in claim 1, characterized in that: The non-encrypted metadata in step S3 includes: Packet quantity, session size, source IP address, destination IP address and port.

Images