Malicious traffic detection method and terminal

Abstract

The application discloses a malicious traffic detection method and a terminal, pre-processes network traffic to obtain a data packet interaction relationship sequence and a packet level feature sequence, constructs a plurality of intra-flow interaction graphs with time sequence relationship according to the data packet interaction relationship sequence, extracts interaction information based on the plurality of intra-flow interaction graphs and the packet level feature sequence using an interaction information extraction model, obtains a graph level representation feature sequence, inputs the graph level representation feature sequence into a malicious traffic detection model for detection, and obtains a detection result, wherein the interaction information extraction model comprises a plurality of feature extraction units, each feature extraction unit comprises a plurality of graph convolution layers, a ReLu layer, a Dropout layer and a global pooling layer, the robustness of the model is improved, the interaction information between data packets can be effectively extracted, the malicious traffic detection model comprises a bidirectional long short-term memory network and a multilayer perceptron, time sequence information in network traffic data can be accurately extracted, and therefore the accuracy of malicious traffic detection is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and terminal for detecting malicious traffic. Background Technology

[0002] With the rapid development of network technology and the continuous expansion of network scale, not only has the traffic of various services exploded, but the types and quantities of malicious traffic have also been increasing. These emerging malicious traffic attacks have caused many extremely serious consequences, leading to increasing emphasis on cyberspace security. In recent years, due to the continuous development of malicious traffic types and network attack techniques, traditional rule-based and signature-based malicious traffic detection methods can no longer meet the needs of real-world environments. Methods based on machine learning and deep learning, relying on the powerful feature extraction capabilities of neural networks, avoid the problem of insufficient feature representation capabilities in manual design and have gradually become the mainstream of industry research. However, existing malicious traffic detection models built using machine learning and deep learning methods only focus on the temporal characteristics between data packets within a network flow, without paying more attention to the complex relationships between data packets.

[0003] Chinese patent document CN202011184585.9 discloses a graph neural network construction method and an abnormal traffic detection method based on graph neural networks. It provides a method for detecting abnormal traffic by transforming the correlation and temporal features of raw traffic data into graph-structured data and using a graph neural network. Specifically, it includes: constructing a recurrent neural network model using the temporal correlation of traffic packets; updating the feature vectors of each field in the traffic packet; converting streaming data into graph data using a graph construction method to obtain the correlation features between fields within a traffic packet segment; and then constructing a deep graph neural network model for abnormal traffic detection and classification. However, this method extracts feature values ​​from each field in a data packet, which is affected by different network environments, causing fluctuations in the maximum / minimum values ​​and making subsequent normalization operations difficult. Furthermore, this method only considers the sequential relationships between data packets, ignoring the richer interactions between data packets, resulting in a lower detection accuracy.

[0004] Therefore, how to provide a malicious traffic detection method that can solve the above problems is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a malicious traffic detection method and terminal that can improve the accuracy of malicious traffic detection.

[0006] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0007] A method for detecting malicious traffic includes the following steps:

[0008] Collect network traffic and preprocess the network traffic to obtain a data packet interaction sequence and a packet-level feature sequence;

[0009] Construct multiple intra-stream interaction graphs with temporal relationships based on the data packet interaction sequence;

[0010] Based on the multiple intra-flow interaction graphs and the packet-level feature sequence, an interaction information extraction model is used to extract interaction information to obtain a graph-level representation feature sequence. The interaction information extraction model includes multiple feature extraction units, and each feature extraction unit includes multiple graph convolutional layers, ReLU layers, Dropout layers, and global pooling layers.

[0011] The graph-level representation feature sequence is input into the malicious traffic detection model for detection, and the detection result is obtained. The malicious traffic detection model includes a bidirectional long short-term memory network and a multilayer perceptron.

[0012] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is as follows:

[0013] A malicious traffic detection terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it performs the following steps:

[0014] Collect network traffic and preprocess the network traffic to obtain a data packet interaction sequence and a packet-level feature sequence;

[0015] Construct multiple intra-stream interaction graphs with temporal relationships based on the data packet interaction sequence;

[0016] Based on the multiple intra-flow interaction graphs and the packet-level feature sequence, an interaction information extraction model is used to extract interaction information to obtain a graph-level representation feature sequence. The interaction information extraction model includes multiple feature extraction units, and each feature extraction unit includes multiple graph convolutional layers, ReLU layers, Dropout layers, and global pooling layers.

[0017] The graph-level representation feature sequence is input into the malicious traffic detection model for detection, and the detection result is obtained. The malicious traffic detection model includes a bidirectional long short-term memory network and a multilayer perceptron.

[0018] The beneficial effects of this invention are as follows: Network traffic is preprocessed to obtain a data packet interaction relationship sequence and a packet-level feature sequence. Multiple intra-flow interaction graphs with temporal relationships are constructed based on the data packet interaction relationship sequence. Interaction information is extracted using an interaction information extraction model based on the multiple intra-flow interaction graphs and the packet-level feature sequence to obtain a graph-level representation feature sequence. This graph-level representation feature sequence is then input into a malicious traffic detection model for detection, yielding the detection result. The interaction information extraction model includes multiple feature extraction units, each of which includes multiple graph convolutional layers, ReLU layers, Dropout layers, and global pooling layers, improving the model's robustness and enabling effective extraction of interaction information between data packets. The malicious traffic detection model includes a bidirectional long short-term memory network and a multilayer perceptron, accurately extracting temporal information from network traffic data, thereby improving the accuracy of malicious traffic detection. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating the steps of a malicious traffic detection method according to an embodiment of the present invention;

[0020] Figure 2 This is a schematic diagram of the structure of a malicious traffic detection terminal according to an embodiment of the present invention;

[0021] Figure 3 This is a schematic diagram illustrating the construction process of the intra-flow interaction graph in the malicious traffic detection method of this invention.

[0022] Figure 4 This is a structural diagram of the interactive information extraction model in the malicious traffic detection method of this invention.

[0023] Figure 5 This is a structural diagram of the malicious traffic detection model in the malicious traffic detection method of this invention. Detailed Implementation

[0024] To explain in detail the technical content, objectives, and effects of the present invention, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0025] Please refer to Figure 1 A method for detecting malicious traffic, comprising the following steps:

[0026] Collect network traffic and preprocess the network traffic to obtain a data packet interaction sequence and a packet-level feature sequence;

[0027] Construct multiple intra-stream interaction graphs with temporal relationships based on the data packet interaction sequence;

[0028] Based on the multiple intra-flow interaction graphs and the packet-level feature sequence, an interaction information extraction model is used to extract interaction information to obtain a graph-level representation feature sequence. The interaction information extraction model includes multiple feature extraction units, and each feature extraction unit includes multiple graph convolutional layers, ReLU layers, Dropout layers, and global pooling layers.

[0029] The graph-level representation feature sequence is input into the malicious traffic detection model for detection, and the detection result is obtained. The malicious traffic detection model includes a bidirectional long short-term memory network and a multilayer perceptron.

[0030] As can be seen from the above description, the beneficial effects of the present invention are as follows: Network traffic is preprocessed to obtain a data packet interaction relationship sequence and a packet-level feature sequence. Multiple intra-flow interaction graphs with temporal relationships are constructed based on the data packet interaction relationship sequence. Interaction information is extracted using an interaction information extraction model based on the multiple intra-flow interaction graphs and the packet-level feature sequence to obtain a graph-level representation feature sequence. This graph-level representation feature sequence is then input into a malicious traffic detection model for detection to obtain the detection result. The interaction information extraction model includes multiple feature extraction units, each of which includes multiple graph convolutional layers, ReLU layers, Dropout layers, and global pooling layers, improving the robustness of the model and effectively extracting interaction information between data packets. The malicious traffic detection model includes a bidirectional long short-term memory network and a multilayer perceptron, which can accurately extract temporal information from network traffic data, thereby improving the accuracy of malicious traffic detection.

[0031] Furthermore, the preprocessing of the network traffic to obtain the packet interaction sequence and packet-level feature sequence includes:

[0032] The network traffic is segmented according to the 5-tuple information to obtain multiple initial network flows, each of which includes multiple data packets;

[0033] Based on a preset flow duration threshold and a preset data packet interval time threshold, multiple data packets in each network flow are segmented to obtain multiple segmented network flows.

[0034] Retransmitted packets and useless packets are removed from the segmented network streams to obtain filtered network streams. The data packets in the filtered network streams are then sorted to obtain a data packet sequence.

[0035] The packet interaction relationship sequence is extracted from the packet sequence, and the packet sequence is processed to obtain the packet-level feature sequence.

[0036] As described above, network traffic is segmented according to the five-tuple information, and then multiple data packets in each network flow are further segmented based on the preset flow duration threshold and the preset data packet interval time threshold. Then, retransmitted packets and useless packets in the segmented network flows are removed, which improves the quality of the data to be processed and ensures the efficiency of subsequent detection.

[0037] Further, extracting the data packet interaction relationship sequence from the data packet sequence includes:

[0038] The relationship between data packets in the data packet sequence is determined based on the transmission direction between adjacent data packets in the filtered multiple network flows;

[0039] Generate a sequence of data packet interaction relationships based on the relationships between the data packets.

[0040] As described above, the relationship between data packets in a data packet sequence is determined based on the transmission direction between adjacent data packets in multiple filtered network flows. This generates a data packet interaction relationship sequence, extracts the interaction relationship between data packets, and helps to identify malicious traffic.

[0041] Further, determining the relationship between data packets in the data packet sequence based on the transmission direction between adjacent data packets in the filtered multiple network flows includes:

[0042] If adjacent data packets in the filtered network flows have the same transmission direction, then it is determined that there is a continuity relationship between the adjacent data packets in the data packet sequence.

[0043] If, among the filtered network flows, there are adjacent data packets whose transmission directions are opposite, then it is determined that there is a response relationship between the adjacent data packets in the data packet sequence.

[0044] As described above, when the transmission direction between adjacent data packets is the same, it is determined that there is a continuity relationship between adjacent data packets in the data packet sequence. When the transmission direction between adjacent data packets is opposite, it is determined that there is a response relationship between adjacent data packets in the data packet sequence. This method of determining the interaction relationship between data packets is simpler and more effective.

[0045] Further, the processing of the data packet sequence to obtain the packet-level feature sequence includes:

[0046] If the length of the data packet sequence exceeds a preset network flow length threshold, the data packet sequence is pruned until the length reaches the preset network flow length threshold to obtain a packet-level feature sequence.

[0047] If the length of the data packet sequence is lower than the preset network flow length threshold, the data packet sequence is padded until the length reaches the preset network flow length threshold to obtain a packet-level feature sequence.

[0048] As described above, the packet sequence is pruned and padded based on the preset network flow length threshold and the packet sequence length to obtain a packet-level feature sequence, which contains the feature information of the packet, so as to facilitate accurate malicious traffic detection in the future.

[0049] Furthermore, the step of constructing multiple intra-stream interaction graphs with temporal relationships based on the data packet interaction sequence includes:

[0050] Based on the data packet interaction sequence, nodes and edge relationships are generated according to preset edge rules, and multiple intra-flow interaction graphs with temporal relationships are obtained based on the nodes and edge relationships.

[0051] As described above, nodes and edge relationships are generated according to preset edge rules based on the data packet interaction relationship sequence. Multiple intra-flow interaction graphs with temporal relationships are obtained based on the nodes and edge relationships. The intra-flow interaction graph can fully reflect the interaction relationship between data packets within a network flow. It can better represent a network flow, and this interaction relationship is less affected by disturbances, ensuring the accuracy of malicious traffic detection.

[0052] Furthermore, the step of extracting interaction information using an interaction information extraction model based on the multiple intra-flow interaction graphs and the packet-level feature sequence to obtain a graph-level representation feature sequence includes:

[0053] Extract an adjacency matrix set from the multiple intra-flow interaction graphs, and extract a node feature matrix set from the packet-level feature sequence based on the multiple intra-flow interaction graphs;

[0054] The adjacency relation matrix set and the node feature matrix set are input into the interaction information extraction model to extract interaction information and output a graph-level representation feature sequence.

[0055] As described above, after extracting the adjacency relation matrix set from multiple intra-flow interaction graphs and extracting the node feature matrix set from the packet-level feature sequence based on multiple intra-flow interaction graphs, the adjacency relation matrix set and the node feature matrix set are input into the interaction information extraction model to extract interaction information and output a graph-level representation feature sequence. The graph-level representation feature sequence reflects the interaction information contained in each intra-flow interaction graph, which can effectively improve the accuracy of subsequent detection.

[0056] Further, the step of extracting an adjacency relation matrix set from the plurality of intra-flow interaction graphs and extracting a node feature matrix set from the packet-level feature sequence based on the plurality of intra-flow interaction graphs includes:

[0057] Each of the intra-flow interaction graphs is transformed into an isomorphic graph, and an adjacency relation matrix is ​​extracted from each of the isomorphic graphs to obtain a set of adjacency relation matrices;

[0058] Based on the node information in each intra-flow interaction graph, data packet features matching the node information are extracted from the packet-level feature sequence, and a node feature matrix corresponding to each intra-flow interaction graph is constructed based on the data packet features to obtain a set of node feature matrices.

[0059] As described above, the intra-flow interaction graph is a graph structure data. The nodes in the graph represent different data packets in a network flow. Transforming each intra-flow interaction graph into a homogeneous graph satisfies the input requirements of the subsequent interaction information extraction model and ensures the accuracy of interaction information extraction.

[0060] Furthermore, the feature extraction unit includes:

[0061]

[0062]

[0063] In the formula, f(X, A) represents a feature extraction unit, and ReLU() represents an activation function. Degree matrix, Let A represent the intermediate matrix, and let I represent the input adjacency relation matrix. N In this context, Dropout() represents the Dropout layer, X represents the input node feature matrix, and W represents the input node feature matrix. (0) and W (1) These represent the learnable parameters in different graph convolutional layers of the model.

[0064] As described above, the feature extraction unit consists of multiple graph convolutional layers, ReLU layers, Dropout layers, and global pooling layers, which can effectively extract data features of network traffic to improve the reliability of malicious traffic detection.

[0065] Please refer to Figure 2 Another embodiment of the present invention provides a malicious traffic detection terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements each step of the above-described malicious traffic detection method.

[0066] The malicious traffic detection method and terminal described above are applicable to scenarios requiring network traffic detection. The following detailed embodiments illustrate these methods:

[0067] Please refer to Figure 1 , Figures 3-5Embodiment 1 of the present invention is as follows:

[0068] A method for detecting malicious traffic includes the following steps:

[0069] S1. Collect network traffic and preprocess the network traffic to obtain a data packet interaction sequence and a packet-level feature sequence, specifically including S11-S14:

[0070] S11. The network traffic is segmented according to the 5-tuple information to obtain multiple initial network flows, each of which includes multiple data packets.

[0071] Specifically, network traffic with the same quintuple information is divided into a single network flow, resulting in an initial set of multiple network flows.

[0072] The five-tuple information includes the source IP address, destination IP address, source port number, destination port number, and transport layer protocol number.

[0073] S12. Based on a preset flow duration threshold and a preset data packet interval time threshold, multiple data packets in each network flow are segmented to obtain multiple segmented network flows.

[0074] The preset flow duration threshold is the time interval between the sending of the first and last data packets in the network flow, and the preset data packet interval threshold is the time interval between the sending of two adjacent data packets in the network flow.

[0075] Specifically, the data packets in the initial multiple network flows are traversed. For each traversed data packet, the time interval between the current data packet and the first data packet of the corresponding network flow is compared to see if it exceeds a preset flow duration threshold, and the time interval between the current data packet and the previous data packet is compared to see if it exceeds a preset data packet interval threshold. If either threshold is exceeded, the network flow is segmented until the traversal is complete, resulting in multiple segmented network flows. Since the preset flow duration threshold compares the time interval between the first and last data packets, after each segmentation, the time information of the first data packet needs to be updated to the time of the current data packet before subsequent traversal operations are performed.

[0076] In real-world network environments, the communicating parties may communicate more than once, and these multiple communications may be unrelated. Segmenting network traffic solely based on the five-tuple information would group multiple communication processes into the same network flow, which can interfere with the detection of malicious traffic. Therefore, further segmentation is needed, namely, segmenting multiple data packets within each network flow based on preset flow duration thresholds and preset packet interval thresholds. For example, in daily life, one might visit the same website multiple times on the same day, but the content accessed each time would differ. If segmentation is based solely on the identifiers of the communicating parties, these multiple access processes would be grouped together, which is clearly unreasonable. Therefore, combining time thresholds can further segment the traffic to separate the multiple access processes and increase the likelihood of a more accurate representation.

[0077] S13. Remove retransmitted packets and useless packets from the segmented network streams to obtain filtered network streams, and sort the data packets in the filtered network streams to obtain a data packet sequence.

[0078] S14. Extract the data packet interaction relationship sequence from the data packet sequence, and process the data packet sequence to obtain the packet-level feature sequence, specifically including S141-S144:

[0079] S141. Determine the relationship between data packets in the data packet sequence based on the transmission direction between adjacent data packets in the filtered multiple network flows.

[0080] Specifically, if adjacent data packets in the filtered network flows have the same transmission direction, then a continuity relationship is determined between the adjacent data packets in the data packet sequence; if adjacent data packets in the filtered network flows have opposite transmission directions, then a response relationship is determined between the adjacent data packets in the data packet sequence. The transmission direction of each data packet and its adjacent data packets is obtained by traversing the IP address information of each data packet.

[0081] S142. Generate a data packet interaction relationship sequence based on the relationship between the data packets.

[0082] S143. If the length of the data packet sequence exceeds a preset network flow length threshold, the data packet sequence is trimmed until the length reaches the preset network flow length threshold to obtain a packet-level feature sequence.

[0083] The preset network flow length threshold is the number of data packets in a network flow.

[0084] S144. If the length of the data packet sequence is lower than the preset network flow length threshold, the data packet sequence is padded until the length reaches the preset network flow length threshold to obtain a packet-level feature sequence.

[0085] The step of filling the data packet sequence includes adding an empty data packet to the data packet sequence, wherein the empty data packet is a data packet in which all fields are zero.

[0086] S2. Construct multiple intra-flow interaction graphs with temporal relationships based on the data packet interaction relationship sequence.

[0087] Specifically, such as Figure 3 As shown, nodes and edge relationships are generated according to the data packet interaction relationship sequence and preset edge rules, and multiple intra-flow interaction graphs with temporal relationships are obtained based on the nodes and edge relationships.

[0088] The step of obtaining multiple intra-flow interaction graphs with temporal relationships based on the nodes and the edge relationships includes: treating each process of adding the nodes and edge relationships to the graph as an iteration, retaining the intra-flow interaction graphs generated in each iteration, and obtaining multiple intra-flow interaction graphs with temporal relationships. The intra-flow interaction graph includes nodes and edges, where each node represents a data packet, and the edges include response edges and continuation edges.

[0089] The preset edge addition rules include direct addition rules, response edge addition rules, and continuation edge addition and response continuation rules. The direct addition rule is as follows: when a node in the initial intra-flow interaction graph is empty or the data packet represented by the current node is a filled data packet, a node is directly added to the intra-flow interaction graph without adding any edge relationships. The response edge addition rule is as follows: when the current data packet in the data packet interaction sequence has a response relationship with the previous data packet, a response relationship edge is added. The continuation edge addition and response continuation rules are as follows: when the current data packet in the data packet interaction sequence has a continuation relationship with the previous data packet, a node and a corresponding continuation edge are first added to the graph. If a response continuation occurs, the response edge in the graph will disconnect from the previous node and instead point to the current node.

[0090] S3. Based on the multiple intra-flow interaction graphs and the packet-level feature sequence, an interaction information extraction model is used to extract interaction information to obtain a graph-level representation feature sequence, specifically including:

[0091] S31. Extract an adjacency matrix set from the multiple intra-flow interaction graphs, and extract a node feature matrix set from the packet-level feature sequence based on the multiple intra-flow interaction graphs, specifically including S311-S312:

[0092] S311. Transform each of the intra-flow interaction graphs into an isomorphic graph, and extract the adjacency relation matrix from each of the isomorphic graphs to obtain a set of adjacency relation matrices.

[0093] Specifically, the two different types of edges in each of the intra-flow interaction graphs are unified as adjacency relationships to obtain an isomorphic graph. Adjacency relationships between nodes are then extracted from each isomorphic graph to construct an adjacency relationship matrix, resulting in a set of adjacency relationship matrices. When two nodes are adjacent, the corresponding element in the adjacency relationship matrix has a value of 1; when two nodes are not adjacent, the corresponding element has a value of 0.

[0094] S312. Extract data packet features that match the node information from the packet-level feature sequence based on the node information in each intra-flow interaction graph, and construct a node feature matrix corresponding to each intra-flow interaction graph based on the data packet features to obtain a set of node feature matrices.

[0095] Specifically, the step of constructing a node feature matrix corresponding to the interaction graph within each flow based on the data packet characteristics to obtain a set of node feature matrices is as follows:

[0096] The MAC address and IP address information in the packet features are anonymized. The first M bytes of data from each anonymized packet feature are then extracted, normalized, and used as node features. This is used to construct the node feature matrix corresponding to the interaction graph within each flow, resulting in a set of node feature matrices. The IP address information includes the source IP address and the destination IP address.

[0097] S32. Input the adjacency relation matrix set and the node feature matrix set into the interaction information extraction model to extract interaction information, and output a graph-level representation feature sequence, such as... Figure 4 As shown.

[0098] The interactive information extraction model includes multiple feature extraction units, each of which includes multiple graph convolutional (GCN) layers, ReLU layers, Dropout layers, and global pooling layers. The feature extraction unit includes:

[0099]

[0100]

[0101] In the formula, f(X, A) represents a feature extraction unit, and ReLU() represents an activation function. Degree matrix, Let A represent the intermediate matrix, and let I represent the input adjacency relation matrix. NThe matrix represents the identity matrix, Dropout() represents the Dropout layer, X represents the input node feature matrix, and W represents the identity matrix. (0) and W (1) These represent the learnable parameters in different graph convolutional layers of the model.

[0102] The graph convolutional layer is used to aggregate the features of nodes and their neighboring nodes in the graph, capturing the interaction information within the network flow.

[0103] The ReLU layer is used to increase the representational power of the interactive information extraction model and improve its nonlinear fitting ability.

[0104] The Dropout layer is used to randomly drop a portion of neurons during training and retain all neurons during testing.

[0105] The global pooling layer is used to extract graph-level feature representations to obtain feature representation vectors of the intra-flow interaction graph, i.e., graph-level representation feature sequences.

[0106] S4. Input the graph-level representation feature sequence into the malicious traffic detection model for detection to obtain the detection result. The malicious traffic detection model includes a bidirectional long short-term memory network (LSTM) and a multilayer perceptron (MLP), such as... Figure 5 As shown.

[0107] In the malicious traffic detection model, the multi-layer bidirectional long short-term memory network serves as the temporal relationship extraction layer, and the multilayer perceptron serves as the classification layer.

[0108] The single-layer bidirectional long short-term memory network is as follows:

[0109]

[0110] In the formula, This indicates a forward hidden state. H represents the backward hidden state. n v represents the hidden state generated by the nth LSTM unit in the nth iteration. n h1 represents the nth feature vector input to the malicious traffic detection model, h2 represents the hidden state generated by the second iteration of the second LSTM unit, and v2 represents the second feature vector input to the malicious traffic detection model.

[0111] It contains contextual information about the feature sequence, aggregated from front to back at the graph level. It contains contextual information about the aggregated graph-level representation of the feature sequence from back to front. and The concatenation of these layers forms the compressed representation vector of the entire input sequence. The temporal relation extraction layer stacks multiple layers of bidirectional long short-term memory networks, and its extracted compressed representation vector is expressed as:

[0112]

[0113] In the formula, z represents the extracted compressed representation vector, and J represents the number of layers in the bidirectional long short-term memory network. This represents the forward hidden state of the i-th layer. This represents the backward hidden state of the i-th layer.

[0114] In one alternative implementation, the learnable parameters in the interactive information extraction model and the malicious traffic detection model are optimized by calculating the loss between the detection result and the true result using the cross-entropy loss function.

[0115] Please refer to Figure 2 Embodiment two of the present invention is as follows:

[0116] A malicious traffic detection terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the various steps of the malicious traffic detection method in Embodiment 1.

[0117] In summary, the malicious traffic detection method and terminal provided by this invention preprocesses network traffic to obtain packet interaction relationship sequences and packet-level feature sequences. Based on the packet interaction relationship sequences, multiple intra-flow interaction graphs with temporal relationships are constructed. Interaction information is extracted using an interaction information extraction model based on the multiple intra-flow interaction graphs and packet-level feature sequences to obtain graph-level representation feature sequences. These graph-level representation feature sequences are then input into a malicious traffic detection model for detection to obtain the detection results. The interaction information extraction model includes multiple feature extraction units, each of which includes multiple graph convolutional layers, ReLU layers, Dropout layers, and global pooling layers, improving the model's robustness and effectively extracting interaction information between packets. The malicious traffic detection model includes a bidirectional long short-term memory network and a multilayer perceptron, enabling accurate extraction of temporal information from network traffic data. This improves the accuracy of malicious traffic detection. Furthermore, by extracting adjacency matrix sets from multiple intra-flow interaction graphs and node feature matrix sets from packet-level feature sequences based on these graphs, the adjacency matrix sets and node feature matrix sets are input into an interaction information extraction model to extract interaction information. The output is a graph-level representation feature sequence, which reflects the interaction information contained in each intra-flow interaction graph, effectively improving the accuracy of subsequent detection. Simultaneously, nodes and edge relationships are generated according to preset edge rules based on the packet interaction relationship sequence. Multiple intra-flow interaction graphs with temporal relationships are obtained based on these nodes and edge relationships. These intra-flow interaction graphs can fully reflect the interaction relationships between packets within a network flow, better representing a network flow. Moreover, these interaction relationships are less affected by disturbances, ensuring the accuracy of malicious traffic detection.

[0118] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for detecting malicious traffic, characterized in that, The method comprises the steps of: collecting network traffic and preprocessing the network traffic to obtain a packet interaction relationship sequence and a packet-level feature sequence; constructing a plurality of intra-flow interaction graphs with time sequence relationship according to the packet interaction relationship sequence; extracting interaction information based on the plurality of intra-flow interaction graphs and the packet-level feature sequence using an interaction information extraction model to obtain a graph-level representation feature sequence, the interaction information extraction model comprising a plurality of feature extraction units, each feature extraction unit comprising a plurality of graph convolution layers, a ReLu layer, a Dropout layer, and a global pooling layer; inputting the graph-level representation feature sequence into a malicious traffic detection model for detection to obtain a detection result, the malicious traffic detection model comprising a bidirectional long short-term memory network and a multilayer perceptron; The preprocessing of the network traffic to obtain the packet interaction relationship sequence and the packet-level feature sequence comprises: segmenting the network traffic according to five-tuple information to obtain an initial plurality of network flows, each network flow comprising a plurality of packets; segmenting the plurality of packets in each network flow based on a preset flow duration threshold and a preset packet interval time threshold to obtain a plurality of segmented network flows; removing retransmission packets and useless packets from the plurality of segmented network flows to obtain a plurality of screened network flows, and sorting the packets in the plurality of screened network flows to obtain a packet sequence; extracting a packet interaction relationship sequence from the packet sequence, and processing the packet sequence to obtain a packet-level feature sequence; The extraction of the packet interaction relationship sequence from the packet sequence comprises: determining the relationship between packets in the packet sequence according to the transmission direction between adjacent packets in the plurality of screened network flows; generating a packet interaction relationship sequence according to the relationship between the packets; The determination of the relationship between packets in the packet sequence according to the transmission direction between adjacent packets in the plurality of screened network flows comprises: if the transmission direction between adjacent packets in the plurality of screened network flows is the same, determining that there is a continuation relationship between the adjacent packets in the packet sequence; if the transmission direction between adjacent packets in the plurality of screened network flows is opposite, determining that there is a response relationship between the adjacent packets in the packet sequence; The feature extraction unit comprises: ； ； wherein denotes a feature extraction unit, denotes an activation function, denotes a degree matrix, denotes an intermediate matrix, A denotes an input adjacency relation matrix, denotes an identity matrix, denotes a Dropout layer, X denotes an input node feature matrix, and denote learnable parameters in different graph convolution layers in the model, respectively.

2. The method of claim 1, wherein, The processing of the packet sequence to obtain a packet-level feature sequence comprises: if the length of the packet sequence exceeds a preset network flow length threshold, the packet sequence is cropped until the length reaches the preset network flow length threshold to obtain a packet-level feature sequence; if the length of the packet sequence is less than the preset network flow length threshold, the packet sequence is padded until the length reaches the preset network flow length threshold to obtain a packet-level feature sequence.

3. The method of claim 1, wherein, The construction of a plurality of intra-flow interaction graphs with time sequence relationship according to the packet interaction relationship sequence comprises: According to the data packet interaction relationship sequence, node and edge relationship is generated according to preset edge connection rules, and a plurality of intra-flow interaction graphs with time sequence relationship are obtained according to the node and the edge relationship.

4. The method of claim 1, wherein, The interaction information is extracted using an interaction information extraction model based on the plurality of intra-flow interaction graphs and the packet-level feature sequence to obtain a graph-level representation feature sequence, which includes: An adjacency relationship matrix set is extracted from the plurality of intra-flow interaction graphs, and a node feature matrix set is extracted from the packet-level feature sequence according to the plurality of intra-flow interaction graphs; The adjacency relationship matrix set and the node feature matrix set are input into an interaction information extraction model to extract interaction information and output a graph-level representation feature sequence.

5. The method of claim 4, wherein, The adjacency relationship matrix set is extracted from the plurality of intra-flow interaction graphs, and a node feature matrix set is extracted from the packet-level feature sequence according to the plurality of intra-flow interaction graphs, which includes: Each of the intra-flow interaction graphs is converted into an isomorphic graph, and an adjacency relationship matrix is extracted from each of the isomorphic graphs to obtain an adjacency relationship matrix set; According to the node information in each of the intra-flow interaction graphs, data packet features conforming to the node information are extracted from the packet-level feature sequence, and a node feature matrix corresponding to each intra-flow interaction graph is constructed according to the data packet features to obtain a node feature matrix set.

6. A malicious traffic detection terminal comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to realize each step of the malicious traffic detection method in any one of claims 1 to 5.

Images