Attack detection method, device, equipment and medium based on multi-dimensional coupling

Abstract

The present invention discloses an attack detection method, device, equipment and medium based on multi-dimensional coupling, which belongs to the field of satellite link security technology. The method includes: obtaining domain name system DNS traffic related to the target satellite link; based on the DNS traffic, extracting feature data corresponding to multiple dimensions respectively; based on the feature data, combining the feature data using preset feature combination rules to obtain multiple data sets; each data set includes feature data formed by a combination of several dimensions; performing intra-group feature conversion on the feature data formed by a combination of several dimensions in each data set to obtain conversion data of each data set; inputting the conversion data of each data set into a pre-trained attack detection model to output the attack detection result according to the attack detection model. The present invention can identify complex attack behaviors that cannot be identified by a single dimension for satellite links, thereby improving the accuracy of satellite link attack detection.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of satellite link security technology, and in particular to an attack detection method, device, equipment and medium based on multi-dimensional coupling. Background Art

[0002] As satellite communication networks are increasingly used around the world, attackers take advantage of the high latency and wide coverage of satellite links to carry out complex network attacks through IP theft, dynamic DNS binding to malicious servers, etc. This attack method circumvents traditional security detection methods, posing a huge challenge to the security of satellite links.

[0003] In related technologies, attack detection is usually performed based on threat intelligence. However, it is difficult to deal with complex attack behaviors on satellite links by relying solely on threat intelligence for detection. Summary of the invention

[0004] The embodiments of the present invention provide an attack detection method, apparatus, device and medium based on multi-dimensional coupling, which can detect complex attack behaviors of satellite links.

[0005] On the one hand, an attack detection method based on multi-dimensional coupling is provided, which is used to detect whether a target satellite link between a target network node and a satellite network is attacked, and the method includes:

[0006] Obtaining Domain Name System (DNS) traffic associated with the target satellite link;

[0007] Based on the DNS traffic, extracting feature data corresponding to multiple dimensions respectively;

[0008] Based on the feature data corresponding to the multiple dimensions, the feature data are feature combined using a preset feature combination rule to obtain multiple data sets; each data set includes feature data formed by a combination of several dimensions;

[0009] Perform intra-group feature transformation on the feature data formed by combining several dimensions in each data set to obtain the transformed data of each data set;

[0010] The converted data of each data set is input into a pre-trained attack detection model to output an attack detection result according to the attack detection model.

[0011] On the other hand, an attack detection device based on multi-dimensional coupling is provided, which is used to detect whether a target satellite link between a target network node and a satellite network is attacked, and the device includes:

[0012] An acquisition unit, configured to acquire Domain Name System (DNS) traffic associated with the target satellite link;

[0013] An extraction unit, configured to extract feature data corresponding to multiple dimensions based on the DNS traffic;

[0014] A combining unit, configured to combine the feature data respectively corresponding to the multiple dimensions using a preset feature combination rule to obtain multiple data sets; each data set includes feature data formed by combining several dimensions;

[0015] A conversion unit, used to perform intra-group feature conversion on feature data formed by combining several dimensions in each data set to obtain conversion data of each data set;

[0016] The detection unit is used to input the converted data of each data set into a pre-trained attack detection model to output an attack detection result according to the attack detection model.

[0017] On the other hand, a computer device is provided, comprising a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of the above-mentioned attack detection method based on multi-dimensional coupling.

[0018] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored in the storage medium, and when the computer program is executed by a processor, the steps of the above-mentioned attack detection method based on multi-dimensional coupling are implemented.

[0019] On the other hand, a computer program product is provided, including a computer program, which implements the steps of the above-mentioned attack detection method based on multi-dimensional coupling when executed by a processor.

[0020] The embodiment of the present invention provides an attack detection method, device, equipment and medium based on multi-dimensional coupling, which extracts feature data from DNS traffic in multiple dimensions respectively, and combines the feature data using preset feature combination rules to obtain multiple data sets, wherein each data set includes feature data formed by a combination of several dimensions, and then performs intra-group feature conversion on the feature data formed by a combination of several dimensions in each data set, and finally implements attack detection using the converted data of each data set. This solution can identify complex attack behaviors that cannot be identified by a single dimension for satellite links, thereby improving the accuracy of satellite link attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 This is a flow chart of an attack detection method based on multi-dimensional coupling provided by an embodiment of the present invention;

[0023] Figure 2 is a structural diagram of an attack detection device based on multi-dimensional coupling provided by an embodiment of the present invention;

[0024] Figure 3 It is a hardware architecture diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0026] Currently, attack detection on satellite links can only be achieved by relying on threat intelligence.

[0027] The inventive concept of the present invention is that when an attacker uses a satellite link to carry out a network attack, the attacker mainly hijacks the satellite IP of a network node on the ground to use the satellite IP to attack other network nodes, resulting in a security problem in the satellite link. Considering that when using a satellite link to carry out an attack, a DNS query is required during the satellite communication process, and the query record is located in the DNS traffic, therefore, it is possible to consider using the DNS traffic of the satellite IP to detect whether the satellite link is attacked.

[0028] In the embodiment of the present invention, anomaly detection can be performed on the data on the corresponding dimension through the baseline value in a single dimension to determine whether the satellite link is attacked, and in order to adapt to the high dynamic characteristics of the satellite network environment, the baseline value is dynamically adjusted. However, the attack behaviors of the satellite link are complex and diverse. When there is no anomaly in a single dimension, it cannot be determined that there is no attack behavior. Therefore, the embodiment of the present invention considers combining the feature data on multiple dimensions to form multiple data sets, and then performing intra-group feature conversion on the feature data in the data sets to obtain conversion data in each data set, so as to use the conversion data in multiple data sets to identify complex attack behaviors on the satellite link.

[0029] The specific implementation of the above concept is described below.

[0030] Please refer to Figure 1 The embodiment of the present invention provides an attack detection method based on multi-dimensional coupling, which is used to detect whether a target satellite link between a target network node and a satellite network is attacked. The method includes:

[0031] Step 100, obtaining Domain Name System DNS traffic related to the target satellite link;

[0032] Step 102: extracting feature data corresponding to multiple dimensions based on the DNS traffic;

[0033] Step 104, based on the feature data corresponding to the multiple dimensions, the feature data are combined using a preset feature combination rule to obtain multiple data sets; each data set includes feature data formed by a combination of several dimensions;

[0034] Step 106, performing intra-group feature conversion on the feature data formed by combining several dimensions in each data set to obtain conversion data of each data set;

[0035] Step 108, inputting the converted data of each data set into a pre-trained attack detection model to output an attack detection result according to the attack detection model.

[0036] In the embodiment of the present invention, feature data is extracted from DNS traffic in multiple dimensions, and the feature data is combined using a preset feature combination rule to obtain multiple data sets, wherein each data set includes feature data formed by a combination of several dimensions, and then the feature data formed by a combination of several dimensions in each data set is converted into features within a group, and finally the converted data of each data set is used to implement attack detection. This solution can identify complex attack behaviors that cannot be identified by a single dimension for satellite links, thereby improving the accuracy of satellite link attack detection.

[0037] Described below Figure 1 How the various steps are performed.

[0038] First, with respect to step 100, Domain Name System DNS traffic related to the target satellite link is obtained.

[0039] The target satellite link is a link between the target network node on the ground and the satellite network. If the target satellite link is hijacked, the attacker will use the target satellite link for satellite communication. The communication record is located in the DNS traffic. Therefore, the attack detection can be performed through the DNS traffic related to the target satellite link. In one implementation, the DNS traffic includes the DNS traffic exchanged between the first satellite IP and other satellite IPs.

[0040] Furthermore, the two ends of the satellite link are network nodes, and the network nodes use their own satellite IPs for satellite communication. The attacker and the attacked are the network nodes at both ends of the satellite link. After the attacker uses the first satellite IP of the target network node to communicate with the satellite IP of the attacked network node through satellite, the attacker may use the satellite IP of another network node to communicate with the satellite IP of the attacked network node through satellite. Only the DNS traffic interacting between the first satellite IP and other satellite IPs is obtained for attack detection, and there will still be many missed detections.

[0041] Based on this, in another implementation, obtaining DNS traffic related to the target satellite link may specifically include:

[0042] A1: Based on the first satellite IP of the target network node, obtaining first DNS traffic related to the first satellite IP;

[0043] A2: parsing a second satellite IP having a communication relationship with the first satellite IP from the first DNS traffic;

[0044] A3: Obtain the second DNS traffic related to the second satellite IP, and use the first DNS traffic and the second DNS traffic as the DNS traffic related to the target satellite link.

[0045] The satellite IP in the embodiment of the present invention is an IP allocated by a satellite provider to a network node for satellite communication. DNS traffic is the query and response between a network node and a DNS server, which can be obtained through a DNS server.

[0046] The target network node is the first satellite IP. After obtaining the first DNS traffic of the first satellite IP from the DNS server, the second satellite IP that has a communication relationship with the first satellite IP can be parsed from the first DNS traffic. Assuming that there are 5 second satellite IPs, the second DNS traffic related to each second satellite IP can also be obtained from the DNS server. In this way, the first DNS traffic and the second DNS traffic are used together as the DNS traffic related to the target satellite link for attack detection on the target satellite link, which can improve the accuracy of the attack detection results and reduce missed detection.

[0047] Then, for step 102, based on the DNS traffic, feature data corresponding to multiple dimensions are extracted.

[0048] In the embodiment of the present invention, the DNS traffic has the characteristics of the corresponding dimensions in at least the following multiple dimensions:

[0049] Time dimension: query timestamp, query frequency, query interval, peak and low peak query times;

[0050] Location dimension: geographic location of satellite IP, ASN (Autonomous System Number), country / region code;

[0051] Traffic dimensions: request type, response size, request size, query rate, protocol type;

[0052] Domain name dimension: the queried domain name (the specific domain name or subdomain name being queried), the character length of the domain name, the character composition of the domain name (the character pattern of the domain name), and the complete domain name characteristics of the queried;

[0053] Response dimensions: Time to Live (TTL), response code, and whether there is extended DNS support;

[0054] Behavioral dimension: query mode (query frequency, regularity, burstiness, repetitiveness and other behavioral characteristics), client behavior (query behavior of a specific client or user), cache status (whether it is from the cache);

[0055] Security dimension: DNS security extension status;

[0056] Network layer dimensions: traffic of source satellite IP and destination satellite IP, source port and destination port, TCP flags.

[0057] It can be seen that each of the above dimensions also has at least one sub-dimension. In the embodiment of the present invention, each of the above sub-dimensions can be used as a dimension for feature extraction.

[0058] In one embodiment of the present invention, in addition to extracting features based on the above dimensions, threat intelligence can also be used to extract feature data from the DNS traffic. For example, the dimensions of feature data extracted using threat intelligence can include: the number of abnormal DNS queries, the number of malicious domain name matches, the activity of threat intelligence (based on the frequent updates of threat intelligence and the comprehensive score of importance rating), the number of DNS query failures, etc.

[0059] In this way, the embodiment of the present invention can extract feature data corresponding to multiple dimensions based on DNS traffic.

[0060] In an embodiment of the present invention, when the DNS traffic obtained in step 100 includes the first DNS traffic and the second DNS traffic, the extraction is performed separately for each relevant satellite IP to obtain feature data corresponding to multiple dimensions respectively for each relevant satellite IP; the relevant satellite IPs include the first satellite IP and the second satellite IP.

[0061] For example, assuming that the multiple dimensions are query frequency, geographic location, domain name and survival time, then for each relevant satellite IP, characteristic data of the relevant satellite IP in terms of query frequency, geographic location, domain name and survival time can be obtained.

[0062] It should be noted that after determining the dimensions from which feature extraction is performed, these dimensions need to be fixed. When extracting features for each relevant satellite IP, they are all extracted from these dimensions to ensure data consistency.

[0063] Next, for step 104, based on the feature data corresponding to the multiple dimensions, the feature data are combined using a preset feature combination rule to obtain multiple data sets; each data set includes feature data formed by a combination of several dimensions.

[0064] Since the extracted feature data corresponds to each dimension respectively, and there is a certain correlation between the feature data of different dimensions, in the embodiment of the present invention, the feature data can be combined using preset feature combination rules to generate new composite features that are helpful for attack detection.

[0065] In one embodiment of the present invention, this step can be implemented at least in the following ways:

[0066] B1: Acquire multiple arithmetic specific rules and multiple specific logic rules in the preset feature combination rules;

[0067] B2: Based on the feature data corresponding to the multiple dimensions, using the multiple specific arithmetic rules and the multiple specific logical rules, respectively generate cross feature data of the multiple arithmetic dimensions and cross feature data of the multiple logical dimensions;

[0068] B3: Based on multiple arithmetic dimensions and multiple logical dimensions, determine the dimension combinations that can be formed, and for each dimension combination, form a data set with the corresponding cross-feature data in the dimension combination; the dimension combination includes arithmetic dimensions and / or logical dimensions.

[0069] Among them, specific arithmetic rules are defined based on the correlation between multiple dimensions, and are used to form new dimensional features that can reflect system behavior through calculations; specific logical rules are defined based on security policies, and are used to form new dimensional features that can reflect high-risk states.

[0070] The specific rule arithmetic and specific logic rules are explained below with examples.

[0071] Example 1: Assume that the dimensions of feature data extraction in step 102 include: number of DNS queries X1, number of abnormal DNS queries X2, number of malicious domain name matches X3, and threat intelligence activity X4.

[0072] For specific arithmetic rules, cross-feature data that can reflect system behavior can be generated through operations on the following arithmetic dimensions:

[0073] Abnormal query ratio: calculate the ratio of abnormal DNS query times to the total DNS query times, calculated as: X2 / X1;

[0074] Threat weighted ratio: Combine threat intelligence activity and malicious domain name matching to calculate the threat weighted ratio. The calculation method is: X3×X4.

[0075] For specific logic rules, cross-feature data that can reflect high-risk status can be generated on the following logical dimensions:

[0076] Risk rating: Based on the relationship between the query anomaly ratio and the first threshold and the relationship between the threat weighted ratio and the second threshold, the corresponding risk rating is determined. For example, the risk rating is low, medium, or high.

[0077] Example 2: Assume that the dimensions of feature data extracted in step 102 include: number of DNS queries per hour Y1, number of DNS query failures per hour Y2, DNS response time Y3, and query timestamp Y4;

[0078] Then for a specific arithmetic rule, cross-feature data that can reflect the system behavior can be formed through operations on the following arithmetic dimensions:

[0079] Query load ratio: Calculate the ratio of the number of DNS query failures per hour to the number of DNS queries per hour. The calculation method is: Y2 / Y1;

[0080] Average response time: calculates the average DNS response time within the set window duration;

[0081] Then for specific logic rules, cross-feature data that can reflect high-risk status can be formed on the following logical dimensions:

[0082] Potential attack period: If the number of DNS query failures increases by a set number of times relative to the average failure rate per hour within a certain hour, and the average response time within the hour increases by a set amount of time relative to the total average response time, the period corresponding to the hour is marked as a potential attack period.

[0083] After obtaining the cross-feature data of multiple arithmetic dimensions and multiple logical dimensions, the dimension combination that can be formed can be determined. The dimension combination can include only arithmetic dimensions, only logical dimensions, or both. And the number of arithmetic dimensions and the number of logical dimensions in the dimension combination can also be arbitrary. Assuming that the arithmetic dimension includes 10 dimensions and the logical dimension includes 4 dimensions, then any number of combinations can be made from the 14 dimensions to obtain multiple data sets. Among them, the arbitrary number is at least two.

[0084] In an embodiment of the present invention, in the attack detection analysis of the satellite link, feature data of multiple dimensions are feature combined using preset feature combination rules, and feature data can be extracted and integrated from different dimensions to generate feature data with more effective information volume, thereby greatly improving the attack detection capability of the satellite link, especially when facing complex attack behaviors, and being able to identify them more accurately.

[0085] Continuing with step 106 , the feature data formed by combining several dimensions in each data set is subjected to intra-group feature conversion to obtain conversion data of each data set.

[0086] In one embodiment of the present invention, when the DNS traffic obtained in step 100 includes the first DNS traffic and the second DNS traffic, each data set performs the intra-group feature conversion in the following manner:

[0087] C1: For each relevant satellite IP in the data set, the feature data corresponding to multiple dimensions are standardized according to the same standardization processing method to obtain the standardized data of each relevant satellite IP in multiple dimensions;

[0088] C2: for any two dimensions of the multiple dimensions, executing: using the standardized data of each relevant satellite IP in the first dimension of the two dimensions and the standardized data of each relevant satellite IP in the second dimension, calculating the covariance between the two dimensions;

[0089] C3: The covariance between any two dimensions in multiple dimensions is formed into a covariance matrix;

[0090] C4: Calculate a plurality of eigenpairs according to the correlation between the covariance matrix and the eigenvectors and eigenvalues; each eigenpair includes an eigenvector and an eigenvalue;

[0091] C5: Select the eigenvectors corresponding to the set number of maximum eigenvalues, and generate the transformed data of the data set based on the selected set number of eigenvectors.

[0092] In an embodiment of the present invention, the converted data combines the effective features of each dimension in the data set, and can characterize more complex attack behaviors or attack scenarios, thereby identifying complex threats or hidden threats that may not be significant in single-dimensional feature data, thereby improving the accuracy of detection results and reducing underreporting.

[0093] In step C1, the feature data on some dimensions are quantitative values, such as survival time, query frequency, etc., while the feature data on some dimensions are non-quantitative values, such as domain name, geographic location; therefore, the feature data of non-quantitative values ​​need to be quantified; in addition, even if the feature data is a quantitative value, the data of different related satellite IPs need to be standardized so that the feature data of different related satellite IPs on the same dimension are on the same scale. Based on this, in one embodiment of the present invention, step C1 may include:

[0094] For each dimension, the following steps are performed: determine whether the characteristic data corresponding to each relevant satellite IP on the dimension is a quantized value; if not, quantize the characteristic data; calculate the mean and standard deviation of multiple relevant satellite IPs based on the characteristic data of each relevant satellite IP on the dimension; use the calculated mean and standard deviation to calculate the Z score on the dimension for each relevant satellite IP, and use the Z score as the standardized data.

[0095] Here, the feature data is quantized so that the quantized value is used to represent the feature data, which facilitates subsequent data calculation.

[0096] In the embodiment of the present invention, the Z score may be calculated as follows:

[0097]

[0098] Among them, Z is the calculated Z score, X is the quantitative value corresponding to the feature data, μ is the mean, and σ is the standard deviation.

[0099] In the embodiment of the present invention, the Z score represents the deviation of each quantized value relative to its mean, with the standard deviation as the unit. A Z score of 0 means that the quantized value is equal to the mean in the dimension feature, a positive value means it is higher than the mean, and a negative value means it is lower than the mean. By standardizing multiple feature data, the feature data of different related satellite IPs in each dimension are converted to the same scale, so that no feature data dominates the detection and analysis process due to its large value, ensuring that all feature data have equal weight when contributing to the final detection result.

[0100] In step C2, by calculating the covariance between any two dimensions, the characteristic relationship between the two dimensions can be found.

[0101] Assuming 5 related satellite IPs, the feature data corresponds to four dimensions, and the standardized data is shown in Table 1 below:

[0102] Table 1:

[0103]

[0104] Taking the calculation of the covariance between dimension W1 and dimension W2 as an example, the covariance calculation process is:

[0105]

[0106] Where n is the total number of related satellite IPs, Z W1 , Z W2 The first matrix / second matrix are respectively formed of standardized data of multiple related satellite IPs in dimension W1 / W2.

[0107] In step C3, the covariance data shown in Table 2 below can be obtained:

[0108] Table 2:

[0109]

[0110] The above covariance data can form a covariance matrix. In the covariance matrix, the diagonal elements identify the variance of the features in their respective dimensions. The larger these values ​​are, the higher the dispersion of the feature data in that dimension. The off-diagonal elements identify the covariance between different dimensions and are used to characterize the feature correlation relationship between different dimensions.

[0111] In step C4, the correlation between the covariance matrix and the eigenvector and eigenvalue is: Av=λv. Where A is the covariance matrix, v is the eigenvector, and λ is the eigenvalue corresponding to the eigenvector. The correlation can be expressed by the characteristic equation. By solving the characteristic equation, multiple characteristic pairs can be obtained. The number of characteristic pairs is equal to the number of dimensions. Each characteristic pair includes an eigenvector and an eigenvalue.

[0112] It should be noted that solving the eigenvector and eigenvalue for a matrix can be achieved through existing solving methods, which will not be described in detail in the embodiment of the present invention.

[0113] In step C5, since each eigenvalue represents the data variance in the direction of the corresponding eigenvector, and the main feature is located in the direction of the eigenvector of the maximum eigenvalue, the eigenvectors corresponding to the set number of maximum eigenvalues ​​are selected, and more information, such as data variation information, can be captured in the direction of the selected eigenvectors. Thus, the transformation data of the data set is generated using these selected eigenvectors.

[0114] In one embodiment of the present invention, if all feature vectors are selected, the dimensions of the obtained conversion data are relatively large. When detecting the conversion data, the amount of calculation is large, which affects the detection efficiency. Therefore, the set number is smaller than the total number of several dimensions in the data set, and the selected feature vectors are the directions of key data variation. By focusing on these key variation directions, potential attack behaviors can be more effectively identified and analyzed.

[0115] Then, when generating the transformation data of the data set based on the selected set number of feature vectors, it may include:

[0116] C51: The selected set number of feature vectors form the feature matrix of the data set;

[0117] C52: for each relevant satellite IP, executing: a standard data matrix formed by the standardized data of the relevant satellite IP in each dimension in the data set; multiplying the standard data matrix with the characteristic matrix of the data set to convert and obtain new data of the relevant satellite IP in each dimension;

[0118] C53: Take the new data of each relevant satellite IP in each dimension as the transformation data of the data set.

[0119] It can be seen that by multiplying the feature matrix formed by the feature vectors with the standard data matrix formed by the standardized data, the new data obtained has key data features in other dimensions, so that complex or hidden attack behaviors can be identified when the converted data is used for subsequent detection.

[0120] Finally, for step 108, the converted data of each data set is input into a pre-trained attack detection model to output an attack detection result according to the attack detection model.

[0121] In the embodiment of the present invention, the attack detection model is pre-trained, and the training process includes:

[0122] D1: Acquire multiple sample pairs; the sample pairs include conversion data of multiple sample data sets as input and sample attack detection results as output;

[0123] D2: Use the multiple sample pairs to train a preset network model to obtain a trained attack detection model.

[0124] In step D1, the sample pairs are obtained as follows:

[0125] For multiple sample satellite links known to be attacked, sample DNS traffic related to the satellite link is obtained, sample feature data corresponding to multiple dimensions are extracted, and based on the sample feature data corresponding to the multiple dimensions, the feature data are feature combined using preset feature combination rules to obtain multiple sample data sets, and feature data formed by combining several dimensions in each sample data set are subjected to intra-group feature conversion to obtain conversion data of each sample data set; wherein, the sample DNS traffic acquisition method, feature extraction method, feature combination method, and feature conversion method in the method for acquiring conversion data in the sample pair are the same as the DNS traffic acquisition method, feature extraction method, feature combination method, and feature conversion method performed during actual attack detection.

[0126] In the embodiment of the present invention, whether the sample satellite link is attacked can be determined by detecting the characteristic data of a single dimension, specifically:

[0127] Collect sample DNS traffic of the sample satellite link during the current collection cycle, and count the quantitative values ​​of each dimension based on the sample DNS traffic; dynamically adjust the baseline value of each dimension during the current collection cycle, and use the adjusted baseline value to perform anomaly detection on the quantitative value of the corresponding dimension, and determine whether the sample satellite link is attacked based on the detection results.

[0128] The reason for dynamically adjusting the baseline value is that, unlike the ground network, the satellite network is highly dynamic and the characteristic data of the satellite link in various dimensions may change frequently. Such frequent changes may be caused by satellite orbit adjustments, changes in user terminal positions, switching of different services, etc. Therefore, fixed baseline values ​​cannot be used in the satellite network to perform anomaly detection on the quantitative values ​​of the corresponding dimensions. The baseline value needs to be dynamically adjusted using the latest changes in the satellite network status to cope with the frequently changing satellite network environment.

[0129] The baseline value can be adjusted dynamically by:

[0130]

[0131] Among them, EWMA t is the baseline value corresponding to the dimension in the current collection cycle. is the baseline value of the dimension in the previous collection cycle, α is the smoothing coefficient, and the smoothing coefficient is a positive number less than 1. t It is the quantized value of this dimension in the current collection period.

[0132] Through this dynamic adjustment method, the baseline value can give greater weight to the latest data to smooth the time series data, reduce the impact of short-term fluctuations, and timely reflect the changing trend of the data.

[0133] Exponentially weighted average method (EWMA) is a smoothing technique that processes data by weighted average, making the latest data have a greater impact on the current state, while the impact of historical data gradually decreases. The exponentially weighted average method is used to combine the historical baseline value and the quantitative value of the dimension in the current collection cycle to smooth the baseline value, thereby eliminating the noise caused by short-term data fluctuations and capturing more stable long-term trends. In addition, by dynamically adjusting the baseline value, normal fluctuations and abnormal behaviors can still be accurately distinguished in a highly dynamic environment.

[0134] Please refer to Figure 2 The embodiment of the present invention provides an attack detection device based on multi-dimensional coupling, which is used to detect whether a target satellite link between a target network node and a satellite network is attacked. The device includes:

[0135] An acquisition unit 200 is used to acquire Domain Name System DNS traffic related to the target satellite link;

[0136] An extraction unit 202, configured to extract feature data corresponding to multiple dimensions based on the DNS traffic;

[0137] A combining unit 204 is used to combine the feature data corresponding to the multiple dimensions respectively using a preset feature combination rule to obtain multiple data sets; each data set includes feature data formed by combining several dimensions;

[0138] A conversion unit 206, configured to perform intra-group feature conversion on feature data formed by combining several dimensions in each data set to obtain conversion data of each data set;

[0139] The detection unit 208 is used to input the converted data of each data set into a pre-trained attack detection model to output an attack detection result according to the attack detection model.

[0140] In one embodiment of the present invention, the acquisition unit is specifically used to: acquire a first DNS traffic related to a first satellite IP of the target network node based on the first satellite IP; parse a second satellite IP having a communication relationship with the first satellite IP from the first DNS traffic; acquire a second DNS traffic related to the second satellite IP, and use the first DNS traffic and the second DNS traffic as DNS traffic related to the target satellite link; the satellite IP is an IP allocated by a satellite provider to a network node for realizing satellite communication.

[0141] In one embodiment of the present invention, the combination unit is specifically used to: obtain multiple specific arithmetic rules and multiple specific logical rules in preset feature combination rules; the specific arithmetic rules are defined based on the correlation between multiple dimensions, and are used to form new dimensional features that can reflect system behavior through calculation; the specific logical rules are defined based on security policies, and are used to form new dimensional features that can reflect high-risk states; based on the feature data corresponding to the multiple dimensions, the multiple specific arithmetic rules and the multiple specific logical rules are used to generate cross-feature data of multiple arithmetic dimensions and cross-feature data of multiple logical dimensions respectively; based on the multiple arithmetic dimensions and the multiple logical dimensions, determine the dimension combinations that can be formed, and for each dimension combination, form a data set with the cross-feature data corresponding to the dimension combination; the dimension combination includes arithmetic dimensions and / or logical dimensions.

[0142] In one embodiment of the present invention, the extraction is performed for each relevant satellite IP respectively, so as to obtain feature data corresponding to multiple dimensions respectively for each relevant satellite IP; the relevant satellite IPs include a first satellite IP and a second satellite IP;

[0143] Each data set undergoes intra-group feature transformation as follows:

[0144] For each relevant satellite IP in the data set, the feature data corresponding to multiple dimensions are standardized according to the same standardization processing method to obtain the standardized data of each relevant satellite IP in multiple dimensions;

[0145] For any two dimensions of the multiple dimensions, the following steps are performed: using the standardized data of each relevant satellite IP in a first dimension of the two dimensions and the standardized data of each relevant satellite IP in a second dimension of the two dimensions, calculating the covariance between the two dimensions;

[0146] The covariance between any two dimensions in multiple dimensions is formed into a covariance matrix;

[0147] According to the correlation between the covariance matrix and the eigenvector and eigenvalue, a plurality of eigenpairs are calculated; each eigenpair includes an eigenvector and an eigenvalue;

[0148] The eigenvectors corresponding to the set number of maximum eigenvalues ​​are selected, and the conversion data of the data set is generated based on the selected set number of eigenvectors.

[0149] In one embodiment of the present invention, when the conversion unit performs standardization processing on the feature data corresponding to multiple dimensions, the process specifically includes: for each dimension, the following steps are performed: determining whether the feature data corresponding to each relevant satellite IP on the dimension is a quantized value, and if not, quantizing the feature data; calculating the mean and standard deviation of multiple relevant satellite IPs based on the feature data of each relevant satellite IP on the dimension; and calculating the Z score on the dimension for each relevant satellite IP using the calculated mean and standard deviation, and using the Z score as the standardized data.

[0150] In one embodiment of the present invention, the set number is less than the total number of dimensions in the corresponding data set;

[0151] The conversion unit, when generating the conversion data of the data set based on the selected set number of feature vectors, specifically includes:

[0152] The selected set number of feature vectors form a feature matrix of the data set;

[0153] For each relevant satellite IP, the following steps are performed: a standard data matrix formed by the standardized data of the relevant satellite IP in each dimension in the data set; and the standard data matrix is ​​multiplied by the characteristic matrix of the data set to convert and obtain new data of the relevant satellite IP in each dimension.

[0154] The new data of each relevant satellite IP in each dimension is used as the transformation data of the data set.

[0155] It should be noted that: the attack detection device based on multi-dimensional coupling provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the attack detection device based on multi-dimensional coupling provided in the above embodiment and the attack detection method embodiment based on multi-dimensional coupling belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0156] The embodiment of the present application also provides a computer device, please refer to Figure 3The computer device includes a processor and a memory, in which at least one instruction, at least one program, a code set or an instruction set is stored, and the at least one instruction, at least one program, a code set or an instruction set is loaded and executed by the processor to implement the attack detection method based on multi-dimensional coupling provided by the above-mentioned method embodiments.

[0157] An embodiment of the present application also provides a computer-readable storage medium, on which is stored at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the attack detection method based on multi-dimensional coupling provided in the above-mentioned method embodiments.

[0158] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes any of the attack detection methods based on multi-dimensional coupling described in the above embodiments.

[0159] For the convenience of description, the above system or device is described by dividing it into various modules or units according to its functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0160] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0161] Finally, it should be noted that, in this article, relational terms such as first, second, third and fourth are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0162] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. An attack detection method based on multi-dimensional coupling, characterized in that: For detecting whether a target satellite link between a target network node and a satellite network is attacked, the method comprises: Obtaining Domain Name System (DNS) traffic associated with the target satellite link; Based on the DNS traffic, extracting feature data corresponding to multiple dimensions respectively; Based on the feature data corresponding to the multiple dimensions, the feature data are feature combined using a preset feature combination rule to obtain multiple data sets; each data set includes feature data formed by a combination of several dimensions; Perform intra-group feature transformation on the feature data formed by combining several dimensions in each data set to obtain the transformed data of each data set; Inputting the converted data of each data set into a pre-trained attack detection model to output an attack detection result according to the attack detection model; The obtaining of the domain name system DNS traffic related to the target satellite link includes: obtaining a first DNS traffic related to the first satellite IP based on the first satellite IP of the target network node; parsing a second satellite IP having a communication relationship with the first satellite IP from the first DNS traffic; obtaining a second DNS traffic related to the second satellite IP, and using the first DNS traffic and the second DNS traffic as the DNS traffic related to the target satellite link; the satellite IP is an IP allocated by a satellite provider to a network node for realizing satellite communication; The feature data corresponding to the multiple dimensions are combined by using preset feature combination rules, including: obtaining multiple specific arithmetic rules and multiple specific logical rules in the preset feature combination rules; the specific arithmetic rules are defined based on the correlation between the multiple dimensions, and are used to form new dimensional features that can reflect system behavior through calculation; the specific logical rules are defined based on security policies, and are used to form new dimensional features that can reflect high-risk states; based on the feature data corresponding to the multiple dimensions, the multiple specific arithmetic rules and the multiple specific logical rules are used to generate cross-feature data of multiple arithmetic dimensions and cross-feature data of multiple logical dimensions respectively; based on the multiple arithmetic dimensions and the multiple logical dimensions, determine the dimension combinations that can be formed, and for each dimension combination, form a data set with the cross-feature data corresponding to the dimension combination; the dimension combination includes arithmetic dimensions and / or logical dimensions.

2. The method according to claim 1, characterized in that The extraction is performed for each relevant satellite IP respectively, so as to obtain feature data corresponding to multiple dimensions respectively for each relevant satellite IP; the relevant satellite IPs include a first satellite IP and a second satellite IP; Each data set undergoes intra-group feature transformation as follows: For each relevant satellite IP in the data set, the feature data corresponding to multiple dimensions are standardized according to the same standardization processing method to obtain the standardized data of each relevant satellite IP in multiple dimensions; For any two dimensions of the multiple dimensions, the following steps are performed: using the standardized data of each relevant satellite IP in a first dimension of the two dimensions and the standardized data of each relevant satellite IP in a second dimension of the two dimensions, calculating the covariance between the two dimensions; The covariance between any two dimensions in multiple dimensions is formed into a covariance matrix; According to the correlation between the covariance matrix and the eigenvectors and eigenvalues, a plurality of eigenpairs are calculated; Each feature pair includes an eigenvector and an eigenvalue; The eigenvectors corresponding to the set number of maximum eigenvalues ​​are selected, and the conversion data of the data set is generated based on the selected set number of eigenvectors.

3. The method according to claim 2, characterized in that The standardization of the feature data corresponding to the multiple dimensions includes: For each dimension, the following steps are performed: determine whether the characteristic data corresponding to each relevant satellite IP on the dimension is a quantized value; if not, quantize the characteristic data; calculate the mean and standard deviation of multiple relevant satellite IPs based on the characteristic data of each relevant satellite IP on the dimension; use the calculated mean and standard deviation to calculate the Z score on the dimension for each relevant satellite IP, and use the Z score as the standardized data.

4. The method according to claim 2, characterized in that: The set number is less than the total number of dimensions in the corresponding data set; The step of generating the conversion data of the data set based on the selected set number of feature vectors includes: The selected set number of feature vectors form a feature matrix of the data set; For each relevant satellite IP, the following steps are performed: a standard data matrix formed by the standardized data of the relevant satellite IP in each dimension in the data set; and the standard data matrix is ​​multiplied by the characteristic matrix of the data set to convert and obtain new data of the relevant satellite IP in each dimension. The new data of each relevant satellite IP in each dimension is used as the transformation data of the data set.

5. An attack detection device based on multi-dimensional coupling, characterized in that: Used to detect whether a target satellite link between a target network node and a satellite network is attacked, the device comprises: An acquisition unit, configured to acquire Domain Name System (DNS) traffic associated with the target satellite link; An extraction unit, configured to extract feature data corresponding to multiple dimensions based on the DNS traffic; A combining unit, configured to combine the feature data respectively corresponding to the multiple dimensions using a preset feature combination rule to obtain multiple data sets; each data set includes feature data formed by combining several dimensions; A conversion unit, used to perform intra-group feature conversion on feature data formed by combining several dimensions in each data set to obtain conversion data of each data set; A detection unit, configured to input the converted data of each data set into a pre-trained attack detection model, so as to output an attack detection result according to the attack detection model; The acquisition unit is specifically used to: acquire a first DNS flow related to a first satellite IP of the target network node based on the first satellite IP; parse a second satellite IP having a communication relationship with the first satellite IP from the first DNS flow; acquire a second DNS flow related to the second satellite IP, and use the first DNS flow and the second DNS flow as DNS flows related to the target satellite link; the satellite IP is an IP allocated by a satellite provider to a network node for realizing satellite communication; The combination unit is specifically used to: obtain multiple specific arithmetic rules and multiple specific logical rules in the preset feature combination rules; the specific arithmetic rules are defined based on the correlation between multiple dimensions, and are used to form new dimensional features that can reflect system behavior through calculation; the specific logical rules are defined based on security policies, and are used to form new dimensional features that can reflect high-risk states; based on the feature data corresponding to the multiple dimensions, using the multiple specific arithmetic rules and the multiple specific logical rules, respectively generate cross-feature data of multiple arithmetic dimensions and cross-feature data of multiple logical dimensions; based on the multiple arithmetic dimensions and the multiple logical dimensions, determine the dimension combinations that can be formed, and for each dimension combination, form a data set with the cross-feature data corresponding to the dimension combination; the dimension combination includes arithmetic dimensions and / or logical dimensions.

6. The device according to claim 5, characterized in that The extraction is performed for each relevant satellite IP respectively, so as to obtain feature data corresponding to multiple dimensions respectively for each relevant satellite IP; the relevant satellite IPs include a first satellite IP and a second satellite IP; Each data set undergoes intra-group feature transformation as follows: For each relevant satellite IP in the data set, the feature data corresponding to multiple dimensions are standardized according to the same standardization processing method to obtain the standardized data of each relevant satellite IP in multiple dimensions; For any two dimensions of the multiple dimensions, the following steps are performed: using the standardized data of each relevant satellite IP in a first dimension of the two dimensions and the standardized data of each relevant satellite IP in a second dimension of the two dimensions, calculating the covariance between the two dimensions; The covariance between any two dimensions in multiple dimensions is formed into a covariance matrix; According to the correlation between the covariance matrix and the eigenvectors and eigenvalues, a plurality of eigenpairs are calculated; Each feature pair includes an eigenvector and an eigenvalue; The eigenvectors corresponding to the set number of maximum eigenvalues ​​are selected, and the conversion data of the data set is generated based on the selected set number of eigenvectors.

7. The device according to claim 6, characterized in that When the conversion unit performs standardization processing on the feature data corresponding to multiple dimensions respectively, the conversion unit specifically includes: for each dimension, the following steps are performed: determining whether the feature data corresponding to each relevant satellite IP on the dimension is a quantized value, and if not, quantizing the feature data; based on the feature data of each relevant satellite IP on the dimension, calculating the mean and standard deviation of multiple relevant satellite IPs; using the calculated mean and standard deviation, calculating the Z score on the dimension for each relevant satellite IP, and using the Z score as the standardized data.

8. The device according to claim 6, characterized in that The set number is less than the total number of dimensions in the corresponding data set; The conversion unit, when generating the conversion data of the data set based on the selected set number of feature vectors, specifically includes: The selected set number of feature vectors form a feature matrix of the data set; For each relevant satellite IP, the following steps are performed: a standard data matrix formed by the standardized data of the relevant satellite IP in each dimension in the data set; and the standard data matrix is ​​multiplied by the characteristic matrix of the data set to convert and obtain new data of the relevant satellite IP in each dimension. The new data of each relevant satellite IP in each dimension is used as the transformation data of the data set.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of any one of the methods described in claims 1-4.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 4 are implemented.

11. A computer program product, characterized in that The method comprises a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images