A method and device for detecting abnormal behavior of encrypted traffic network

Abstract

The present application discloses a method and device for detecting abnormal behavior of an encrypted traffic network, which belongs to the field of video surveillance technology. The method includes: collecting encrypted traffic data; extracting multi-dimensional features from the collected encrypted traffic data, and integrating the multi-dimensional features into data in JSON format; constructing a multi-fingerprint model of the encrypted traffic data based on different features in the JSON format data, and dynamically calculating the multi-fingerprint model to obtain known abnormal behavior data; constructing a graph attention network based on the known abnormal behavior data, optimizing the attention weight of the graph attention network based on reinforcement learning, and obtaining a trained graph neural network model; inputting the encrypted traffic data to be predicted into the trained graph neural network model to obtain abnormal behavior recognition results. This solution can improve the detection accuracy and detection range of abnormal traffic and reduce the false alarm rate.

Description

Technical Field

[0001] The present invention relates to the field of video surveillance technology, and in particular to a method, device, computing equipment and storage medium for detecting abnormal behavior in an encrypted traffic network. Background Art

[0002] As a core component of security systems, video surveillance equipment has been widely used in urban transportation, public places, commercial areas, etc. With the advancement of encryption technology and the improvement of user privacy awareness, in the field of video surveillance, network traffic usually uses https for encrypted communication. Traditional abnormal behavior detection methods based on non-encrypted traffic networks, port analysis and traffic packet header analysis are gradually becoming ineffective, and identifying potential threats and abnormal behaviors has become increasingly complex.

[0003] At present, the abnormal behavior detection methods for encrypted traffic networks mainly include: methods based on statistical features, methods based on behavior analysis, methods based on machine learning, methods based on encryption protocol analysis, etc. For example, the Chinese patent document with publication number CN113765846A discloses "a method, device and electronic device for intelligent detection and response of abnormal network behavior". The method includes: collecting mirror traffic at the session layer through a switch, and extracting traffic features from the mirror traffic; training verification rules based on traffic features, wherein the verification rules include internal and external network verification rules, survival host verification rules, existing network service verification rules and existing operating system network fingerprint generation rules; marking each network request according to the verification rules to form a request log; making a basic response to each network request according to the request log. The accuracy of the detection of this scheme depends on pre-defined rules, and it is easy to have false positives or false negatives in complex network environments. The Chinese patent document with publication number CN115314268A discloses a "malicious encrypted traffic detection method and system based on traffic fingerprint and behavior". The method includes: receiving the data stream sent by the collection terminal; extracting the encryption suite and digital certificate from the message payload part, and generating a traffic fingerprint vector together with the identifier, the encryption suite and the digital certificate; decrypting the data stream according to the encryption suite, sampling the data stream according to the continuity of the time domain, and obtaining a discrete data stream after dimensionality reduction; by calling the syntactic model and the semantic analysis model, the data stream is segmented and redundantly filtered, and the feature extraction is automated; through the convolutional neural network and random forest classification, it is judged whether the data stream sent by the collection terminal includes an attack vector according to the classification result. This scheme relies heavily on the ability to decrypt the data stream. If the encryption protocol or key management mechanism changes, or a strong encryption algorithm is used, the decryption process may become infeasible or inaccurate. The model training data cannot cover all possible attack vectors and encrypted traffic types, and the generalization ability of the model may be limited. The Chinese patent document with publication number CN109495513A discloses "unsupervised encrypted malicious traffic detection method, device, equipment and medium", which includes: based on the data feature set required for network traffic collection; using the collected data feature set to establish a bipartite graph between the client and the server; performing initial clustering of the client and server nodes through the graph segmentation method; vectorizing the client and server nodes of the larger connected subgraph in the initial clustering; clustering the vectorized data again using the DBSCAN algorithm; and determining malicious traffic and nodes using the clustering results after the re-clustering. This method relies on the analysis of the feature set based on the network traffic. If the feature selection is inaccurate, or the selected features cannot effectively distinguish between normal traffic and malicious traffic, the accuracy of the clustering results will be seriously affected.

[0004] Therefore, encrypted traffic anomaly detection faces many challenges, including reduced traffic visibility, increased difficulty in feature extraction, high false alarm rate, low detection rate, protocol evolution, privacy protection, and attack countermeasure technology. Summary of the invention

[0005] Based on the problems existing in the prior art, this solution proposes a method, device, computing equipment and storage medium for abnormal behavior detection in encrypted traffic networks. Different detection technologies are used for known types of abnormal behaviors and unknown types of abnormal behaviors, and different feature fingerprint models are constructed according to different traffic characteristics. By introducing an adaptive density estimation method and a balanced KD tree-based method into the traditional clustering algorithm, the dependence of the traditional method on the accuracy of appropriate thresholds and rules can be overcome; by dynamically calculating the coefficients of multiple fingerprint models, the problems of insufficient generalization ability and difficulty in distinguishing calculations in different regions and at different times are overcome; based on reinforcement learning, the attention weights of the graph attention neural network are optimized, which overcomes the problems of single attention weight and low correlation between node relationships, and can improve the efficiency and accuracy of abnormal behavior identification in encrypted traffic networks.

[0006] According to a first aspect of the present invention, there is provided a method for detecting abnormal behavior of an encrypted traffic network, comprising: collecting encrypted traffic data; performing multi-dimensional feature extraction on the collected encrypted traffic data, and integrating the multi-dimensional features into data in JSON format; constructing a multi-fingerprint model of the encrypted traffic data based on different features in the JSON format data, and dynamically calculating the multi-fingerprint model to obtain abnormal behavior data of known types; constructing a graph attention network based on the abnormal behavior data of known types, and optimizing the attention weights of the graph attention network based on reinforcement learning to obtain a trained graph neural network model; inputting the encrypted traffic data to be predicted into the trained graph neural network model to obtain abnormal behavior recognition results.

[0007] By adopting the above technical solution, multiple features are constructed separately, and a multi-fingerprint model is constructed based on traffic features. The coefficients of the constructed multi-fingerprint model can be dynamically adjusted according to different traffic features to reduce false positives or negatives in complex network environments. In the graph attention network model, reinforcement learning is used to optimize the attention weights. Combined with the policy network and policy gradient method, the attention mechanism can be continuously adjusted during the training process until the model converges. Based on the characteristics of the graph and the associated information, the prediction of unknown abnormal traffic is realized.

[0008] Optionally, in the abnormal behavior detection method for an encrypted traffic network provided by the present invention, the traffic of the video surveillance device is mirrored to a designated monitoring port through port mirroring of a switch, and the original traffic data of the monitoring port is captured based on a network traffic analysis tool; the captured original traffic data is preliminarily filtered, and different types of traffic data are identified based on the traffic protocol; and encrypted traffic data is extracted based on the port number, traffic pattern and data packet content in different types of traffic data.

[0009] By adopting the above technical solutions, port mirroring can capture traffic data without interfering with the normal operation of the network, ensuring the concealment of monitoring and the stability of the network. By analyzing the port number, traffic pattern and data packet content, encrypted traffic data can be effectively extracted, facilitating in-depth analysis of specific traffic.

[0010] Optionally, in the abnormal behavior detection method for an encrypted traffic network provided by the present invention, statistical features, protocol features, time features and frequency features of the encrypted traffic data are extracted through the nDPI deep packet inspection module, the statistical features include quintuples and packet lengths, the protocol features include protocol type and header length, the time features include lifetime and timestamp, and the frequency features include confirmation number and connection frequency; with the destination IP address as the key value, the extracted statistical features, protocol features, time features and frequency features are integrated into data in JSON format.

[0011] By adopting the above technical solutions, we can comprehensively capture the multi-faceted information of traffic by extracting statistical features, protocol features, time features, and frequency features. This integration of multi-dimensional features helps to better understand traffic patterns and improve the accuracy of abnormal behavior detection.

[0012] Optionally, in the abnormal behavior detection method for an encrypted traffic network provided by the present invention, data in JSON format is standardized to obtain standardized traffic data; the standardized traffic data is feature classified based on the DBSCAN clustering algorithm based on adaptive density estimation to obtain fingerprint models of multiple traffic features; the fingerprint models of the constructed multiple traffic features are dynamically calculated to obtain abnormal behavior data.

[0013] By adopting the above technical solution, by introducing an adaptive density estimation method and a balanced KD tree-based method into the traditional clustering algorithm, it is possible to overcome the traditional method's reliance on the accuracy of appropriate thresholds and rules; by dynamically calculating the coefficients of the multi-fingerprint model, it is possible to overcome the problems of insufficient generalization ability and difficulty in distinguishing calculations in different regions and at different times.

[0014] Optionally, in the abnormal behavior detection method for encrypted traffic network provided by the present invention, a data set is constructed , select a certain dimension to sort the data set to obtain the sorting result, and use the median of the sorting result as the split point;

[0015] Maintain a priority queue Q, for each query point in the data set, recursively traverse the KD tree, record the current nearest neighbor distance , is the distance to the currently known nearest neighbor, is the minimum distance in the priority queue Q. When traversing to a subtree, calculate the split plane distance of the subtree , if the splitting plane distance of the current subtree is Less than , then the subtree is explored first and its information is added to the priority queue Q, otherwise the subtree is skipped directly;

[0016] The density of each data point is estimated by the following formula: ,

[0017] Where n is the number of data points in the dataset X, , K() is the kernel function, is bandwidth;

[0018] The bandwidth is adjusted based on the density estimate. The bandwidth is calculated using the following formula: , is the global initial bandwidth, is the preliminary density estimate of the data points, g is the geometric mean of all preliminary density estimates, is a tuning parameter.

[0019] Optionally, in the abnormal behavior detection method for an encrypted traffic network provided by the present invention, the fingerprint models of multiple traffic features are dynamically calculated by the following formula to obtain a dynamic calculation result Y:

[0020] , is the fingerprint model corresponding to different traffic characteristics, The dynamic coefficient changes with time. The dynamic coefficient calculation formula is: , , , , , where A is the amplitude of the fluctuation, n is the baseline value, At different time points;

[0021] Based on the dynamic calculation results, the communication relationship between IPs and the commonly accessed resources, request frequency, packet size, and response time, the known types of abnormal behavior data are obtained.

[0022] Optionally, in the abnormal behavior detection method for an encrypted traffic network provided by the present invention, edges are constructed according to the communication relationship between IPs and the commonly accessed resources, and the weights of the edges are determined based on the request frequency, data packet size, and response time to construct a graph attention network; the attention weight of each node i to its neighbor node j in the graph attention network is calculated by the following formula: , where W is the linear transformation matrix, a is the learned attention parameter, and is the feature vector of nodes i and j, || represents the vector connection operation, is the activation function;

[0023] The attention weights are normalized: , where N(i) represents the set of neighbor nodes of node i;

[0024] The new feature of node i is calculated by the following formula: ,in: is the new feature of node i, σ is Activation function, W is the linear transformation matrix, is the attention weight of node i and its neighbor node j, N ( i ) is the set of neighbor nodes of node i;

[0025] Randomly initialize the policy network parameters , define a reward function R based on the prediction accuracy, maximize the cumulative reward R, use the REINFORCE algorithm to optimize the policy network parameters, and calculate the loss function , update the policy network parameters through back propagation : , is the learning rate, and the above steps are repeated until the model converges to obtain a trained graph neural network model.

[0026] Through the above technical solution, the method of optimizing attention weight based on reinforcement learning, by combining the policy network and the policy gradient method, can continuously adjust the attention mechanism during the training process, so that the network can better adapt to the needs of downstream tasks.

[0027] According to a second aspect of the present invention, there is provided an abnormal behavior detection device for an encrypted traffic network, comprising: a data acquisition module, a feature extraction module, a fingerprint model construction module, a graph neural network construction module and a prediction module.

[0028] Among them, the data collection module is used to collect encrypted traffic data; the feature extraction module is used to extract multi-dimensional features from the collected encrypted traffic data and integrate the multi-dimensional features into data in JSON format; the fingerprint model construction module is used to construct a multi-fingerprint model of encrypted traffic data based on different features in the JSON format data, and dynamically calculate the multi-fingerprint model to obtain known types of abnormal behavior data; the graph neural network construction module is used to construct a graph attention network based on known types of abnormal behavior data, and optimize the attention weights of the graph attention network based on reinforcement learning to obtain a trained graph neural network model; the prediction module is used to input the encrypted traffic data to be predicted into the trained graph neural network model to obtain abnormal behavior recognition results.

[0029] According to a third aspect of the present invention, there is provided a computing device comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be suitable for execution by at least one processor, and the program instructions include instructions for executing the above-mentioned method for detecting abnormal behavior in an encrypted traffic network.

[0030] According to a fourth aspect of the present invention, a readable storage medium storing program instructions is provided. When the program instructions are read and executed by a computing device, the computing device executes the above-mentioned abnormal behavior detection method for an encrypted traffic network.

[0031] In summary, the abnormal behavior detection method and device for an encrypted traffic network provided by the present invention can at least achieve the following technical effects:

[0032] 1. Construct different feature fingerprint models according to different features. By introducing adaptive density estimation method and balanced KD tree-based method into traditional clustering algorithm, the dependence of traditional method on the accuracy of appropriate threshold and rules can be overcome. By dynamically calculating the coefficients of multiple fingerprint models, the problem of insufficient generalization ability and difficulty in distinguishing calculations in different regions and at different times can be overcome, and the recognition of known types of abnormal behaviors can be realized.

[0033] 2. Based on reinforcement learning, the attention weight of the graph attention neural network is optimized, which overcomes the problems of single attention weight and low correlation of node relationships, and can improve the efficiency and accuracy of abnormal behavior identification in encrypted traffic networks;

[0034] 3. Build a graph of traffic behavior and other information to identify abnormal behavior. Perform forward reasoning based on the constructed graph and infer whether the traffic is abnormal based on the association to be predicted. This enables the prediction of unknown abnormal traffic in network security fields such as video surveillance.

[0035] 4. Different detection technologies are used for known types of abnormal behaviors and unknown types of abnormal behaviors. Under the dual detection technology, the abnormal traffic detection accuracy is higher, the false alarm rate is lower, and the detection range is wider.

[0036] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A block diagram of a computing device 100 according to an embodiment of the present invention is shown;

[0038] Figure 2 A schematic flow chart of an abnormal behavior detection method 200 for an encrypted traffic network according to an embodiment of the present invention is shown;

[0039] Figure 3 A schematic structural diagram of an abnormal behavior detection device 300 for an encrypted traffic network according to an embodiment of a wardrobe of the present invention is shown. DETAILED DESCRIPTION

[0040] Taking into account the different proportions and importance of different traffic features in the identification of abnormal behavior of encrypted traffic, this solution constructs multiple traffic features separately, and based on the different characteristics of different abnormal behaviors, adopts a multi-fingerprint model to achieve accurate identification of abnormal behavior of encrypted traffic, without the need to decrypt traffic data or set thresholds; by introducing adaptive density estimation, an improved clustering algorithm based on KD tree and dynamically calculating the coefficients of the multi-fingerprint model, the problems of rule dependence, insufficient generalization ability and low accuracy in identifying abnormal behavior of encrypted traffic in the traditional DBSCAN clustering algorithm are solved; by optimizing the attention weights of the graph neural network model through reinforcement learning, the attention mechanism can be continuously adjusted during the training process, which solves the problems of low efficiency and accuracy in identifying abnormal behavior of encrypted traffic in the traditional graph neural network algorithm.

[0041] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0042] Figure 1 FIG. 1 is a schematic diagram showing the structure of a computing device 100 according to an embodiment of the present invention. Figure 1As shown, in a basic configuration 102, computing device 100 includes system memory 106 and one or more processors 104. A memory bus 108 may be used for communication between processor 104 and system memory 106.

[0043] The processor 104 may be any type of processor, including but not limited to a microprocessor (µP), a microcontroller (µC), a digital signal processor (DSP), or any combination thereof. The processor 104 may include one or more levels of cache, such as a level 1 cache 110 and a level 2 cache 112, a processor core 114, and registers 116. An example processor core 114 may include an arithmetic logic unit (ALU), a floating point unit (FPU), a digital signal processing core (DSP core), or any combination thereof. An example memory controller 118 may be used with the processor 104, or in some implementations, the memory controller 118 may be an internal part of the processor 104.

[0044] The system memory 106 may be any type of memory, including but not limited to: volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.) or any combination thereof. The physical memory in the computing device generally refers to the volatile memory RAM, and the data in the disk needs to be loaded into the physical memory before it can be read by the processor 104. The system memory 106 may include an operating system 120, one or more applications 122, and program data 124. In some embodiments, the application 122 may be arranged to execute instructions on the operating system by one or more processors 104 using the program data 124. The operating system 120 may be, for example, Linux, Windows, etc., which includes program instructions for processing basic system services and performing hardware-dependent tasks. The application 122 includes program instructions for implementing various user-desired functions, and the application 122 may be, for example, a browser, instant messaging software, a software development tool (such as an integrated development environment IDE, a compiler, etc.), etc., but is not limited thereto. When the application 122 is installed in the computing device 100, a driver module may be added to the operating system 120.

[0045] When the computing device 100 starts running, the processor 104 reads and executes the program instructions of the operating system 120 from the memory 106. The application 122 runs on the operating system 120 and uses the interfaces provided by the operating system 120 and the underlying hardware to implement various functions desired by the user. When the user starts the application 122, the application 122 is loaded into the memory 106, and the processor 104 reads and executes the program instructions of the application 122 from the memory 106.

[0046] Computing device 100 also includes a storage device 132 including a removable storage 136 and a non-removable storage 138 , both of which are connected to storage interface bus 134 .

[0047] The computing device 100 may also include an interface bus 140 that facilitates communication from various interface devices (e.g., output devices 142, peripheral interfaces 144, and communication devices 146) to the basic configuration 102 via the bus / interface controller 130. Example output devices 142 include a graphics processing unit 148 and an audio processing unit 150. They can be configured to facilitate communication with various external devices such as a display or speakers via one or more A / V ports 152. Example peripheral interfaces 144 may include a serial interface controller 154 and a parallel interface controller 156, which may be configured to facilitate communication with external devices such as input devices (e.g., keyboards, mice, pens, voice input devices, touch input devices) or other peripherals (e.g., printers, scanners, etc.) via one or more I / O ports 158. Example communication devices 146 may include a network controller 160, which may be arranged to facilitate communication with one or more other computing devices 162 via a network communication link via one or more communication ports 164.

[0048] A network communication link may be an example of a communication medium. Communication media may generally be embodied as computer-readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium. A "modulated data signal" may be a signal in which one or more of its data sets or its changes may be performed in a manner that encodes information in the signal. As non-limiting examples, communication media may include wired media such as a wired network or a dedicated network, and various wireless media such as sound, radio frequency (RF), microwave, infrared (IR) or other wireless media. The term computer-readable media used herein may include both storage media and communication media. In a computing device 100 according to the present invention, an application 122 includes instructions for executing the abnormal behavior detection method 200 for an encrypted traffic network of the present invention.

[0049] Figure 2 FIG. 2 is a flow chart showing a method 200 for detecting abnormal behavior in an encrypted traffic network according to an embodiment of the present invention. Figure 2 As shown, in step S210, encrypted traffic data is collected.

[0050] Port mirroring can be set up on a network switch. Through port mirroring, network administrators can monitor network traffic, troubleshoot problems, or analyze network performance without interfering with the original data stream. Through the switch's port mirroring, the traffic of the video surveillance device is mirrored to the specified monitoring port, and the original traffic data of the monitoring port is captured based on network traffic analysis tools (such as Wireshark, tcpdump, etc.). These tools can record all data packets passing through the switch.

[0051] Perform preliminary filtering on the captured raw traffic data and identify different types of traffic data based on the traffic protocol. Preliminary filtering can exclude unnecessary traffic such as broadcast traffic and irrelevant control traffic. By analyzing the traffic protocol, different types of traffic data such as HTTP, RTSP, RTMP, FTP, etc. can be identified. Extract encrypted traffic data based on the port number, traffic pattern, and packet content in different types of traffic data. For example, common encryption protocols such as HTTPS usually use port 443, and the packet content usually contains TLS handshakes. Store the extracted encrypted traffic data in a scalable storage system and add corresponding tags to facilitate subsequent processing and analysis.

[0052] Then in step S220, multi-dimensional features are extracted from the collected encrypted traffic data, and the multi-dimensional features are integrated into data in JSON format.

[0053] Specifically, the statistical features, protocol features, time features and frequency features of encrypted traffic data can be extracted through the nDPI deep packet inspection module.

[0054] Among them, statistical features include quintuples (including source IP address, destination IP address, source port, destination port and protocol type) and packet length. The packet length is the length of each data packet, which is used to analyze the size distribution of traffic. Protocol features include protocol type (such as HTTPS, SSH, VPN, etc.) and header length. The header length affects the processing efficiency and network load of the data packet. Time features include time to live (TTL) and timestamp. The data packet’s time to live can be used to analyze network topology and latency. The timestamp is the sending and receiving time of each data packet, which is used to identify traffic patterns and abnormal behaviors. Frequency features include confirmation number and connection frequency. The confirmation number in the TCP protocol helps monitor the connection status and the reliability of data transmission. The number of connections to a specific destination IP address within a certain period of time helps identify abnormal behaviors.

[0055] After completing the multi-dimensional feature extraction, the extracted statistical features, protocol features, time features, and frequency features are integrated into JSON format using the destination IP address as the key value. The JSON data can be stored in a NoSQL database (such as MongoDB) for subsequent query and analysis.

[0056] Then in step S230, based on different features in the data in JSON format, a multi-fingerprint model of the encrypted traffic data is constructed, and the multi-fingerprint model is dynamically calculated to obtain abnormal behavior data of known types.

[0057] Since different traffic features have different proportions and importance in identifying abnormal behaviors of encrypted traffic, the differences of these features must be fully considered. This solution conducts in-depth analysis of multiple traffic features, and based on the differences in the features of different abnormal behaviors, adopts a multi-fingerprint model to accurately identify abnormal behaviors of encrypted traffic, analyzes encrypted traffic from multiple dimensions, and thus improves the accuracy of abnormal behavior detection.

[0058] First, the integrated JSON format traffic data is standardized. The standardization formula is: , Z is the standardized data point, X is the original data point, μ is the mean of the original data, and σ is the standard deviation of the original data.

[0059] Since the method of using a large model to identify abnormal behavior by building multiple features into a large model has a high misjudgment rate, this solution builds a multi-fingerprint model based on multiple different features in the standardized traffic data. That is, by separately building multi-dimensional features, using clustering algorithms (such as K-means, DBSCAN) to classify the features, find similar traffic patterns and mark them as "fingerprints", and integrate different IP addresses into independent data streams.

[0060] Due to the particularity of traffic data, that is, different density distributions in different areas and at different times, for example, the difference between dense and sparse networks of video equipment, and the difference between peak and trough traffic. According to an embodiment of the present invention, the standardized traffic data can be feature classified based on the DBSCAN clustering algorithm of adaptive density estimation to obtain fingerprint models of multiple traffic features.

[0061] The main idea of ​​the DBSCAN algorithm is to determine clusters by examining the density of data points. It implements clustering through two main parameters: (epsilon) and MinPts (minimum number of points). -Neighborhood: For a point p, its -neighborhood is defined as the set of all points whose distance is less than or equal to p, denoted as: . Where D is the dataset, dist(p,q) is the distance between points p and q. Core Point: If the neighborhood of point p contains at least MinPts points, that is: |N(p)|≥MinPts. Then p is a core point.

[0062] When facing large-scale data sets, the traditional DBSCAN algorithm needs to repeatedly calculate the distance between points, resulting in huge computational complexity and long running time. This solution uses a balanced KD tree to ensure that the height of the subtree remains balanced after each split. The balanced KD tree combined with the nearest neighbor search technology optimized by the priority queue can significantly reduce the search time and computing resource consumption when processing large-scale data sets.

[0063] Specifically, for a set P containing n points, select a dimension d to sort , the split point is chosen as the median: , ensuring that the number of points in the left and right subtrees is as equal as possible, thus maintaining the balance of the tree. This balancing strategy avoids the tree imbalance problem caused by uneven data distribution in the traditional KD tree in high-dimensional space, thereby improving the search efficiency.

[0064] Maintain a priority queue Q to store the subtree information to be explored. For each query point, recursively traverse the KD tree and record the current nearest neighbor distance , is the distance to the currently known nearest neighbor, is the minimum distance in the priority queue Q. When traversing to a subtree, calculate the split plane distance of the subtree If the splitting plane distance of the current subtree is Less than , indicating that the subtree may contain closer neighbor points, then the subtree is explored first and its information is added to the priority queue Q. Otherwise, the subtree is skipped directly to avoid unnecessary node access and reduce the number of distance calculations. In this way, the priority queue Q always stores the subtree information that is most likely to contain closer neighbor points, thereby optimizing the search path, greatly reducing the number of distance calculations, and further improving the search efficiency.

[0065] At the same time, the traditional DBSCAN algorithm uses a unified parameter for density estimation, which makes it difficult to perform separate calculations for different regions and different times, resulting in low recognition accuracy and high misjudgment rate. To this end, this solution introduces an adaptive density estimation method. Adaptive density estimation is a method that dynamically adjusts bandwidth parameters in kernel density estimation (KDE), which can more accurately reflect the local characteristics of the data, allowing the DBSCAN clustering algorithm to adjust according to the local density of the area where the data point is located.

[0066] For the constructed dataset , , the density estimation formula of the kernel density estimation (KDE) at each data point is: , where n is the number of data points, K() is the kernel function. Commonly used kernel functions include Gaussian kernel function, Epanechnikov kernel function, etc.

[0067] Each data point The bandwidth is dynamically adjusted according to the local density of the point. , is the global initial bandwidth, is the preliminary density estimate of the point, g is the geometric mean of all preliminary density estimates, is a tuning parameter, usually set to 0.5 (when =0.5, it is called the square root method, which can better balance the estimation effects of high-density and low-density areas and avoid overfitting or underfitting problems). The global initial bandwidth is usually determined by the fixed-bandwidth density estimation method, and the initial density estimate is usually obtained by fixed-bandwidth kernel density estimation.

[0068] This solution uses bandwidth Adaptive adjustment is performed. In areas with high local density, the bandwidth is relatively small, and the kernel function can capture local details more finely. In areas with low density, the bandwidth is relatively large, and the kernel function can more effectively estimate the density of sparse areas. Through adaptive density estimation, the clustering algorithm can more accurately reflect the local characteristics of the data, especially when dealing with data sets with complex structures and uneven distributions, it can provide more accurate probability density function estimates. By introducing adaptive density parameters to adapt to different traffic density environments and flexibly adjusting the clustering criteria according to changes in real-time traffic, the impact of region and time on recognition results can be reduced.

[0069] For different features of encrypted traffic, such as packet length, lifetime, protocol type, header length, confirmation number, etc., this solution regards different features as fingerprints of encrypted traffic. Since most of the collected data is normal traffic data, these normal traffic data can be used to train the model. Through the above model training, fingerprint models of multiple traffic features are formed. This method ensures that the model can understand the characteristics of normal traffic, so as to better identify abnormal behavior.

[0070] Because different traffic characteristics have different effects on the identification of abnormal behavior of encrypted traffic, the present invention dynamically calculates the constructed multi-fingerprint model and integrates the output results of multiple fingerprints to detect encrypted traffic in the video surveillance field.

[0071] Specifically, the influence of each feature is taken into account through a dynamic calculation formula to form abnormal behavior data Y:

[0072] ,

[0073] is the fingerprint model corresponding to different traffic characteristics, is the dynamic coefficient, which changes with time, making the coefficient larger during peak periods and lower during off-peak periods. The dynamic coefficient calculation formula is: , , , , ,in, They are different time points respectively, A is the amplitude of fluctuation, which determines the maximum value of the coefficient during the peak period, and n is the baseline value, which determines the minimum value of the coefficient.

[0074] Through the multi-fingerprint model constructed above, combined with the dynamic calculation mechanism, it is possible to effectively identify known types of abnormal behaviors and obtain abnormal behavior data, which is of great significance for network security monitoring, traffic analysis and malicious behavior identification.

[0075] Then in step S240, a graph attention network is constructed based on known types of abnormal behavior data, and the attention weights of the graph attention network are optimized based on reinforcement learning to obtain a trained graph neural network model.

[0076] Among them, the known types of abnormal behavior data obtained by dynamically calculating the multi-fingerprint model include IP addresses, abnormal behavior calculation results (dynamic calculation results of the multi-fingerprint model), request frequency, corresponding status (such as request success or failure), etc. Each IP address represents a node. The node feature vector can be composed of IP-related behavior data, device information and other features.

[0077] The edges are constructed based on the communication relationship between IPs, the commonly accessed resources and other information. The weight of the edge is determined based on the communication frequency, data packet size, response time and other information. Thus, an undirected graph can be constructed. , where V is a node set, representing all IP addresses, and E is an edge set, representing the relationship between IP addresses. In the construction of the graph, all IP addresses form a node set, and the connection relationships formed by information such as communication frequency and packet size constitute edges. This graph structure is very suitable for deep learning using graph neural networks.

[0078] Graph Attention Network (GAT) introduces a self-attention mechanism that allows the model to adaptively adjust weights based on the importance of neighbor nodes without the need for a predefined graph structure. This overcomes the limitation of traditional graph neural networks in processing neighbor nodes, that is, treating all neighbor nodes equally. At the same time, through the multi-head attention mechanism, GAT can learn graph information from multiple subspaces in parallel. This method can effectively reduce the instability that may be caused by a single attention mechanism and improve the robustness and expressiveness of the model.

[0079] The attention weight of each node i to its neighbor node j is:

[0080] , where W is the linear transformation matrix used to transform the input features, a is the learned attention parameter, and is the feature vector of nodes i and j, || represents the vector connection operation, which concatenates the two features. is an activation function used to introduce nonlinearity.

[0081] In order to ensure that the sum of the importance of all neighboring nodes of node i is 1, the attention coefficient needs to be normalized. The normalization method uses the softmax function: , N(i) represents the set of neighbor nodes of node i. The new feature of node i is obtained by combining the features of its neighbor nodes according to the attention weights The weighted sum is transformed by a nonlinear activation function: .in: is the new feature of node i, σ is Activation function, W is the linear transformation matrix, which is used to transform the input features. is the attention weight of node i and its neighbor node j, N ( i ) is the set of neighbor nodes of node i.

[0082] Since the field of video surveillance encrypted networks has unique temporal and spatial characteristics, according to an embodiment of the present invention, attention weights can be optimized based on reinforcement learning. By combining the policy network with the policy gradient method, the attention mechanism can be continuously adjusted during the training process, so that the network can better adapt to the needs of downstream tasks.

[0083] First, randomly initialize the policy network parameters, define a reward function R based on the prediction accuracy, maximize the cumulative reward R, use the REINFORCE algorithm to optimize the policy network parameters, and calculate the loss function , update the parameters of the policy network through back propagation , is the learning rate, and the above steps are repeated until the model converges to obtain a trained graph neural network model.

[0084] Finally, in step S250, the encrypted traffic data to be predicted is input into the trained graph neural network model to obtain the abnormal behavior recognition result.

[0085] First, the predicted encrypted traffic data is processed, and the statistical features, protocol features, time features and frequency features of the encrypted traffic data can be extracted through the nDPI deep packet inspection module.

[0086] The statistical features include a five-tuple (source IP address, destination IP address, source port, destination port, and protocol type) and packet length, which is the length of each data packet and is used to analyze the size distribution of traffic.

[0087] Protocol characteristics include protocol type (such as HTTPS, SSH, VPN, etc.) and header length. The header length affects the processing efficiency of data packets and network load.

[0088] Time features include time to live (TTL) and timestamp. The time to live of a data packet can be used to analyze network topology and latency. The timestamp is the time each data packet is sent and received, which is used to identify traffic patterns and abnormal behavior.

[0089] Frequency features include acknowledgment number and connection frequency. The acknowledgment number in the TCP protocol helps monitor the connection status and data transmission reliability. The number of connections to a specific destination IP address within a certain period of time helps identify abnormal behavior.

[0090] After completing the multi-dimensional feature extraction, the extracted statistical features, protocol features, time features, and frequency features are integrated into data in JSON format using the destination IP address as the key value.

[0091] Then, the graph neural network model trained in step S240 is used for forward propagation to calculate the output representation of each node. For each node, the category with the highest prediction probability is selected as its classification result.

[0092] This solution breaks through the limitations of traditional technologies, such as the need for a large amount of data for labeling, being easily affected by normal traffic fluctuations, being difficult to apply to different users and scenarios, and being difficult to detect unknown abnormal behaviors, and realizes the identification of abnormal behaviors under encrypted traffic. The implementation of the present invention not only significantly improves the accuracy of identification, but also greatly reduces the misjudgment rate of abnormal behaviors, and reduces a large amount of manpower and material costs, which is of great significance for the identification of abnormal behaviors in encrypted traffic in the field of video surveillance.

[0093] Figure 3FIG. 3 is a schematic diagram showing the structure of an abnormal behavior detection device 300 for an encrypted traffic network according to an embodiment of the wardrobe of the present invention. Figure 3 As shown, the device 300 includes: a data acquisition module 310, a feature extraction module 320, a fingerprint model construction module 330, a graph neural network construction module 340 and a prediction module 350.

[0094] Among them, the data acquisition module 310 can collect encrypted traffic data. In one embodiment of the present invention, the data acquisition module 310 can set port mirroring on the network switch, mirror the traffic of the video surveillance device to the specified monitoring port through the port mirroring of the switch, and capture the original traffic data of the monitoring port based on the network traffic analysis tool (such as Wireshark, tcpdump, etc.). These tools can record all data packets passing through the switch. Based on the port number, traffic mode and data packet content in different types of traffic data, the encrypted traffic data is extracted.

[0095] The feature extraction module 320 can perform multi-dimensional feature extraction on the collected encrypted traffic data and integrate the multi-dimensional features into data in JSON format. For example, the statistical features, protocol features, time features, and frequency features of the encrypted traffic data are extracted through the nDPI deep packet inspection module. The extracted statistical features, protocol features, time features, and frequency features are integrated into JSON format using the destination IP address as the key value.

[0096] The fingerprint model construction module 330 can construct a multi-fingerprint model of encrypted traffic data based on different features in the data in JSON format, and dynamically calculate the multi-fingerprint model to obtain known abnormal behavior data. Specifically, the fingerprint model construction module can first standardize the data in JSON format, and then construct multiple fingerprint models for different features of the standardized data, and integrate different IPs into different data streams. In one embodiment of the present invention, the introduction of an adaptive density estimation method and a balanced KD tree-based method in the traditional clustering algorithm can overcome the dependence on the accuracy of appropriate thresholds and rules; by dynamically calculating the coefficients of the multi-fingerprint model, the problem of insufficient generalization ability and difficulty in distinguishing calculations in different regions and at different times is overcome.

[0097] The graph neural network construction module 340 can construct a graph attention network based on known abnormal behavior data, and optimize the attention weight of the graph attention network based on reinforcement learning to obtain a trained graph neural network model. The present invention adopts a graph attention network (GAT) and adaptively learns the weights of neighbor nodes of each node by introducing a self-attention mechanism. It does not require predefined graph structure information, so that GAT can more accurately extract useful features from local graph information and avoid the limitation of traditional graph neural networks that treat each neighbor node equally.

[0098] At the same time, through the multi-head attention mechanism, GAT can understand the relationship between nodes from multiple perspectives and effectively reduce the instability that may be caused by a single attention mechanism. Multi-head attention allows the model to learn graph information in multiple subspaces in parallel, thereby enhancing the robustness and expressiveness of the model. Based on the method of optimizing attention weights based on reinforcement learning, by combining the policy network with the policy gradient method, the attention mechanism can be continuously adjusted during the training process, so that the network can better adapt to the needs of downstream tasks.

[0099] The prediction module 350 can input the encrypted traffic data to be predicted into the trained graph neural network model to obtain the abnormal behavior recognition result. For the encrypted traffic data to be predicted, the feature extraction module 320 can be used to complete the multi-dimensional feature extraction of the encrypted traffic data, and then the model trained by the graph neural network construction module 340 can be used for forward propagation to calculate the output representation of each node. For each node, the category with the highest prediction probability is selected as its classification result.

[0100] In summary, the abnormal behavior detection method and device for an encrypted traffic network provided by the present invention can at least achieve the following technical effects:

[0101] 1. Construct different feature fingerprint models according to different features. By introducing adaptive density estimation method and balanced KD tree-based method into traditional clustering algorithm, the dependence of traditional method on the accuracy of appropriate threshold and rules can be overcome. By dynamically calculating the coefficients of multiple fingerprint models, the problem of insufficient generalization ability and difficulty in distinguishing calculations in different regions and at different times can be overcome, and the recognition of known types of abnormal behaviors can be realized.

[0102] 2. Based on reinforcement learning, the attention weight of the graph attention neural network is optimized, which overcomes the problems of single attention weight and low correlation of node relationships, and can improve the efficiency and accuracy of abnormal behavior identification in encrypted traffic networks;

[0103] 3. Build a graph of traffic behavior and other information to identify abnormal behavior. Perform forward reasoning based on the constructed graph and infer whether the traffic is abnormal based on the association to be predicted. This enables the prediction of unknown abnormal traffic in network security fields such as video surveillance.

[0104] 4. Different detection technologies are used for known types of abnormal behaviors and unknown types of abnormal behaviors. Under the dual detection technology, the abnormal traffic detection accuracy is higher, the false alarm rate is lower, and the detection range is wider.

[0105] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0106] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and teaching purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is illustrative and not restrictive with respect to the scope of the present invention, and the scope of the present invention is defined by the appended claims.

Claims

1. A method for detecting abnormal behavior in an encrypted traffic network, characterized in that: include: Collect encrypted traffic data; Extracting multi-dimensional features from the collected encrypted traffic data, and integrating the multi-dimensional features into data in JSON format; Based on different features in the data in the JSON format, a multi-fingerprint model of the encrypted traffic data is constructed, and the multi-fingerprint model is dynamically calculated to obtain abnormal behavior data of known types, including: Standardize the data in JSON format to obtain standardized traffic data; Based on the DBSCAN clustering algorithm of adaptive density estimation, the standardized traffic data is subjected to feature classification to obtain fingerprint models of multiple traffic features respectively; Dynamically calculate the fingerprint models of the multiple traffic features constructed to obtain abnormal behavior data of known types; Building a graph attention network based on the known types of abnormal behavior data, and optimizing the attention weights of the graph attention network based on reinforcement learning to obtain a trained graph neural network model; Inputting the encrypted traffic data to be predicted into the trained graph neural network model to obtain abnormal behavior recognition results; The step of performing feature classification on the standardized traffic data using the DBSCAN clustering algorithm based on adaptive density estimation to obtain fingerprint models of multiple traffic features includes: Building a dataset , select a certain dimension to sort the data set to obtain a sorting result, and use the median of the sorting result as a split point; Maintain a priority queue Q, for each query point in the data set, recursively traverse the KD tree, record the current nearest neighbor distance , is the distance to the currently known nearest neighbor, is the minimum distance in the priority queue Q. When traversing to a subtree, calculate the split plane distance of the subtree , if the splitting plane distance of the current subtree is Less than , then the subtree is explored first and its information is added to the priority queue Q, otherwise the subtree is skipped directly; The density of each data point is estimated by the following formula: , Where n is the number of data points in the dataset X, , K() is the kernel function, is bandwidth; The bandwidth is adjusted according to the density estimate, and the bandwidth is calculated by the following formula: , is the global initial bandwidth, is the preliminary density estimate of the data points, g is the geometric mean of all preliminary density estimates, is a tuning parameter.

2. The method for detecting abnormal behavior of an encrypted traffic network according to claim 1, characterized in that: The step of collecting encrypted traffic data includes: Mirror the traffic of the video surveillance device to the specified monitoring port through the port mirroring of the switch, and capture the original traffic data of the monitoring port based on the network traffic analysis tool; Preliminarily filtering the captured raw traffic data, and identifying different types of traffic data based on traffic protocols; Extract encrypted traffic data based on port numbers, traffic patterns, and packet content from different types of traffic data.

3. The method for detecting abnormal behavior of an encrypted traffic network according to claim 1, characterized in that: The step of extracting multi-dimensional features from the collected encrypted traffic data and integrating the multi-dimensional features into data in JSON format includes: Extract statistical features, protocol features, time features and frequency features of encrypted traffic data through the nDPI deep packet inspection module, wherein the statistical features include quintuples and packet lengths, the protocol features include protocol types and header lengths, the time features include lifetimes and timestamps, and the frequency features include confirmation numbers and connection frequencies; Using the destination IP address as the key value, the extracted statistical features, protocol features, time features, and frequency features are integrated into data in JSON format.

4. The method for detecting abnormal behavior of an encrypted traffic network according to claim 1, characterized in that: The step of dynamically calculating the fingerprint models of the plurality of traffic features to obtain abnormal behavior data of known types includes: The fingerprint model of multiple traffic features is dynamically calculated using the following formula to obtain the dynamic calculation result Y: , is the fingerprint model corresponding to different traffic characteristics, The dynamic coefficient changes with time. The dynamic coefficient calculation formula is: , , , , , where A is the amplitude of the fluctuation, n is the baseline value, At different time points; Based on the dynamic calculation results, the communication relationship between IPs and the commonly accessed resources, request frequency, data packet size, and response time, known types of abnormal behavior data are obtained.

5. The method for detecting abnormal behavior of an encrypted traffic network according to claim 4, characterized in that: The steps of constructing a graph attention network based on the known types of abnormal behavior data, optimizing the attention weights of the graph attention network based on reinforcement learning, and obtaining a trained graph neural network model include: Build edges based on the communication relationship between IPs and the commonly accessed resources, determine the edge weights based on request frequency, packet size, and response time, and build a graph attention network; The attention weight of each node i to its neighbor node j in the graph attention network is calculated by the following formula: , where W is the linear transformation matrix, a is the learned attention parameter, and is the feature vector of nodes i and j, || represents the vector connection operation, is the activation function; The attention weights are normalized: , where N(i) represents the set of neighbor nodes of node i; The new feature of node i is calculated by the following formula: ,in: is the new feature of node i, σ is Activation function, W is the linear transformation matrix, is the attention weight of node i and its neighbor node j, N ( i ) is the set of neighbor nodes of node i; Randomly initialize the policy network parameters , define a reward function R based on the prediction accuracy, maximize the cumulative reward R, use the REINFORCE algorithm to optimize the policy network parameters, and calculate the loss function , update the policy network parameters through back propagation : , is the learning rate, and the above steps are repeated until the model converges to obtain a trained graph neural network model.

6. An abnormal behavior detection device for an encrypted traffic network, characterized in that: The method for detecting abnormal behavior of an encrypted traffic network according to any one of claims 1 to 5 comprises: Data collection module, used to collect encrypted traffic data; A feature extraction module is used to extract multi-dimensional features from the collected encrypted traffic data and integrate the multi-dimensional features into data in JSON format; A fingerprint model building module, used to build a multi-fingerprint model of encrypted traffic data based on different features in the data in the JSON format, and dynamically calculate the multi-fingerprint model to obtain abnormal behavior data of known types; A graph neural network construction module, used to construct a graph attention network based on the known types of abnormal behavior data, and optimize the attention weights of the graph attention network based on reinforcement learning to obtain a trained graph neural network model; The prediction module is used to input the encrypted traffic data to be predicted into the trained graph neural network model to obtain abnormal behavior recognition results.

7. A computing device, characterized in that include: At least one processor and a memory storing program instructions, wherein the program instructions are configured to be suitable for being executed by the at least one processor, and the program instructions include instructions for executing the abnormal behavior detection method for an encrypted traffic network as described in any one of claims 1-5.

8. A readable storage medium storing program instructions, characterized in that: When the program instructions are read and executed by a computing device, the computing device executes the abnormal behavior detection method for an encrypted traffic network as described in any one of claims 1-5.

Images