Malicious encrypted traffic detection method based on multi-feature fusion

Abstract

The invention discloses a malicious encrypted traffic detection method based on multi-feature fusion, and relates to the technical field of traffic detection, and the method comprises the following implementation steps: entering a collection processing end, continuously collecting encrypted traffic generated by malicious software through multiple means, and carrying out data cleaning and labeling in real time; entering an aggregation marking end, and querying a multi-AV engine scanning result of the threat intelligence platform for each sample according to the sample; and entering a progressive identification end, filtering aggregated sample features in real time, carrying out malicious software family type identification by using a multi-classification model, comparing and verifying the detection effect of the malicious software encrypted traffic detection model in real time, and realizing differential alarm and preferential presentation. According to the malicious encrypted traffic detection method based on multi-feature fusion, the deviation existing in malicious encrypted traffic detection is reduced, the comprehensiveness of complexity description of encrypted traffic in some load network environments is increased, and the authenticity of a malicious encrypted traffic detection result is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of traffic detection, and in particular to a malicious encrypted traffic detection method based on multi-feature fusion. Background Art

[0002] Malicious encrypted traffic based on multi-feature fusion refers to a method of identifying and detecting malicious encrypted traffic by combining multiple different types of network traffic features. In the field of network security, although encryption technology protects communication security, it also provides malware with an opportunity to hide its malicious behavior. Traditional methods based on payload and deep packet inspection are no longer applicable because they cannot parse encrypted content. Therefore, researchers have proposed a malicious encrypted traffic detection method based on multi-feature fusion.

[0003] Application No. CN202410344014.9 discloses a method and system for detecting malicious encrypted traffic based on multi-view feature fusion, the method comprising: obtaining and preprocessing the network traffic data to be detected, and extracting sequence features xv from V different views. The method provided by the present invention uses deep neural network technology to comprehensively analyze network features from a multi-view perspective, and automatically performs efficient and accurate malicious traffic behavior detection.

[0004] After searching the above patents, it was found that malicious encrypted traffic based on multi-feature fusion still has some shortcomings. At present, malicious samples are difficult to collect on a large scale, and the quality of samples collected from public channels is uneven, making it difficult to clean and label data, which leads to deviations in malicious encrypted traffic detection. At the same time, the complexity of encrypted traffic in certain load network environments is not sufficiently characterized, and the characteristics of different attack behaviors of malware at different attack stages are not sufficiently considered, which cannot meet the requirements of malicious encrypted traffic detection at different attack stages and different attack behaviors, affecting the accuracy of malicious code encrypted traffic model detection. Moreover, the original data presented in the detection results of the currently used AI model is encrypted, and the features that the model detection relies on are statistical features, which are insufficiently explanatory of the detection results and difficult to obtain evidence, affecting the convenience of malicious encrypted traffic detection.

[0005] Therefore, a new malicious encrypted traffic detection method based on multi-feature fusion is proposed to solve the above problems. Summary of the invention

[0006] The main purpose of the present invention is to provide a malicious encrypted traffic detection method based on multi-feature fusion to solve the problems raised in the above background.

[0007] To achieve the above purpose, the technical solution adopted by the present invention is: a malicious encrypted traffic detection method based on multi-feature fusion, the method comprising the following implementation steps:

[0008] Step 1: Enter the collection and processing end, continuously collect the encrypted traffic generated by the malware through various means, and perform data cleaning and annotation in real time;

[0009] Step 2: Enter the aggregation and tagging end, query the multi-AV engine scanning results of the threat intelligence platform for each sample, realize aggregation, and perform real-time hierarchical identification during aggregation, and monitor and identify anomalies in real time;

[0010] Step 3: Enter the progressive identification terminal, filter the aggregated sample features in real time, use the multi-classification model to identify the malware family type, and compare and verify the detection effect of the malware encrypted traffic detection model in real time to achieve differentiated alarms and give priority presentation.

[0011] The collection and processing end in step 1 includes a flow collection module, a stage cleaning module and a stage marking module;

[0012] The flow receiving module is used to collect the flow at different times in real time through a clock and a data acquisition instrument, and obtain the flow value at the current time through multiple channels.

[0013] The stage-by-stage cleaning module includes a time-by-stage unit and a data cleaning unit;

[0014] The time-division and class-division unit is used to set the duration and class threshold to classify the collected traffic values;

[0015] The data cleaning unit is used to clean the class-differentiated traffic values. The calculation formula for data cleaning is as follows:

[0016] Standardized_data={x|x∈D,r(x)}

[0017] Where D represents the traffic set, and all traffic features in the dataset D are normalized to the class distinction threshold.

[0018] The grading standard module includes a synchronous grading unit, a color marking unit and a data deletion unit;

[0019] The synchronous grading unit is used to perform synchronous grading setting on the flow value after data cleaning, and the setting includes flow width, flow duration and flow power;

[0020] The color marking unit is used to mark the flow value with color according to the stage setting;

[0021] The data deletion unit is used to automatically delete the flow values ​​that are not marked with colors.

[0022] The aggregation marking end includes a query scanning module, an aggregation training module and a stage monitoring module;

[0023] The query scanning module includes a query threat unit and a scan aggregation unit;

[0024] The threat query unit is used to query the IP, certificate server domain name, encrypted communication JA3 / JA3S fingerprint and malicious server certificate fingerprint of malicious encrypted traffic communication, extract the common string of the tag family type and count the corresponding AV engine number, and detect the IP, certificate server domain name, encrypted communication JA3 / JA3S fingerprint and malicious server certificate fingerprint of malicious encrypted traffic communication;

[0025] The scanning aggregation unit is used to use a clustering algorithm on the training samples after multi-AV calibration, and merge the malware traffic with a similarity of more than 95% after aggregation into a new family type.

[0026] The aggregation training module includes an aggregation hierarchical unit and a hierarchical training unit;

[0027] The aggregation stage unit is used to set the aggregation flow in stages, which are set as the first stage, the second stage and the third stage;

[0028] The step-by-step training unit is used to perform step-by-step training on the flow value according to the step-by-step setting of the aggregated flow.

[0029] The staged monitoring module includes a monitoring identification unit and an identification and early warning unit;

[0030] The monitoring and identification unit is used to calculate the flow value for the correction value of the step-by-step training, the method is as follows:

[0031] S1(1): Calculate the coefficient of the first-order term of the regression equation. The formula is as follows:

[0032]

[0033] Among them, A represents the coefficient of the first-order term. This regression equation is used to express the quadratic relationship between the flow value for step-by-step training and the deviation from the step-by-step training standard data. S xy Indicates the basic value of the first-order flow value deviation from the staged training. Indicates the basic value of the first-order flow value for staged training. Indicates the base value of the second-order flow value for staged training deviation. Indicates the basic value of the second-order flow value for step-by-step training, S xx Indicates the basic value of the deviation of the flow value stage training at the current moment. Here, it indicates the deviation value of the stage training at different time points and different flow values;

[0034] S1(2): Calculate the quadratic coefficient of the regression equation. The formula is as follows:

[0035]

[0036] Among them, B represents the coefficient of the quadratic term. The constant term coefficient of the regression equation is calculated based on the coefficient of the linear term and the coefficient of the quadratic term.

[0037]

[0038] Where C represents the constant term coefficient;

[0039] S1(3): According to the coefficient of the first-order term, the coefficient of the second-order term and the coefficient of the constant term, a regression equation is established to obtain the correction value of the flow numerical classification training;

[0040] S1(4): Monitor the flow value in real time through the camera according to the correction value of the flow value stage training;

[0041] The identification and early warning unit is used to report the recognition result to the system in real time and issue a voice reminder when abnormality is detected.

[0042] The progressive recognition end includes a multi-dimensional filtering module, an abnormal classification module and a comparison and verification module;

[0043] The multi-dimensional filtering module is used to filter the aggregated sample features in real time through data filtering, and to identify the malware family type through a multi-classification model.

[0044] The abnormality classification module includes an abnormality identification unit and an abnormality classification unit;

[0045] The abnormality identification unit is used to calculate the correction value of the flow signal transmission in a step-by-step manner in real time according to the correction value calculation formula of the flow value step-by-step training, and if the calculated flow correction value is greater than 0, the flow is judged to be abnormal, and if the calculated flow correction value is less than or equal to 0, the flow is judged to be normal;

[0046] The abnormality classification unit is used to automatically classify the correction values ​​in stages according to the flow abnormality, so as to realize synchronous stage-by-stage abnormality classification.

[0047] The comparison and verification module includes a difference alarm unit, an alarm priority unit and an alarm interpretation unit;

[0048] The difference alarm unit is used to report to the system when it is determined that the flow is abnormal, and display the alarm page on the computer in real time;

[0049] The alarm priority unit is used to update the latest alarm information in real time through the page timing update technology;

[0050] The alarm interpretation unit is used to automatically retrieve the solution of the alarm information according to the alarm information, and visually display the solution of the alarm information in sequence on a computer page by arranging the serial numbers.

[0051] The present invention has the following beneficial effects:

[0052] 1. In the present invention, by setting a collection and processing end, in the malicious encrypted traffic detection method based on multi-feature fusion, encrypted traffic is collected through multiple channels, and staged cleaning and staged labeling are performed according to the data, so as to ensure the stability of large-scale traffic collection, avoid uneven sample quality, reduce the deviation of malicious encrypted traffic detection, and timely delete and crush the data of the cleaned and labeled traffic to timely cut off the malicious traffic;

[0053] 2. In the present invention, by setting an aggregation tag end, in the malicious encrypted traffic detection method based on multi-feature fusion, through multi-channel aggregation, and by implementing hierarchical training and real-time monitoring of the aggregated data, it is possible to increase the comprehensiveness of the complexity characterization of encrypted traffic under certain load network environments, and meet the malicious encrypted traffic detection of different attack behaviors at different attack stages, thereby increasing the accuracy of malicious code encrypted traffic model detection;

[0054] 3. In the present invention, by setting a progressive identification end, in the malicious encrypted traffic detection method based on multi-feature fusion, by real-time filtering of aggregated sample features and real-time comparison and verification of the detection effect of the malicious software encrypted traffic detection model, the authenticity of the malicious encrypted traffic detection results can be further enhanced, and by means of differentiated alarms and priority presentation, differentiated alarm information can be displayed in time, thereby increasing the convenience of malicious encrypted traffic detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 This is an overall flow chart of a malicious encrypted traffic detection method based on multi-feature fusion of the present invention;

[0056] Figure 2 It is a schematic diagram of the architecture of a collection and processing end of a malicious encrypted traffic detection method based on multi-feature fusion according to the present invention;

[0057] Figure 3 It is a schematic diagram of the architecture of an aggregation marking end of a malicious encrypted traffic detection method based on multi-feature fusion according to the present invention;

[0058] Figure 4 The present invention is a schematic diagram of the architecture of a progressive identification terminal of a malicious encrypted traffic detection method based on multi-feature fusion. DETAILED DESCRIPTION

[0059] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further explained below in conjunction with specific implementation methods.

[0060] Embodiment 1

[0061] Please refer to Figure 1-2 As shown: A malicious encrypted traffic detection method based on multi-feature fusion includes the following implementation steps:

[0062] Step 1: Enter the collection and processing end, continuously collect the encrypted traffic generated by the malware through various means, and perform data cleaning and annotation in real time;

[0063] Step 2: Enter the aggregation and tagging end, query the multi-AV engine scanning results of the threat intelligence platform for each sample, realize aggregation, and perform real-time hierarchical identification during aggregation, and monitor and identify anomalies in real time;

[0064] Step 3: Enter the progressive identification terminal, filter the aggregated sample features in real time, use the multi-classification model to identify the malware family type, and compare and verify the detection effect of the malware encrypted traffic detection model in real time to achieve differentiated alarms and give priority presentation.

[0065] The collection and processing end in step 1 includes a flow collection module, a stage cleaning module and a stage marking module;

[0066] The flow receiving module is used to collect the flow at different times in real time through the clock and data acquisition instrument, and obtain the flow value at the current time through multiple channels.

[0067] The staged cleaning module includes a time-division and stage-division unit and a data cleaning unit;

[0068] The time-division and class-division unit is used to set the duration and class threshold to classify the collected traffic values;

[0069] The data cleaning unit is used to clean the traffic values ​​​​differentiated by class. The calculation formula for data cleaning is as follows:

[0070] Standardized_data={x|x∈D,r(x)}

[0071] Where D represents the traffic set, and all traffic features in the dataset D are normalized to the class distinction threshold.

[0072] The hierarchical standard module includes a synchronous hierarchical unit, a color marking unit and a data deletion unit;

[0073] The synchronous grading unit is used to synchronously grade the flow values ​​after data cleaning, including flow width, flow duration and flow power;

[0074] The color marking unit is used to mark the flow value with color according to the stage setting;

[0075] The data deletion unit is used to automatically delete the traffic values ​​that are not marked with colors.

[0076] Encrypted traffic is collected through multiple channels, and data cleaning and data labeling are performed in real time during the collection process. Cleaning and labeling are performed in stages according to the data to ensure the stability of large-scale traffic collection, avoid uneven sample quality, reduce deviations in malicious encrypted traffic detection, and promptly delete and crush data for cleaned and labeled traffic to cut off malicious traffic in a timely manner.

[0077] Embodiment 2

[0078] Please refer to Figure 3 As shown: Based on the first embodiment, the aggregation marking end includes a query scanning module, an aggregation training module and a staged monitoring module;

[0079] The query scanning module includes a query threat unit and a scan aggregation unit;

[0080] The threat query unit is used to query the IP, certificate server domain name, encrypted communication JA3 / JA3S fingerprint and malicious server certificate fingerprint of malicious encrypted traffic communication, extract the common string of the tag family type and count the corresponding AV engine number, and detect the IP, certificate server domain name, encrypted communication JA3 / JA3S fingerprint and malicious server certificate fingerprint of malicious encrypted traffic communication;

[0081] The scanning aggregation unit is used to use a clustering algorithm on the training samples after multi-AV calibration, and merge the malware traffic with a similarity of more than 95% after aggregation into a new family type.

[0082] The aggregation training module includes an aggregation hierarchical unit and a hierarchical training unit;

[0083] The aggregation stage unit is used to set the aggregation traffic in stages, which are set as the first stage, the second stage and the third stage;

[0084] The step training unit is used to perform step training on the flow value according to the step setting of the aggregated flow.

[0085] The staged monitoring module includes a monitoring identification unit and an identification and early warning unit;

[0086] The monitoring and recognition unit is used to calculate the flow value for the correction value of the step training, the method is as follows:

[0087] S1(1): Calculate the coefficient of the first-order term of the regression equation. The formula is as follows:

[0088]

[0089] Among them, A represents the coefficient of the first-order term. This regression equation is used to express the quadratic relationship between the flow value for step-by-step training and the deviation from the step-by-step training standard data. S xy Indicates the basic value of the first-order flow value deviation from the staged training. Indicates the basic value of the first-order flow value for staged training. Indicates the base value of the second-order flow value for staged training deviation. Indicates the basic value of the second-order flow value for step-by-step training, S xx Indicates the basic value of the deviation of the flow value stage training at the current moment. Here, it indicates the deviation value of the stage training at different time points and different flow values;

[0090] S1(2): Calculate the quadratic coefficient of the regression equation. The formula is as follows:

[0091]

[0092] Among them, B represents the coefficient of the quadratic term. The constant term coefficient of the regression equation is calculated based on the coefficient of the linear term and the coefficient of the quadratic term.

[0093]

[0094] Where C represents the constant term coefficient;

[0095] S1(3): According to the coefficient of the first-order term, the coefficient of the second-order term and the coefficient of the constant term, a regression equation is established to obtain the correction value of the flow numerical classification training;

[0096] S1(4): Monitor the flow value in real time through the camera according to the correction value of the flow value stage training;

[0097] The recognition and warning unit is used to report the recognition results to the system in real time and issue voice reminders when abnormalities are detected.

[0098] By querying the multi-AV engine scanning results of the threat intelligence platform for each sample, real-time multi-channel aggregation, and implementing staged training and real-time monitoring of the aggregated data, it is possible to increase the comprehensiveness of the complexity of encrypted traffic under certain load network environments, and meet the detection of malicious encrypted traffic of different attack behaviors at different attack stages, thereby increasing the accuracy of malicious code encrypted traffic model detection.

[0099] Embodiment 3

[0100] Please refer to Figure 4As shown: Based on the first embodiment, the progressive identification end includes a multi-dimensional filtering module, an abnormal classification module and a comparison verification module;

[0101] The multi-dimensional filtering module is used to filter the aggregated sample features in real time through data filtering, and to identify the malware family type through a multi-classification model.

[0102] The anomaly classification module includes an anomaly identification unit and an anomaly classification unit;

[0103] The abnormality identification unit is used to calculate the correction value of the flow signal transmission in a step-by-step manner in real time according to the correction value calculation formula of the flow value step-by-step training. If the calculated flow correction value is greater than 0, the flow is judged to be abnormal; if the calculated flow correction value is less than or equal to 0, the flow is judged to be normal.

[0104] The abnormal classification unit is used to automatically classify the correction values ​​in stages according to the flow abnormality, so as to realize synchronous staged abnormality classification.

[0105] The comparison and verification module includes a difference alarm unit, an alarm priority unit and an alarm interpretation unit;

[0106] The difference alarm unit is used to report to the system when the traffic is judged to be abnormal, and the alarm page is displayed on the computer in real time;

[0107] The alarm priority unit is used to update the latest alarm information in real time through the page timing update technology;

[0108] The alarm interpretation unit is used to automatically retrieve the solution of the alarm information according to the alarm information, and visually display the solution of the alarm information on the computer page in sequence by arranging the serial numbers.

[0109] By filtering the aggregated sample features in real time and using a multi-classification model to identify malware family types, the detection effect of the malware encrypted traffic detection model can be verified in real time, which can further enhance the authenticity of the malicious encrypted traffic detection results. By using differentiated alarms and giving priority to them, differentiated alarm information can be displayed in a timely manner, increasing the convenience of malicious encrypted traffic detection.

[0110] In the present invention, a malicious encrypted traffic detection method based on multi-feature fusion first enters the collection and processing end, continuously collects the encrypted traffic generated by the malware through a variety of means, and performs data cleaning and labeling in real time, collects the encrypted traffic through multiple channels, and performs data cleaning and data labeling in real time during the collection process, and performs staged cleaning and staged labeling according to the data to ensure the stability of large-scale traffic collection, avoid uneven sample quality, reduce the deviation in malicious encrypted traffic detection, and timely delete and crush the data of the data-cleaned and data-labeled traffic to timely cut off the malicious traffic; enters the aggregation and marking end, queries the multi-AV engine scanning results of the threat intelligence platform for each sample according to the sample, realizes aggregation, and performs real-time staged identification during aggregation, monitors and identifies anomalies in real time, and realizes real-time detection of anomalies by querying the multi-AV engine scanning results of the threat intelligence platform for each sample according to the sample. It aggregates multiple channels at the same time, and implements hierarchical training and real-time monitoring of the aggregated data, which can increase the comprehensiveness of the complexity of encrypted traffic under certain load network environments, and meet the detection of malicious encrypted traffic of different attack behaviors at different attack stages, thereby increasing the accuracy of malicious code encrypted traffic model detection; entering the aggregation tagging end, for each sample, according to the sample query threat intelligence platform's multi-AV engine scanning results, to achieve aggregation, and perform real-time hierarchical identification during aggregation, real-time monitoring and identification of anomalies, through real-time filtering of aggregated sample features, and use of multi-classification models for malware family type identification, real-time comparison and verification of the detection effect of the malware encrypted traffic detection model, can further enhance the authenticity of the malicious encrypted traffic detection results, and through differentiated alarms and priority presentation, can timely display differentiated alarm information, and increase the convenience of malicious encrypted traffic detection.

[0111] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A method for detecting malicious encrypted traffic based on multi-feature fusion, characterized in that: The method comprises the following implementation steps: Step 1: Enter the collection and processing end, continuously collect the encrypted traffic generated by the malware through various means, and perform data cleaning and annotation in real time; Step 2: Enter the aggregation and tagging end, query the multi-AV engine scanning results of the threat intelligence platform for each sample, realize aggregation, and perform real-time hierarchical identification during aggregation, and monitor and identify anomalies in real time; Step 3: Enter the progressive identification terminal, filter the aggregated sample features in real time, use the multi-classification model to identify the malware family type, and compare and verify the detection effect of the malware encrypted traffic detection model in real time to achieve differentiated alarms and give priority presentation.

2. The method according to claim 1, characterized in that: The collection and processing end in step 1 includes a flow collection module, a stage cleaning module and a stage marking module; The flow receiving module is used to collect the flow at different times in real time through a clock and a data acquisition instrument, and obtain the flow value at the current time through multiple channels.

3. The method according to claim 2, characterized in that: The stage-by-stage cleaning module includes a time-by-stage unit and a data cleaning unit; The time-division and class-division unit is used to set the duration and class threshold to classify the collected traffic values; The data cleaning unit is used to clean the class-differentiated traffic values. The calculation formula for data cleaning is as follows: Standardized_data={x|x∈D,r(x)} Where D represents the traffic set, and all traffic features in the dataset D are normalized to the class distinction threshold.

4. The method according to claim 3, characterized in that: The grading standard module includes a synchronous grading unit, a color marking unit and a data deletion unit; The synchronous grading unit is used to perform synchronous grading setting on the flow value after data cleaning, and the setting includes flow width, flow duration and flow power; The color marking unit is used to mark the flow value with color according to the stage setting; The data deletion unit is used to automatically delete the flow values ​​that are not marked with colors.

5. The method according to claim 1, characterized in that: The aggregation marking end includes a query scanning module, an aggregation training module and a stage monitoring module; The query scanning module includes a query threat unit and a scan aggregation unit; The threat query unit is used to query the IP, certificate server domain name, encrypted communication JA3 / JA3S fingerprint and malicious server certificate fingerprint of malicious encrypted traffic communication, extract the common string of the tag family type and count the corresponding AV engine number, and detect the IP, certificate server domain name, encrypted communication JA3 / JA3S fingerprint and malicious server certificate fingerprint of malicious encrypted traffic communication; The scanning aggregation unit is used to use a clustering algorithm on the training samples after multi-AV calibration, and merge the malware traffic with a similarity of more than 95% after aggregation into a new family type.

6. The method according to claim 5, characterized in that: The aggregation training module includes an aggregation hierarchical unit and a hierarchical training unit; The aggregation stage unit is used to set the aggregation flow in stages, which are set as the first stage, the second stage and the third stage; The step-by-step training unit is used to perform step-by-step training on the flow value according to the step-by-step setting of the aggregated flow.

7. The method according to claim 6, characterized in that: The staged monitoring module includes a monitoring identification unit and an identification and early warning unit; The monitoring and identification unit is used to calculate the flow value for the correction value of the step-by-step training, the method is as follows: S1(1): Calculate the coefficient of the first-order term of the regression equation. The formula is as follows: Among them, A represents the coefficient of the first-order term. This regression equation is used to express the quadratic relationship between the flow value for step-by-step training and the deviation from the step-by-step training standard data. S xy Indicates the basic value of the first-order flow value deviation from the staged training. Indicates the basic value of the first-order flow value for staged training. Indicates the base value of the second-order flow value for staged training deviation. Indicates the basic value of the second-order flow value for step-by-step training, S xx Indicates the basic value of the deviation of the flow value stage training at the current moment. Here, it indicates the deviation value of the stage training at different time points and different flow values; S1(2): Calculate the quadratic coefficient of the regression equation. The formula is as follows: Among them, B represents the coefficient of the quadratic term. The constant term coefficient of the regression equation is calculated based on the coefficient of the linear term and the coefficient of the quadratic term. Where C represents the constant term coefficient; S1(3): According to the coefficient of the first-order term, the coefficient of the second-order term and the coefficient of the constant term, a regression equation is established to obtain the correction value of the flow numerical classification training; S1(4): Monitor the flow value in real time through the camera according to the correction value of the flow value stage training; The identification and early warning unit is used to report the system in real time according to the identification result, and issue a voice reminder when monitoring anomalies.

8. The method according to claim 1, characterized in that: The progressive recognition end includes a multi-dimensional filtering module, an abnormal classification module and a comparison and verification module; The multi-dimensional filtering module is used to filter the aggregated sample features in real time through data filtering, and to identify the malware family type through a multi-classification model.

9. The method according to claim 8, characterized in that: The abnormality classification module includes an abnormality identification unit and an abnormality classification unit; The abnormality identification unit is used to calculate the correction value of the flow signal transmission in a step-by-step manner in real time according to the correction value calculation formula of the flow value step-by-step training, and if the calculated flow correction value is greater than 0, the flow is judged to be abnormal, and if the calculated flow correction value is less than or equal to 0, the flow is judged to be normal; The abnormality classification unit is used to automatically classify the correction values ​​in stages according to the flow abnormality, so as to realize synchronous stage-by-stage abnormality classification.

10. The method according to claim 9, characterized in that: The comparison and verification module includes a difference alarm unit, an alarm priority unit and an alarm interpretation unit; The difference alarm unit is used to report to the system when it is determined that the flow is abnormal, and display the alarm page on the computer in real time; The alarm priority unit is used to update the latest alarm information in real time through the page timing update technology; The alarm interpretation unit is used to automatically retrieve the solution of the alarm information according to the alarm information, and visually display the solution of the alarm information in sequence on a computer page by arranging the serial numbers.

Images