Traffic attack detection method and device and electronic equipment

Abstract

The embodiment of the invention provides a traffic attack detection method and device and electronic equipment, and the method comprises the steps: determining a first feature vector corresponding to a to-be-detected data stream based on a feature value, corresponding to a target feature, of each data packet in the to-be-detected data stream; inputting the first feature vector into an attack detection model, and determining a first category of the to-be-detected data stream through the attack detection model; wherein the attack detection model comprises a symmetric tree structure, and the first category represents whether the to-be-detected data stream is normal or not; determining a second category of the first data stream through an attack recognition model; wherein the attack recognition model is a deep learning model, the first data stream is an abnormal to-be-detected data stream, and the second category comprises a preset attack type. A two-stage recognition architecture of the attack detection model and the attack recognition model is adopted, the detection speed is increased, the real-time response capability of detection is improved, fine recognition of network attacks is achieved, and the precision and reliability of detection are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a flow attack detection method, device and electronic device. Background Art

[0002] With the rapid development of Internet technology, cyber attacks have increased and network security issues have become increasingly prominent. Cyber ​​attacks not only affect the availability of services, but may also cause huge economic losses and reputation damage. For example, Distributed Denial of Service (DDOS) attacks, as a common means of network attacks, use network resources to initiate a large number of requests, exhaust the bandwidth or processing power of the target system, and prevent legitimate users from accessing services normally.

[0003] In the related art, the method based on traffic statistics identifies abnormal traffic by analyzing the characteristics of network traffic, such as traffic size, frequency, etc.

[0004] However, the above method not only requires a large amount of computing resources, but also has low detection efficiency and low detection accuracy. Summary of the invention

[0005] The embodiments of the present application provide a traffic attack detection method, device and electronic device for efficiently and accurately performing traffic attack detection.

[0006] In a first aspect, an embodiment of the present application provides a first traffic attack detection method, the method comprising:

[0007] Determine a first feature vector corresponding to the data stream to be tested based on a feature value corresponding to the target feature of each data packet in the data stream to be tested;

[0008] Inputting the first feature vector into an attack detection model, and determining a first category of the data flow to be tested through the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category represents whether the data flow to be tested is normal;

[0009] The second category of the first data flow is determined by an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes preset attack types.

[0010] In some optional implementations, determining a first feature vector corresponding to the data stream to be tested based on a feature value corresponding to a target feature of each data packet in the data stream to be tested includes:

[0011] For any target feature, based on the feature value of each data packet in the data stream to be tested of the target feature, determine at least one second feature value of the data stream to be tested of the target feature; and based on the time interval between adjacent data packets in the data stream to be tested, determine the target time interval of the data stream to be tested;

[0012] The first feature vector is generated based on the second feature values ​​of all target features of the data flow to be tested and the target time interval.

[0013] In some optional implementations, determining at least one second characteristic value of the target feature of the data flow to be tested based on the characteristic value of each data packet in the data flow to be tested, includes:

[0014] The minimum characteristic value of the target characteristic of all data packets in the data stream to be tested, the maximum characteristic value of the target characteristic of all data packets in the data stream to be tested, and the standard deviation of the target characteristic of all data packets in the data stream to be tested are determined as the second characteristic value.

[0015] In some optional implementations, determining a target time interval of the data flow to be tested based on a time interval between adjacent data packets in the data flow to be tested includes:

[0016] The shortest time interval between adjacent data packets in the data stream to be tested is determined as the target time interval.

[0017] In some optional implementation manners, before determining the second category of the first data flow by using the attack identification model, the method further includes:

[0018] Performing dimension conversion and normalization processing on the first eigenvector of the first data stream to obtain a second eigenvector of the first data stream;

[0019] The second feature vector is input into the attack identification model.

[0020] In some optional implementations, the output of the attack identification model also includes a normal category; and the method further includes:

[0021] Determining whether a second data flow in a target time period is the second category or the normal category by using the attack identification model; wherein the second data flow is a data flow to be tested other than the first data flow;

[0022] If the number of the second data flows of the second category exceeds a preset number, the attack detection model is adjusted based on the second data flows of the second category.

[0023] In some optional implementations, before determining the first feature vector corresponding to the data stream to be tested based on the feature value corresponding to the target feature of each data packet in the data stream to be tested, the method further includes:

[0024] Determining that there is no flow identifier corresponding to the data flow to be tested in the data flow library;

[0025] After the first feature vector is input into the attack detection model, the method further includes:

[0026] The data flow library is updated based on the category of the data flow to be tested.

[0027] Some optional implementations also include:

[0028] If there is a flow identifier corresponding to the data flow to be tested in the data flow library, the category of the data flow to be tested is queried from the data flow library.

[0029] Some optional implementations also include:

[0030] If the occupancy rate of the data stream library is greater than a preset occupancy rate, information corresponding to at least one data stream is deleted based on the query time of the data stream in the data stream library.

[0031] In a second aspect, an embodiment of the present application provides a first traffic attack detection device, the device comprising:

[0032] A feature extraction module, used to determine a first feature vector corresponding to the data stream to be tested based on a feature value corresponding to a target feature of each data packet in the data stream to be tested;

[0033] An attack detection module, configured to input the first feature vector into an attack detection model, and determine a first category of the data flow to be tested through the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category represents whether the data flow to be tested is normal;

[0034] An attack identification module is used to determine the second category of the first data flow through an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes preset attack types.

[0035] In some optional implementations, the feature extraction module is specifically used to:

[0036] For any target feature, based on the feature value of each data packet in the data stream to be tested of the target feature, determine at least one second feature value of the data stream to be tested of the target feature; and based on the time interval between adjacent data packets in the data stream to be tested, determine the target time interval of the data stream to be tested;

[0037] The first feature vector is generated based on the second feature values ​​of all target features of the data flow to be tested and the target time interval.

[0038] In some optional implementations, the feature extraction module is specifically used to:

[0039] The minimum characteristic value of the target characteristic of all data packets in the data stream to be tested, the maximum characteristic value of the target characteristic of all data packets in the data stream to be tested, and the standard deviation of the target characteristic of all data packets in the data stream to be tested are determined as the second characteristic value.

[0040] In some optional implementations, the feature extraction module is specifically used to:

[0041] The shortest time interval between adjacent data packets in the data stream to be tested is determined as the target time interval.

[0042] In some optional implementations, the attack identification module, before determining the second category of the first data flow through the attack identification model, is further configured to:

[0043] Performing dimension conversion and normalization processing on the first eigenvector of the first data stream to obtain a second eigenvector of the first data stream;

[0044] The second feature vector is input into the attack identification model.

[0045] In some optional implementations, the output of the attack identification model also includes a normal category; and the attack identification module is further used to:

[0046] Determining whether a second data flow in a target time period is the second category or the normal category by using the attack identification model; wherein the second data flow is a data flow to be tested other than the first data flow;

[0047] If the number of the second data flows of the second category exceeds a preset number, the attack detection model is adjusted based on the second data flows of the second category.

[0048] Some optional implementations further include a query module, which is used to determine that there is no flow identifier corresponding to the data flow to be tested in the data flow library before the feature extraction module determines the first feature vector corresponding to the data flow to be tested based on the feature value corresponding to the target feature of each data packet in the data flow to be tested;

[0049] It is also used to update the data flow library based on the category of the data flow to be tested after the attack detection module inputs the first feature vector into the attack detection model.

[0050] In some optional implementation manners, the query module is further used to:

[0051] If there is a flow identifier corresponding to the data flow to be tested in the data flow library, the category of the data flow to be tested is queried from the data flow library.

[0052] In some optional implementation manners, the query module is further used to:

[0053] If the occupancy rate of the data stream library is greater than a preset occupancy rate, information corresponding to at least one data stream is deleted based on the query time of the data stream in the data stream library.

[0054] In a third aspect, an embodiment of the present application provides an electronic device, comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes any of the traffic attack detection methods described in the first aspect.

[0055] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a processor. When the program runs on the processor, the processor executes the traffic attack detection method described in any one of the first aspects above.

[0056] In the embodiment of the present application, based on the characteristic value corresponding to the target characteristic of each data packet in the data flow to be tested, the first characteristic vector characterizing the flow characteristic of the data flow to be tested is accurately determined; an attack detection model and an attack identification model are adopted, combined with a symmetric tree structure and machine learning technology, and an initial detection is first performed through the attack detection model. Due to the symmetric tree structure, the same tree structure is used in the training and prediction stages, which greatly speeds up the detection speed of the model, thereby improving the real-time response capability of the detection process; and then the attack identification model is used for subsequent fine identification, so as to realize accurate identification and classification of potential network attack traffic, thereby improving the accuracy and reliability of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 A flow chart of a first flow attack detection method provided in an embodiment of the present application;

[0059] Figure 2 A second category of schematic diagrams provided for embodiments of the present application;

[0060] Figure 3 A schematic diagram of a first characteristic vector provided in an embodiment of the present application;

[0061] Figure 4 A schematic diagram of an attack identification model provided in an embodiment of the present application;

[0062] Figure 5 A flow chart of a second flow attack detection method provided in an embodiment of the present application;

[0063] Figure 6 A schematic diagram of a flow chart of a third flow attack detection method provided in an embodiment of the present application;

[0064] Figure 7 A schematic diagram of the structure of a flow attack detection device provided in an embodiment of the present application;

[0065] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0067] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0068] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the term "connection" should be understood in a broad sense, for example, it can be directly connected, or indirectly connected through an intermediate medium, or it can be the internal connection of two devices. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0069] Network attacks not only affect the availability of services, but may also cause huge economic losses and reputation damage. For example, DDOS, as a common network attack method, uses network resources to initiate a large number of requests, exhausting the bandwidth or processing power of the target system, making it impossible for legitimate users to access services normally.

[0070] In the related art, the method based on traffic statistics identifies abnormal traffic by analyzing the characteristics of network traffic, such as traffic size, frequency, etc.

[0071] However, the above method not only requires a large amount of computing resources, but also has low detection efficiency and low detection accuracy.

[0072] In some embodiments, attack detection is performed based on signatures, but this approach relies on matching known attack patterns and has limited ability to identify emerging or variant attack patterns.

[0073] In view of this, an embodiment of the present application proposes a flow attack detection method, device and electronic device, the method comprising: determining a first feature vector corresponding to the data flow to be tested based on the feature value corresponding to the target feature of each data packet in the data flow to be tested; inputting the first feature vector into an attack detection model, and determining a first category of the data flow to be tested through the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category characterizes whether the data flow to be tested is normal; determining a second category of the first data flow through an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes preset attack types.

[0074] The above scheme accurately determines the first eigenvector characterizing the flow characteristics of the data flow to be tested based on the eigenvalues ​​corresponding to the target characteristics of each data packet in the data flow to be tested; adopts the attack detection model and the attack identification model, combined with the symmetric tree structure and machine learning technology, and first performs initial detection through the attack detection model. Due to the symmetric tree structure, the same tree structure is used in the training and prediction stages, which greatly speeds up the detection speed of the model, thereby improving the real-time response capability of the detection process; and then performs subsequent fine identification through the attack identification model to achieve accurate identification and classification of potential network attack traffic, thereby improving the accuracy and reliability of detection.

[0075] The following will be combined with the accompanying drawings and specific embodiments to describe in detail the technical solution of the present application and how the technical solution of the present application solves the above technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0076] Figure 1 A flow chart of the first flow attack detection method provided in the embodiment of the present application is as follows: Figure 1 As shown, the following steps are included:

[0077] Step S101: determining a first feature vector corresponding to the data stream to be tested based on a feature value corresponding to a target feature of each data packet in the data stream to be tested.

[0078] During implementation, since network traffic involves many features, some features are more important for classification, while some features appear less frequently and are not important for classification. Therefore, it is necessary to determine several target features that are more important for classification, so that feature extraction can be carried out effectively and accurate detection can be achieved.

[0079] This embodiment does not specifically limit the method for determining the target features. In some embodiments, a feature importance index is determined based on all sample features in a sample data set using a random forest. The feature importance index reflects the contribution of each feature to the classification or regression task, and feature selection is then performed based on the feature importance index.

[0080] For example, the CICDDos2019 dataset (a DDos detection dataset) is used. CICFDDos2019 includes more than 1 million benign flows and more than 30 million malicious flows, including 13 types of DDos attacks, such as NTP, DNS, LDAP, MSSQL, and NetBIOS, from which 83 sample features are extracted;

[0081] Calculate the information gain IG(D p ,f), Among them, I G (D p ) is the Gini index of the parent node p, I G (D j ) is the Gini index of child node j, N p and N j are the number of samples in the parent node and child node respectively.

[0082] The Gini index measures the impurity of the sample category in a node. Its value ranges from 0 to 1. 0 means that the data set is completely pure (all data points belong to the same category), and 1 means that the data set is completely chaotic (the categories are evenly distributed). The lower the Gini index, the higher the purity of the data set. The calculation formula is:

[0083] where J is the number of categories and p(j|t) is the frequency of category j in node t.

[0084] Information gain is a metric used in decision tree algorithms to select the best split feature. It measures the amount of uncertainty reduction in a data set after feature splitting. High information gain means that the feature is more effective in reducing data impurity. Normalize the information gain of sample features and select the top M features in terms of importance. For example, select the top 7 features in terms of importance as target features: minimum packet length, minimum forward packet size, minimum backward packet size, shortest time interval for forward data packets, backward initialization window size, packet length standard deviation, and forward packet header length.

[0085] After the target feature is determined, the packet feature consisting of the feature values ​​corresponding to the target feature of the data packet can be determined.

[0086] Since packet features are attributes of a single network packet, by performing aggregate analysis on the data packet features in the network traffic, the packet-level features are converted into flow-level features (first feature vector). Based on the first feature vector, a more comprehensive traffic analysis can be provided, thereby improving the accuracy of attack detection.

[0087] This embodiment does not specifically limit the method of obtaining data packets in the data flow to be tested, such as setting the event window W within this window, and taking data packets with the same flow ID as a data flow to be tested. The flow ID is a basic element used to identify a specific network flow in network traffic analysis, usually called a five-tuple, including: source IP address (Source IPAddress, destination IP address (Destination IP Address), source port number (Source Port Number), destination port number (Destination Port Number) and transport layer protocol (Transport Layer Protocol).

[0088] Step S102: inputting the first feature vector into an attack detection model, and determining a first category of the data flow to be tested through the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category represents whether the data flow to be tested is normal.

[0089] During implementation, if attack detection is performed directly through a deep learning model, the detection speed is low and the time consumption is long. Based on this, this embodiment first performs initial detection through an attack detection model with a symmetric tree structure. Due to the symmetric tree structure, the same tree structure (tree depth and splitting rules) is used in the training and prediction stages, which greatly speeds up the detection speed of the model, thereby improving the real-time response capability of the detection process.

[0090] Exemplarily, the above attack detection model may adopt a Catboost (an open source machine learning library) model.

[0091] Taking the Catboost model as an example, training is performed in the following way:

[0092] 1. Initialize a model containing T decision trees;

[0093] 2. For each tree t (t = 1, 2, ..., T), calculate the negative gradient of the loss function x i is the first eigenvector of the sample, y i is the first category of the sample;

[0094] Fitting the basic model: f t (x i ) = f t-1 (x i )+η·Gradient t ; Among them, f t (x i ) is the prediction function of the tth tree, and η is the learning rate parameter.

[0095] 3. Add regularization terms to control model complexity Regularization t =λ·||f t ||2 2 ;

[0096] Update model parameters

[0097] In implementation, after the attack detection model is trained, it can also be evaluated, the model performance can be evaluated through cross-validation or retention set, and the optimal number of iterations T and parameter settings can be selected. The attack detection model can be evaluated from two aspects: detection capability and detection efficiency.

[0098] Exemplarily, the detection capability parameters include some or all of the following:

[0099] Accuracy is the ratio of correctly predicted abnormal traffic to normal traffic in all traffic; Accuracy = (TP+TN) / (TP+FP+FN+TN);

[0100] Precision is the ratio of correctly predicted abnormal traffic to all predicted abnormal traffic; Precision = TP / (TP+FP);

[0101] Recall is the ratio of correctly predicted abnormal traffic to all abnormal traffic; Recall = TP / (TP+FN);

[0102] The F1 score is a balanced average of precision and recall.

[0103] Among them, TP is the correctly predicted abnormal traffic, TN is the correctly predicted normal traffic, FP is the normal traffic wrongly predicted as abnormal, and FN is the abnormal traffic wrongly predicted as normal.

[0104] Detection efficiency can be measured by the time it takes the central processing unit (CPU) to process each flow.

[0105] For example, average processing efficiency (MPE) = CPU Time / Test Sets, where CPU Time is the total number of clock ticks used to process the TestSets stream.

[0106] Step S103: Determine the second category of the first data flow through an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes preset attack types.

[0107] In practice, the attack detection model has limited accuracy and only performs two-classification of traffic (normal or not), which makes it difficult to further determine the attack type corresponding to abnormal traffic;

[0108] Based on this, this embodiment also sets up an attack identification model, such as a convolutional neural network (CNN), to further identify the attack type.

[0109] This embodiment does not limit the specific implementation of the second category, and attack methods with similar behavior characteristics can be regarded as the same attack type.

[0110] Take DDOS attack as an example, see Figure 2 As shown, User Datagram Protocol Flood (UDP Flood) and User Datagram Protocol Lag (UDP-Lag) belong to the first type of User Datagram Protocol (UDP) attacks;

[0111] The Transmission Control Protocol (TCP) three-way handshake attack (SYNFlood) attack belongs to the first type of TCP attack;

[0112] Microsoft SQL Server (MSSQL) attacks and Simple Service Discovery Protocol Flood (SSDP Flood) attacks belong to the second category of TCP attacks or UDP / TCP mixed attacks;

[0113] Character Generator (CharGen) attacks, Network Time Protocol (NTP) attacks, and Trivial File Transfer Protocol (TFTP) attacks belong to the second type of UDP attacks or UDP / TCP mixed attacks.

[0114] Among them, the first type of UDP attack and the first type of TCP attack have similar behavior characteristics, so they are regarded as protocol exploitation attacks;

[0115] The second type of UDP attack, the second type of TCP attack, and the UDP / TCP mixed attack have similar behavioral characteristics and are considered as reflection-based and amplification attacks.

[0116] The above scheme accurately determines the first eigenvector characterizing the flow characteristics of the data flow to be tested based on the eigenvalues ​​corresponding to the target characteristics of each data packet in the data flow to be tested; adopts the attack detection model and the attack identification model, combined with the symmetric tree structure and machine learning technology, and first performs initial detection through the attack detection model. Due to the symmetric tree structure, the same tree structure is used in the training and prediction stages, which greatly speeds up the detection speed of the model, thereby improving the real-time response capability of the detection process; and then performs subsequent fine identification through the attack identification model to achieve accurate identification and classification of potential network attack traffic, thereby improving the accuracy and reliability of detection.

[0117] In some optional implementation manners, the above step S101 may be implemented by but not limited to the following methods:

[0118] For any target feature, based on the feature value of each data packet in the data stream to be tested of the target feature, determine at least one second feature value of the data stream to be tested of the target feature; and based on the time interval between adjacent data packets in the data stream to be tested, determine the target time interval of the data stream to be tested;

[0119] The first feature vector is generated based on the second feature values ​​of all target features of the data flow to be tested and the target time interval.

[0120] See also Figure 3 As shown, each data packet corresponds to a characteristic value and a timestamp of a target characteristic, and each target characteristic is independent of each other. The characteristic values ​​of each target characteristic of the data packet are integrated to determine at least one second characteristic value of the target characteristic of the data stream to be tested, that is, each target characteristic may correspond to one or more second characteristic values;

[0121] The timestamp reflects the time information of the data packet, and based on the time interval between adjacent data packets, the target time interval of the flow characteristics of the data flow to be tested is determined;

[0122] Based on the above two pieces of information, the first eigenvector of the data stream to be tested is determined.

[0123] In some optional implementations, the second eigenvalue is determined by:

[0124] The minimum characteristic value of the target characteristic of all data packets in the data stream to be tested, the maximum characteristic value of the target characteristic of all data packets in the data stream to be tested, and the standard deviation of the target characteristic of all data packets in the data stream to be tested are determined as the second characteristic value.

[0125] Since the data stream to be tested contains multiple data packets, the minimum characteristic value of a data packet in a certain target feature represents the lower limit of the data stream to be tested in the target feature, and the maximum characteristic value of a data packet in a certain target feature represents the upper limit of the data stream to be tested in the target feature. These two values ​​cover the value range of the data stream to be tested in the target feature; and the standard deviation reflects the dispersion of the data stream to be tested in the target feature. Therefore, using these values ​​as the second characteristic value can fully reflect the characteristic information of the data stream to be tested in the target feature.

[0126] For example, the minimum eigenvalue f min =min({f k |p∈P i ,k=1,...,n});

[0127] Maximum eigenvalue f max =max({f k |p∈P i ,k=1,...,n});

[0128] -Standard Deviation

[0129] Among them, p is the data packet, P i is the data stream i to be tested, f k P i The characteristic value of the kth target feature of data packet p, P i The average feature value of the kth target feature of data packet p;

[0130] The second eigenvalue of the target feature is {f min ,f max ,f std}.

[0131] In some optional implementations, the target time interval is determined by:

[0132] The shortest time interval between adjacent data packets in the data stream to be tested is determined as the target time interval.

[0133] Exemplarily, the data stream P to be tested is calculated i The time interval Δt between all adjacent data packets in pk,pj =t pj -t pk , and determine the shortest time interval T min =min({Δt pk,pj |pk,pj∈P i ,t pj >t pk}), as the target time interval at the stream level.

[0134] In some optional implementation manners, before the above step S103, the following steps are further performed:

[0135] Performing dimension conversion and normalization processing on the first eigenvector of the first data stream to obtain a second eigenvector of the first data stream;

[0136] The second feature vector is input into the attack identification model.

[0137] In implementation, in order to facilitate the calculation of the attack identification model, the first feature vector is firstly dimensionally transformed and normalized to obtain the second feature vector of the first data stream, and the second feature vector is input into the attack identification model.

[0138] Take the attack recognition model as a CNN model as an example, see Figure 4 As shown, it includes convolutional layers, pooling layers, and fully connected layers;

[0139] During the training process, the input vector is first adjusted to a 3D vector of shape (n, n_step, n_input); where n is the number of sample data streams input to the network, n_step is the number of times the feature is fed to the hidden layer, and n_input is the first feature vector of the sample;

[0140] Use flattening to convert the vector of a single sample from (n_step, n_input) to (n_step, n_input, 1), and perform normalization to obtain the second eigenvector.

[0141] When the model is used, the first eigenvector of the first data stream is converted to (n_step, n_input, 1) and normalized to obtain its second eigenvector.

[0142] In the CNN model, the first convolutional layer contains nf zero-filling filters of size (fs, fs). The activation function used is Relu, and the output X1 of the first layer is obtained.c , X1 c The shape is (n, n_step, n_input, nf);

[0143] The convolutional layer is followed by a pooling layer with a stride of st and a pooling size of (ps,ps). The activation function Relu is used to obtain the output X2 of the second layer. c , X2 c The shape is (n, [n_step / ps], [n_input / ps], nf);

[0144] The output of the third layer is the information representing the second category.

[0145] In some optional implementations, the output of the attack identification model further includes a normal category; based on any embodiment, the following steps are further performed:

[0146] Determining whether a second data flow in a target time period is the second category or the normal category by using the attack identification model; wherein the second data flow is a data flow to be tested other than the first data flow;

[0147] If the number of the second data flows of the second category exceeds a preset number, the attack detection model is adjusted based on the second data flows of the second category.

[0148] Since the present embodiment sets a two-level model, the attack detection model can detect efficiently, but the accuracy is not as good as the attack identification model;

[0149] Based on this, in order to reduce the occurrence of missed detections, this embodiment optimizes the attack detection model based on the attack identification model.

[0150] Since the second data flow is determined to be normal by the attack detection model, the attack identification model is used to determine whether the second data flow is normal, and the number of second data flows (determined to be of the second category by the attack identification model) that are different from the judgment of the attack detection model within the target time period is counted; if the number exceeds the preset number, it means that the attack detection model has a high missed detection rate, and the attack detection model is adjusted based on the second data flow of the second category to improve the detection effect of the attack detection model on this type of second data flow.

[0151] This embodiment does not specifically limit the triggering method of the optimization process, such as triggering based on user instructions, or triggering at regular intervals, etc.

[0152] Figure 5 A flow chart of a second flow attack detection method provided in an embodiment of the present application is shown as follows: Figure 5 As shown, the following steps are included:

[0153] Step S501: Determine whether there is a flow identifier corresponding to the data flow to be tested in the data flow library.

[0154] As described above, based on the data flow, the corresponding flow ID can be determined. The source IP address, destination IP address, source port number, destination port number and transport layer protocol of the data flows with the same flow ID are the same, and the corresponding categories are also the same.

[0155] Based on this, the present embodiment sets up a data stream library to store data streams of determined categories;

[0156] By querying the data flow library based on the flow identifier corresponding to the data flow to be tested, it can be determined whether there is a flow identifier corresponding to the data flow to be tested in the data flow library; if so, determine the corresponding category from the data flow library; if not, execute the subsequent feature extraction and detection process.

[0157] This embodiment does not specifically limit the storage method of the data stream library. Exemplarily, a data structure consisting of a hash table and a linked list is used for storage.

[0158] Define a hash function h: "Flow ID" → "index" to map the Flow ID to an index in the hash table, in order to quickly access the corresponding linked list. Let the Flow ID be e and the hash function be h(), then the function h(e) can determine the flow index where the packet is located. Maintain a linked list L at the hash table index h(e) h(e) , the elements in the linked list are arranged in ascending order of timestamps, that is, for any two data packets p in the linked list m and p n , if p m Timestamp < timestamp, then p m In p n Before.

[0159] Step S502: If there is no flow identifier corresponding to the data flow to be tested in the data flow library, a first feature vector corresponding to the data flow to be tested is determined based on the feature value corresponding to the target feature of each data packet in the data flow to be tested.

[0160] Step S503: inputting the first feature vector into an attack detection model, and determining a first category of the data flow to be tested through the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category represents whether the data flow to be tested is normal.

[0161] Step S504: Determine the second category of the first data flow through an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes preset attack types.

[0162] The specific implementation of steps S502 to S504 may refer to other embodiments and will not be described in detail here.

[0163] Step S505: updating the data flow library based on the category of the data flow to be tested.

[0164] For example, by searching for key k in the hash table, if key k does not exist, a new key-value pair (k, v) is inserted into the hash table, and a new node is inserted at the head of the bidirectional linked list, so as to facilitate subsequent queries for the same flow identifier.

[0165] The category of the above-mentioned data flow to be tested is related to the detection result. If the first category of the data flow to be tested is normal, then the data flow to be tested has no corresponding second category; if the first category of the data flow to be tested is abnormal, then the data flow to be tested has a corresponding second category.

[0166] Figure 6 A flow chart of a third flow attack detection method provided in an embodiment of the present application is shown as follows: Figure 6 As shown, the following steps are included:

[0167] Step S601: Determine whether there is a flow identifier corresponding to the data flow to be tested in the data flow library.

[0168] The specific implementation of step S601 may refer to other embodiments and will not be described in detail here.

[0169] Step S602: If there is a flow identifier corresponding to the data flow to be tested in the data flow library, the category of the data flow to be tested is queried from the data flow library.

[0170] As described above, in some embodiments, a hash table is established in the data stream library, and the key k is searched in the hash table. If the key k exists, the category of the data stream to be tested is directly queried.

[0171] In this embodiment, when there is a flow identifier corresponding to the data flow to be tested in the data flow library, the category of the data flow to be tested is directly queried from the data flow library, thereby further improving the detection efficiency.

[0172] In some optional implementation manners, based on any of the above embodiments, the following steps are further performed:

[0173] If the occupancy rate of the data stream library is greater than a preset occupancy rate, information corresponding to at least one data stream is deleted based on the query time of the data stream in the data stream library.

[0174] In the implementation, since the relevant information of the data stream is cached in the data stream library, when the cache is full, it will affect the efficiency and performance of the cache;

[0175] Based on this, this embodiment performs cache management. If the occupancy rate of the data stream library is greater than the preset occupancy rate, it means that the cache is full. Based on the query time of the data stream in the data stream library, the information corresponding to at least one data stream is deleted, thereby eliminating the data items that have not been used for the longest time.

[0176] As described above, some embodiments provide a hash table and a linked list;

[0177] By looking up the key k in the hash table, if the key k exists, access the corresponding node n in the doubly linked list through the pointer in the hash table; move the node n to the head of the doubly linked list to indicate the most recent use.

[0178] If the key k does not exist, insert a new key-value pair (k, v) into the hash table and insert a new node at the head of the doubly linked list.

[0179] If the cache is full (|C|=C), or the occupancy rate is greater than the preset occupancy rate, the node at the end of the doubly linked list (the node represents the data item that has not been used for the longest time) is eliminated, and the corresponding key-value pair is deleted from the hash table. That is, the data item that has not been accessed for the longest time will be removed first.

[0180] like Figure 7 As shown, the embodiment of the present application provides a traffic attack detection device 700, which includes:

[0181] A feature extraction module 701 is used to determine a first feature vector corresponding to the data flow to be tested based on a feature value corresponding to a target feature of each data packet in the data flow to be tested;

[0182] An attack detection module 702 is used to input the first feature vector into an attack detection model, and determine a first category of the data flow to be tested through the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category represents whether the data flow to be tested is normal;

[0183] The attack identification module 703 is used to determine the second category of the first data flow through an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes preset attack types.

[0184] In some optional implementations, the feature extraction module 701 is specifically used to:

[0185] For any target feature, based on the feature value of each data packet in the data stream to be tested of the target feature, determine at least one second feature value of the data stream to be tested of the target feature; and based on the time interval between adjacent data packets in the data stream to be tested, determine the target time interval of the data stream to be tested;

[0186] The first feature vector is generated based on the second feature values ​​of all target features of the data flow to be tested and the target time interval.

[0187] In some optional implementations, the feature extraction module 701 is specifically used to:

[0188] The minimum characteristic value of the target characteristic of all data packets in the data stream to be tested, the maximum characteristic value of the target characteristic of all data packets in the data stream to be tested, and the standard deviation of the target characteristic of all data packets in the data stream to be tested are determined as the second characteristic value.

[0189] In some optional implementations, the feature extraction module 701 is specifically used to:

[0190] The shortest time interval between adjacent data packets in the data stream to be tested is determined as the target time interval.

[0191] In some optional implementations, the attack identification module 703, before determining the second category of the first data flow through the attack identification model, is further configured to:

[0192] Performing dimension conversion and normalization processing on the first eigenvector of the first data stream to obtain a second eigenvector of the first data stream;

[0193] The second feature vector is input into the attack identification model.

[0194] In some optional implementations, the output of the attack identification model also includes a normal category; the attack identification module 703 is further used to:

[0195] Determining whether a second data flow in a target time period is the second category or the normal category by using the attack identification model; wherein the second data flow is a data flow to be tested other than the first data flow;

[0196] If the number of the second data flows of the second category exceeds a preset number, the attack detection model is adjusted based on the second data flows of the second category.

[0197] Some optional implementations further include a query module 704, which is used to determine that there is no flow identifier corresponding to the data flow to be tested in the data flow library before the feature extraction module 701 determines the first feature vector corresponding to the data flow to be tested based on the feature value corresponding to the target feature of each data packet in the data flow to be tested;

[0198] It is also used to update the data flow library based on the category of the data flow to be tested after the attack detection module 702 inputs the first feature vector into the attack detection model.

[0199] In some optional implementations, the query module 704 is further configured to:

[0200] If there is a flow identifier corresponding to the data flow to be tested in the data flow library, the category of the data flow to be tested is queried from the data flow library.

[0201] In some optional implementations, the query module 704 is further configured to:

[0202] If the occupancy rate of the data stream library is greater than a preset occupancy rate, information corresponding to at least one data stream is deleted based on the query time of the data stream in the data stream library.

[0203] Since the device is the device in the method in the embodiment of the present application, and the principle of solving the problem by the device is similar to that of the method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0204] Based on the same technical concept, the embodiment of the present application also provides an electronic device 800, such as Figure 8 As shown, it includes at least one processor 801 and a memory 802 connected to the at least one processor. The specific connection medium between the processor 801 and the memory 802 is not limited in the embodiment of the present application. Figure 8 For example, the processor 801 and the memory 802 are connected via a bus 803. The bus can be divided into an address bus, a data bus, a control bus, etc. For convenience of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0205] Among them, the processor 801 is the control center of the electronic device, which can use various interfaces and lines to connect various parts of the electronic device, and realize data processing by running or executing instructions stored in the memory 802 and calling data stored in the memory 802. Optionally, the processor 801 may include one or more processing units, and the processor 801 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes the issuance of instructions. It is understandable that the above-mentioned modem processor may not be integrated into the processor 801. In some embodiments, the processor 801 and the memory 802 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0206] The processor 801 may be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the traffic attack detection method may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0207] The memory 802 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 802 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 802 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 802 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0208] In the embodiment of the present application, the memory 802 stores a computer program. When the program is executed by the processor 801, the processor 801 executes:

[0209] Determine a first feature vector corresponding to the data stream to be tested based on a feature value corresponding to the target feature of each data packet in the data stream to be tested;

[0210] Inputting the first feature vector into an attack detection model, and determining a first category of the data flow to be tested through the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category represents whether the data flow to be tested is normal;

[0211] The second category of the first data flow is determined by an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes preset attack types.

[0212] In some optional implementation manners, the processor 801 specifically performs:

[0213] For any target feature, based on the feature value of each data packet in the data stream to be tested of the target feature, determine at least one second feature value of the data stream to be tested of the target feature; and based on the time interval between adjacent data packets in the data stream to be tested, determine the target time interval of the data stream to be tested;

[0214] The first feature vector is generated based on the second feature values ​​of all target features of the data flow to be tested and the target time interval.

[0215] In some optional implementation manners, the processor 801 specifically performs:

[0216] The minimum characteristic value of the target characteristic of all data packets in the data stream to be tested, the maximum characteristic value of the target characteristic of all data packets in the data stream to be tested, and the standard deviation of the target characteristic of all data packets in the data stream to be tested are determined as the second characteristic value.

[0217] In some optional implementation manners, the processor 801 specifically performs:

[0218] The shortest time interval between adjacent data packets in the data stream to be tested is determined as the target time interval.

[0219] In some optional implementation manners, before determining the second category of the first data flow by using the attack identification model, the processor 801 further executes:

[0220] Performing dimension conversion and normalization processing on the first eigenvector of the first data stream to obtain a second eigenvector of the first data stream;

[0221] The second feature vector is input into the attack identification model.

[0222] In some optional implementations, the output of the attack identification model further includes a normal category; and the processor 801 further executes:

[0223] Determining whether a second data flow in a target time period is the second category or the normal category by using the attack identification model; wherein the second data flow is a data flow to be tested other than the first data flow;

[0224] If the number of the second data flows of the second category exceeds a preset number, the attack detection model is adjusted based on the second data flows of the second category.

[0225] In some optional implementations, before determining the first feature vector corresponding to the data stream to be tested based on the feature value corresponding to the target feature of each data packet in the data stream to be tested, the processor 801 further executes:

[0226] Determining that there is no flow identifier corresponding to the data flow to be tested in the data flow library;

[0227] After inputting the first feature vector into the attack detection model, the processor 801 further executes:

[0228] The data flow library is updated based on the category of the data flow to be tested.

[0229] In some optional implementations, the processor 801 further executes:

[0230] If there is a flow identifier corresponding to the data flow to be tested in the data flow library, the category of the data flow to be tested is queried from the data flow library.

[0231] In some optional implementations, the processor 801 further executes:

[0232] If the occupancy rate of the data stream library is greater than a preset occupancy rate, information corresponding to at least one data stream is deleted based on the query time of the data stream in the data stream library.

[0233] Since the electronic device is the electronic device in the method in the embodiment of the present application, and the principle of solving the problem by the electronic device is similar to that of the method, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0234] Based on the same technical concept, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer program executable by a processor. When the program runs on the processor, the processor executes the steps of the above-mentioned traffic attack detection method.

[0235] In some optional embodiments, various aspects of the traffic attack detection method provided by the present application can also be implemented in the form of a program product, which includes computer-executable instructions. When the program product is run on a computer device, the computer-executable instructions are used to enable the computer device to execute the steps of the traffic attack detection method according to various exemplary embodiments of the present application described above in this specification.

[0236] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0237] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0238] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0239] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0240] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0241] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A traffic attack detection method, characterized in that: The method includes: Determine a first feature vector corresponding to the data stream to be tested based on a feature value corresponding to the target feature of each data packet in the data stream to be tested; Inputting the first feature vector into an attack detection model, and determining a first category of the data flow to be tested through the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category represents whether the data flow to be tested is normal; The second category of the first data flow is determined by an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes preset attack types.

2. The method according to claim 1, characterized in that Determining a first feature vector corresponding to the data stream to be tested based on a feature value corresponding to a target feature of each data packet in the data stream to be tested includes: For any target feature, based on the feature value of each data packet in the data stream to be tested of the target feature, determine at least one second feature value of the data stream to be tested of the target feature; and based on the time interval between adjacent data packets in the data stream to be tested, determine the target time interval of the data stream to be tested; The first feature vector is generated based on the second feature values ​​of all target features of the data flow to be tested and the target time interval.

3. The method according to claim 2, characterized in that Determining at least one second characteristic value of the target feature of the data flow to be tested based on the characteristic value of each data packet in the data flow to be tested, comprising: The minimum characteristic value of the target characteristic of all data packets in the data stream to be tested, the maximum characteristic value of the target characteristic of all data packets in the data stream to be tested, and the standard deviation of the target characteristic of all data packets in the data stream to be tested are determined as the second characteristic value.

4. The method according to claim 2, characterized in that Determining a target time interval of the data stream to be tested based on the time interval between adjacent data packets in the data stream to be tested includes: The shortest time interval between adjacent data packets in the data stream to be tested is determined as the target time interval.

5. The method according to claim 1, characterized in that Before determining the second category of the first data flow by using the attack identification model, the method further includes: Performing dimension conversion and normalization processing on the first eigenvector of the first data stream to obtain a second eigenvector of the first data stream; The second feature vector is input into the attack identification model.

6. The method according to claim 1, characterized in that The output of the attack identification model also includes a normal category; the method also includes: Determining whether a second data flow in a target time period is the second category or the normal category by using the attack identification model; wherein the second data flow is a data flow to be tested other than the first data flow; If the number of the second data flows of the second category exceeds a preset number, the attack detection model is adjusted based on the second data flows of the second category.

7. The method according to claim 1, characterized in that Before determining the first feature vector corresponding to the data stream to be tested based on the feature value corresponding to the target feature of each data packet in the data stream to be tested, the method further includes: Determining that there is no flow identifier corresponding to the data flow to be tested in the data flow library; After the first feature vector is input into the attack detection model, the method further includes: The data flow library is updated based on the category of the data flow to be tested.

8. The method according to claim 7, characterized in that Also includes: If there is a flow identifier corresponding to the data flow to be tested in the data flow library, the category of the data flow to be tested is queried from the data flow library.

9. The method according to claim 8, characterized in that Also includes: If the occupancy rate of the data stream library is greater than a preset occupancy rate, information corresponding to at least one data stream is deleted based on the query time of the data stream in the data stream library.

10. A flow attack detection device, characterized in that: The device includes: A feature extraction module, used to determine a first feature vector corresponding to the data stream to be tested based on a feature value corresponding to a target feature of each data packet in the data stream to be tested; An attack detection module, configured to input the first feature vector into an attack detection model, and determine a first category of the data flow to be tested through the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category represents whether the data flow to be tested is normal; An attack identification module is used to determine the second category of the first data flow through an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes preset attack types.

11. An electronic device, characterized in that: The method comprises at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the method according to any one of claims 1 to 9.

Images