Traffic attack detection method, device and electronic equipment

Abstract

The embodiment of the present application provides a flow attack detection method, device and electronic device, the method comprising: determining a first feature vector corresponding to the data flow to be tested based on the feature value corresponding to the target feature of each data packet in the data flow to be tested; inputting the first feature vector into an attack detection model, and determining the first category of the data flow to be tested through the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category characterizes whether the data flow to be tested is normal; determining the second category of the first data flow through an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes a preset attack type. The two-level recognition architecture of the attack detection model and the attack identification model is adopted to speed up the detection speed, improve the real-time response capability of the detection, and realize the fine identification of network attacks, thereby improving the accuracy and reliability of the detection.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a traffic attack detection method, device, and electronic device. Background Art

[0002] With the rapid development of internet technology, cyberattacks are increasing, and network security issues are becoming increasingly prominent. Cyberattacks not only impact service availability but can also cause significant economic losses and reputational damage. For example, a common cyberattack method, Distributed Denial of Service (DDOS), exploits network resources to launch a large number of requests, exhausting the target system's bandwidth or processing power, preventing legitimate users from accessing services.

[0003] In related technologies, methods based on traffic statistics identify abnormal traffic by analyzing the characteristics of network traffic, such as traffic size and frequency.

[0004] However, the above method not only requires a large amount of computing resources, but also has low detection efficiency and low detection accuracy. Summary of the Invention

[0005] The embodiments of the present application provide a traffic attack detection method, device, and electronic device for efficiently and accurately performing traffic attack detection.

[0006] In a first aspect, an embodiment of the present application provides a first traffic attack detection method, the method comprising:

[0007] Determining a first eigenvector corresponding to the data stream to be tested based on a eigenvalue corresponding to the target feature of each data packet in the data stream to be tested;

[0008] Inputting the first feature vector into an attack detection model, and determining a first category of the data flow to be tested by the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category represents whether the data flow to be tested is normal;

[0009] The second category of the first data flow is determined by an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes a preset attack type.

[0010] In some optional implementations, determining a first eigenvector corresponding to the data stream to be tested based on a eigenvalue corresponding to a target feature of each data packet in the data stream to be tested includes:

[0011] For any target feature, determining at least one second feature value of the data flow to be tested for the target feature based on the feature value of each data packet in the data flow to be tested; and determining a target time interval of the data flow to be tested based on the time interval between adjacent data packets in the data flow to be tested;

[0012] The first feature vector is generated based on the second feature values ​​of all target features of the data stream to be measured and the target time interval.

[0013] In some optional implementations, determining at least one second characteristic value of the target feature of the data flow to be tested based on the characteristic value of each data packet in the data flow to be tested includes:

[0014] The minimum characteristic value of the target characteristic of all data packets in the data stream to be tested, the maximum characteristic value of the target characteristic of all data packets in the data stream to be tested, and the standard deviation of the target characteristic of all data packets in the data stream to be tested are determined as the second characteristic value.

[0015] In some optional implementations, determining a target time interval of the data flow to be tested based on a time interval between adjacent data packets in the data flow to be tested includes:

[0016] The shortest time interval between adjacent data packets in the data stream to be tested is determined as the target time interval.

[0017] In some optional implementations, before determining the second category of the first data flow using the attack identification model, the method further includes:

[0018] Performing dimension conversion and normalization processing on the first eigenvector of the first data stream to obtain a second eigenvector of the first data stream;

[0019] The second feature vector is input into the attack recognition model.

[0020] In some optional implementations, the output of the attack identification model further includes a normal category; and the method further includes:

[0021] Determining whether a second data flow within a target time period is the second category or the normal category by using the attack identification model; wherein the second data flow is a data flow to be tested other than the first data flow;

[0022] If the number of the second data flows of the second category exceeds a preset number, the attack detection model is adjusted based on the second data flows of the second category.

[0023] In some optional implementations, before determining the first eigenvector corresponding to the data stream to be tested based on the eigenvalue corresponding to the target feature of each data packet in the data stream to be tested, the method further includes:

[0024] Determining that there is no flow identifier corresponding to the data flow to be tested in the data flow library;

[0025] After inputting the first feature vector into the attack detection model, the method further includes:

[0026] The data flow library is updated based on the category of the data flow to be tested.

[0027] Some optional implementations further include:

[0028] If there is a flow identifier corresponding to the data flow to be tested in the data flow library, the category of the data flow to be tested is queried from the data flow library.

[0029] Some optional implementations further include:

[0030] If the occupancy rate of the data stream library is greater than a preset occupancy rate, information corresponding to at least one data stream is deleted based on the query time of the data stream in the data stream library.

[0031] In a second aspect, an embodiment of the present application provides a first traffic attack detection device, which includes:

[0032] A feature extraction module, configured to determine a first feature vector corresponding to the data stream to be tested based on a feature value corresponding to a target feature of each data packet in the data stream to be tested;

[0033] an attack detection module, configured to input the first feature vector into an attack detection model, and determine a first category of the data flow to be tested using the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category indicates whether the data flow to be tested is normal;

[0034] An attack identification module is used to determine the second category of the first data flow through an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes a preset attack type.

[0035] In some optional implementations, the feature extraction module is specifically configured to:

[0036] For any target feature, determining at least one second feature value of the data flow to be tested for the target feature based on the feature value of each data packet in the data flow to be tested; and determining a target time interval of the data flow to be tested based on the time interval between adjacent data packets in the data flow to be tested;

[0037] The first feature vector is generated based on the second feature values ​​of all target features of the data stream to be measured and the target time interval.

[0038] In some optional implementations, the feature extraction module is specifically configured to:

[0039] The minimum characteristic value of the target characteristic of all data packets in the data stream to be tested, the maximum characteristic value of the target characteristic of all data packets in the data stream to be tested, and the standard deviation of the target characteristic of all data packets in the data stream to be tested are determined as the second characteristic value.

[0040] In some optional implementations, the feature extraction module is specifically configured to:

[0041] The shortest time interval between adjacent data packets in the data stream to be tested is determined as the target time interval.

[0042] In some optional implementations, the attack identification module, before determining the second category of the first data flow using the attack identification model, is further configured to:

[0043] Performing dimension conversion and normalization processing on the first eigenvector of the first data stream to obtain a second eigenvector of the first data stream;

[0044] The second feature vector is input into the attack recognition model.

[0045] In some optional implementations, the output of the attack identification model further includes a normal category; and the attack identification module is further configured to:

[0046] Determining whether a second data flow within a target time period is the second category or the normal category by using the attack identification model; wherein the second data flow is a data flow to be tested other than the first data flow;

[0047] If the number of the second data flows of the second category exceeds a preset number, the attack detection model is adjusted based on the second data flows of the second category.

[0048] Some optional embodiments further include a query module for determining that there is no flow identifier corresponding to the data flow to be tested in the data flow library before the feature extraction module determines the first feature vector corresponding to the data flow to be tested based on the feature value corresponding to the target feature of each data packet in the data flow to be tested;

[0049] It is also configured to update the data flow library based on the category of the data flow to be tested after the attack detection module inputs the first feature vector into the attack detection model.

[0050] In some optional implementations, the query module is further configured to:

[0051] If there is a flow identifier corresponding to the data flow to be tested in the data flow library, the category of the data flow to be tested is queried from the data flow library.

[0052] In some optional implementations, the query module is further configured to:

[0053] If the occupancy rate of the data stream library is greater than a preset occupancy rate, information corresponding to at least one data stream is deleted based on the query time of the data stream in the data stream library.

[0054] In a third aspect, an embodiment of the present application provides an electronic device comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes any of the traffic attack detection methods described in the first aspect.

[0055] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a processor. When the program runs on the processor, the processor executes the traffic attack detection method described in any one of the first aspects above.

[0056] In an embodiment of the present application, a first eigenvector representing the flow characteristics of the data flow to be tested is accurately determined based on the eigenvalue corresponding to the target characteristic of each data packet in the data flow to be tested; an attack detection model and an attack identification model are adopted, combined with a symmetric tree structure and machine learning technology, and an initial detection is first performed through the attack detection model. Due to the symmetric tree structure, the same tree structure is used in the training and prediction stages, which greatly accelerates the detection speed of the model, thereby improving the real-time response capability of the detection process; and then subsequent fine identification is performed through the attack identification model to achieve accurate identification and classification of potential network attack traffic, thereby improving the accuracy and reliability of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0058] Figure 1 A flow chart of the first traffic attack detection method provided in an embodiment of the present application;

[0059] Figure 2 A second category of schematic diagrams provided in an embodiment of the present application;

[0060] Figure 3 A schematic diagram of the first eigenvector provided in an embodiment of the present application;

[0061] Figure 4 Schematic diagram of the attack identification model provided in the embodiment of the present application;

[0062] Figure 5 A flow chart of a second method for detecting traffic attacks provided in an embodiment of the present application;

[0063] Figure 6 A flow chart of a third method for detecting traffic attacks provided in an embodiment of the present application;

[0064] Figure 7 A schematic diagram of the structure of a traffic attack detection device provided in an embodiment of the present application;

[0065] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] To make the objectives, technical solutions, and advantages of this application more clear, this application will be further described in detail below with reference to the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0067] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature specified as "first" or "second" may explicitly or implicitly include one or more of such features. Throughout this application, unless otherwise specified, "plurality" means two or more.

[0068] In the description of this application, it should be noted that, unless otherwise specified or limited, the term "connection" should be understood in a broad sense. For example, it can mean direct connection, indirect connection through an intermediate medium, or internal communication between two devices. Those skilled in the art will understand the specific meaning of the above terms in this application based on specific circumstances.

[0069] Cyberattacks not only affect service availability but can also cause significant financial losses and reputational damage. For example, DDOS, a common cyberattack, exploits network resources to launch a large number of requests, exhausting the target system's bandwidth or processing power, preventing legitimate users from accessing services.

[0070] In related technologies, methods based on traffic statistics identify abnormal traffic by analyzing the characteristics of network traffic, such as traffic size and frequency.

[0071] However, the above method not only requires a large amount of computing resources, but also has low detection efficiency and low detection accuracy.

[0072] In some embodiments, attack detection is performed based on signatures, but this approach relies on matching known attack patterns and has limited ability to identify emerging or variant attack patterns.

[0073] In view of this, an embodiment of the present application proposes a traffic attack detection method, device and electronic device, the method comprising: determining a first feature vector corresponding to the data flow to be tested based on the feature value corresponding to the target feature of each data packet in the data flow to be tested; inputting the first feature vector into an attack detection model, and determining the first category of the data flow to be tested through the attack detection model; wherein, the attack detection model includes a symmetric tree structure, and the first category characterizes whether the data flow to be tested is normal; determining the second category of the first data flow through an attack identification model; wherein, the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes preset attack types.

[0074] The above scheme accurately determines the first eigenvector representing the flow characteristics of the data flow to be tested based on the eigenvalues ​​corresponding to the target characteristics of each data packet in the data flow to be tested; adopts the attack detection model and the attack identification model, combined with the symmetric tree structure and machine learning technology, and first performs initial detection through the attack detection model. Due to the symmetric tree structure, the same tree structure is used in the training and prediction stages, which greatly accelerates the detection speed of the model, thereby improving the real-time response capability of the detection process; and then performs subsequent fine identification through the attack identification model to achieve accurate identification and classification of potential network attack traffic, thereby improving the accuracy and reliability of detection.

[0075] The following will be combined with the accompanying drawings and specific embodiments to explain in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0076] Figure 1 The flow chart of the first flow attack detection method provided in the embodiment of the present application is as follows: Figure 1 As shown, the following steps are included:

[0077] Step S101: determining a first eigenvector corresponding to the data flow to be tested based on a eigenvalue corresponding to a target feature of each data packet in the data flow to be tested.

[0078] During implementation, since network traffic involves many features, some features are more important for classification, while some features appear less frequently and are not important for classification. Therefore, it is necessary to determine several target features that are more important for classification, so that feature extraction can be carried out effectively and accurate detection can be achieved.

[0079] This embodiment does not specifically limit the method for determining the target features. In some embodiments, based on all sample features in the sample data set, a random forest is used to determine the feature importance index. The feature importance index reflects the contribution of each feature to the classification or regression task, and feature selection is then performed based on the feature importance index.

[0080] For example, we use the CICDDos2019 dataset (a DDos detection dataset). CICFDDos2019 includes more than 1 million benign flows and more than 30 million malicious flows, including 13 types of DDos attacks, such as NTP, DNS, LDAP, MSSQL, and NetBIOS. We extract 83 sample features from it.

[0081] Calculate the information gain IG(D p ,f), Among them, I G (D p ) is the Gini index of the parent node p, I G (D j ) is the Gini index of child node j, N p and N j are the number of samples in the parent node and child node respectively.

[0082] The Gini index measures the impurity of the sample categories in a node. Its value ranges from 0 to 1, where 0 indicates that the dataset is completely pure (all data points belong to the same category) and 1 indicates that the dataset is completely chaotic (categories are evenly distributed). The lower the Gini index, the higher the purity of the dataset. The calculation formula is:

[0083] where J is the number of categories and p(j|t) is the frequency of category j in node t.

[0084] Information gain is a metric used in decision tree algorithms to select the best splitting feature. It measures the reduction in uncertainty in a dataset after a feature split. A high information gain indicates that the feature is more effective in reducing data impurity. Normalize the information gain of the sample features and select the top M most important features. For example, the top seven most important features are selected as target features: minimum packet length, minimum forward packet size, minimum backward packet size, minimum forward packet transmission interval, backward initialization window size, packet length standard deviation, and forward packet header length.

[0085] After the target feature is determined, the packet feature consisting of the feature values ​​corresponding to the target feature of the data packet can be determined.

[0086] Since packet features are the properties of a single network packet, by performing aggregate analysis on the data packet features in the network traffic, the packet-level features are converted into flow-level features (first feature vector). Based on this first feature vector, a more comprehensive traffic analysis can be provided, thereby improving the accuracy of attack detection.

[0087] This embodiment does not specifically limit the method for obtaining data packets in the data flow to be tested. For example, an event window W is set within this window, and data packets with the same flow ID are treated as a data flow to be tested. A flow ID is a basic element used to identify a specific network flow in network traffic analysis. It is usually called a quintuple and includes: Source IP Address, Destination IP Address, Source Port Number, Destination Port Number, and Transport Layer Protocol.

[0088] Step S102: inputting the first feature vector into an attack detection model, and determining a first category of the data flow to be tested through the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category represents whether the data flow to be tested is normal.

[0089] During implementation, if attack detection is performed directly through a deep learning model, the detection speed is low and the time consumption is long. Based on this, this embodiment first performs initial detection through an attack detection model with a symmetric tree structure. Due to the symmetric tree structure, the same tree structure (tree depth and splitting rules) is used in the training and prediction stages, which greatly speeds up the detection speed of the model, thereby improving the real-time response capability of the detection process.

[0090] Exemplarily, the attack detection model may adopt a Catboost (an open source machine learning library) model.

[0091] Taking the Catboost model as an example, training is performed in the following way:

[0092] 1. Initialize a model containing T decision trees;

[0093] 2. For each tree t (t = 1, 2, ..., T), calculate the negative gradient of the loss function x i is the first eigenvector of the sample, y i is the first category of the sample;

[0094] Fitting the basic model: f t (x i )=f t-1 (x i )+η·Gradient t ; Among them, f t (x i ) is the prediction function of the t-th tree, and η is the learning rate parameter.

[0095] 3. Add regularization to control model complexity t =λ·||f t ||2 2 ;

[0096] Update model parameters

[0097] During implementation, after training an attack detection model, it can be evaluated. Model performance can be assessed through cross-validation or a holdout set, and the optimal number of iterations T and parameter settings can be selected. Attack detection models can be evaluated based on both detection capability and efficiency.

[0098] Exemplarily, the detection capability parameters include some or all of the following:

[0099] Accuracy is the ratio of correctly predicted abnormal traffic to normal traffic in all traffic; Accuracy = (TP + TN) / (TP + FP + FN + TN);

[0100] Precision is the ratio of correctly predicted abnormal traffic to all predicted abnormal traffic; Precision = TP / (TP+FP);

[0101] Recall is the ratio of correctly predicted abnormal traffic to all abnormal traffic; Recall = TP / (TP+FN);

[0102] F1 Score is the balanced average of precision and recall;

[0103] Among them, TP is the correctly predicted abnormal traffic, TN is the correctly predicted normal traffic, FP is the normal traffic wrongly predicted as abnormal, and FN is the abnormal traffic wrongly predicted as normal.

[0104] Detection efficiency can be measured by the time it takes the central processing unit (CPU) to process each flow.

[0105] For example, average processing efficiency (MPE) = CPU Time / Test Sets, where CPU Time is the total number of clock ticks used to process the TestSets stream.

[0106] Step S103: Determine the second category of the first data flow through an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes a preset attack type.

[0107] In practice, the attack detection model has limited accuracy and only performs a binary classification of traffic (normal or not), making it difficult to further determine the attack type corresponding to abnormal traffic;

[0108] Based on this, this embodiment also sets up an attack recognition model, such as a convolutional neural network (CNN), to further identify the attack type.

[0109] This embodiment does not limit the specific implementation of the second category, and attack methods with similar behavioral characteristics can be regarded as the same attack type.

[0110] Take DDOS attack as an example, see Figure 2 As shown in the figure, User Datagram Protocol Flood (UDP Flood) and User Datagram Protocol Lag (UDP-Lag) belong to the first type of User Datagram Protocol (UDP) attacks.

[0111] The Transmission Control Protocol (TCP) three-way handshake attack (SYNFlood) attack belongs to the first type of TCP attack;

[0112] Microsoft SQL Server (MSSQL) attacks and Simple Service Discovery Protocol (SSDP) flood attacks are considered Type 2 TCP attacks or UDP / TCP hybrid attacks.

[0113] Character Generator (CharGen) attacks, Network Time Protocol (NTP) attacks, and Trivial File Transfer Protocol (TFTP) attacks belong to the second type of UDP attacks or UDP / TCP mixed attacks.

[0114] Among them, the first type of UDP attack and the first type of TCP attack have similar behavioral characteristics, and they are regarded as protocol exploitation attacks;

[0115] The second type of UDP attack, the second type of TCP attack, and the UDP / TCP mixed attack have similar behavioral characteristics and are considered as reflection-based and amplification attacks.

[0116] The above scheme accurately determines the first eigenvector representing the flow characteristics of the data flow to be tested based on the eigenvalues ​​corresponding to the target characteristics of each data packet in the data flow to be tested; adopts the attack detection model and the attack identification model, combined with the symmetric tree structure and machine learning technology, and first performs initial detection through the attack detection model. Due to the symmetric tree structure, the same tree structure is used in the training and prediction stages, which greatly accelerates the detection speed of the model, thereby improving the real-time response capability of the detection process; and then performs subsequent fine identification through the attack identification model to achieve accurate identification and classification of potential network attack traffic, thereby improving the accuracy and reliability of detection.

[0117] In some optional implementations, the above step S101 may be implemented by, but not limited to, the following methods:

[0118] For any target feature, determining at least one second feature value of the data flow to be tested for the target feature based on the feature value of each data packet in the data flow to be tested; and determining a target time interval of the data flow to be tested based on the time interval between adjacent data packets in the data flow to be tested;

[0119] The first feature vector is generated based on the second feature values ​​of all target features of the data stream to be measured and the target time interval.

[0120] See Figure 3 As shown, each data packet corresponds to a characteristic value of a target feature and a timestamp. Each target feature is independent of each other. The characteristic values ​​of each target feature of the data packet are integrated to determine at least one second characteristic value of the target feature of the data stream to be tested. That is, each target feature can correspond to one or more second characteristic values.

[0121] The timestamp reflects the time information of the data packet. Based on the time interval between adjacent data packets, the target time interval of the flow characteristics of the data flow to be tested is determined;

[0122] Combining the above two pieces of information, the first eigenvector of the data stream to be tested is determined.

[0123] In some optional implementations, the second eigenvalue is determined by:

[0124] The minimum characteristic value of the target characteristic of all data packets in the data stream to be tested, the maximum characteristic value of the target characteristic of all data packets in the data stream to be tested, and the standard deviation of the target characteristic of all data packets in the data stream to be tested are determined as the second characteristic value.

[0125] Because the data stream under test contains multiple packets, the minimum eigenvalue of a packet for a target characteristic represents the lower limit of the target characteristic for the data stream under test, while the maximum eigenvalue of a packet for a target characteristic represents the upper limit of the target characteristic for the data stream under test. These two values ​​cover the range of values ​​for the target characteristic for the data stream under test. The standard deviation, on the other hand, reflects the degree of dispersion of the data stream under test for the target characteristic. Therefore, using these values ​​as the second eigenvalue can fully reflect the characteristic information of the data stream under test for the target characteristic.

[0126] For example, the minimum eigenvalue f min =min({f k |p∈P i ,k=1,...,n});

[0127] Maximum eigenvalue f max =max({f k |p∈P i ,k=1,...,n});

[0128] -Standard deviation

[0129] Among them, p is the data packet, P i is the data stream i, f to be tested k P i The characteristic value of the k-th target feature of the data packet p, P i The average feature value of the kth target feature of data packet p;

[0130] The second eigenvalue of the target feature is {f min ,f max ,f std}.

[0131] In some optional implementations, the target time interval is determined by:

[0132] The shortest time interval between adjacent data packets in the data stream to be tested is determined as the target time interval.

[0133] For example, the data stream P to be tested is calculated i The time interval Δt between all adjacent data packets in pk,pj =t pj -t pk , and determine the shortest time interval T min =min({Δt pk,pj |pk,pj∈P i ,t pj >t pk}), as the target time interval at the stream level.

[0134] In some optional implementations, before the above step S103, the following steps are further performed:

[0135] Performing dimension conversion and normalization processing on the first eigenvector of the first data stream to obtain a second eigenvector of the first data stream;

[0136] The second feature vector is input into the attack recognition model.

[0137] During implementation, in order to facilitate calculation of the attack identification model, the first eigenvector is first dimensionally transformed and normalized to obtain a second eigenvector of the first data stream, and the second eigenvector is input into the attack identification model.

[0138] Take the attack recognition model as a CNN model as an example, see Figure 4 As shown, it includes convolutional layers, pooling layers, and fully connected layers;

[0139] During training, we first adjust the input vector to a 3D vector of shape (n, n_step, n_input); where n is the number of sample data streams fed into the network, n_step is the number of times the feature is fed to the hidden layer, and n_input is the first feature vector of the sample.

[0140] Use flattening to convert the vector of a single sample from (n_step, n_input) to (n_step, n_input, 1), and perform normalization to obtain the second eigenvector.

[0141] When the model is used, the first eigenvector of the first data stream is converted to (n_step, n_input, 1) and normalized to obtain its second eigenvector.

[0142] In the CNN model, the first convolutional layer contains nf zero-filled filters of size (fs, fs). The activation function used is Relu, and the output of the first layer is X1c , X1 c The shape is (n, n_step, n_input, nf);

[0143] The convolution layer is followed by a pooling layer with a stride of st and a pooling size of (ps,ps). The activation function Relu is used to obtain the output X2 of the second layer. c , X2 c The shape is (n, [n_step / ps], [n_input / ps], nf);

[0144] The output of the third layer is the information representing the second category.

[0145] In some optional implementations, the output of the attack identification model further includes a normal category; based on any embodiment, the following steps are further performed:

[0146] Determining whether a second data flow within a target time period is the second category or the normal category by using the attack identification model; wherein the second data flow is a data flow to be tested other than the first data flow;

[0147] If the number of the second data flows of the second category exceeds a preset number, the attack detection model is adjusted based on the second data flows of the second category.

[0148] Since this embodiment sets up a two-level model, the attack detection model can detect efficiently, but the accuracy is not as good as the attack identification model;

[0149] Based on this, in order to reduce the occurrence of missed detections, this embodiment optimizes the attack detection model based on the attack identification model.

[0150] Since the second data stream is determined to be normal by the attack detection model, the attack identification model is used to determine whether the second data stream is normal, and the number of second data streams (determined to be of the second category by the attack identification model) that differ from the judgment of the attack detection model within the target time period is counted; if the number exceeds the preset number, it means that the attack detection model has a high missed detection rate. The attack detection model is adjusted based on the second data stream of the second category to improve the detection effect of the attack detection model on this type of second data stream.

[0151] This embodiment does not specifically limit the triggering method of the optimization process, such as triggering based on user instructions, or triggering at regular intervals, etc.

[0152] Figure 5 A flow chart of the second flow attack detection method provided in the embodiment of the present application is shown as follows: Figure 5 As shown, the following steps are included:

[0153] Step S501: Determine whether there is a flow identifier corresponding to the data flow to be tested in the data flow library.

[0154] As described above, based on the data flow, the corresponding flow ID can be determined. The source IP address, destination IP address, source port number, destination port number, and transport layer protocol of the data flows with the same flow ID are the same, and the corresponding categories are also the same.

[0155] Based on this, this embodiment sets up a data stream library to store data streams of determined categories;

[0156] Based on the flow identifier corresponding to the data flow to be tested, a query is performed in the data flow library to determine whether there is a flow identifier corresponding to the data flow to be tested in the data flow library; if so, the corresponding category is determined from the data flow library; if not, the subsequent feature extraction and detection process is performed.

[0157] This embodiment does not specifically limit the storage method of the data stream library. Exemplarily, it is stored in a data structure composed of a hash table and a linked list.

[0158] Define a hash function h: "Flow ID" → "index" to map the Flow ID to an index in the hash table, so that the corresponding linked list can be accessed quickly. Let the Flow ID be e and the hash function be h(), then the function h(e) can determine the flow index where the packet is located. Maintain a linked list L at the hash table index h(e) h(e) , the elements in the linked list are arranged in ascending order of timestamps, that is, for any two data packets p in the linked list m and p n , if p m Timestamp < timestamp, then p m In p n Before.

[0159] Step S502: If there is no flow identifier corresponding to the data flow to be tested in the data flow library, a first feature vector corresponding to the data flow to be tested is determined based on the feature value corresponding to the target feature of each data packet in the data flow to be tested.

[0160] Step S503: inputting the first feature vector into an attack detection model, and determining a first category of the data flow to be tested through the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category represents whether the data flow to be tested is normal.

[0161] Step S504: Determine the second category of the first data flow through an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes a preset attack type.

[0162] The specific implementation of steps S502 to S504 can refer to other embodiments and will not be repeated here.

[0163] Step S505: updating the data flow library based on the category of the data flow to be tested.

[0164] For example, by searching for key k in the hash table, if key k does not exist, a new key-value pair (k, v) is inserted into the hash table, and a new node is inserted at the head of the doubly linked list to facilitate subsequent queries with the same flow identifier.

[0165] The category of the above-mentioned data flow to be tested is related to the detection result. If the first category of the data flow to be tested is normal, then the data flow to be tested has no corresponding second category; if the first category of the data flow to be tested is abnormal, then the data flow to be tested has a corresponding second category.

[0166] Figure 6 A flow chart of the third flow attack detection method provided in the embodiment of the present application is shown as follows: Figure 6 As shown, the following steps are included:

[0167] Step S601: Determine whether there is a flow identifier corresponding to the data flow to be tested in the data flow library.

[0168] The specific implementation of step S601 can refer to other embodiments and will not be repeated here.

[0169] Step S602: If there is a flow identifier corresponding to the data flow to be tested in the data flow library, the category of the data flow to be tested is queried from the data flow library.

[0170] As described above, in some embodiments, a hash table is established in the data stream library, and the category of the data stream to be tested is directly queried by searching the hash table for the key k if the key k exists.

[0171] In this embodiment, when there is a flow identifier corresponding to the data flow to be tested in the data flow library, the category of the data flow to be tested is directly queried from the data flow library, thereby further improving the detection efficiency.

[0172] In some optional implementation manners, based on any of the above embodiments, the following steps are further performed:

[0173] If the occupancy rate of the data stream library is greater than a preset occupancy rate, information corresponding to at least one data stream is deleted based on the query time of the data stream in the data stream library.

[0174] In the implementation, the data stream library caches the relevant information of the data stream. When the cache is full, it will affect the efficiency and performance of the cache.

[0175] Based on this, this embodiment performs cache management. If the occupancy rate of the data stream library is greater than the preset occupancy rate, it means that the cache is full. Based on the query time of the data stream in the data stream library, the information corresponding to at least one data stream is deleted, thereby eliminating the data items that have not been used for the longest time.

[0176] As mentioned above, some embodiments provide a hash table and a linked list;

[0177] By searching for key k in the hash table, if key k exists, access the corresponding node n in the doubly linked list through the pointer in the hash table; move node n to the head of the doubly linked list to indicate that it has been used recently.

[0178] If the key k does not exist, insert a new key-value pair (k, v) into the hash table and insert a new node at the head of the doubly linked list.

[0179] If the cache is full (|C|=C), or the occupancy rate is greater than the preset occupancy rate, the node at the end of the doubly linked list (which represents the data item that has not been used for the longest time) is eliminated, and the corresponding key-value pair is deleted from the hash table. That is, the data item that has not been accessed for the longest time will be removed first.

[0180] like Figure 7 As shown, the embodiment of the present application provides a traffic attack detection device 700, which includes:

[0181] A feature extraction module 701 is configured to determine a first feature vector corresponding to the data stream to be tested based on a feature value corresponding to a target feature of each data packet in the data stream to be tested;

[0182] an attack detection module 702 configured to input the first feature vector into an attack detection model and determine a first category of the data flow to be tested using the attack detection model; wherein the attack detection model comprises a symmetric tree structure, and the first category indicates whether the data flow to be tested is normal;

[0183] The attack identification module 703 is used to determine the second category of the first data flow through an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes a preset attack type.

[0184] In some optional implementations, the feature extraction module 701 is specifically configured to:

[0185] For any target feature, determining at least one second feature value of the data flow to be tested for the target feature based on the feature value of each data packet in the data flow to be tested; and determining a target time interval of the data flow to be tested based on the time interval between adjacent data packets in the data flow to be tested;

[0186] The first feature vector is generated based on the second feature values ​​of all target features of the data stream to be measured and the target time interval.

[0187] In some optional implementations, the feature extraction module 701 is specifically configured to:

[0188] The minimum characteristic value of the target characteristic of all data packets in the data stream to be tested, the maximum characteristic value of the target characteristic of all data packets in the data stream to be tested, and the standard deviation of the target characteristic of all data packets in the data stream to be tested are determined as the second characteristic value.

[0189] In some optional implementations, the feature extraction module 701 is specifically configured to:

[0190] The shortest time interval between adjacent data packets in the data stream to be tested is determined as the target time interval.

[0191] In some optional implementations, the attack identification module 703, before determining the second category of the first data flow using the attack identification model, is further configured to:

[0192] Performing dimension conversion and normalization processing on the first eigenvector of the first data stream to obtain a second eigenvector of the first data stream;

[0193] The second feature vector is input into the attack recognition model.

[0194] In some optional implementations, the output of the attack identification model further includes a normal category; and the attack identification module 703 is further configured to:

[0195] Determining whether a second data flow within a target time period is the second category or the normal category by using the attack identification model; wherein the second data flow is a data flow to be tested other than the first data flow;

[0196] If the number of the second data flows of the second category exceeds a preset number, the attack detection model is adjusted based on the second data flows of the second category.

[0197] Some optional implementations further include a query module 704 for determining, before the feature extraction module 701 determines the first feature vector corresponding to the data flow to be tested based on the feature value corresponding to the target feature of each data packet in the data flow to be tested, that there is no flow identifier corresponding to the data flow to be tested in the data flow library;

[0198] It is also configured to update the data flow library based on the category of the data flow to be tested after the attack detection module 702 inputs the first feature vector into the attack detection model.

[0199] In some optional implementations, the query module 704 is further configured to:

[0200] If there is a flow identifier corresponding to the data flow to be tested in the data flow library, the category of the data flow to be tested is queried from the data flow library.

[0201] In some optional implementations, the query module 704 is further configured to:

[0202] If the occupancy rate of the data stream library is greater than a preset occupancy rate, information corresponding to at least one data stream is deleted based on the query time of the data stream in the data stream library.

[0203] Since the device is the device in the method in the embodiment of the present application, and the principle of solving the problem by the device is similar to that of the method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0204] Based on the same technical concept, the embodiment of the present application further provides an electronic device 800, such as Figure 8 As shown, it includes at least one processor 801 and a memory 802 connected to the at least one processor. The specific connection medium between the processor 801 and the memory 802 is not limited in the embodiment of the present application. Figure 8 For example, the processor 801 and the memory 802 are connected via a bus 803. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0205] Among them, the processor 801 is the control center of the electronic device, which can use various interfaces and lines to connect various parts of the electronic device, and realize data processing by running or executing instructions stored in the memory 802 and calling data stored in the memory 802. Optionally, the processor 801 may include one or more processing units. The processor 801 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc., and the modem processor mainly processes the issuance of instructions. It is understandable that the above-mentioned modem processor may not be integrated into the processor 801. In some embodiments, the processor 801 and the memory 802 may be implemented on the same chip. In some embodiments, they may also be implemented separately on independent chips.

[0206] Processor 801 can be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiment of the traffic attack detection method can be directly implemented as a hardware processor, or can be implemented using a combination of hardware and software modules in the processor.

[0207] The memory 802 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 802 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 802 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 802 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0208] In the embodiment of the present application, the memory 802 stores a computer program. When the program is executed by the processor 801, the processor 801 executes:

[0209] Determining a first eigenvector corresponding to the data stream to be tested based on a eigenvalue corresponding to the target feature of each data packet in the data stream to be tested;

[0210] Inputting the first feature vector into an attack detection model, and determining a first category of the data flow to be tested by the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category represents whether the data flow to be tested is normal;

[0211] The second category of the first data flow is determined by an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes a preset attack type.

[0212] In some optional implementations, the processor 801 specifically performs:

[0213] For any target feature, determining at least one second feature value of the data flow to be tested for the target feature based on the feature value of each data packet in the data flow to be tested; and determining a target time interval of the data flow to be tested based on the time interval between adjacent data packets in the data flow to be tested;

[0214] The first feature vector is generated based on the second feature values ​​of all target features of the data stream to be measured and the target time interval.

[0215] In some optional implementations, the processor 801 specifically performs:

[0216] The minimum characteristic value of the target characteristic of all data packets in the data stream to be tested, the maximum characteristic value of the target characteristic of all data packets in the data stream to be tested, and the standard deviation of the target characteristic of all data packets in the data stream to be tested are determined as the second characteristic value.

[0217] In some optional implementations, the processor 801 specifically performs:

[0218] The shortest time interval between adjacent data packets in the data stream to be tested is determined as the target time interval.

[0219] In some optional implementations, before determining the second category of the first data flow using the attack identification model, the processor 801 further executes:

[0220] Performing dimension conversion and normalization processing on the first eigenvector of the first data stream to obtain a second eigenvector of the first data stream;

[0221] The second feature vector is input into the attack recognition model.

[0222] In some optional implementations, the output of the attack identification model further includes a normal category; and the processor 801 further executes:

[0223] Determining whether a second data flow within a target time period is the second category or the normal category by using the attack identification model; wherein the second data flow is a data flow to be tested other than the first data flow;

[0224] If the number of the second data flows of the second category exceeds a preset number, the attack detection model is adjusted based on the second data flows of the second category.

[0225] In some optional implementations, before determining the first eigenvector corresponding to the data stream to be tested based on the eigenvalue corresponding to the target feature of each data packet in the data stream to be tested, the processor 801 further executes:

[0226] Determining that there is no flow identifier corresponding to the data flow to be tested in the data flow library;

[0227] After inputting the first feature vector into the attack detection model, the processor 801 further executes:

[0228] The data flow library is updated based on the category of the data flow to be tested.

[0229] In some optional implementations, the processor 801 further executes:

[0230] If there is a flow identifier corresponding to the data flow to be tested in the data flow library, the category of the data flow to be tested is queried from the data flow library.

[0231] In some optional implementations, the processor 801 further executes:

[0232] If the occupancy rate of the data stream library is greater than a preset occupancy rate, information corresponding to at least one data stream is deleted based on the query time of the data stream in the data stream library.

[0233] Since the electronic device is the electronic device in the method in the embodiment of the present application, and the principle of solving the problem by the electronic device is similar to that of the method, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0234] Based on the same technical concept, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer program executable by a processor. When the program runs on the processor, the processor executes the steps of the above-mentioned traffic attack detection method.

[0235] In some optional embodiments, various aspects of the traffic attack detection method provided in the present application can also be implemented in the form of a program product, which contains computer-executable instructions. When the program product is run on a computer device, the computer-executable instructions are used to cause the computer device to execute the steps of the traffic attack detection method according to various exemplary embodiments of the present application described above in this specification.

[0236] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0237] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0238] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0239] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0240] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0241] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A traffic attack detection method, characterized in that: The method includes: Determining a first eigenvector corresponding to the data stream to be tested based on a eigenvalue corresponding to the target feature of each data packet in the data stream to be tested; Inputting the first feature vector into an attack detection model, and determining a first category of the data flow to be tested by the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category represents whether the data flow to be tested is normal; The second category of the first data flow is determined by an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes a preset attack type.

2. The method according to claim 1, wherein Determining a first eigenvector corresponding to the data stream to be tested based on a eigenvalue corresponding to a target feature of each data packet in the data stream to be tested includes: For any target feature, determining at least one second feature value of the data flow to be tested for the target feature based on the feature value of each data packet in the data flow to be tested; and determining a target time interval of the data flow to be tested based on the time interval between adjacent data packets in the data flow to be tested; The first feature vector is generated based on the second feature values ​​of all target features of the data stream to be measured and the target time interval.

3. The method according to claim 2, wherein Determining at least one second characteristic value of the target feature of the data flow to be tested based on the characteristic value of each data packet in the data flow to be tested, comprising: The minimum characteristic value of the target characteristic of all data packets in the data stream to be tested, the maximum characteristic value of the target characteristic of all data packets in the data stream to be tested, and the standard deviation of the target characteristic of all data packets in the data stream to be tested are determined as the second characteristic value.

4. The method according to claim 2, wherein Determining a target time interval of the data flow to be tested based on a time interval between adjacent data packets in the data flow to be tested includes: The shortest time interval between adjacent data packets in the data stream to be tested is determined as the target time interval.

5. The method according to claim 1, wherein Before determining the second category of the first data flow using the attack identification model, the method further includes: Performing dimension conversion and normalization processing on the first eigenvector of the first data stream to obtain a second eigenvector of the first data stream; The second feature vector is input into the attack recognition model.

6. The method according to claim 1, wherein The output of the attack identification model also includes a normal category; the method further includes: Determining whether a second data flow within a target time period is the second category or the normal category by using the attack identification model; wherein the second data flow is a data flow to be tested other than the first data flow; If the number of the second data flows of the second category exceeds a preset number, the attack detection model is adjusted based on the second data flows of the second category.

7. The method according to claim 1, wherein Before determining the first eigenvector corresponding to the data stream to be tested based on the eigenvalue corresponding to the target feature of each data packet in the data stream to be tested, the method further includes: Determining that there is no flow identifier corresponding to the data flow to be tested in the data flow library; After inputting the first feature vector into the attack detection model, the method further includes: The data flow library is updated based on the category of the data flow to be tested.

8. The method according to claim 7, wherein Also includes: If there is a flow identifier corresponding to the data flow to be tested in the data flow library, the category of the data flow to be tested is queried from the data flow library.

9. The method according to claim 8, wherein Also includes: If the occupancy rate of the data stream library is greater than a preset occupancy rate, information corresponding to at least one data stream is deleted based on the query time of the data stream in the data stream library.

10. A traffic attack detection device, characterized in that: The device includes: A feature extraction module, configured to determine a first feature vector corresponding to the data stream to be tested based on a feature value corresponding to a target feature of each data packet in the data stream to be tested; an attack detection module, configured to input the first feature vector into an attack detection model, and determine a first category of the data flow to be tested using the attack detection model; wherein the attack detection model includes a symmetric tree structure, and the first category indicates whether the data flow to be tested is normal; An attack identification module is used to determine the second category of the first data flow through an attack identification model; wherein the attack identification model is a deep learning model, the first data flow is an abnormal data flow to be tested, and the second category includes a preset attack type.

11. An electronic device, characterized in that: The system comprises at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the method according to any one of claims 1 to 9.

Images