Encrypted traffic attack detection method and system based on audio features, and medium

Abstract

The invention discloses an encrypted traffic attack detection method and system based on audio characteristics and a medium, and the method comprises the steps: dividing a network session stream through a quintuple, and converting the network session stream from a traffic pcap format to an audio wav format according to a binary relation between traffic bytes and audio signals; inputting the wav format file into an audio feature extraction algorithm, calculating framing parameters, and extracting MFCC audio features; and training a neural network model by using the MFCC audio features to realize encrypted traffic attack classification. According to the method, the problem of insufficient key attack feature extraction or key attack information loss in the network traffic can be avoided, expert knowledge dependence can be reduced, and subsequent feature extraction and attack detection are supported.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technologies such as cyberspace security and robot learning, and in particular to an encrypted traffic attack detection method, system and medium based on audio features. Background Art

[0002] Internet encrypted traffic mainly uses the TLS encryption protocol to encrypt the traffic transmission content, thereby achieving the purpose of protecting personal privacy and data, but at the same time it will hide malware and attack behaviors, adding challenges to network anomaly detection. Traditional anomaly detection methods for plaintext traffic mainly use payload-based deep packet inspection, while encryption protocols encrypt the transmission content, and it is necessary to decrypt the encrypted traffic before detection, which will consume a lot of resources and affect user privacy and security.

[0003] Anomaly detection methods for encrypted traffic are usually implemented based on machine learning algorithms. According to the different model input information, existing anomaly detection methods can be divided into three types, namely, detection methods based on statistical features, based on original traffic features, and based on hybrid features.

[0004] The detection method based on statistical features directly extracts the plaintext fields of encrypted traffic or calculates the statistical values ​​of samples as features, such as encryption suites, encryption protocol versions, packet lengths, payload lengths, etc. However, the extraction of statistical features relies on expert experience, and the statistical method is similar to that of plaintext traffic. In addition, the plaintext fields of encrypted traffic only exist in the handshake phase of the TLS protocol, and the features that can be extracted are limited. When new encryption technologies emerge, the protocol features need to be redesigned.

[0005] The detection method based on raw traffic features takes raw traffic as input, and uses a deep learning model to automatically mine the image features or word vectors of traffic bytes for detection. In terms of image features, researchers currently usually extract the first 784 bytes of raw traffic and convert them into 28×28 grayscale images, and use deep learning models such as CNN and RNN to automatically extract features. However, network attackers often use attack payloads to launch attacks, and directly intercepting and zero-filling the network will lead to problems such as missing or confusing key attack information. In terms of word vectors, word vectors are extracted from raw traffic bytes, and encrypted traffic classification is achieved using a natural language processing model after pre-training and fine-tuning stages. However, natural language processing models, such as Bert, have hundreds of millions of parameters, and the computing resources required by the model are large, which limits their practical applications.

[0006] The detection method based on hybrid features uses both raw traffic and statistical features as input to detect malicious traffic. For example, after constructing an undirected graph using the similarity of grayscale image features, the statistical features are set as node attributes, and then algorithms such as graph neural networks are used to obtain input data that integrates the two types of features, and finally classify them. This method uses multiple features as input and can achieve a high detection accuracy, but it also has the disadvantages of statistical features and raw traffic features.

[0007] In addition, some scholars have used sound to represent traffic data, which is called network traffic sonification. Security practitioners in the security operation center can detect and identify network attacks based on the deviation of traffic sound. Existing sonification methods usually match music attributes such as chords, pitch, beats, etc. with traffic attributes such as number of packets, packet length, transmission speed, etc., thereby converting network traffic into music. Finally, security analysts judge whether the network has been invaded by listening to the music. This method essentially uses the statistical characteristics of network traffic and manual analysis for attack detection, relies on expert experience to generate audio, and requires security analysts to distinguish network intrusions based on music, which requires security analysts to have high listening ability.

[0008] The encrypted traffic attack detection method using statistical features relies on expert experience to design features and has poor generalization ability. The method using raw traffic as input often causes key information to be missing or confused when intercepting or supplementing fixed-size features. Although the method using mixed features as input has better detection effects, it has the above two disadvantages. The audio format can represent the entire network traffic, but the current sonification technology relies on expert experience to generate audio and distinguish intrusion situations, which makes it difficult to expand and apply in practice. Summary of the invention

[0009] The main purpose of the present invention is to propose an encrypted traffic attack detection method, system and medium based on audio features, aiming to avoid the problem of insufficient extraction of key attack features in network traffic or missing key attack information, reduce dependence on expert knowledge, and support subsequent feature extraction and attack detection.

[0010] To achieve the above object, the present invention provides an encrypted traffic attack detection method based on audio features, the method comprising the following steps: Step S10, dividing the network session flow by five-tuples, and converting the network session flow from the flow pcap format to the audio wav format according to the binary relationship between the flow bytes and the audio signal; Step S20, inputting the wav format file into the audio feature extraction algorithm, calculating the frame parameters, and extracting the MFCC audio features; Step S30, using MFCC audio features to train a neural network model to achieve encrypted traffic attack classification.

[0011] A further technical solution of the present invention is that step S10 comprises: Step S101, dividing the original traffic pcap file into multiple independent session pcap files according to the five-tuple; Step S102: Convert the byte value of each session file into an audio signal value according to the byte mapping rule, thereby generating a digital audio file.

[0012] A further technical solution of the present invention is that the byte rule is defined as: The highest bit of the M-bit unsigned binary data in the network traffic is regarded as the sign bit, and is converted into M-bit signed binary data in the digital audio file, where M is 8, 16 or 24.

[0013] A further technical solution of the present invention is that the audio file is used to store a binary representation of an audio signal, and the audio signal in the digital audio is sampled at discrete time intervals.

[0014] A further technical solution of the present invention is that step S20 comprises: Step S201: divide the audio signal into several frames according to the set sampling rate, apply the window function to the audio signal of each frame according to the set window size, and obtain the time domain signal ; Step S202: convert the time domain signal Perform fast Fourier transform to convert it into frequency domain signal , the calculation formula is:

[0015] in, represents the total number of sampling points, n represents the nth sampling point, represents the kth spectral line in the frequency domain, j is an imaginary unit; Step S203: frequency domain signal Through multiple Mel filters, calculate the logarithmic energy of each filter group output , the calculation formula is:

[0016] in, represents the frequency domain response of the mth Mel filter, Refers to the total number of Mel filters, Represents the total number of sampling points, and n represents the nth sampling point; Step S204: Logarithmic energy Perform discrete cosine transform to obtain MFCC parameters; the longer the audio file length, the more MFCC parameters there are; MFCC parameters The calculation formula is:

[0017] in, represents the nth MFCC parameter, and M represents the total number of Mel filters.

[0018] A further technical solution of the present invention is that step S30 comprises: The extracted audio features of different sizes are sequentially input into the convolutional neural network model for training, and finally classified by the Softmax classifier; wherein, the convolutional neural network model includes a convolutional layer, a pooling layer, a Dropout layer, and a fully connected layer. The convolutional layer extracts features through convolution operation and inputs them into the ReLU activation function. The output is then input into the pooling layer for downsampling, and Dropout is used to prevent overfitting. An adaptive pooling layer is used to scale the features to a fixed size and then input them into the fully connected layer. Finally, a softmax classifier is used for classification.

[0019] To achieve the above object, the present invention also proposes an encrypted traffic attack detection system based on audio features, the system comprising a memory, a processor, and an encrypted traffic attack detection program based on audio features stored on the processor, the encrypted traffic attack detection program based on audio features performing the following steps when being run by the processor: The network session flow is divided into five-tuples, and the network session flow is converted from the traffic pcap format to the audio wav format according to the binary relationship between the traffic bytes and the audio signal; Input the wav format file into the audio feature extraction algorithm, calculate the frame parameters, and extract the MFCC audio features; The neural network model is trained using MFCC audio features to achieve encrypted traffic attack classification.

[0020] A further technical solution of the present invention is that when the encrypted traffic attack detection program based on audio features is executed by the processor, the following steps are further performed: Divide the original traffic pcap file into multiple independent session pcap files according to the five-tuple; According to the byte mapping rules, the byte value of each session file is converted into an audio signal value, thereby generating a digital audio file.

[0021] A further technical solution of the present invention is that the byte rule is defined as: The highest bit of the M-bit unsigned binary data in the network traffic is regarded as the sign bit, and is converted into M-bit signed binary data in the digital audio file, where M is 8, 16 or 24.

[0022] To achieve the above objectives, the present invention also proposes a computer-readable storage medium, which stores an encrypted traffic attack detection program based on audio features, and the encrypted traffic attack detection program based on audio features executes the steps of the method described above when run by a processor.

[0023] The beneficial effects of the encrypted traffic attack detection method, system and medium based on audio features of the present invention are: 1. The present invention maps traffic bytes to audio signals to form audio files, so that machine learning methods can be used to automatically extract audio features to achieve attack detection. Compared with the existing network traffic sonification technology that uses feature matching, it can reduce manual dependence and support subsequent feature extraction and traffic classification tasks.

[0024] 2. Existing encrypted traffic attack detection methods can only rely on expert experience to design features or extract features from fixed-size network flows. The audio feature extraction algorithm proposed in the present invention can extract features from all bytes of the traffic, can extract rich features contained in network traffic, and has generalization capabilities, and does not rely on expert experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0026] Figure 1 It is a flow chart of a preferred embodiment of the encrypted traffic attack detection method based on audio features of the present invention; Figure 2 is a detailed flow chart of step S10; Figure 3 It is a detailed flowchart of step S20.

[0027] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] In view of the technical problems existing in the prior art, the present invention uses audio features to realize encrypted traffic attack detection. After converting the network conversation flow into audio according to the binary correspondence between traffic bytes and audio signals, the audio feature extraction algorithm is used to extract features for each audio file, and finally input into the convolutional neural network model for training and classification.

[0030] In attack detection for encrypted traffic, the present invention fully considers the attack load in the conversation flow, and uses the audio feature extraction algorithm to automatically extract features from the entire network conversation flow, thus avoiding the problem of missing input information. In addition, the present invention realizes the audibility of network traffic through the correspondence between traffic bytes and audio signals, which can reduce the reliance on expert knowledge and support the automation process of subsequent feature extraction and attack detection.

[0031] The present invention proposes an encrypted traffic attack detection method based on audio features. After the encrypted traffic is converted into audio, the audio features are extracted and input into a convolutional neural network to realize attack classification. The main steps of the encrypted traffic attack detection method based on audio features of the present invention include network traffic auditory, audio feature extraction and attack classification based on convolutional neural networks.

[0032] Please refer to Figure 1 The preferred embodiment of the encrypted traffic attack detection method based on audio features of the present invention comprises the following steps: Step S10, dividing the network session flow by five-tuples, and converting the network session flow from the traffic pcap format to the audio wav format according to the binary relationship between the traffic bytes and the audio signal.

[0033] The audio obtained after network traffic is auditoryized has obvious distinguishing features, and the audio can represent the complete network session flow. Therefore, attack detection can be achieved by converting traffic into audio files.

[0034] Step S20, input the wav format file into the audio feature extraction algorithm, calculate the frame parameters, and extract the MFCC audio features.

[0035] In this step, audio features are extracted for all the obtained WAV format audio files. Mel frequency cepstrum coefficient (MFCC) is the current mainstream audio feature vector, which removes high-frequency noise while retaining the time domain and frequency domain features of the sound signal. It has the characteristics of simple extraction, high prediction accuracy, and good noise resistance.

[0036] Step S30, using MFCC audio features to train a neural network model to achieve encrypted traffic attack classification.

[0037] The existing encrypted traffic attack detection methods have problems such as poor generalization ability, missing input information, and large consumption of computing resources. This embodiment automatically extracts features from the entire network conversation flow through an audio feature extraction algorithm, and then uses a convolutional neural network for classification, which can avoid reliance on expert knowledge, make full use of rich network conversation flow information, and consume less computing resources than natural language processing models.

[0038] Please refer to Figure 2 In this embodiment, step S10 specifically includes: Step S101, dividing the original traffic pcap file into multiple independent session pcap files according to the quintuple.

[0039] Step S102: Convert the byte value of each session file into an audio signal value according to the byte mapping rule, thereby generating a digital audio file.

[0040] In step S10, the network traffic in pcap format is converted into digital audio in wav format by bytes. First, the original traffic pcap file is divided into multiple independent session pcap files according to the five-tuple (source IP, destination IP, source port, destination port, protocol). Then, according to the byte mapping rule, the byte value of each session file is converted into an audio signal value, thereby generating a digital audio file.

[0041] The byte mapping rule is defined as follows: the highest bit of the M-bit unsigned binary data in the network traffic is regarded as the sign bit, and thus converted into the M-bit signed binary data in the digital audio file, where M can be 8, 16, or 24. Audio files are used to store the binary representation of audio signals, and the audio signals in digital audio are sampled at discrete time intervals. These sampling time points are called sampling points, and the number of bits of the sampling points is called the sampling bit depth. The range of audio signal values ​​is determined by the sampling bit depth. The sampling bit depth indicates the accuracy of the audio signal, and common values ​​are 8 bits, 16 bits, 24 bits, etc. For example, when the sampling bit depth is 16 bits, the binary of the audio signal is a 16-bit signed integer; in the network traffic, 2 bytes are 16-bit unsigned binary, so by considering its highest bit as the sign bit, it can be mapped to the range of audio signal values, that is, an integer within [-32768, 32767].

[0042] Both network traffic and audio files can be converted into data streams composed of binary data. Therefore, network traffic can be converted into audio files through binary size, avoiding the expert knowledge dependence problem caused by generating audio files using feature matching.

[0043] Please refer to Figure 3 In this embodiment, step S20 includes: Step S201: divide the audio signal into several frames according to the set sampling rate, apply the window function to the audio signal of each frame according to the set window size, and obtain the time domain signal .

[0044] When the audio file is longer, the number of frames is more, and the audio signal is more. Common window functions include rectangular window, triangular window, Hanning window, Hamming window, and Gaussian window.

[0045] Step S202: convert the time domain signal Perform fast Fourier transform to convert it into frequency domain signal , the calculation formula is:

[0046] in, represents the total number of sampling points, n represents the nth sampling point, represents the kth spectral line in the frequency domain, and j is an imaginary unit.

[0047] Step S203: frequency domain signal Through multiple Mel filters, calculate the logarithmic energy of each filter group output , the calculation formula is:

[0048] in, represents the frequency domain response of the mth Mel filter, Refers to the total number of Mel filters, Represents the total number of sampling points, and n represents the nth sampling point.

[0049] Step S204: Logarithmic energy Perform discrete cosine transform to obtain MFCC parameters; the longer the audio file length, the more MFCC parameters there are; MFCC parameters The calculation formula is:

[0050] in, represents the nth MFCC parameter, and M represents the total number of Mel filters.

[0051] In this embodiment, the step S30 specifically includes: The extracted audio features of different sizes are sequentially input into the convolutional neural network model for training, and finally classified by the Softmax classifier; wherein, the convolutional neural network model includes a convolutional layer, a pooling layer, a Dropout layer, and a fully connected layer. The convolutional layer extracts features through convolution operation and inputs them into the ReLU activation function. The output is then input into the pooling layer for downsampling, and Dropout is used to prevent overfitting. An adaptive pooling layer is used to scale the features to a fixed size and then input them into the fully connected layer. Finally, a softmax classifier is used for classification.

[0052] The beneficial effects of the encrypted traffic attack detection method based on audio features of the present invention are: 1. The present invention maps traffic bytes to audio signals to form audio files, so that machine learning methods can be used to automatically extract audio features to achieve attack detection. Compared with the existing network traffic sonification technology using feature matching, it can reduce manual dependence and support subsequent feature extraction and traffic classification tasks; 2. Existing encrypted traffic attack detection methods can only rely on expert experience to design features or extract features from fixed-size network flows. The audio feature extraction algorithm proposed in the present invention can extract features from all bytes of the traffic, can extract rich features contained in network traffic, and has generalization capabilities, and does not rely on expert experience.

[0053] To achieve the above object, the present invention also proposes an encrypted traffic attack detection system based on audio features, the system comprising a memory, a processor, and an encrypted traffic attack detection program based on audio features stored on the processor, the encrypted traffic attack detection program based on audio features performing the following steps when being run by the processor: The network session flow is divided into five-tuples, and the network session flow is converted from the traffic pcap format to the audio wav format according to the binary relationship between the traffic bytes and the audio signal; Input the wav format file into the audio feature extraction algorithm, calculate the frame parameters, and extract the MFCC audio features; The neural network model is trained using MFCC audio features to achieve encrypted traffic attack classification.

[0054] Furthermore, when the encrypted traffic attack detection program based on audio features is executed by the processor, the following steps are also performed: Divide the original traffic pcap file into multiple independent session pcap files according to the five-tuple; According to the byte mapping rules, the byte value of each session file is converted into an audio signal value, thereby generating a digital audio file.

[0055] Furthermore, the byte rule is defined as: The highest bit of the M-bit unsigned binary data in the network traffic is regarded as the sign bit, and is converted into M-bit signed binary data in the digital audio file, where M is 8, 16 or 24.

[0056] The beneficial effects of the encrypted traffic attack detection system based on audio features of the present invention are: 1. The present invention maps traffic bytes to audio signals to form audio files, so that machine learning methods can be used to automatically extract audio features to achieve attack detection. Compared with the existing network traffic sonification technology using feature matching, it can reduce manual dependence and support subsequent feature extraction and traffic classification tasks; 2. Existing encrypted traffic attack detection methods can only rely on expert experience to design features or extract features from fixed-size network flows. The audio feature extraction algorithm proposed in the present invention can extract features from all bytes of the traffic, can extract rich features contained in network traffic, and has generalization capabilities, and does not rely on expert experience.

[0057] To achieve the above objectives, the present invention also proposes a computer-readable storage medium, which stores an encrypted traffic attack detection program based on audio features. When the encrypted traffic attack detection program based on audio features is executed by a processor, the steps of the method described in the above embodiment are executed, which will not be repeated here.

[0058] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. All equivalent structural changes made by using the contents of the present invention specification and drawings under the concept of the present invention, or directly / indirectly applied in other related technical fields are included in the patent protection scope of the present invention.

Claims

1. A method for detecting encrypted traffic attacks based on audio features, characterized in that: The method comprises the following steps: Step S10, dividing the network session flow by five-tuples, and converting the network session flow from the flow pcap format to the audio wav format according to the binary relationship between the flow bytes and the audio signal; Step S20, inputting the wav format file into the audio feature extraction algorithm, calculating the frame parameters, and extracting the MFCC audio features; Step S30, using MFCC audio features to train a neural network model to achieve encrypted traffic attack classification.

2. The method for detecting encrypted traffic attacks based on audio features according to claim 1, characterized in that: The step S10 comprises: Step S101, dividing the original traffic pcap file into multiple independent session pcap files according to the five-tuple; Step S102: Convert the byte value of each session file into an audio signal value according to the byte mapping rule, thereby generating a digital audio file.

3. The method for detecting encrypted traffic attacks based on audio features according to claim 2 is characterized in that: The byte rule is defined as: The highest bit of the M-bit unsigned binary data in the network traffic is regarded as the sign bit, and is converted into M-bit signed binary data in the digital audio file, where M is 8, 16 or 24.

4. The method for detecting encrypted traffic attacks based on audio features according to claim 2 is characterized in that: The audio file is used to store a binary representation of an audio signal. The audio signal in digital audio is sampled at discrete time intervals.

5. The method for detecting encrypted traffic attacks based on audio features according to claim 1 is characterized in that: The step S20 comprises: Step S201: divide the audio signal into several frames according to the set sampling rate, apply the window function to the audio signal of each frame according to the set window size, and obtain the time domain signal ; Step S202: convert the time domain signal Perform fast Fourier transform to convert it into frequency domain signal , the calculation formula is: ； in, represents the total number of sampling points, n represents the nth sampling point, represents the kth spectral line in the frequency domain, j is an imaginary unit; Step S203: frequency domain signal Through multiple Mel filters, calculate the logarithmic energy of each filter group output , the calculation formula is: ； in, represents the frequency domain response of the mth Mel filter, Refers to the total number of Mel filters, Represents the total number of sampling points, and n represents the nth sampling point; Step S204: Logarithmic energy Perform discrete cosine transform to obtain MFCC parameters; the longer the audio file length, the more MFCC parameters there are; MFCC parameters The calculation formula is: ； in, represents the nth MFCC parameter, and M represents the total number of Mel filters.

6. The method for detecting encrypted traffic attacks based on audio features according to claim 1, characterized in that: The step S30 comprises: The extracted audio features of different sizes are sequentially input into the convolutional neural network model for training, and finally classified by the Softmax classifier; wherein, the convolutional neural network model includes a convolutional layer, a pooling layer, a Dropout layer, and a fully connected layer. The convolutional layer extracts features through convolution operation and inputs them into the ReLU activation function. The output is then input into the pooling layer for downsampling, and Dropout is used to prevent overfitting. An adaptive pooling layer is used to scale the features to a fixed size and then input them into the fully connected layer. Finally, a softmax classifier is used for classification.

7. An encrypted traffic attack detection system based on audio features, characterized in that: The system includes a memory, a processor, and an encrypted traffic attack detection program based on audio features stored on the processor, and the encrypted traffic attack detection program based on audio features performs the following steps when executed by the processor: The network session flow is divided into five-tuples, and the network session flow is converted from the traffic pcap format to the audio wav format according to the binary relationship between the traffic bytes and the audio signal; Input the wav format file into the audio feature extraction algorithm, calculate the frame parameters, and extract the MFCC audio features; The neural network model is trained using MFCC audio features to achieve encrypted traffic attack classification.

8. The encrypted traffic attack detection system based on audio features according to claim 7 is characterized in that: When the encrypted traffic attack detection program based on audio features is executed by the processor, the following steps are further performed: Divide the original traffic pcap file into multiple independent session pcap files according to the five-tuple; According to the byte mapping rules, the byte value of each session file is converted into an audio signal value, thereby generating a digital audio file.

9. The encrypted traffic attack detection system based on audio features according to claim 8 is characterized in that: The byte rule is defined as: The highest bit of the M-bit unsigned binary data in the network traffic is regarded as the sign bit, and is converted into M-bit signed binary data in the digital audio file, where M is 8, 16 or 24.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores an encrypted traffic attack detection program based on audio features, and the encrypted traffic attack detection program based on audio features, when executed by a processor, performs the steps of the method described in any one of claims 1 to 6.

Images