Tunnel attack detection method and device and electronic equipment

Abstract

The invention discloses a tunnel attack detection method and device and electronic equipment. The method comprises the following steps: acquiring to-be-detected data transmitted in a terminal; a particle swarm optimization support vector machine model is adopted to detect the to-be-detected data, a detection result is obtained, and the particle swarm optimization support vector machine model is obtained through training based on behavior statistical characteristics and content statistical characteristics of historical data; and returning the target data of which the detection result is that the hidden tunnel attack exists to the terminal. According to the method and the device, the technical problem that hidden tunnel attacks cannot be timely and effectively identified due to relatively poor identification accuracy of ICMP tunnel attacks in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of network security threat detection, and specifically, to a method, device and electronic device for detecting tunnel attacks. Background Art

[0002] With the maturity of Internet technology and the rapid promotion of related applications, network security issues have become more serious. Computer viruses, Trojans and other attack methods have emerged in an endless stream, leading to serious information leakage problems. Among these attack methods, ICMP (Internet Control Message Protocol) covert tunnel attacks are very simple and efficient, and have become an important factor in undermining information security.

[0003] Generally speaking, ICMP tunneling uses the request (type 8) and response (type 0) messages of the ICMP protocol to hide malicious payloads in ICMP data packets, use the Ping command to establish a covert tunnel, and transmit forged data packets, thereby bypassing the blocking of firewalls and intrusion detection systems.

[0004] Therefore, compared with common leaking methods (such as viruses, Trojans, etc.), ICMP tunnels are more concealed and more difficult to detect. The identification and detection methods for ICMP tunnel attacks in related technologies cannot promptly and effectively identify the problem of concealed tunnel attacks.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present application provide a method, device and electronic device for detecting a tunnel attack, so as to at least solve the technical problem that due to the poor recognition accuracy of ICMP tunnel attacks in the related art, covert tunnel attacks cannot be identified in a timely and effective manner.

[0007] According to one aspect of an embodiment of the present application, a method for detecting a tunnel attack is provided, including: obtaining data to be detected transmitted in a terminal; using a particle swarm optimization support vector machine model to detect the data to be detected to obtain a detection result, wherein the particle swarm optimization support vector machine model is trained based on the behavioral statistical features and content statistical features of historical data; and returning the detection result that the target data is a covert tunnel attack to the terminal.

[0008] Optionally, the particle swarm optimization support vector machine model is trained in the following manner: obtaining historical data and obtaining label data corresponding to the historical data, wherein the historical data includes historical request messages and historical response messages of the Internet Control Message Protocol ICMP, and the label data is used to indicate whether the historical data has an ICMP covert tunnel attack; determining the behavioral statistical characteristics and content statistical characteristics of the historical data based on the historical request messages and historical response messages; inputting the behavioral statistical characteristics, content statistical characteristics and label data into the initial model for iterative training; and if the iteration upper limit is not reached, adjusting the parameters of the initial model until the iteration upper limit is reached or the preset conditions are met, and the iteration is stopped to obtain the particle swarm optimization support vector machine model.

[0009] Optionally, based on historical request messages and historical response messages, behavioral statistical characteristics and content statistical characteristics of historical data are determined, including: extracting source IP addresses corresponding to historical request messages and historical response messages; determining the total number of ICMP requests initiated by each source IP address within a preset time period, and determining the total number of ICMP responses initiated by each source IP address within a preset time period; determining the behavioral statistical characteristics of historical data based on the total number of requests and the total number of responses; determining a first average repetition rate corresponding to each source IP address from the historical request messages, and determining a second average repetition rate corresponding to each source IP address from the historical response messages; and determining content statistical characteristics based on the first average repetition rate and the second average repetition rate.

[0010] Optionally, determining a first average repetition rate corresponding to each source IP address from historical request messages includes: grouping the historical request messages according to the source IP addresses, obtaining a first message set corresponding to the first source IP address determined from the historical request messages, wherein the first source IP address is any source IP address in the historical request messages; determining a first number of repeated characters in the data packet contents of the first message and the second message in the first message set, and determining a total number of characters in the first data packet corresponding to the first message, wherein the first message and the second message are messages with adjacent sending times in the first message set, and the sending time of the first message is earlier than the sending time of the second message; determining a request data packet repetition rate corresponding to the first message based on the first number of repeated characters and the total number of characters in the first data packet; and determining the average value of the request data packet repetition rate corresponding to each message in the first source IP address as the first average repetition rate corresponding to the first source IP address.

[0011] Optionally, determining a second average repetition rate corresponding to each source IP address from historical reply messages includes: grouping the historical reply messages according to the source IP addresses, obtaining a second message set corresponding to the second source IP address determined from the historical reply messages, wherein the second source IP address is any source IP address in the historical reply messages; determining a second number of repeated characters in the data packet content of a third message and a fourth message in the second message set, and determining a total number of characters of the second data packet corresponding to the third message, wherein the third message and the fourth message are messages with adjacent sending times in the second message set, and the sending time of the third message is earlier than the sending time of the fourth message; determining a repetition rate of the reply data packet corresponding to the third message based on the second number of repeated characters and the total number of characters of the second data packet; and determining the average value of the repetition rate of the reply data packet corresponding to each message in the second source IP address as the second average repetition rate corresponding to the second source IP address.

[0012] Optionally, after determining the behavioral statistical features and content statistical features of the historical data, the method also includes: determining a first maximum value, a first minimum value and a first eigenvalue of the behavioral statistical features, wherein the first eigenvalue is any eigenvalue in the behavioral statistical features; normalizing the first eigenvalue based on the first maximum value, the first minimum value and the first eigenvalue; determining a second maximum value, a second minimum value and a second eigenvalue of the content statistical features, wherein the second eigenvalue is any eigenvalue in the content statistical features; normalizing the second eigenvalue based on the second maximum value, the second minimum value and the second eigenvalue.

[0013] Optionally, the target data for which a detection result indicates the presence of a covert tunnel attack is returned to the terminal, including: obtaining a source IP address corresponding to the target data; deduplicating the source IP address corresponding to the target data to obtain a target IP address; and returning the target IP address and target data to the terminal.

[0014] According to another aspect of an embodiment of the present application, a tunnel attack detection device is also provided, including: an acquisition module, used to acquire the data to be detected transmitted in the terminal; a detection module, used to use a particle swarm optimization support vector machine model to detect the data to be detected to obtain a detection result, wherein the particle swarm optimization support vector machine model is trained based on the behavioral statistical characteristics and content statistical characteristics of historical data; a return module, used to return the detection result that the target data has a hidden tunnel attack to the terminal.

[0015] According to another aspect of the embodiments of the present application, an electronic device is also provided, including: a memory for storing program instructions; a processor, connected to the memory, for executing program instructions to implement the following functions: obtaining data to be detected transmitted in a terminal; using a particle swarm optimization support vector machine model to detect the data to be detected to obtain a detection result, wherein the particle swarm optimization support vector machine model is trained based on the behavioral statistical characteristics and content statistical characteristics of historical data; and returning the detection result that the target data is subject to a covert tunnel attack to the terminal.

[0016] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, wherein the non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned method for detecting tunnel attacks by running the computer program.

[0017] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which implement the above-mentioned tunnel attack detection method when executed by a processor.

[0018] In an embodiment of the present application, by acquiring the data to be detected transmitted in the terminal; using a particle swarm optimization support vector machine model to detect the data to be detected, a detection result is obtained, wherein the particle swarm optimization support vector machine model is trained based on the behavioral statistical characteristics and content statistical characteristics of historical data; the target data with the detection result of the existence of a covert tunnel attack is returned to the terminal, thereby achieving the purpose of improving the accuracy of ICMP covert tunnel attack detection, thereby achieving the technical effect of enhancing network security protection capabilities, and further solving the technical problem of being unable to timely and effectively identify covert tunnel attacks due to the poor recognition accuracy of ICMP tunnel attacks in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 is a hardware structure diagram of a computer terminal for implementing a method for detecting a tunnel attack according to an embodiment of the present application;

[0021] Figure 2 is a flow chart of a method for detecting a tunnel attack according to an embodiment of the present application;

[0022] Figure 3 is a schematic diagram of a tunnel attack detection process according to an embodiment of the present application;

[0023] Figure 4It is a structural diagram of a tunnel attack detection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] First, some nouns or terms that appear in the process of explaining the embodiments of the present application are subject to the following explanations:

[0027] ICMP (Internet Control Message Protocol): It is a sub-protocol in the TCP / IP protocol suite. It works at the network layer and is used to transmit control messages between IP hosts and routers.

[0028] PSO (Particle Swarm Optimization): is an evolutionary computing technology that simulates the social behavior of bird flocks. In PSO, each solution is regarded as a "particle" and the particles move in the solution space to find the optimal solution.

[0029] SVM (Support Vector Machine): It is a supervised learning algorithm mainly used for classification and regression analysis. It minimizes the prediction error by finding the optimal decision boundary (i.e., the maximum margin hyperplane).

[0030] PSO-SVM (Particle Swarm Optimization-Support Vector Machine): is a technology that combines particle swarm optimization algorithm and support vector machine to solve classification and regression problems. The main feature of this model is to use the PSO algorithm to optimize the parameter selection of SVM to achieve the purpose of improving model performance.

[0031] In order to solve the problem of poor tunnel attack detection capability in the related art, the present application embodiment provides a tunnel attack detection method, which can be run on Figure 1 In the computer terminal shown, the computer terminal is described below.

[0032] The tunnel attack detection method embodiment provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing a method for detecting tunnel attacks. Figure 1 As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions connected via a wired and / or wireless network. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art can understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0033] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0034] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the method for detecting tunnel attacks in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned method for detecting tunnel attacks is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0035] The transmission module 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission module 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0036] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0037] It should be noted that, in some optional embodiments, the above Figure 1 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0038] In the above operating environment, an embodiment of the present application provides an embodiment of a method for detecting a tunnel attack. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0039] Figure 2 is a flow chart of a method for detecting a tunnel attack according to an embodiment of the present application, such as Figure 2As shown, the method comprises the following steps:

[0040] Step S202, obtaining the data to be detected transmitted in the terminal.

[0041] In the above step S202, the system can capture and select data packets that need to be detected for ICMP covert tunnel attack from the network traffic, that is, the above data to be detected.

[0042] Step S204 , using a particle swarm optimization support vector machine model to detect the data to be detected to obtain a detection result, wherein the particle swarm optimization support vector machine model is trained based on the behavior statistical features and content statistical features of the historical data.

[0043] In the above step S204, the particle swarm optimization algorithm PSO can be used to optimize the parameters of the support vector machine model SVM to improve the SVM model's ability to identify covert tunnel attacks. The parameters of the SVM model are trained based on the behavior statistical features (such as the number of times each source IP uses ICMP within a preset time period) and content statistical features (such as the average repetition rate of the data packet content corresponding to each source IP) extracted from the historical data.

[0044] Step S206, returning the target data with the detection result that there is a covert tunnel attack to the terminal.

[0045] In the above step S206, the target data may include data packets with covert tunnel attacks and their corresponding source IPs. Since there may be multiple data packets with covert tunnel attacks originating from the same IP address, all extracted source IPs may be deduplicated to ensure that each source IP is recorded only once, forming a clear data set so that corresponding security measures can be taken later.

[0046] Through the above steps S202 to S206, the purpose of improving the detection accuracy of ICMP covert tunnel attacks is achieved, thereby achieving the technical effect of enhancing network security protection capabilities, and further solving the technical problem that the covert tunnel attacks cannot be identified in a timely and effective manner due to the poor recognition accuracy of ICMP tunnel attacks in related technologies. The following is a detailed description.

[0047] In the above step S204, the particle swarm optimization support vector machine model is trained in the following manner: obtaining historical data and obtaining label data corresponding to the historical data, wherein the historical data includes historical request messages and historical response messages of the Internet Control Message Protocol ICMP, and the label data is used to indicate whether the historical data has an ICMP covert tunnel attack; determining the behavior statistical features and content statistical features of the historical data based on the historical request messages and the historical response messages; inputting the behavior statistical features, the content statistical features and the label data into the initial model for iterative training; and when the iteration upper limit is not reached, adjusting the parameters of the initial model until the iteration upper limit is reached or the preset conditions are met, and the iteration is stopped to obtain the particle swarm optimization support vector machine model.

[0048] In an embodiment of the present application, the training process of the PSO-SVM model may include the following steps:

[0049] Step 1: Data preparation.

[0050] First, historical data in network traffic is obtained, preprocessed, and divided into a training set and a test set, wherein the historical data includes historical request messages and historical response messages in the ICMP protocol; at the same time, label data corresponding to the historical data is obtained to distinguish normal data from data with covert tunnel attacks in the historical data.

[0051] Step 2: Feature extraction.

[0052] The behavioral statistical characteristics of the data packets (such as the number of times each source IP uses ICMP within a preset time period) and content statistical characteristics (such as the average repetition rate of the data packet content corresponding to each source IP) are extracted from the above historical data to reflect the traffic pattern and content characteristics in the ICMP protocol.

[0053] Step 3: Initialization of the PSO-SVM model.

[0054] Choose a suitable kernel function, such as RGB function:

[0055] K(x i ·x j ) = exp(-γ||x i -x j ||),γ>0

[0056] Among them, K(x i ·x j ) represents the kernel function; x i and x j represents the input feature vector; exp represents the exponential function; ||x i -x j || represents the feature vector x iand x j The square of the Euclidean norm of the difference between ; γ represents the kernel function parameter.

[0057] Step 4: Parameter optimization.

[0058] The PSO algorithm is used to optimize the parameters of the SVM model. The optimization process mainly includes:

[0059] 1) Initialization process: configure the initial parameters of the PSO algorithm and determine the search limit of the penalty factor c and the kernel function parameter γ. The optimization problem formula of the SVM model and the corresponding constraints are as follows:

[0060]

[0061]

[0062] Among them, the first function Used to increase the model classification interval; the second function Used to minimize model complexity; α i , α j is the Lagrange multiplier, which is used to represent the weight in the model optimization process; y i ,y j represents the labels of the i-th sample and the j-th sample; K(x i ·x j ) is the kernel function, which is used to calculate the eigenvector x i and x j The similarity between them; N is the total number of samples; c is the penalty factor, which is used to control the degree of penalty for misclassification of the model.

[0063] 2) Calculate the fitness function: The fitness function is used to calculate the effect of the parameter combination, usually based on the performance of the model on the training set, such as classification accuracy.

[0064] 3) Extreme value update: According to the fitness results, update the position and velocity of each particle and record the global optimal solution. The specific process can be as follows:

[0065] Assuming that the number of particles in D-dimensional space is n, the position set x of the i-th particle is i and the velocity set v i They are:

[0066] x i =(x i1 ,x i2 ,L,x iD ), i=1,2,L,n

[0067] v i =(v i1 ,vi2 ,L,v iD ), i=1,2,L,n

[0068] The optimal position set pbest experienced by individual particles i and the population optimal position set gbest i They are:

[0069] pbest i =(pbest i1 ,pbest i2 ,L,pbest iD )

[0070] gbest i =(gbest1,gbest2,L,gbest D )

[0071] When the individual optimal position set pbest i The best position set gbest of the population i When it is better, the latter is updated. For any particle of dimension d (1≤d≤D), the position and velocity are limited to the preset limit range [-x max,d ,x max,d ] and [-v max,d ,v max,d ], if it exceeds the preset limit range during the optimization process, it will be set to the boundary value. Therefore, the particle speed and position update formula are as follows:

[0072]

[0073] in, Indicates the velocity of the particle after update; Indicates the velocity of the particle before updating; Indicates the position of the particle after update; represents the position of the particle before the update; c1 and c2 represent learning factors; rand(0,1) represents a random number between [0,1]; pbest id Indicates the optimal position of individual particles; gbest d represents the global optimal particle position.

[0074] 4) Iteration and update: Repeat the extreme value update and particle position adjustment until the preset number of iterations is reached or other stopping conditions are met.

[0075] 5) Termination and output: When the termination condition is reached, the optimal parameter settings are output for building the SVM model.

[0076] Step 5: Model training.

[0077] The optimized model parameters are applied to the SVM model, and the SVM model is trained using labeled historical data. Through iterative training, the SVM model learns the ability to distinguish ICMP covert tunnel attacks from normal traffic.

[0078] In the training process of the above-mentioned PSO-SVM model, the behavior statistical characteristics and content statistical characteristics of the historical data are determined based on the historical request messages and historical response messages, including: extracting the source IP addresses corresponding to the historical request messages and historical response messages; determining the total number of requests initiated by each source IP address within a preset time period, and determining the total number of responses initiated by each source IP address within a preset time period; determining the behavior statistical characteristics of the historical data based on the total number of requests and the total number of responses; determining the first average repetition rate corresponding to each source IP address from the historical request messages, and determining the second average repetition rate corresponding to each source IP address from the historical response messages; determining the content statistical characteristics based on the first average repetition rate and the second average repetition rate. The behavior statistical characteristics and content statistical characteristics are described below respectively.

[0079] In an embodiment of the present application, the method for determining the behavioral statistical features of historical data can be as follows: log parsing of historical request messages and historical response messages is performed to obtain the parsed source IP address, destination IP address, data packet length, data packet content, message type, and log occurrence time and other fields, from which the source IP addresses corresponding to the historical request messages and historical response messages are extracted, and the number of times each source IP uses the ICMP protocol within the preset time period is calculated according to the time window (i.e., the above-mentioned preset time period), and the obtained behavioral statistical features are as follows:

[0080] (1)Req-count i : Total number of requests, which refers to the total number of ICMP requests initiated by each source IP within a preset time period (such as five minutes).

[0081] (2)Res-count i : Total number of responses, refers to the total number of ICMP responses initiated by each source IP within a preset time period (such as five minutes).

[0082] In the embodiment of the present application, the content statistical characteristics of the historical data are as follows:

[0083] (1)Req-averatio i : The average repetition rate of request packets, i.e., the first average repetition rate mentioned above, refers to the average repetition rate of each source IP packet in the historical request messages.

[0084] (2) Res-averatio i: The average repetition rate of the reply packets, i.e. the second average repetition rate mentioned above, refers to the average repetition rate of each source IP packet in the historical reply messages.

[0085] Among them, the first average repetition rate is determined as follows: after grouping the historical request messages according to the source IP address, obtain the first message set corresponding to the first source IP address determined from the historical request messages, wherein the first source IP address is any source IP address in the historical request messages; determine the first repeated character number of the data packet content of the first message and the second message in the first message set, and determine the total number of characters of the first data packet corresponding to the first message, wherein the first message and the second message are messages with adjacent sending times in the first message set, and the sending time of the first message is earlier than the sending time of the second message; determine the request data packet repetition rate corresponding to the first message based on the first repeated character number and the total number of characters in the first data packet; determine the average value of the request data packet repetition rate corresponding to each message in the first source IP address as the first average repetition rate corresponding to the first source IP address.

[0086] The second average repetition rate is determined as follows: after grouping the historical reply messages according to the source IP addresses, obtain a second message set corresponding to the second source IP address determined from the historical reply messages, wherein the second source IP address is any source IP address in the historical reply messages; determine the second number of repeated characters of the data packet content of the third message and the fourth message in the second message set, and determine the total number of characters of the second data packet corresponding to the third message, wherein the third message and the fourth message are messages with adjacent sending times in the second message set, and the sending time of the third message is earlier than the sending time of the fourth message; determine the repetition rate of the reply data packet corresponding to the third message based on the second number of repeated characters and the total number of characters of the second data packet; and determine the average value of the repetition rate of the reply data packet corresponding to each message in the second source IP address as the second average repetition rate corresponding to the second source IP address.

[0087] In an embodiment of the present application, the source IP addresses corresponding to the historical request messages and the historical response messages can be grouped and managed so as to analyze the data of each source IP address independently. Subsequently, the average repetition rate of the data packets corresponding to the historical request messages and the historical response messages can be calculated based on the grouped original IP addresses. The specific process can be as follows:

[0088] As for the first average repetition rate corresponding to the historical request messages, first, all messages corresponding to the first source IP address can be selected from the grouped historical request messages to form a first message set. It should be noted that the first source IP address can be any source IP address in the historical request messages; then, for each pair of messages with adjacent sending times in the first message set (i.e. the first message and the second message mentioned above, and the sending time of the first message is earlier than that of the second message), the total number of characters of the first data packet corresponding to the first message is determined, and the number of repeated characters in the data packet content corresponding to the first message and the second message (i.e. the first repeated character number mentioned above) is determined; then, the request data packet repetition rate corresponding to the first message is obtained by dividing the first repeated character number by the total number of characters in the first data packet; finally, the first average repetition rate is obtained by calculating the average value of the request data packet repetition rate corresponding to each message in the first source IP address.

[0089] As for the second average repetition rate corresponding to the historical reply messages, first, all messages corresponding to the second source IP address can be selected from the grouped historical reply messages to form a second message set. It should be noted that the second source IP address can be any source IP address in the historical reply messages; then, for each pair of messages with adjacent sending times in the second message set (i.e. the third message and the fourth message mentioned above, and the sending time of the third message is earlier than that of the fourth message), the total number of characters of the second data packet corresponding to the third message is determined, and the number of repeated characters of the data packet content corresponding to the third message and the fourth message (i.e. the second repeated character number mentioned above) is determined; then, the repetition rate of the reply data packet corresponding to the third message is obtained by dividing the second repeated character number by the total number of characters in the second data packet; finally, the second average repetition rate is obtained by calculating the average repetition rate of the reply data packet corresponding to each message in the second source IP address.

[0090] Optionally, after determining the behavioral statistical features and content statistical features of the historical data, the method also includes: determining a first maximum value, a first minimum value and a first eigenvalue of the behavioral statistical features, wherein the first eigenvalue is any eigenvalue in the behavioral statistical features; normalizing the first eigenvalue based on the first maximum value, the first minimum value and the first eigenvalue; determining a second maximum value, a second minimum value and a second eigenvalue of the content statistical features, wherein the second eigenvalue is any eigenvalue in the content statistical features; normalizing the second eigenvalue based on the second maximum value, the second minimum value and the second eigenvalue.

[0091] In the embodiment of the present application, after determining the behavior statistical features and content statistical features of the historical data, all statistical feature data can also be subjected to feature preprocessing, such as normalization, to uniformly proportion the values ​​corresponding to all statistical features to a fixed interval range, eliminating the influence of different dimensions, so as to facilitate the subsequent analysis and processing of the PSO-SVM model. The specific normalization formula can be as follows:

[0092]

[0093] Among them, X norm It is used to represent the normalized behavior statistical features or content statistical features. max It is used to represent the maximum value of data, that is, the first maximum value of the above-mentioned behavior statistical feature in the normalization process, or the second maximum value of the above-mentioned content statistical feature in the normalization process; X min It is used to represent the minimum value of the data, that is, the first minimum value of the above-mentioned behavior statistical feature in the normalization process, or the second minimum value of the above-mentioned content statistical feature in the normalization process; X is used to represent the input data, that is, any one of the characteristic values ​​(first characteristic value) in the above-mentioned behavior statistical feature, or any one of the characteristic values ​​(second characteristic value) in the above-mentioned content statistical feature.

[0094] In the above step S206, the target data detected as having a covert tunnel attack is returned to the terminal, including: obtaining the source IP address corresponding to the target data; deduplicating the source IP address corresponding to the target data to obtain the target IP address; and returning the target IP address and the target data to the terminal.

[0095] In the embodiment of the present application, the data to be detected is input into the PSO-SVM model for detection, and the detection results indicating normal data and target data with covert tunnel attacks can be obtained. Furthermore, the target data with covert tunnel attacks in the detection results is returned to the terminal, which can effectively identify the source of ICMP covert tunnel attacks, provide key information for network security protection, and take corresponding defense measures.

[0096] The target data may include data with covert tunnel attacks and their corresponding source IPs. Since there may be multiple covert tunnel attack packets originating from the same IP address, all extracted source IPs can be deduplicated to ensure that each source IP is recorded only once, forming a clear data set so that corresponding security measures can be taken later.

[0097] Figure 3 FIG. 1 is a schematic diagram of a tunnel attack detection process according to an embodiment of the present application. Figure 3As shown in the figure, firstly, the ICMP historical request and response logs (messages) are obtained through the database interface, and then the corresponding field information such as source IP address, destination IP address, data packet length, data packet content, message type, log occurrence time, etc. are extracted through log parsing, and statistical features based on ICMP behavior (behavior statistical features Req-count i and Res-count i ) and the statistical characteristics of ICMP packet content (content statistical characteristics Req-averatio i and Res-averatio i ), then perform feature preprocessing on all statistical features, and optimize the parameters of the support vector machine (SVM) based on the particle swarm optimization (PSO) algorithm. Finally, the source IP related to the ICMP covert tunnel attack can be obtained through the detection results of the PSO-SVM model.

[0098] In an embodiment of the present application, statistical features are first constructed through ICMP request and response logs, and then the particle swarm optimization (PSO) algorithm is used to optimize the parameters of the support vector machine (SVM), thereby improving the accuracy of the model in identifying ICMP tunnel attacks and normal traffic. Finally, the source IP related to the ICMP tunnel attack is obtained through the detection results of the PSO-SVM model. The statistical feature analysis and advanced machine learning technology are combined to enable the system to more accurately distinguish tunnel attacks from normal network behaviors, and thus identify hidden tunnel attacks in a timely and effective manner.

[0099] According to an embodiment of the present application, a tunnel attack detection device is provided. It should be noted that the tunnel attack detection device of the embodiment of the present application can be used to execute the tunnel attack detection method provided in the embodiment of the present application. The tunnel attack detection device provided in the embodiment of the present application is introduced below.

[0100] Figure 4 is a structural diagram of a tunnel attack detection device provided according to an embodiment of the present application. Figure 4 As shown, the device comprises:

[0101] An acquisition module 40 is used to acquire the data to be detected transmitted in the terminal;

[0102] A detection module 42 is used to detect the data to be detected by using a particle swarm optimization support vector machine model to obtain a detection result, wherein the particle swarm optimization support vector machine model is trained based on the behavior statistical features and content statistical features of the historical data;

[0103] The return module 44 is used to return the target data detected as having a covert tunnel attack to the terminal.

[0104] Through the acquisition module 40, detection module 42 and return module 44 in the above-mentioned tunnel attack detection device, the purpose of improving the detection accuracy of ICMP covert tunnel attacks is achieved, thereby realizing the technical effect of enhancing network security protection capabilities, and further solving the technical problem of being unable to timely and effectively identify covert tunnel attacks due to the poor recognition accuracy of ICMP tunnel attacks in related technologies.

[0105] In the tunnel attack detection device provided in the embodiment of the present application, it includes a training module 46, which is used to obtain historical data and label data corresponding to the historical data, wherein the historical data includes historical request messages and historical response messages of the Internet Control Message Protocol ICMP, and the label data is used to indicate whether the historical data has an ICMP covert tunnel attack; based on the historical request messages and historical response messages, the behavioral statistical characteristics and content statistical characteristics of the historical data are determined; the behavioral statistical characteristics, content statistical characteristics and label data are input into the initial model for iterative training; if the iteration upper limit is not reached, the parameters of the initial model are adjusted until the iteration upper limit is reached or the preset conditions are met, and the iteration is stopped to obtain a particle swarm optimization support vector machine model.

[0106] In the tunnel attack detection device provided in the embodiment of the present application, the training module is also used to extract the source IP addresses corresponding to historical request messages and historical response messages; determine the total number of ICMP requests initiated by each source IP address within a preset time period, and determine the total number of ICMP responses initiated by each source IP address within a preset time period; determine the behavioral statistical characteristics of the historical data based on the total number of requests and the total number of responses; determine the first average repetition rate corresponding to each source IP address from the historical request messages, and determine the second average repetition rate corresponding to each source IP address from the historical response messages; determine the content statistical characteristics based on the first average repetition rate and the second average repetition rate.

[0107] In the tunnel attack detection device provided in the embodiment of the present application, the training module is also used to group the historical request messages according to the source IP address, and then obtain a first message set corresponding to the first source IP address determined from the historical request messages, wherein the first source IP address is any source IP address in the historical request messages; determine the first number of repeated characters in the data packet content of the first message and the second message in the first message set, and determine the total number of characters of the first data packet corresponding to the first message, wherein the first message and the second message are messages with adjacent sending times in the first message set, and the sending time of the first message is earlier than the sending time of the second message; determine the repetition rate of the request data packet corresponding to the first message based on the first number of repeated characters and the total number of characters in the first data packet; and determine the average value of the repetition rate of the request data packet corresponding to each message in the first source IP address as the first average repetition rate corresponding to the first source IP address.

[0108] In the tunnel attack detection device provided in the embodiment of the present application, the training module is also used to group the historical response messages according to the source IP address, and then obtain a second message set corresponding to the second source IP address determined from the historical response messages, wherein the second source IP address is any source IP address in the historical response messages; determine the second number of repeated characters of the data packet content of the third message and the fourth message in the second message set, and determine the total number of characters of the second data packet corresponding to the third message, wherein the third message and the fourth message are messages with adjacent sending times in the second message set, and the sending time of the third message is earlier than the sending time of the fourth message; determine the repetition rate of the response data packet corresponding to the third message based on the second number of repeated characters and the total number of characters of the second data packet; and determine the average value of the repetition rate of the response data packet corresponding to each message in the second source IP address as the second average repetition rate corresponding to the second source IP address.

[0109] In the tunnel attack detection device provided in the embodiment of the present application, the training module is also used to determine the first maximum value, the first minimum value and the first eigenvalue of the behavior statistical feature, wherein the first eigenvalue is any eigenvalue in the behavior statistical feature; the first eigenvalue is normalized based on the first maximum value, the first minimum value and the first eigenvalue; the second maximum value, the second minimum value and the second eigenvalue of the content statistical feature are determined, wherein the second eigenvalue is any eigenvalue in the content statistical feature; the second eigenvalue is normalized based on the second maximum value, the second minimum value and the second eigenvalue.

[0110] In the tunnel attack detection device provided in the embodiment of the present application, the return module is also used to obtain the source IP address corresponding to the target data; after deduplication processing of the source IP address corresponding to the target data, the target IP address is obtained; and the target IP address and target data are returned to the terminal.

[0111] An embodiment of the present application also provides an electronic device, including: a memory for storing program instructions; a processor, connected to the memory, for executing program instructions to implement the following functions: obtaining the data to be detected transmitted in the terminal; using a particle swarm optimization support vector machine model to detect the data to be detected to obtain a detection result, wherein the particle swarm optimization support vector machine model is trained based on the behavioral statistical characteristics and content statistical characteristics of historical data; and returning the detection result that the target data has a covert tunnel attack to the terminal.

[0112] It should be noted that the above electronic equipment is used to execute Figure 2 The tunnel attack detection method shown in the figure, therefore the relevant explanations in the above tunnel attack detection method are also applicable to the electronic device and will not be repeated here.

[0113] An embodiment of the present application also provides a non-volatile storage medium, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned tunnel attack detection method by running the computer program.

[0114] It should be noted that the above non-volatile storage medium is used to execute Figure 2 The tunnel attack detection method shown in the figure, therefore the relevant explanations in the above tunnel attack detection method are also applicable to the non-volatile storage medium, and will not be repeated here.

[0115] The embodiment of the present application also provides a computer program product, including computer instructions, which implement the above-mentioned tunnel attack detection method when executed by a processor.

[0116] It should be noted that the above-mentioned computer program product is used to execute Figure 2 The tunnel attack detection method shown in the figure, therefore the relevant explanations in the above tunnel attack detection method are also applicable to the computer program product, which will not be repeated here.

[0117] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0118] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0119] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0120] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0121] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0122] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0123] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting a tunnel attack, characterized in that: include: Obtain the data to be detected transmitted in the terminal; Using a particle swarm optimization support vector machine model to detect the data to be detected to obtain a detection result, wherein the particle swarm optimization support vector machine model is trained based on the behavior statistical characteristics and content statistical characteristics of historical data; The target data whose detection result indicates that there is a covert tunnel attack is returned to the terminal.

2. The method according to claim 1, characterized in that: The particle swarm optimization support vector machine model is trained in the following way: Acquire the historical data, and acquire label data corresponding to the historical data, wherein the historical data includes historical request messages and historical response messages of Internet Control Message Protocol (ICMP), and the label data is used to indicate whether the historical data contains an ICMP covert tunnel attack; Determining the behavior statistical features and the content statistical features of the historical data according to the historical request message and the historical response message; Inputting the behavior statistical features, the content statistical features and the label data into an initial model for iterative training; When the iteration upper limit is not reached, the parameters of the initial model are adjusted until the iteration upper limit is reached or the preset conditions are met, and the iteration is stopped to obtain the particle swarm optimization support vector machine model.

3. The method according to claim 2, characterized in that Determining the behavior statistical features and the content statistical features of the historical data according to the historical request message and the historical response message includes: Extracting the source IP addresses corresponding to the historical request messages and the historical response messages; Determine the total number of ICMP requests initiated by each source IP address within a preset time period, and determine the total number of ICMP responses initiated by each source IP address within the preset time period; Determining the behavior statistical characteristics of the historical data according to the total number of requests and the total number of responses; Determine a first average repetition rate corresponding to each source IP address from the historical request messages, and determine a second average repetition rate corresponding to each source IP address from the historical response messages; The content statistical feature is determined according to the first average repetition rate and the second average repetition rate.

4. The method according to claim 3, characterized in that: Determining a first average repetition rate corresponding to each source IP address from the historical request messages includes: After grouping the historical request messages according to the source IP addresses, obtaining a first message set corresponding to a first source IP address determined from the historical request messages, wherein the first source IP address is any source IP address in the historical request messages; Determining, in the first message set, a first number of repeated characters in data packet contents of a first message and a second message, and determining a total number of characters in a first data packet corresponding to the first message, wherein the first message and the second message are messages in the first message set with adjacent sending times, and the sending time of the first message is earlier than the sending time of the second message; Determine a request data packet repetition rate corresponding to the first message according to the first number of repeated characters and the total number of characters in the first data packet; The average value of the repetition rate of the request data packets corresponding to each message in the first source IP address is determined as the first average repetition rate corresponding to the first source IP address.

5. The method according to claim 3, characterized in that: Determining a second average repetition rate corresponding to each source IP address from the historical response message includes: After grouping the historical response messages according to the source IP addresses, obtaining a second message set corresponding to a second source IP address determined from the historical response messages, wherein the second source IP address is any source IP address in the historical response messages; Determining, in the second message set, a second number of repeated characters of the data packet contents of the third message and the fourth message, and determining a total number of characters of the second data packet corresponding to the third message, wherein the third message and the fourth message are messages in the second message set with adjacent sending times, and the sending time of the third message is earlier than the sending time of the fourth message; Determine a repetition rate of a response data packet corresponding to the third message according to the second number of repeated characters and the total number of characters in the second data packet; The average value of the repetition rate of the reply data packets corresponding to each message in the second source IP address is determined as the second average repetition rate corresponding to the second source IP address.

6. The method according to claim 3, characterized in that After determining the behavior statistical features and the content statistical features of the historical data, the method further includes: Determine a first maximum value, a first minimum value, and a first characteristic value of the behavior statistical feature, wherein the first characteristic value is any characteristic value of the behavior statistical feature; Normalizing the first eigenvalue according to the first maximum value, the first minimum value, and the first eigenvalue; Determine a second maximum value, a second minimum value, and a second characteristic value of the content statistical feature, wherein the second characteristic value is any characteristic value of the content statistical feature; The second eigenvalue is normalized according to the second maximum value, the second minimum value and the second eigenvalue.

7. The method according to claim 1, characterized in that Returning the target data detected as having a covert tunnel attack to the terminal includes: Obtaining the source IP address corresponding to the target data; After deduplication of the source IP address corresponding to the target data, the target IP address is obtained; The target IP address and the target data are returned to the terminal.

8. A tunnel attack detection device, characterized in that: include: An acquisition module, used for acquiring the data to be detected transmitted in the terminal; A detection module, used for detecting the data to be detected by using a particle swarm optimization support vector machine model to obtain a detection result, wherein the particle swarm optimization support vector machine model is trained based on the behavior statistical features and content statistical features of historical data; The returning module is used to return the target data of the detection result indicating the existence of a covert tunnel attack to the terminal.

9. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is connected to the memory and is used to execute program instructions to implement the following functions: obtaining the data to be detected transmitted in the terminal; using a particle swarm optimization support vector machine model to detect the data to be detected to obtain a detection result, wherein the particle swarm optimization support vector machine model is trained based on the behavioral statistical characteristics and content statistical characteristics of historical data; and returning the detection result that the target data has a covert tunnel attack to the terminal.

10. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the method for detecting a tunnel attack according to any one of claims 1 to 7 by running the computer program.

11. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the method for detecting a tunnel attack according to any one of claims 1 to 7 is implemented.

Images