Method, device and electronic equipment for detecting a tunneling attack

Abstract

The application discloses a tunnel attack detection method and device and electronic equipment. The method comprises the following steps: obtaining to-be-detected data transmitted in a terminal; detecting the to-be-detected data by using a particle swarm optimization support vector machine model to obtain a detection result, wherein the particle swarm optimization support vector machine model is trained based on behavior statistical features and content statistical features of historical data; and returning target data with hidden tunnel attack to the terminal. The application solves the technical problem that hidden tunnel attacks cannot be identified in time and effectively due to poor accuracy of ICMP tunnel attack identification in related technologies.

Description

Technical Field

[0001] This application relates to the field of network security threat detection, and more specifically, to a method, apparatus, and electronic device for detecting tunnel attacks. Background Technology

[0002] With the maturity of Internet technology and the rapid promotion of related applications, network security issues have become more severe. Computer viruses, Trojans and other attack methods are emerging one after another, leading to serious information leakage problems. Among these attack methods, ICMP (Internet Control Message Protocol) covert tunneling attacks are very simple and efficient, and have become an important factor in undermining information security.

[0003] Generally speaking, ICMP tunneling utilizes the request (type 8) and response (type 0) messages of the ICMP protocol to hide malicious payloads within ICMP data packets. By using the Ping command to establish a covert tunnel, forged data packets are transmitted, thereby bypassing firewalls and intrusion detection systems.

[0004] Therefore, compared with ordinary data leakage methods (such as viruses and Trojans), ICMP tunnels are more concealed and more difficult to detect. The identification and detection methods for ICMP tunnel attacks in related technologies are also unable to identify the problem of covert tunnel attacks in a timely and effective manner.

[0005] There is currently no effective solution to the above problems. Summary of the Invention

[0006] This application provides a method, apparatus, and electronic device for detecting tunnel attacks, in order to at least solve the technical problem that the poor accuracy of ICMP tunnel attack identification in related technologies makes it impossible to identify covert tunnel attacks in a timely and effective manner.

[0007] According to one aspect of the embodiments of this application, a method for detecting tunnel attacks is provided, comprising: acquiring data to be detected transmitted in a terminal; using a particle swarm optimization support vector machine model to detect the data to be detected and obtaining a detection result, wherein the particle swarm optimization support vector machine model is trained based on behavioral statistical features and content statistical features of historical data; and returning target data that is detected as having a hidden tunnel attack to the terminal.

[0008] Optionally, the particle swarm optimization support vector machine model is trained in the following way: acquiring historical data and corresponding label data, wherein the historical data includes historical request messages and historical response messages of the Internet Control Message Protocol (ICMP), and the label data is used to indicate whether the historical data is subject to ICMP covert tunneling attacks; determining the behavioral statistical features and content statistical features of the historical data based on the historical request messages and historical response messages; inputting the behavioral statistical features, content statistical features, and label data into the initial model for iterative training; adjusting the parameters of the initial model before reaching the iteration limit, until the iteration limit is reached or the preset conditions are met, and stopping the iteration to obtain the particle swarm optimization support vector machine model.

[0009] Optionally, based on historical request messages and historical response messages, behavioral statistical characteristics and content statistical characteristics of historical data are determined, including: extracting the source IP addresses corresponding to historical request messages and historical response messages; determining the total number of ICMP requests initiated by each source IP address within a preset time period, and determining the total number of ICMP responses initiated by each source IP address within a preset time period; determining the behavioral statistical characteristics of historical data based on the total number of requests and responses; determining the first average repetition rate corresponding to each source IP address from historical request messages, and determining the second average repetition rate corresponding to each source IP address from historical response messages; and determining content statistical characteristics based on the first average repetition rate and the second average repetition rate.

[0010] Optionally, determining the first average repetition rate corresponding to each source IP address from historical request packets includes: grouping the historical request packets according to their source IP addresses, obtaining a first packet set corresponding to a first source IP address from the historical request packets, wherein the first source IP address is any one of the source IP addresses in the historical request packets; determining the first number of repeated characters in the data packet content of the first packet and the second packet in the first packet set, and determining the total number of characters in the first data packet corresponding to the first packet, wherein the first packet and the second packet are packets with adjacent sending times in the first packet set, and the sending time of the first packet is earlier than the sending time of the second packet; determining the request data packet repetition rate corresponding to the first packet based on the first number of repeated characters and the total number of characters in the first data packet; and determining the average value of the request data packet repetition rate corresponding to each packet in the first source IP address as the first average repetition rate corresponding to the first source IP address.

[0011] Optionally, determining the second average repetition rate corresponding to each source IP address from historical response messages includes: grouping historical response messages according to source IP addresses, obtaining a second message set corresponding to a second source IP address determined from the historical response messages, wherein the second source IP address is any one of the source IP addresses in the historical response messages; determining the second number of repeated characters in the data packet content of the third and fourth messages in the second message set, and determining the total number of characters in the second data packet corresponding to the third message, wherein the third and fourth messages are messages with adjacent sending times in the second message set, and the sending time of the third message is earlier than the sending time of the fourth message; determining the response data packet repetition rate corresponding to the third message based on the second number of repeated characters and the total number of characters in the second data packet; and determining the average of the response data packet repetition rates corresponding to each message in the second source IP address as the second average repetition rate corresponding to the second source IP address.

[0012] Optionally, after determining the behavioral statistical features and content statistical features of the historical data, the method further includes: determining a first maximum value, a first minimum value, and a first feature value of the behavioral statistical features, wherein the first feature value is any one of the feature values ​​in the behavioral statistical features; normalizing the first feature value based on the first maximum value, the first minimum value, and the first feature value; determining a second maximum value, a second minimum value, and a second feature value of the content statistical features, wherein the second feature value is any one of the feature values ​​in the content statistical features; and normalizing the second feature value based on the second maximum value, the second minimum value, and the second feature value.

[0013] Optionally, returning the target data that the detection result indicates exists as a covert tunnel attack to the terminal includes: obtaining the source IP address corresponding to the target data; deduplicating the source IP address corresponding to the target data to obtain the target IP address; and returning the target IP address and the target data to the terminal.

[0014] According to another aspect of the embodiments of this application, a tunnel attack detection device is also provided, comprising: an acquisition module for acquiring data to be detected transmitted in a terminal; a detection module for using a particle swarm optimization support vector machine model to detect the data to be detected and obtaining a detection result, wherein the particle swarm optimization support vector machine model is trained based on behavioral statistical features and content statistical features of historical data; and a return module for returning target data to the terminal that the detection result indicates the presence of a covert tunnel attack.

[0015] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a memory for storing program instructions; and a processor connected to the memory for executing program instructions to perform the following functions: acquiring data to be detected transmitted in a terminal; using a particle swarm optimization support vector machine model to detect the data to be detected and obtaining a detection result, wherein the particle swarm optimization support vector machine model is trained based on behavioral statistical features and content statistical features of historical data; and returning target data that is detected as having a hidden tunnel attack to the terminal.

[0016] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned tunnel attack detection method by running the computer program.

[0017] According to another aspect of the embodiments of this application, a computer program product is also provided, including computer instructions, which, when executed by a processor, implement the above-described method for detecting tunnel attacks.

[0018] In this embodiment, the detection data transmitted in the terminal is acquired; a particle swarm optimization support vector machine model is used to detect the data and obtain the detection result. The particle swarm optimization support vector machine model is trained based on the behavioral and content statistical features of historical data; the target data that is detected as having a covert tunnel attack is returned to the terminal. This achieves the goal of improving the detection accuracy of ICMP covert tunnel attacks, thereby enhancing the technical effect of network security protection capabilities. It also solves the technical problem that the poor accuracy of ICMP tunnel attack identification in related technologies makes it impossible to identify covert tunnel attacks in a timely and effective manner. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0020] Figure 1 This is a hardware structure diagram of a computer terminal for implementing a tunnel attack detection method according to an embodiment of this application;

[0021] Figure 2 This is a flowchart of a tunnel attack detection method according to an embodiment of this application;

[0022] Figure 3 This is a schematic diagram of a tunnel attack detection process according to an embodiment of this application;

[0023] Figure 4This is a structural diagram of a tunnel attack detection device according to an embodiment of this application. Detailed Implementation

[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] First, some nouns or terms that appear in the explanation of the embodiments of this application shall be interpreted as follows:

[0027] ICMP (Internet Control Message Protocol) is a sub-protocol in the TCP / IP protocol suite. It operates at the network layer and is used to transmit control messages between IP hosts and routers.

[0028] PSO (Particle Swarm Optimization) is an evolutionary computational technique that simulates the social behavior of bird flocks. In PSO, each solution is treated as a "particle," which moves through the solution space in search of the optimal solution.

[0029] SVM (Support Vector Machine) is a supervised learning algorithm mainly used for classification and regression analysis. It minimizes prediction error by finding the optimal decision boundary (i.e., the maximum margin hyperplane).

[0030] PSO-SVM (Particle Swarm Optimization-Support Vector Machine) is a technique that combines particle swarm optimization (PSO) and support vector machines to solve classification and regression problems. The main characteristic of this model is that it utilizes the PSO algorithm to optimize the parameter selection of the SVM, thereby improving model performance.

[0031] To address the issue of poor tunnel attack detection capabilities in related technologies, this application provides a tunnel attack detection method that can be implemented in... Figure 1 The computer terminal shown is described below.

[0032] The tunnel attack detection method provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal for implementing a method to detect tunnel attacks is shown. Figure 1 As shown, the computer terminal 10 may include one or more processors (shown as 102a, 102b, ..., 102n in the figure) (the processor may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission module 106 for communication functions connected via wired and / or wireless networks. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0033] It should be noted that the aforementioned one or more processors and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be implemented wholly or partially as software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be wholly or partially integrated into any other element in the computer terminal 10. As involved in the embodiments of this application, the data processing circuits serve as processor control (e.g., selection of a variable resistor termination path connected to an interface).

[0034] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the tunnel attack detection method in this embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned tunnel attack detection method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0035] The transmission module 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission module 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission module 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0036] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10.

[0037] It should be noted here that, in some optional embodiments, the above... Figure 1 The computer terminal shown may include hardware elements (including circuitry), software elements (including computer code stored on a computer-readable medium), or a combination of both hardware and software elements. It should be noted that... Figure 1 This is only one instance of a specific particular instance, and is intended to illustrate the types of components that may exist in the aforementioned computer terminal.

[0038] In the above operating environment, this application provides an embodiment of a method for detecting tunnel attacks. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0039] Figure 2 This is a flowchart of a tunnel attack detection method according to an embodiment of this application, such as... Figure 2As shown, the method includes the following steps:

[0040] Step S202: Obtain the data to be detected transmitted in the terminal.

[0041] In step S202 above, the system can capture and select data packets from network traffic that need to be detected for ICMP covert tunnel attacks, i.e., the data to be detected.

[0042] Step S204: The particle swarm optimization support vector machine model is used to detect the data to be detected and the detection results are obtained. The particle swarm optimization support vector machine model is trained based on the behavioral statistical features and content statistical features of historical data.

[0043] In step S204 above, the particle swarm optimization algorithm (PSO) can be used to optimize the parameters of the support vector machine (SVM) model, thereby improving the SVM model's ability to identify covert tunneling attacks. The parameters of this SVM model are trained based on behavioral statistical features (such as the number of times each source IP uses ICMP within a preset time period) and content statistical features (such as the average repetition rate of packet content corresponding to each source IP) extracted from historical data.

[0044] Step S206: Return the target data that was detected as having a covert tunnel attack to the terminal.

[0045] In step S206 above, the target data may include data packets containing covert tunnel attacks and their corresponding source IPs. Since multiple data packets potentially originating from the same IP address may be involved in covert tunnel attacks, all extracted source IPs can be deduplicated to ensure each source IP is recorded only once, forming a clear dataset for subsequent security measures.

[0046] Through steps S202 to S206 above, the accuracy of ICMP covert tunnel attack detection is improved, thereby enhancing network security protection capabilities. This solves the technical problem that poor accuracy in identifying ICMP tunnel attacks in related technologies prevents timely and effective identification of covert tunnel attacks. Detailed explanation follows.

[0047] In step S204 above, the particle swarm optimization support vector machine model is trained in the following way: acquiring historical data and corresponding label data, wherein the historical data includes historical request messages and historical response messages of the Internet Control Message Protocol (ICMP), and the label data is used to indicate whether the historical data is subject to ICMP covert tunneling attacks; determining the behavioral statistical features and content statistical features of the historical data based on the historical request messages and historical response messages; inputting the behavioral statistical features, content statistical features, and label data into the initial model for iterative training; adjusting the parameters of the initial model before reaching the iteration limit, until the iteration limit is reached or the preset conditions are met, and stopping the iteration to obtain the particle swarm optimization support vector machine model.

[0048] In this embodiment of the application, the training process of the PSO-SVM model may include the following steps:

[0049] Step 1: Data preparation.

[0050] First, historical data from network traffic is acquired, preprocessed, and divided into training and testing sets. This historical data includes historical request and response messages from the ICMP protocol. Simultaneously, tag data corresponding to this historical data is acquired to distinguish between normal data and data exhibiting covert tunneling attacks.

[0051] Step 2: Feature extraction.

[0052] The behavioral statistical features (such as the number of times each source IP uses ICMP within a preset time period) and content statistical features (such as the average repetition rate of the packet content corresponding to each source IP) of the above historical data are extracted to reflect the traffic patterns and content characteristics in the ICMP protocol.

[0053] Step 3: Initialization of the PSO-SVM model.

[0054] Choose a suitable kernel function, such as the RGB function:

[0055] K(x i ·x j )=exp(-γ||x i -x j ||),γ>0

[0056] Where K(x) i ·x j ) represents the kernel function; x i and x j The input feature vector is represented by exp; the exponential function is represented by ||x. i -x j || represents the eigenvector x iand x j The square of the Euclidean norm of the difference between them; γ represents the kernel function parameter.

[0057] Step 4: Parameter optimization.

[0058] The PSO algorithm is used to optimize the parameters of the SVM model. This optimization process mainly includes:

[0059] 1) Initialization process: Configure the initial parameters of the PSO algorithm and determine the search bounds of the penalty factor c and the kernel function parameter γ. The optimization problem formula and corresponding constraints of the SVM model are as follows:

[0060]

[0061]

[0062] Among them, the first function Used to increase the model's classification margin; second function Used to minimize model complexity; α i α j These are Lagrange multipliers, used to represent weights in the model optimization process; y i y j K(x) represents the labels of the i-th and j-th samples; i ·x j ) is the kernel function used to calculate the eigenvector x. i and x j The similarity between the samples; N is the total number of samples; c is the penalty factor, used to control the degree of punishment for misclassification by the model.

[0063] 2) Calculate the fitness function: The fitness function is used to calculate the effect of the parameter combination, which is usually based on the model's performance on the training set, such as classification accuracy.

[0064] 3) Extreme Value Update: Based on the fitness results, update the position and velocity of each particle, and simultaneously record the global optimal solution. The specific process can be as follows:

[0065] Suppose that in a D-dimensional space, there are n particles, then the set of positions of the i-th particle is x. i and velocity set v i They are respectively:

[0066] x i =(x i1 ,x i2 ,L,x iD ), i = 1, 2, ..., n

[0067] v i =(v i1 ,vi2 ,L,v iD ), i = 1, 2, ..., n

[0068] The optimal set of positions experienced by individual particles, pbest i with the population's optimal location set gbest i They are respectively:

[0069] pbest i =(pbest i1 pbest i2 ,L,pbest iD )

[0070] gbest i =(gbest1,gbest2,L,gbest) D )

[0071] When the optimal position set of individuals is pbest i Compared to the population's optimal location set gbest i If a better approach is taken, the latter is updated. The position and velocity of particles of any dimension d (1 ≤ d ≤ D) are constrained within a preset limit range [-x]. max,d ,x max,d ] and [-v max,d ,v max,d Within this range, if the value exceeds a preset limit during the optimization process, it is set as a boundary value. Therefore, the particle velocity and position update formulas are as follows:

[0072]

[0073] in, This indicates the velocity of the particle after the update; This indicates the velocity of the particle before the update; Indicates the position of the particle after the update; c1 and c2 represent the positions of the particles before the update; c1 and c2 represent the learning factors; rand(0,1) represents a random number between [0,1]; pbest id Indicates the optimal position of an individual particle; gbest d This represents the globally optimal particle position.

[0074] 4) Iteration and Update: Repeatedly perform extreme value updates and particle position adjustments until the preset number of iterations is reached or other stopping conditions are met.

[0075] 5) Termination and Output: When the termination condition is met, output the optimal parameter settings to be used to build the SVM model.

[0076] Step 5: Model training.

[0077] The optimized model parameters are applied to the SVM model, and the SVM model is trained using labeled historical data. Through iterative training, the SVM model learns to distinguish between ICMP covert tunnel attacks and normal traffic.

[0078] During the training process of the aforementioned PSO-SVM model, behavioral and content statistical features of historical data are determined based on historical request and response packets. This includes: extracting the source IP addresses corresponding to historical request and response packets; determining the total number of ICMP requests initiated by each source IP address within a preset time period, and the total number of ICMP responses initiated by each source IP address within the preset time period; determining the behavioral statistical features of historical data based on the total number of requests and responses; determining the first average repetition rate for each source IP address from historical request packets, and the second average repetition rate for each source IP address from historical response packets; and determining the content statistical features based on the first and second average repetition rates. The behavioral and content statistical features are explained below.

[0079] In this embodiment, the behavioral statistical characteristics of historical data can be determined as follows: Log parsing is performed on historical request and response messages to obtain fields such as the parsed source IP address, destination IP address, data packet length, data packet content, message type, and log occurrence time. The source IP addresses corresponding to the historical request and response messages are then extracted. The number of times each source IP uses the ICMP protocol within the preset time period is calculated according to a time window (i.e., the aforementioned preset time period). The resulting behavioral statistical characteristics are as follows:

[0080] (1) Req-count i Total number of requests: This refers to the total number of ICMP requests initiated by each source IP within a preset time period (e.g., within five minutes).

[0081] (2) Res-count i Total number of responses refers to the total number of ICMP responses initiated by each source IP within a preset time period (e.g., within five minutes).

[0082] In this embodiment of the application, the statistical characteristics of the historical data are as follows:

[0083] (1) Req-average i The average repetition rate of request packets, also known as the first average repetition rate mentioned above, refers to the average repetition rate of each source IP packet in historical request messages.

[0084] (2) Res-average iThe average repetition rate of response packets, also known as the second average repetition rate mentioned above, refers to the average repetition rate of each source IP packet in historical response messages.

[0085] The first average repetition rate is determined as follows: Historical request packets are grouped according to their source IP addresses. A first packet set corresponding to a first source IP address is obtained from the historical request packets, where the first source IP address is any one of the source IP addresses in the historical request packets. The first number of repeated characters in the data packet content of the first packet and the second packet are determined from the first packet set, as well as the total number of characters in the first data packet corresponding to the first packet. The first packet and the second packet are packets with adjacent sending times in the first packet set, and the sending time of the first packet is earlier than that of the second packet. Based on the first number of repeated characters and the total number of characters in the first data packet, the request data packet repetition rate corresponding to the first packet is determined. The average repetition rate of the request data packet corresponding to each packet in the first source IP address is determined as the first average repetition rate corresponding to the first source IP address.

[0086] The second average repetition rate is determined as follows: After grouping historical response messages by source IP address, obtain the second message set corresponding to the second source IP address from the historical response messages, where the second source IP address is any one of the source IP addresses in the historical response messages; determine the second number of repeated characters in the data packet content of the third and fourth messages in the second message set, and determine the total number of characters in the second data packet corresponding to the third message, where the third and fourth messages are messages sent at adjacent times in the second message set, and the sending time of the third message is earlier than that of the fourth message; determine the response data packet repetition rate corresponding to the third message based on the second number of repeated characters and the total number of characters in the second data packet; and determine the average of the response data packet repetition rates corresponding to each message in the second source IP address as the second average repetition rate corresponding to the second source IP address.

[0087] In this embodiment, the source IP addresses corresponding to historical request and response messages can be grouped for management, facilitating independent analysis of the data for each source IP address. Subsequently, the average repetition rate of the data packets corresponding to the historical request and response messages can be calculated based on the grouped source IP addresses. The specific process is as follows:

[0088] Regarding the first average repetition rate corresponding to historical request packets, firstly, all packets corresponding to the first source IP address can be selected from the grouped historical request packets to form a first packet set. It should be noted that the first source IP address can be any source IP address in the historical request packets. Subsequently, for each pair of packets with adjacent sending times in the first packet set (i.e., the first packet and the second packet mentioned above, where the sending time of the first packet is earlier than that of the second packet), the total number of characters in the first data packet corresponding to the first packet and the number of repeated characters in the data packet content corresponding to the first packet and the second packet (i.e., the first repeated character count mentioned above) are determined. Then, the request data packet repetition rate corresponding to the first packet is obtained by dividing the first repeated character count by the total number of characters in the first data packet. Finally, the average of the request data packet repetition rates corresponding to each packet in the first source IP address is calculated to obtain the first average repetition rate.

[0089] To determine the second average repetition rate for historical response messages, firstly, all messages corresponding to the second source IP address can be selected from the grouped historical response messages to form a second message set. It should be noted that this second source IP address can be any source IP address from the historical response messages. Then, for each pair of messages in the second message set with adjacent sending times (i.e., the third and fourth messages mentioned above, where the third message was sent earlier than the fourth message), the total number of characters in the second data packet corresponding to the third message is determined, as well as the number of repeated characters in the data packet content corresponding to the third and fourth messages (i.e., the second number of repeated characters). Next, the repetition rate of the response data packet corresponding to the third message is obtained by dividing the second number of repeated characters by the total number of characters in the second data packet. Finally, the average repetition rate of the response data packet corresponding to each message in the second source IP address is calculated to obtain the second average repetition rate.

[0090] Optionally, after determining the behavioral statistical features and content statistical features of the historical data, the method further includes: determining a first maximum value, a first minimum value, and a first feature value of the behavioral statistical features, wherein the first feature value is any one of the feature values ​​in the behavioral statistical features; normalizing the first feature value based on the first maximum value, the first minimum value, and the first feature value; determining a second maximum value, a second minimum value, and a second feature value of the content statistical features, wherein the second feature value is any one of the feature values ​​in the content statistical features; and normalizing the second feature value based on the second maximum value, the second minimum value, and the second feature value.

[0091] In this embodiment, after determining the behavioral and content statistical features of historical data, feature preprocessing, such as normalization, can be performed on all statistical feature data. This normalization process unifies the values ​​corresponding to all statistical features to a fixed range, eliminating the influence of different units of measurement, thus facilitating subsequent analysis and processing by the PSO-SVM model. The specific normalization formula can be as follows:

[0092]

[0093] Among them, X norm X is used to represent behavioral or content statistical features after normalization. max Used to represent the maximum value of the data, that is, the first maximum value of the above behavioral statistical feature in the normalization process, or the second maximum value of the above content statistical feature in the normalization process; X min X is used to represent the minimum value of the data, that is, the first minimum value of the above behavioral statistical features in the normalization process, or the second minimum value of the above content statistical features in the normalization process; X is used to represent the input data, that is, any one of the above behavioral statistical features (first feature value), or any one of the above content statistical features (second feature value).

[0094] In step S206 above, the target data that is detected as having a covert tunnel attack is returned to the terminal, including: obtaining the source IP address corresponding to the target data; deduplicating the source IP address corresponding to the target data to obtain the target IP address; and returning the target IP address and the target data to the terminal.

[0095] In this embodiment, the data to be detected is input into the PSO-SVM model for detection, which yields detection results indicating normal data and target data with covert tunnel attacks. Furthermore, returning the target data with covert tunnel attacks identified in the detection results to the terminal effectively identifies the source of ICMP covert tunnel attacks, providing crucial information for network security protection and enabling corresponding defensive measures.

[0096] The target data can include data containing covert tunnel attacks and their corresponding source IPs. Since multiple packets from covert tunnel attacks may originate from the same IP address, all extracted source IPs can be deduplicated to ensure each source IP is recorded only once, forming a clear dataset for subsequent security measures.

[0097] Figure 3 This is a schematic diagram of a tunnel attack detection process according to an embodiment of this application. Figure 3As shown, firstly, ICMP historical request and response logs (messages) are obtained through the database interface. Then, the source IP address, destination IP address, packet length, packet content, message type, and log occurrence time are extracted through log parsing. Finally, statistical features based on ICMP behavior (behavioral statistical features Req-count) are constructed. i and Res-count i ) and statistical characteristics of ICMP packet content (content statistics Req-average) i and Res-average i Next, feature preprocessing is performed on all statistical features, and the parameters of the support vector machine (SVM) are optimized based on the particle swarm optimization (PSO) algorithm. Finally, the source IP related to ICMP covert tunnel attacks can be obtained through the detection results of the PSO-SVM model.

[0098] In this embodiment, statistical features are first constructed using ICMP request and response logs. Then, the parameters of the support vector machine (SVM) are optimized using the particle swarm optimization (PSO) algorithm, which improves the accuracy of the model in distinguishing between ICMP tunnel attacks and normal traffic. Finally, the source IP related to ICMP tunnel attacks is obtained through the detection results of the PSO-SVM model. By combining statistical feature analysis and advanced machine learning techniques, the system can more accurately distinguish between tunnel attacks and normal network behavior, thereby identifying covert tunnel attacks in a timely and effective manner.

[0099] According to embodiments of this application, a tunnel attack detection device is provided. It should be noted that the tunnel attack detection device of this application embodiment can be used to execute the tunnel attack detection method provided in this application embodiment. The tunnel attack detection device provided in this application embodiment is described below.

[0100] Figure 4 This is a structural diagram of a tunnel attack detection device provided according to an embodiment of this application. Figure 4 As shown, the device includes:

[0101] The acquisition module 40 is used to acquire the data to be detected transmitted in the terminal;

[0102] Detection module 42 is used to detect the data to be detected using a particle swarm optimization support vector machine model and obtain the detection results. The particle swarm optimization support vector machine model is trained based on the behavioral statistical features and content statistical features of historical data.

[0103] Return module 44 is used to return target data that indicates a covert tunnel attack to the terminal.

[0104] By using the acquisition module 40, detection module 42, and return module 44 in the aforementioned tunnel attack detection device, the accuracy of ICMP covert tunnel attack detection is improved, thereby enhancing network security protection capabilities. This solves the technical problem that covert tunnel attacks cannot be identified in a timely and effective manner due to the poor accuracy of ICMP tunnel attack identification in related technologies.

[0105] In the tunnel attack detection device provided in this application embodiment, a training module 46 is included. This training module is used to acquire historical data and corresponding tag data. The historical data includes historical request messages and historical response messages of Internet Control Message Protocol (ICMP). The tag data is used to indicate whether there is an ICMP covert tunnel attack in the historical data. Based on the historical request messages and historical response messages, the behavioral statistical features and content statistical features of the historical data are determined. The behavioral statistical features, content statistical features, and tag data are input into an initial model for iterative training. If the iteration limit is not reached, the parameters of the initial model are adjusted until the iteration limit is reached or a preset condition is met, at which point the iteration stops, resulting in a particle swarm optimization support vector machine model.

[0106] In the tunnel attack detection device provided in this application embodiment, the training module is further configured to extract the source IP addresses corresponding to historical request packets and historical response packets; determine the total number of ICMP requests initiated by each source IP address within a preset time period, and determine the total number of ICMP responses initiated by each source IP address within the preset time period; determine the behavioral statistical characteristics of historical data based on the total number of requests and responses; determine the first average repetition rate corresponding to each source IP address from the historical request packets, and determine the second average repetition rate corresponding to each source IP address from the historical response packets; and determine the content statistical characteristics based on the first average repetition rate and the second average repetition rate.

[0107] In the tunnel attack detection device provided in this application embodiment, the training module is further configured to group historical request packets according to source IP addresses, obtain a first packet set corresponding to a first source IP address determined from the historical request packets, wherein the first source IP address is any one of the source IP addresses in the historical request packets; determine the first number of duplicate characters in the data packet content of the first packet and the second packet in the first packet set, and determine the total number of characters in the first data packet corresponding to the first packet, wherein the first packet and the second packet are packets with adjacent sending times in the first packet set, and the sending time of the first packet is earlier than the sending time of the second packet; determine the request data packet duplication rate corresponding to the first packet based on the first number of duplicate characters and the total number of characters in the first data packet; and determine the average value of the request data packet duplication rate corresponding to each packet in the first source IP address as the first average duplication rate corresponding to the first source IP address.

[0108] In the tunnel attack detection device provided in this application embodiment, the training module is further configured to group historical response messages according to source IP addresses, obtain a second message set corresponding to a second source IP address determined from the historical response messages, wherein the second source IP address is any one of the source IP addresses in the historical response messages; determine the second number of repeated characters in the data packet content of the third message and the fourth message in the second message set, and determine the total number of characters in the second data packet corresponding to the third message, wherein the third message and the fourth message are messages with adjacent sending times in the second message set, and the sending time of the third message is earlier than the sending time of the fourth message; determine the response data packet repetition rate corresponding to the third message based on the second number of repeated characters and the total number of characters in the second data packet; and determine the average value of the response data packet repetition rate corresponding to each message in the second source IP address as the second average repetition rate corresponding to the second source IP address.

[0109] In the tunnel attack detection device provided in this application embodiment, the training module is further configured to determine a first maximum value, a first minimum value, and a first feature value of the behavioral statistical features, wherein the first feature value is any one of the behavioral statistical features; normalize the first feature value based on the first maximum value, the first minimum value, and the first feature value; determine a second maximum value, a second minimum value, and a second feature value of the content statistical features, wherein the second feature value is any one of the content statistical features; and normalize the second feature value based on the second maximum value, the second minimum value, and the second feature value.

[0110] In the tunnel attack detection device provided in this application embodiment, the return module is further used to obtain the source IP address corresponding to the target data; after deduplicating the source IP address corresponding to the target data, the target IP address is obtained; and the target IP address and target data are returned to the terminal.

[0111] This application also provides an electronic device, including: a memory for storing program instructions; and a processor connected to the memory for executing program instructions to perform the following functions: acquiring data to be detected transmitted in a terminal; using a particle swarm optimization support vector machine model to detect the data to be detected and obtaining a detection result, wherein the particle swarm optimization support vector machine model is trained based on behavioral statistical features and content statistical features of historical data; and returning the target data that is detected as having a hidden tunnel attack to the terminal.

[0112] It should be noted that the aforementioned electronic equipment is used to perform Figure 2 The tunnel attack detection method shown above also applies to this electronic device, and will not be repeated here.

[0113] This application also provides a non-volatile storage medium including a stored computer program, wherein the device containing the non-volatile storage medium executes the above-mentioned tunnel attack detection method by running the computer program.

[0114] It should be noted that the aforementioned non-volatile storage media is used for execution. Figure 2 The tunnel attack detection method shown above also applies to this non-volatile storage medium, and will not be repeated here.

[0115] This application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above-described method for detecting tunnel attacks.

[0116] It should be noted that the above-mentioned computer program product is used to execute Figure 2 The tunnel attack detection method shown above also applies to this computer program product, and will not be repeated here.

[0117] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0118] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0119] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0120] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0121] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0122] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0123] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting tunnel attacks, characterized in that, include: Acquire the data to be detected transmitted from the terminal; The particle swarm optimization support vector machine model is used to detect the data to be detected, and the detection result is obtained. The particle swarm optimization support vector machine model is trained based on the behavioral statistical features and content statistical features of historical data. The target data that is detected as having a covert tunnel attack is returned to the terminal. The method further includes: determining the content statistical features based on a first average repetition rate and a second average repetition rate, wherein the first average repetition rate is the average repetition rate corresponding to each source IP address in the historical request packets in the historical data, and the second average repetition rate is the average repetition rate corresponding to each source IP address in the historical response packets in the historical data. The first average repetition rate is determined by: grouping the historical request packets according to their source IP addresses, and obtaining a first packet set corresponding to a first source IP address determined from the historical request packets, wherein the first source IP address is any one of the source IP addresses in the historical request packets. The P address; determine the first number of repeated characters in the data packet content of the first message and the second message in the first message set, and determine the total number of characters in the first data packet corresponding to the first message, wherein the first message and the second message are messages with adjacent sending times in the first message set, and the sending time of the first message is earlier than the sending time of the second message; determine the request data packet repetition rate corresponding to the first message based on the first number of repeated characters and the total number of characters in the first data packet; determine the average value of the request data packet repetition rate corresponding to each message in the first source IP address as the first average repetition rate corresponding to the first source IP address.

2. The method according to claim 1, characterized in that, The particle swarm optimization support vector machine model is trained in the following way: The historical data is obtained, as well as the tag data corresponding to the historical data. The historical data includes historical request messages and historical response messages of Internet Control Message Protocol (ICMP). The tag data is used to indicate whether the historical data is subject to ICMP covert tunneling attacks. Based on the historical request messages and the historical response messages, determine the behavioral statistical characteristics and content statistical characteristics of the historical data; The behavioral statistical features, the content statistical features, and the tag data are input into the initial model for iterative training. If the iteration limit is not reached, the parameters of the initial model are adjusted until the iteration limit is reached or a preset condition is met, at which point the iteration stops, and the particle swarm optimization support vector machine model is obtained.

3. The method according to claim 2, characterized in that, Based on the historical request messages and the historical response messages, determine the behavioral statistical characteristics and content statistical characteristics of the historical data, including: Extract the source IP addresses corresponding to the historical request messages and the historical response messages; Determine the total number of ICMP requests initiated by each source IP address within a preset time period, and determine the total number of ICMP responses initiated by each source IP address within the preset time period; The behavioral statistical characteristics of the historical data are determined based on the total number of requests and the total number of responses. Determine the first average repetition rate for each source IP address from the historical request messages, and determine the second average repetition rate for each source IP address from the historical response messages; Based on the first average repetition rate and the second average repetition rate, the content statistical characteristics are determined.

4. The method according to claim 3, characterized in that, Determining the second average repetition rate for each source IP address from the historical response messages includes: After grouping the historical response messages according to their source IP addresses, a second message set corresponding to the second source IP address is obtained from the historical response messages, wherein the second source IP address is any one of the source IP addresses in the historical response messages; In the second message set, determine the number of second duplicate characters in the data packet content of the third message and the fourth message, and determine the total number of characters in the second data packet corresponding to the third message, wherein the third message and the fourth message are messages with adjacent sending times in the second message set, and the sending time of the third message is earlier than the sending time of the fourth message; The repetition rate of the response data packet corresponding to the third message is determined based on the second number of repeated characters and the total number of characters in the second data packet; The average repetition rate of the response data packets corresponding to each message in the second source IP address is determined as the second average repetition rate corresponding to the second source IP address.

5. The method according to claim 3, characterized in that, After determining the behavioral statistical features and content statistical features of the historical data, the method further includes: Determine the first maximum value, the first minimum value, and the first feature value of the behavioral statistical feature, wherein the first feature value is any one of the feature values ​​in the behavioral statistical feature; Based on the first maximum value, the first minimum value, and the first feature value, the first feature value is normalized. Determine the second maximum value, the second minimum value, and the second feature value of the content statistical features, wherein the second feature value is any one of the feature values ​​in the content statistical features; Based on the second maximum value, the second minimum value, and the second eigenvalue, the second eigenvalue is normalized.

6. The method according to claim 1, characterized in that, Returning target data indicating a covert tunnel attack as detected by the test results to the terminal includes: Obtain the source IP address corresponding to the target data; After deduplicating the source IP address corresponding to the target data, the target IP address is obtained; The target IP address and the target data are returned to the terminal.

7. A detection device for tunnel attacks, characterized in that, include: The acquisition module is used to acquire the data to be detected transmitted in the terminal; The detection module is used to detect the data to be detected using a particle swarm optimization support vector machine model to obtain the detection result. The particle swarm optimization support vector machine model is trained based on the behavioral statistical features and content statistical features of historical data. The return module is used to return the target data, which indicates that the detection result indicates the presence of a covert tunnel attack, to the terminal; The device further includes a training module for determining the content statistical features based on a first average repetition rate and a second average repetition rate, wherein the first average repetition rate is the average repetition rate corresponding to each source IP address in the historical request packets in the historical data, and the second average repetition rate is the average repetition rate corresponding to each source IP address in the historical response packets in the historical data. The first average repetition rate is determined by grouping the historical request packets according to their source IP addresses and obtaining a first packet set corresponding to a first source IP address determined from the historical request packets, wherein the first source IP address is any one of the historical request packets. The first source IP address is identified; the first number of repeated characters in the data packet content of the first message and the second message are determined in the first message set, and the total number of characters in the first data packet corresponding to the first message is determined, wherein the first message and the second message are messages with adjacent sending times in the first message set, and the sending time of the first message is earlier than that of the second message; based on the first number of repeated characters and the total number of characters in the first data packet, the request data packet repetition rate corresponding to the first message is determined; the average value of the request data packet repetition rate corresponding to each message in the first source IP address is determined as the first average repetition rate corresponding to the first source IP address.

8. An electronic device, characterized in that, include: Memory, used to store program instructions; A processor, connected to the memory, is configured to execute program instructions to perform the following functions: acquire data to be detected transmitted from the terminal; detect the data to be detected using a particle swarm optimization support vector machine model to obtain a detection result, wherein the particle swarm optimization support vector machine model is trained based on behavioral and content statistical features of historical data; return the target data, which is detected as having a covert tunnel attack, to the terminal; determine the content statistical features based on a first average repetition rate and a second average repetition rate, wherein the first average repetition rate is the average repetition rate corresponding to each source IP address in the historical request packets in the historical data, and the second average repetition rate is the average repetition rate corresponding to each source IP address in the historical response packets in the historical data, wherein the first average repetition rate is determined by: dividing the historical request packets into... After grouping by source IP address, a first packet set corresponding to a first source IP address is obtained from the historical request packets, wherein the first source IP address is any one of the source IP addresses in the historical request packets; the first number of duplicate characters in the data packet content of the first packet and the second packet is determined in the first packet set, and the total number of characters in the first data packet corresponding to the first packet is determined, wherein the first packet and the second packet are packets with adjacent sending times in the first packet set, and the sending time of the first packet is earlier than the sending time of the second packet; based on the first number of duplicate characters and the total number of characters in the first data packet, the request data packet duplication rate corresponding to the first packet is determined; the average value of the request data packet duplication rate corresponding to each packet in the first source IP address is determined as the first average duplication rate corresponding to the first source IP address.

9. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored computer program, wherein the device containing the non-volatile storage medium executes the tunnel attack detection method according to any one of claims 1 to 6 by running the computer program.

10. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the tunnel attack detection method according to any one of claims 1 to 6.

Images