Malicious traffic detection method and device, computer equipment and readable storage medium

Abstract

The embodiment of the invention provides a malicious traffic detection method and device, computer equipment and a readable storage medium. The method comprises the following steps: establishing an inter-flow interaction graph corresponding to a to-be-detected flow based on a plurality of internet protocol addresses and a data flow interaction relationship among the plurality of internet protocol addresses; performing reconstruction processing on each first data stream between any two internet protocol addresses to obtain a second data stream; performing feature aggregation on a plurality of data packets contained in the second data stream to obtain corresponding edge features of the second data stream in the inter-stream interaction graph; according to the at least one first data stream and the corresponding second data stream, generating a node feature of each internet protocol address in an inter-stream interaction graph; and identifying each edge feature through the first target model to obtain a first malicious traffic detection result, and identifying each node feature through the first target model to obtain a second malicious traffic detection result. Therefore, the accuracy of malicious traffic detection can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of traffic detection, and in particular to a malicious traffic detection method, apparatus, computer equipment and readable storage medium. Background Art

[0002] Malicious traffic refers to data flows generated by malicious behavior or attack activities in the network. Malicious traffic is usually used to attack computer systems, steal data, disrupt services, spread malware, or conduct unauthorized access, etc. Therefore, in order to prevent and respond to network threats, network traffic can be detected to see if it is malicious traffic to protect the security and availability of systems, data, and services.

[0003] In the related art, when detecting network traffic, a generalized feature pooling and feature splicing method is generally used to combine and process all features, which results in the model being unable to extract useful information from the data for classification, thereby reducing the accuracy of malicious traffic detection. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a malicious traffic detection method, device, computer equipment and readable storage medium, which can improve the accuracy of malicious traffic detection.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a malicious traffic detection method, the method comprising:

[0006] Acquire the traffic to be detected, and establish an inter-flow interaction graph corresponding to the traffic to be detected based on multiple Internet Protocol addresses in the traffic to be detected and data flow interaction relationships between the multiple Internet Protocol addresses;

[0007] Reconstructing each first data stream between any two Internet Protocol addresses to obtain a second data stream;

[0008] For at least one second data flow between any two Internet Protocol addresses, feature aggregation is performed on a plurality of data packets included in the second data flow to obtain edge features corresponding to the second data flow in the inter-flow interaction graph;

[0009] For each Internet Protocol address, generating a node feature of an interaction graph between the Internet Protocol address according to at least one first data flow and a corresponding second data flow;

[0010] Each edge feature in the inter-flow interaction graph is identified through the first target model to obtain a first malicious traffic detection result, and each node feature in the inter-flow interaction graph is identified through the first target model to obtain a second malicious traffic detection result.

[0011] Accordingly, a second aspect of an embodiment of the present application provides a malicious traffic detection device, the device comprising:

[0012] An acquisition module, used for acquiring the traffic to be detected, and establishing a flow interaction graph corresponding to the traffic to be detected based on a plurality of Internet Protocol addresses in the traffic to be detected and a data flow interaction relationship between the plurality of Internet Protocol addresses;

[0013] A reconstruction module, used for reconstructing each first data stream between any two Internet Protocol addresses to obtain a second data stream;

[0014] an aggregation module, configured to perform feature aggregation on a plurality of data packets included in at least one second data flow between any two Internet Protocol addresses, and obtain edge features corresponding to the second data flow in the inter-flow interaction graph;

[0015] A generating module, configured to generate, for each Internet Protocol address, node features of an interaction graph between the Internet Protocol address and the streams according to at least one first data stream and a corresponding second data stream;

[0016] An identification module is used to identify each edge feature in the inter-flow interaction graph through a first target model to obtain a first malicious traffic detection result, and to identify each node feature in the inter-flow interaction graph through the first target model to obtain a second malicious traffic detection result.

[0017] In some embodiments, the reconstruction module is further used to:

[0018] For each first data flow between any two Internet Protocol addresses, determining multiple length information of multiple data packets included in the first data flow;

[0019] Sorting the plurality of data packets in a preset sorting order according to the plurality of length information to obtain a sorted first intermediate data stream;

[0020] Duplicate data packets are deduplicated on multiple data packets of the first intermediate data stream to obtain a second data stream.

[0021] In some implementations, the malicious traffic detection device further includes an averaging module, configured to:

[0022] For each of the second data flows, averaging the lengths of the multiple data packets according to the multiple length information to obtain an average data packet length corresponding to the second data flow;

[0023] Obtaining a preset maximum transmission unit, and determining a deviation threshold between the average data packet length and the maximum transmission unit;

[0024] When there is a target data flow in the second data flow whose deviation threshold is less than the preset target threshold, the corresponding target data flow is input into the second target model to obtain a malicious traffic detection result of the target data flow.

[0025] In some embodiments, the aggregation module is further used to:

[0026] For at least one second data flow between any two Internet Protocol addresses, constructing an intra-flow interaction graph corresponding to the second data flow according to directions of a plurality of data packets included in the second data flow;

[0027] The traffic statistical features of each data packet in the second data flow are obtained, and feature aggregation of multiple traffic statistical features corresponding to the multiple data packets is performed according to the intra-flow interaction graph to obtain the edge features corresponding to the second data flow in the inter-flow interaction graph.

[0028] In some embodiments, the aggregation module is further used to:

[0029] For at least one second data flow between any two Internet Protocol addresses, sequentially determining directions of a plurality of data packets in the second data flow;

[0030] Determining continuous data packets having the same direction in the second data stream as data clusters, and determining a start data packet and an end data packet of each of the data clusters;

[0031] Determine in sequence the data layer corresponding to each of the data clusters in the intra-stream interaction graph, and in each of the data layers, connect the data packets contained in each data cluster in sequence;

[0032] In any two of the data layers, the start data packets of the data clusters between the data layers are correspondingly connected, and the end data packets of the data clusters between the data layers are correspondingly connected to obtain an intra-flow interaction graph corresponding to the second data flow.

[0033] In some embodiments, the generating module is further used to:

[0034] For each Internet Protocol address, concatenate the first data stream received by each Internet Protocol address with the corresponding second data stream to obtain a target data stream;

[0035] Acquire multiple target data streams received by the Internet Protocol address, and splice the multiple target data streams in chronological order to obtain a data stream sequence;

[0036] The data stream sequence is converted and input into a preset sequence embedding model to obtain the node features of the Internet Protocol address in the interaction graph between the streams.

[0037] In some implementations, the malicious traffic detection device further includes a fusion module, which is used to:

[0038] When there are multiple edge features between any two Internet Protocol addresses, determining an adjustment weight for each edge feature;

[0039] Based on the multiple adjustment weights of the multiple edge features, weight fusion is performed on the multiple edge features between the two Internet Protocol addresses to obtain an aggregated edge feature;

[0040] Then, each edge feature in the flow interaction graph is identified by the first target model to obtain a first malicious traffic detection result, including:

[0041] Each aggregate edge feature in the inter-flow interaction graph is identified through the first target model to obtain a first malicious traffic detection result.

[0042] In some implementations, the malicious traffic detection device further includes a training module, which is used to:

[0043] Acquire sample traffic, and determine sample edge features and sample node features of the sample traffic;

[0044] Inputting the sample edge features and the sample node features into a preset model to obtain predicted sample edge labels of the sample edge features and predicted sample node labels of the sample node features;

[0045] Obtaining a true sample edge label of the sample edge feature, and determining a first loss according to a gap between the predicted sample edge label and the true sample edge label;

[0046] Obtaining a real sample node label of the sample node feature, and obtaining a second loss according to a gap between the predicted sample node label and the real sample node label;

[0047] The preset model is trained according to the first loss and the second loss to obtain a target model.

[0048] In some embodiments, the training module is further used to:

[0049] Obtaining a first adjustment weight set for a first loss, and adjusting the first loss according to the first adjustment weight to obtain a first target loss;

[0050] Obtaining a second adjustment weight set for a second loss, and adjusting the second loss according to the second adjustment weight to obtain a second target loss;

[0051] Adding the first target loss and the second target loss to obtain a target loss;

[0052] The preset model is trained according to the target loss to obtain a target model.

[0053] Correspondingly, the third aspect of the embodiments of the present application proposes a computer device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the malicious traffic detection method described in any one of the embodiments of the first aspect of the present application when executing the computer program.

[0054] Correspondingly, the fourth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the malicious traffic detection method described in any one of the embodiments of the first aspect of the present application.

[0055] The present application obtains the traffic to be detected, and based on multiple Internet Protocol addresses in the traffic to be detected and the data flow interaction relationship between the multiple Internet Protocol addresses, establishes an inter-flow interaction graph corresponding to the traffic to be detected; reconstructs each first data flow between any two Internet Protocol addresses to obtain a second data flow; for at least one second data flow between any two Internet Protocol addresses, performs feature aggregation on multiple data packets contained in the second data flow to obtain the edge features corresponding to the second data flow in the inter-flow interaction graph; for each Internet Protocol address, generates node features of the Internet Protocol address in the inter-flow interaction graph according to at least one first data flow and the corresponding second data flow; identifies each edge feature in the inter-flow interaction graph through a first target model to obtain a first malicious traffic detection result, and identifies each node feature in the inter-flow interaction graph through the first target model to obtain a second malicious traffic detection result. In this way, by constructing an interaction graph between flows, it is possible to accurately capture the interaction relationship between Internet Protocol addresses in the traffic to be detected, and generate fine-grained edge features and node features through the reconstructed second data stream, thereby making full use of the limited set of available features in the traffic to be detected, obtaining a better traffic embedding representation, and thus improving the accuracy of malicious traffic detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a schematic diagram of the architecture of the malicious traffic detection system provided in an embodiment of the present application;

[0057] Figure 2 is a flow chart of a malicious traffic detection method provided in an embodiment of the present application;

[0058] Figure 3 It is a general schematic diagram of the malicious traffic detection method provided in the embodiment of the present application;

[0059] Figure 4 It is an overall flow chart of the malicious traffic detection method provided in the embodiment of the present application;

[0060] Figure 5 It is a functional module diagram of a malicious traffic detection device provided in an embodiment of the present application;

[0061] Figure 6 It is a schematic diagram of the hardware structure of the computer device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0063] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0064] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0065] Malicious traffic refers to data flows generated by malicious behavior or attack activities in the network. Malicious traffic is usually used to attack computer systems, steal data, disrupt services, spread malware, or conduct unauthorized access, etc. Therefore, in order to prevent and respond to network threats, network traffic can be detected to see if it is malicious traffic to protect the security and availability of systems, data, and services.

[0066] In the related art, when detecting network traffic, a generalized feature pooling and feature splicing method is generally used to combine and process all features, which results in the model being unable to extract useful information from the data for classification, thereby reducing the accuracy of malicious traffic detection.

[0067] It is worth noting that when the relevant technologies classify malicious traffic, there may also be problems with homogeneity assumptions. Specifically, when the relevant technologies often consider a node to be a malicious node, they will classify all edges with the malicious node vector as malicious edges, resulting in a large number of false positives.

[0068] Based on this, the embodiments of the present application provide a malicious traffic detection method, apparatus, computer equipment and readable storage medium, which can improve the accuracy of malicious traffic detection.

[0069] The malicious traffic detection method, apparatus, computer equipment and readable storage medium provided in the embodiments of the present application are specifically described through the following embodiments. First, the malicious traffic detection system in the embodiments of the present application is described.

[0070] Please refer to Figure 1 In some implementations, an embodiment of the present application provides a malicious traffic detection system, the system including a terminal 11 and a server 12.

[0071] For example, the terminal 11 can be a desktop computer, a mobile device, an IoT device, an industrial control system, etc. The terminal 11 can generate network traffic, which will be used by the system to analyze whether there is malicious behavior. In addition, the terminal 11 can also install client software to help the system perform preliminary traffic recording and preprocessing, thereby reducing the pressure on the server 12.

[0072] Furthermore, the server 12 can be a cloud server, a data center, a security gateway, etc. The server 12 can collect traffic data from the terminal 11, process and analyze it, and identify malicious traffic through a trained model. The server 12 is responsible for performing core tasks such as traffic cleaning, feature extraction, model training, and classification prediction, and ultimately feeds back the detection results to security managers or automatically executes corresponding security policies.

[0073] The malicious traffic detection method in the embodiment of the present application can be illustrated by the following embodiment.

[0074] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or separate consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or separate consent, the necessary user-related data for enabling the normal operation of the embodiment of the present application will be obtained.

[0075] In the embodiment of the present application, the malicious traffic detection device will be described from the perspective of the malicious traffic detection device, which can be specifically integrated into a computer device. Figure 2 , Figure 2This is a flowchart of the steps of the malicious traffic detection method provided in the embodiment of the present application. The embodiment of the present application takes the malicious traffic detection device as an example, which is specifically integrated in a terminal or a server. When the processor on the terminal or the server executes the program instructions corresponding to the malicious traffic detection method, the specific process is as follows:

[0076] Step 101, obtain the traffic to be detected, and establish a flow interaction graph corresponding to the traffic to be detected based on multiple Internet Protocol addresses in the traffic to be detected and the data flow interaction relationship between the multiple Internet Protocol addresses.

[0077] In some implementations, in order to analyze the behavior pattern of the traffic to be detected, an inter-flow interaction graph of the traffic to be detected can be constructed with Internet Protocol addresses as nodes and the interaction relationships between Internet Protocol addresses as edges to improve the efficiency and accuracy of detecting the traffic to be detected.

[0078] The traffic to be detected may be network traffic data that needs to be analyzed and detected to see if it is malicious traffic. The traffic to be detected may be encrypted traffic data or unencrypted traffic data. The embodiments of the present application are mainly described in the encrypted traffic scenario. Meanwhile, the technical solution of the present application may also be used in the unencrypted traffic scenario. Specifically, the traffic to be detected may include a sequence of data packets, each of which contains information such as a source Internet Protocol (IP) address, a destination IP address, a protocol type, a data packet length, and a data packet arrival timestamp.

[0079] The Internet Protocol address may be an IP address, which is a unique address used to identify a device in a network. The IP address allows data packets to be addressed and routed in a network, thereby enabling data exchange between different devices.

[0080] The data flow interaction relationship may refer to the communication relationship formed by sending and receiving data packets between different Internet Protocol addresses in the traffic to be detected. The data flow interaction relationship may be represented as the flow of data packets between a pair of Internet Protocol addresses, including the number, direction, size and other information of data packets. Each data flow may include multiple data packets, and a pair of Internet Protocol addresses may include multiple data flows.

[0081] The flow interaction graph may be a graph structure composed of Internet Protocol addresses in the traffic to be detected and the data flow interaction relationship between them. In the flow interaction graph, Internet Protocol addresses may be used as nodes, and the data flow interactions between nodes may be regarded as edges. The flow interaction graph may be used to visualize the interaction patterns in the traffic to be detected and help detect malicious traffic.

[0082] Exemplarily, the traffic to be detected can be cleaned, and the Internet Protocol addresses and the interactive relationships between the Internet Protocol addresses can be extracted to construct an inter-flow interaction graph. For example, if the traffic between Internet Protocol addresses A, B, C, and D needs to be detected, Internet Protocol address A sends 100 data packets to Internet Protocol address B, Internet Protocol address B responds to Internet Protocol address A with 100 data packets, Internet Protocol address C sends 500 data packets to Internet Protocol address D, and Internet Protocol address D responds to Internet Protocol address C with 500 data packets, then Internet Protocol addresses A, B, C, and D can be used as nodes of the inter-flow interaction graph, and each node can be connected according to the direction of the traffic sent by the node, thereby constructing an inter-flow interaction graph.

[0083] Furthermore, data cleaning of the traffic to be detected may include obtaining the regional network traffic records of the target area collected in the gateway, such as pcap files, and performing a series of processing and cleaning on the unstructured network records in the regional network traffic records to convert them into structured data for subsequent processing. Processing and cleaning may include operations such as extracting features, eliminating null values ​​and outliers, etc.

[0084] By constructing an interaction graph between flows, we can more effectively capture the communication patterns in the network and conduct in-depth analysis based on them, thereby improving the efficiency and accuracy of identifying malicious traffic and providing a basis for subsequent feature extraction and malicious traffic detection.

[0085] Step 102: reconstruct each first data stream between any two Internet Protocol addresses to obtain a second data stream.

[0086] It is understandable that in the application scenario of encrypted traffic, since the traffic load in the traffic is ciphertext, it is invisible to the detection personnel and difficult to perform content analysis. If the coarse-grained statistical features such as the packet length sequence, the packet arrival frequency, and the flow duration are directly used as the original features to express the encrypted traffic, the actual generation process of these features will be greatly affected by network fluctuations and malicious confusion behaviors. For example, normal network delays or malicious confusion by attackers will cause sequence offsets, packet replays, and packet reorganization of the packet length sequence captured by the receiving end, directly causing huge changes in the packet sequence of the same network flow, and also causing significant changes in features such as the packet arrival frequency and flow duration. This change directly affects the original traffic features that serve as the basis for prediction of the deep learning model, making it difficult for the trained model to maintain good results under new network fluctuations. Therefore, in some embodiments, the present application can reconstruct each first data stream between any two Internet Protocol addresses to obtain a second data stream, and then extract edge features and node features for malicious traffic detection, eliminating the influence of network fluctuations and malicious confusion behaviors, and greatly improving the robustness of features and the accuracy of detection.

[0087] The first data stream may be an original data stream generated when any two Internet Protocol addresses communicate with each other. The first data stream may include an encrypted data payload, metadata of a data packet pair, length of a data packet, arrival timestamp, etc.

[0088] The second data stream may be a new data stream obtained by reconstructing the first data stream.

[0089] Exemplarily, the reconstruction processing of the first data stream may include reordering data packets, deduplicating data packets, completing lost data packets, etc. The specific reconstruction processing type may be adjusted as needed.

[0090] By reconstructing the first data stream to obtain the second data stream, the reliability of the data stream can be ensured, and the detection accuracy and robustness of the system when performing malicious traffic detection can be enhanced.

[0091] In some implementations, in order to ensure that the data packet sequence remains consistent and stable in the event of network fluctuations or malicious confusion (such as out-of-order or repeated transmission of data packets), the data packets contained in each first data stream may be reordered and deduplicated to improve the robustness of the traffic characteristics. For example, step 102 may include:

[0092] (102.1) for each first data flow between any two Internet Protocol addresses, determining multiple length information of multiple data packets included in the first data flow;

[0093] (102.2) sorting the plurality of data packets according to a preset sorting order based on the plurality of length information to obtain a sorted first intermediate data stream;

[0094] (102.3) De-duplication processing is performed on multiple data packets of the first intermediate data stream to obtain a second data stream.

[0095] Among them, a data packet can be the basic data unit transmitted in network communication. Each data packet contains header information and payload (i.e., the actual data to be transmitted). The header information usually includes the source IP address, the destination IP address, the protocol type, the packet length, the timestamp, etc. When detecting encrypted traffic, since the payload is usually encrypted, it is necessary to obtain the metadata of the data packet, especially its length information, and focus on it.

[0096] The length information may be the payload size of the data packet, that is, the length of the data portion of the data packet excluding the header information. In the process of detecting encrypted traffic, the length information is one of the important features because it can still help construct the characteristic pattern of the data packet sequence even if the encrypted content cannot be viewed.

[0097] The preset sorting order may be a preset sorting logic, such as from large to small, from small to large, etc. Generally speaking, since a longer data packet may contain more information, the preset sorting order may be set to sort from large to small to give priority to processing longer data packets. The sorting order may be set according to different requirements.

[0098] The first intermediate data stream may be a data stream obtained after rearranging the first data stream.

[0099] Exemplarily, reconstructing each first data stream may include reordering and deduplicating data packets of the first data stream.

[0100] Specifically, when reordering the data packets, multiple length information of multiple data packets contained in each first data stream between any two Internet Protocol addresses can be sorted to obtain a sorted first intermediate data stream. For example, the data packets in each first data stream are reordered from large to small to ensure that the data packet sequence remains unchanged even when the sequence is disordered.

[0101] Furthermore, when deduplicating data packets, duplicate data packets in each first intermediate data stream may be removed based on the data packet length and content of each first intermediate data stream, thereby ensuring that the data packet sequence remains unchanged during data replay.

[0102] It should be noted that the reconstruction processing of each data stream is not limited to rearrangement and deduplication processing, but may also include other reconstruction operations, and there is no restriction on the order of the rearrangement and deduplication processing operations. Rearrangement may be performed first and then deduplication processing, or deduplication processing may be performed first and then rearrangement processing.

[0103] By sorting the data packets in each first data stream according to the length of the data packets, the relative position of the data packets remains unchanged even under network delays or attacker interference; and by deduplicating the data packets in each data stream, duplicate data packets can be removed to prevent sequence anomalies caused by data packet replay, thereby ensuring the purity and consistency of the data packet sequence. In this way, the influence of network fluctuations and malicious obfuscation behaviors can be eliminated, greatly improving the robustness of the original characteristics of the traffic.

[0104] In some embodiments, when the network environment changes or there is malicious obfuscation behavior, the attacker may intentionally merge multiple short data packets into one long data packet, causing the average length of the data packet to be close to the maximum transmission unit (MTU). This behavior will cause the length distribution of the data packet to change significantly, thereby affecting the normal traffic characteristics. In order to more accurately identify this obfuscation behavior, the network flow containing higher frequency long data packets can be classified separately to ensure that the characteristics of these data packets are not affected by other data packets, thereby improving the overall performance and accuracy of encrypted malicious traffic detection. For example, after step 102, it also includes:

[0105] (A.1) for each second data stream, averaging the lengths of multiple data packets according to multiple length information to obtain an average data packet length corresponding to the second data stream;

[0106] (A.2) obtaining a preset maximum transmission unit and determining a deviation threshold between the average data packet length and the maximum transmission unit;

[0107] (A.3) When there is a target data flow in the second data flow whose deviation threshold is less than a preset target threshold, the corresponding target data flow is input into the second target model to obtain a malicious traffic detection result of the target data flow.

[0108] The average data packet length may be an average value calculated for each second data stream based on length information of multiple data packets.

[0109] The maximum transmission unit may be the maximum size of a data packet under a specific network protocol.

[0110] The deviation threshold may be a difference value between an average data packet length and a maximum transmission unit.

[0111] The target threshold may be a preset value used to determine whether the degree of deviation between the average data packet length and the maximum transmission unit requires further analysis.

[0112] The target data flow may be a data flow whose deviation threshold is smaller than the target threshold.

[0113] The second target model can be a model specifically used to detect whether the target data stream contains malicious traffic, and the second target model can quickly determine whether the data stream containing the reassembled data packet is malicious traffic. The second target model can be a model trained according to the first preset model, such as a convolutional neural network, a recurrent neural network, a graph neural network, etc.

[0114] The malicious traffic detection result may be a conclusion obtained by analyzing the target data flow through the second target model to determine whether the data flow contains malicious traffic.

[0115] In some embodiments, taking the second target model and the first preset model as a graph neural network as an example, the first preset model can be pre-trained, and specifically, special training can be performed for data streams in which the deviation threshold between the average data packet length and the maximum transmission unit is less than the preset target threshold, so that the trained second target model has the ability to accurately classify data streams containing reassembled data packets.

[0116] For example, if the maximum transmission unit in enterprise network A is preset to 1500 bytes, if the second data stream a contains 100 data packets, and the average data packet length of the second data stream a is calculated to be 1300 bytes, then the deviation threshold between the average data packet length and the maximum transmission unit is 200 bytes.

[0117] Further, if the target threshold is 300 bytes and the deviation threshold is less than the target threshold, the second data stream a is determined as the target data stream, and the target data stream can be input into the second target model to obtain the malicious traffic detection result of the target data stream.

[0118] By filtering out data streams whose deviation threshold is less than the target threshold, data streams that may contain malicious behavior can be identified more accurately. Even if attackers try to confuse the detection system by merging multiple short data packets, the second target model can still quickly and effectively identify these abnormal data streams, reducing the false alarm rate.

[0119] Step 103: for at least one second data flow between any two Internet Protocol addresses, feature aggregation is performed on a plurality of data packets included in the second data flow to obtain edge features corresponding to the second data flow in the inter-flow interaction graph.

[0120] In some embodiments, in order to more accurately capture the interaction patterns between data streams and improve the accuracy of malicious traffic detection, after filtering the target data stream in the second data stream (or without filtering the target data stream in the second data stream), the edge features of at least one second data stream between any two Internet Protocol addresses are aggregated to provide richer and more robust feature expressions, thereby improving the accuracy and robustness of malicious traffic detection.

[0121] The edge feature may be a characteristic expression of a characteristic of a second data flow between any two Internet Protocol addresses, which is generated by aggregating the characteristics of data packets in the second data flow, and the edge feature may be used to characterize the properties of the corresponding second data flow in the flow interaction graph. Since there may be multiple second data flows between two Internet Protocol addresses, there may be multiple edge features between the two Internet Protocol addresses.

[0122] Exemplarily, an intra-stream interaction graph of the second data flow can be constructed based on multiple data packets in each second data flow, and based on the intra-stream interaction graph of the second data flow, combined with feature information of each data packet, such as packet length, packet duration and other features, the feature information can be aggregated using message passing, graph neural networks or other neural networks to obtain an embedded expression that can represent the intra-stream interaction graph as the edge feature of the second data flow.

[0123] By generating edge features to characterize the characteristics of each second data flow between any two Internet Protocol addresses, it is possible to provide richer and more robust feature expressions and improve the accuracy of malicious traffic detection.

[0124] In some implementations, in order to better capture the subtle behavior model in the second data flow, an intra-flow interaction graph may be constructed, and feature aggregation may be performed based on the intra-flow interaction graph to obtain the corresponding edge features of the second data flow in the inter-flow interaction graph, so as to improve the robustness and accuracy of traffic detection. For example, step 103 may include:

[0125] (103.1) for at least one second data flow between any two Internet Protocol addresses, construct an intra-flow interaction graph corresponding to the second data flow according to directions of a plurality of data packets included in the second data flow;

[0126] (103.2) Obtain traffic statistical features of each data packet in the second data flow, and perform feature aggregation of multiple traffic statistical features corresponding to multiple data packets according to the intra-flow interaction graph to obtain edge features corresponding to the second data flow in the inter-flow interaction graph.

[0127] The intra-stream interaction graph may be a graph structure used to characterize the interaction pattern between data packets within a single second data stream.

[0128] The traffic statistics feature may be an individual attribute of each data packet, such as data packet length, data packet duration, and the like.

[0129] Exemplarily, clustering can be performed within each second data stream according to the direction (forward or reverse) of the data packets, that is, continuous data packets in the same direction will be regarded as a data cluster, and each data cluster will be regarded as a data layer in the intra-stream interaction graph, and the number of data packets in the data cluster determines the number of nodes in the data layer. Each data packet is regarded as a node in the intra-stream interaction graph, and the connection rule between nodes is that the starting node of each data layer is connected to the starting node of the next data layer, and the ending node of each data layer is connected to the ending node of the next data layer, and the data packets in the layer are connected in sequence, so as to construct the intra-stream interaction graph.

[0130] Furthermore, traffic statistical features, such as packet length, packet duration, etc., can be extracted based on each data packet in the second data flow, and the traffic statistical features of multiple data packets can be aggregated according to the connection relationship between the data packets in the interaction graph within the flow to obtain the edge features of the second data flow.

[0131] Exemplarily, when aggregating the traffic statistical features of multiple data packets, message passing, graph neural networks or other neural networks can be used for information aggregation. This application does not limit the aggregation method, and it only needs to generate an embedded expression representing the interaction graph within the corresponding flow as an edge feature.

[0132] By constructing the intra-flow interaction graph of the second data flow and performing feature aggregation to obtain the edge features corresponding to the second data flow, not only the characteristics of a single data packet but also the interaction relationship between data packets can be considered, which enables the first target model to make accurate judgments when facing complex and diverse malicious traffic.

[0133] In some implementations, in order to more precisely capture the dynamic relationship between data packets, an intra-stream interaction graph may be constructed to characterize the interaction pattern between data packets within a single data stream, so that the edge features corresponding to the second data stream not only contain static information of the data packets (such as length and duration), but also reflect the order and directionality between the data packets, so as to more comprehensively express the features of the second data stream. For example, (103.1) may include:

[0134] (103.1.1) for at least one second data flow between any two Internet Protocol addresses, sequentially determine directions of a plurality of data packets in the second data flow;

[0135] (103.1.2) in the second data stream, determining consecutive data packets having the same direction as data clusters, and determining a start data packet and an end data packet of each data cluster;

[0136] (103.1.3) sequentially determine the data layer corresponding to each data cluster in the intra-stream interaction graph, and in each data layer, sequentially connect the data packets contained in each data cluster;

[0137] (103.1.4) In any two data layers, the start data packets of the data clusters between the data layers are connected correspondingly, and the end data packets of the data clusters between the data layers are connected correspondingly to obtain an intra-stream interaction graph corresponding to the second data stream.

[0138] The data cluster may be a set of data packets in each second data stream that are continuous and have the same direction (i.e., they are all from the source Internet Protocol address to the target Internet Protocol address, or they are all from the target Internet Protocol address back to the source Internet Protocol address). For example, if data packets are sent from the client to the server, then this series of continuous transmissions constitutes a forward data cluster; conversely, data packets returned from the server to the client constitute a reverse data cluster.

[0139] The starting data packet may be the first data packet sent or received in each data cluster, and the starting data packet is the starting point of the corresponding data cluster in the time series.

[0140] The termination data packet may be the last data packet sent or received in each data cluster, and the termination data packet is the end point of the corresponding data cluster in the time series.

[0141] The data layer may be a data layer corresponding to each data cluster in the process of constructing the intra-flow interaction graph, and each data cluster may correspond to a data layer. In other words, each data cluster represents a layer in the graph, and all data packets contained in the data layer are continuously transmitted in the same direction.

[0142] For example, if the second data stream f n Contains a series of data packets, the data packet sequence is recorded as [p1,p2,…,p i ], these data packets change direction during the transmission process, and the direction of these data packets is regarded as forward or reverse. Forward means that the data packet flows from one Internet Protocol address a to another Internet Protocol address b, and reverse means that the data packet flows back from another Internet Protocol address b to the original Internet Protocol address a.

[0143] Furthermore, the second data stream f can be determined first n The direction of each data packet in the sequence is determined, and the data packet sequence is divided into multiple data clusters in sequence according to the change of the direction of consecutive data packets, for example: [p1], [p2, p3], [p4, p5, p6], [p7], [p8, p9, p10], [p11], [p12, p13], [p14, p15, p16], [p17], [p18, p19] 10 ]etc.

[0144] Among them, the direction of the p1 data packet is forward, the direction of the p2 and p3 data packets is reverse, the direction of the p4, p5, p6 data packets is forward, and so on.

[0145] Furthermore, each data cluster can be regarded as a data layer, for example, [p1] is the first layer, [p2, p3] is the second layer, and so on. Afterwards, the actual data packet and the termination data packet of each data cluster are determined. For the data cluster [p1], p1 is both the start data packet and the termination data packet; for [p2, p3], p2 is the start data packet and p3 is the termination data packet; for the data cluster [p4, p5, p6], p4 is the start data packet and p6 is the termination data packet.

[0146] Furthermore, in each data layer, the data packets corresponding to the data layer can be connected in sequence, for example, p4, p5, and p6 can be connected in sequence. Between any two data layers, for example, between the first data layer and the second data layer, the p1 node can be connected to the p2 and p3 nodes according to the corresponding connection of the start data packet and the corresponding connection of the end data packet. For example, between the second data layer and the third data layer, the p2 node can be connected to the p4 node, the p3 node can be connected to the p6 node, and so on, to finally form the intra-flow interaction graph of the second data flow.

[0147] By constructing an intra-flow interaction graph for each second data flow, we can capture fine-grained behavior patterns between data packets, simplify the understanding of complex traffic, and make the system more reliable and efficient when facing complex network environments and potential malicious behaviors.

[0148] Step 104: for each Internet Protocol address, generate node features of an Internet Protocol address in an inter-flow interaction graph according to at least one first data flow and a corresponding second data flow.

[0149] In some implementations, in order to avoid the problem of inaccurate detection results caused by the homogeneity assumption, the node features of the flow interaction graph can be constructed while constructing the edge features of the flow interaction graph to reduce the negative impact of the homogeneity assumption and thereby reduce the false alarm rate in the malicious traffic detection process.

[0150] The node feature may be a set of attributes used to describe each node (Internet Protocol address) in the flow interaction graph.

[0151] Exemplarily, in order to retain both the original features and the reconstructed robust features, the first data stream and the second data stream may be spliced ​​to obtain the target data stream. The multiple data streams received by each Internet Protocol address are spliced ​​in chronological order to obtain a data stream sequence corresponding to each Internet Protocol address, thereby obtaining the overall behavior pattern of the corresponding Internet Protocol address.

[0152] Furthermore, the data stream sequence can be input into a preset sequence embedding model to generate node features of the Internet Protocol address in the flow interaction graph. For example, the sequence embedding model can be a recurrent neural network (RNN), a long short-term memory network (LSTM), a bidirectional long short-term memory network (Bi-LSTM), a transformer, and the like. The corresponding sequence embedding model can be selected according to the actual situation.

[0153] By generating node features of each Internet Protocol address in the flow interaction graph, the overall behavior pattern of the Internet Protocol address in the network can be integrated, which helps to capture the activity patterns of the Internet Protocol address in the network more comprehensively and accurately. At the same time, the rich feature information can help the subsequent first target model to more accurately identify malicious traffic and reduce the false alarm rate.

[0154] In some embodiments, in order to simultaneously retain the features of the first data stream and the robust features of the processed second data stream, and to ensure that the generated node features contain the details of the original data and can resist the influence of network fluctuations and malicious obfuscation behaviors, the first data stream received by each Internet Protocol address and the corresponding second data stream may be spliced. In addition, the target data streams received by each Internet Protocol address may be spliced ​​in chronological order to generate a data stream sequence to capture the time series dependency in the data stream and determine the dynamic behavior pattern of the Internet Protocol address in the network, so that the malicious traffic detection system is more reliable and efficient when facing a complex and changeable network environment. For example, step 104 may include:

[0155] (104.1) for each Internet Protocol address, concatenate the first data stream received by each Internet Protocol address with the corresponding second data stream to obtain a target data stream;

[0156] (104.2) obtaining multiple target data streams received by the Internet Protocol address, and splicing the multiple target data streams in chronological order to obtain a data stream sequence;

[0157] (104.3) The data stream sequence is converted into an input into a preset sequence embedding model to obtain the node features of the Internet Protocol address in the flow interaction graph.

[0158] The target data stream may be a new data stream formed by splicing the first data stream (original data stream) received by each Internet Protocol address and the corresponding second data stream (data stream reconstructed from the original data stream).

[0159] The data stream sequence may be an ordered data stream sequence formed by splicing multiple target data streams received by each Internet Protocol address in chronological order.

[0160] The sequence embedding model can be a machine learning model for processing data stream sequences, which can capture the temporal dependencies of data stream sequences and convert data stream sequences into node features. The sequence embedding model can be a recurrent neural network (RNN), a long short-term memory network (LSTM), a bidirectional long short-term memory network (Bi-LSTM), a transformer, and the like.

[0161] Exemplarily, for Internet Protocol address 1, all incoming first data streams and second data streams obtained by reconstructing the first data streams are collected, and the first data stream and the second data stream are spliced ​​into a target data stream.

[0162] Furthermore, if there is only one data stream flowing into Internet Protocol address 1, the target data stream can be directly input into the sequence embedding model to obtain the node features of the Internet Protocol address in the flow interaction graph.

[0163] Furthermore, if multiple data streams flow into Internet Protocol address 2, the target data stream corresponding to each data stream can be obtained. For example, if three data streams flow into Internet Protocol address 2, namely data stream 1 (receiving time 12:05), data stream 2 (receiving time 12:10) and data stream 3 (receiving time 12:15), the target data stream a1 corresponding to data stream 1, the target data stream a2 corresponding to data stream 2, and the target data stream a3 corresponding to data stream 3 are obtained, and the target data streams a1, a2, and a3 are spliced ​​in time order to obtain a data stream sequence.

[0164] Furthermore, by inputting the data stream sequence into the sequence embedding model, the node features of the Internet Protocol address in the flow interaction graph can be obtained.

[0165] By generating node features for each Internet Protocol address in the inter-flow interaction graph, we can comprehensively describe the behavior pattern of each Internet Protocol address in the network, enhance the robustness of the features and the accuracy of the detection model, and make the malicious traffic detection system more reliable and efficient when facing complex and changeable network environments.

[0166] In some embodiments, since there may be multiple communications between the same pair of Internet Protocol addresses, these communications form multiple network flows. In order to enable the generated edge features to better reflect the complex interaction patterns between nodes (Internet Protocol addresses), edge features can be aggregated to improve the reliability and efficiency of the malicious traffic detection system. For example, before "identifying each edge feature in the flow interaction graph through the first target model to obtain the first malicious traffic detection result" in step 105, it also includes:

[0167] (B.1) when there are multiple edge features between any two Internet Protocol addresses, determining an adjustment weight for each edge feature;

[0168] (B.2) Based on multiple adjustment weights of multiple edge features, weight fusion is performed on multiple edge features between two Internet Protocol addresses to obtain an aggregated edge feature;

[0169] (B.3) Each edge feature in the flow interaction graph is identified through the first target model to obtain the first malicious traffic detection result, including:

[0170] (B.4) Each aggregate edge feature in the flow interaction graph is identified through the first target model to obtain a first malicious traffic detection result.

[0171] The adjustment weight may be a weight value assigned to each edge feature when multiple edge features exist between two Internet Protocol addresses, and the adjustment weight is used to reflect the importance of different edge features during the aggregation process.

[0172] The aggregated edge feature may be a comprehensive edge feature obtained by aggregating multiple edge features generated between any two Internet Protocol addresses that have an interactive relationship.

[0173] Exemplarily, the adjustment weight of each edge feature can be determined by assigning values ​​through an attention mechanism, assigning values ​​through rule matching, assigning values ​​based on predicted probabilities after direct classification using a deep learning model, etc. The specific method for obtaining the adjustment weight can be determined based on actual conditions, and the embodiments of the present application do not impose any specific restrictions on this.

[0174] For example, if there are three data flows between node 1 (Internet Protocol address 1) and node 2 (Internet Protocol address 2) in the flow interaction graph, namely flow 1, flow 2 and flow 3, and the corresponding edge features are E1, E2 and E3, respectively, if the adjustment weight w1 of E1 is determined to be 0.4, the adjustment weight w2 of E2 is 0.3, and the adjustment weight w3 of E3 is 0.3 through the attention mechanism, it is assumed that the edge features E1, E2 and E3 are represented by the following vectors:

[0175] E1 = [0.5, 0.3, 0.7];

[0176] E2 = [0.4, 0.6, 0.2];

[0177] E3 = [0.3, 0.4, 0.5];

[0178] Furthermore, based on the adjusted weights, the edge features can be weighted fused to obtain the aggregated edge feature E = w1*E1+w2*E2+w3*E3 = [0.41, 0.42, 0.49].

[0179] In some implementations, the aggregate edge feature may also be obtained by averaging the edge features between any two nodes. For example, in the above embodiment, the aggregate edge feature E may also be equal to (E1+E2+E3) / 3.

[0180] By aggregating the edge features between any two nodes in the above manner to obtain aggregated edge features, the complex interaction patterns between any two Internet Protocol addresses can be more accurately captured, and more robust edge features can be generated, thereby improving the accuracy and reliability of the encrypted malicious traffic detection system.

[0181] Step 105, identifying each edge feature in the flow interaction graph through the first target model to obtain a first malicious traffic detection result, and identifying each node feature in the flow interaction graph through the first target model to obtain a second malicious traffic detection result.

[0182] In some embodiments, in order to comprehensively and accurately detect malicious traffic, each edge feature and each node feature in the flow interaction graph can be identified through the first target model to improve the accuracy of detection, making the malicious traffic detection system more reliable and efficient in a complex and changeable network environment.

[0183] In some embodiments, when there are multiple edge features between any two nodes in the flow interaction graph, the edge features can be aggregated to obtain the aggregated edge features, and then each aggregated edge feature in the flow interaction graph is identified through the first target model.

[0184] Among them, the first target model can be a pre-trained machine learning model for identifying node features and edge features in the inter-flow interaction graph. The first target model can detect malicious traffic by identifying node features and edge features in the inter-flow interaction graph.

[0185] The first malicious traffic detection result may be a detection result obtained by identifying each edge feature (when there are multiple edge features between nodes, here is an aggregated edge feature) in the flow interaction graph through the first target model. The first malicious traffic detection result reflects whether there is suspicious or malicious traffic in the edge feature.

[0186] The second malicious traffic detection result may refer to a detection result obtained by identifying each node feature in the flow interaction graph through the first target model. The second malicious traffic detection result reflects whether there is suspicious or malicious behavior in the node feature.

[0187] Exemplarily, the first target model can be a machine learning model for identifying node features and edge features in an inter-flow interaction graph. For example, the first target model can be a point-edge joint graph neural network (Graph Neura lNetwork, GNN), specifically a graph convolutional network (Graph Convolutional Network, GCN), a graph attention network (Graph Attention Network, GAT), etc.

[0188] For example, the node features, edge features, and corresponding flow interactions can be Figure 1 The node features and edge features are input into the first target model together, or only the node features and edge features are input into the first target model together. When the first target model identifies the edge features, a first malicious traffic detection result can be obtained, in which the edge features are malicious edges and benign edges. When the first target model identifies the node features, a second malicious traffic detection result can be obtained, in which the node features are malicious nodes and benign nodes. Any node that has sent malicious traffic can be marked as a malicious node (malicious Internet Protocol address).

[0189] It is understandable that in the traffic, the Internet Protocol addresses or edges classified as malicious may have attacking behaviors (such as sending scanning packets, attacking data packets carrying vulnerabilities, etc.), destructive behaviors (such as crawling information data, stealing wool, cheating and other malicious attack behaviors through mobile phone group control, etc.), flooding the target server or its surrounding infrastructure with large-scale Internet traffic to destroy the target server, service or normal network traffic, etc. The Internet Protocol addresses or edges classified as benign may be search engines, statistics and advertising programs, popular domain name queries, newly registered domain name queries, etc. The specific classification can be determined according to actual conditions.

[0190] Furthermore, when a malicious node or a malicious edge is detected, the corresponding malicious node or malicious edge can be fed back to the security personnel so that the security personnel can handle it in time.

[0191] By identifying the node features and edge features in the flow interaction graph through the first target model, malicious traffic can be comprehensively detected, which improves the accuracy and robustness of detection and ensures that malicious behavior is discovered and handled in a complex network environment in a timely manner.

[0192] In some implementations, in order to enable the first target model to learn features for distinguishing malicious traffic from normal traffic from data and generalize to unseen data, the preset model can be trained, and the parameters of the preset model can be continuously optimized during the training process, so that the model can accurately identify malicious traffic when facing new encrypted traffic. Exemplarily, the first target model is trained by the following steps:

[0193] (C.1) Obtain sample traffic and determine sample edge features and sample node features of the sample traffic;

[0194] (C.2) inputting the sample edge features and the sample node features into a preset model to obtain predicted sample edge labels of the sample edge features and predicted sample node labels of the sample node features;

[0195] (C.3) obtaining the true sample edge label of the sample edge feature, and determining the first loss according to the gap between the predicted sample edge label and the true sample edge label;

[0196] (C.4) Obtain the real sample node label of the sample node feature, and obtain the second loss according to the gap between the predicted sample node label and the real sample node label;

[0197] (C.5) Train the preset model according to the first loss and the second loss to obtain the target model.

[0198] The sample traffic may be real or simulated network traffic data used to train and test a preset model. The sample traffic may include multiple network flows, each of which is composed of a series of data packets, and these data packets form a certain interaction pattern in time.

[0199] The sample edge feature may be a feature vector of each sample edge (ie, the communication between any two sample Internet Protocol addresses) in the sample flow interaction graph formed according to the sample traffic.

[0200] The sample node feature may be a feature vector of each sample node (i.e., a sample Internet Protocol address) in the sample flow interaction graph. The sample node feature may include information such as a data packet length sequence and a data packet arrival frequency, which are used to represent the attributes of the sample node.

[0201] Among them, the preset model can be a model that has not yet been finally optimized. The preset model can be a preliminarily configured point-edge joint graph neural network, such as GCN, GAT, etc., which is used to identify malicious behavior in encrypted traffic.

[0202] The predicted sample edge label can be a predicted label of each sample edge obtained after processing the sample edge features through a preset model, indicating whether the sample edge belongs to malicious traffic. The predicted sample label is usually binary, such as 0 for normal and 1 for malicious, or there may be other classification methods.

[0203] The predicted sample node label can be a predicted label of each node obtained after processing the sample node features through a preset model, indicating whether the node involves malicious behavior. Similarly, the label is usually binary, such as 0 for normal and 1 for malicious.

[0204] Among them, the true sample edge label can refer to the actual label of each sample edge feature in the sample traffic, that is, the label marked according to previous experience or a known malicious behavior database, which is used to train the preset model.

[0205] The first loss may be a first loss value calculated based on the difference between the predicted sample edge label and the true sample edge label. The first loss may be a cross entropy loss, a mean square error, etc. The first loss focuses on the classification accuracy of the sample edge features.

[0206] The real sample node label may refer to the actual label of each sample node feature in the sample traffic, that is, the label marked according to previous experience or a known malicious behavior database. The real sample node label is used to train the preset model.

[0207] The second loss may be a second loss value calculated based on the difference between the predicted sample node label and the true sample node label. Similar to the first loss, the second loss focuses on the classification accuracy of the sample node features. Both the first loss and the second loss are calculated using the same binary loss function.

[0208] Specifically, the first loss L edge It can be calculated by the following formula:

[0209]

[0210] Among them, y ij represents the true sample edge label of the sample edge feature between the i-th and j-th sample nodes (sample Internet Protocol addresses) in the sample flow interaction graph. If the sample edge feature is malicious, then y ij =1, otherwise y ij =0; N represents the predicted probability that the sample edge feature between sample node i and sample node j output by the preset model belongs to the malicious category; edges Indicates the number of sample edge features.

[0211] Furthermore, the second loss Lnode It can be calculated by the following formula:

[0212]

[0213] Among them, y i represents the real sample node label of the i-th sample node feature (sample Internet Protocol address) in the sample flow interaction graph. If the sample node is malicious, then y i =1, otherwise y i =0; N represents the predicted probability that the i-th sample node feature output by the preset model belongs to the malicious category; nodes Indicates the number of sample nodes.

[0214] For example, the sample node features, sample edge features and corresponding sample flows can be interacted Figure 1 The sample node features and the sample edge features are input into the preset model at the same time, or only the sample node features and the sample edge features are input into the preset model, and the first loss and the second loss of the preset model in predicting the sample edge features and the sample node features are calculated respectively through the above-mentioned calculation formulas of the first loss and the second loss, and then the preset model is trained by combining the first loss and the second loss to achieve the purpose of improving the detection accuracy of encrypted malicious traffic and reducing the false alarm rate, so that the trained first target model can make full use of the point features and the edge features to classify the traffic to be detected more comprehensively and accurately.

[0215] Furthermore, the target loss can be constructed by the first loss and the second loss, and the preset model can be trained based on the target loss until the preset convergence condition is reached, and the training of the preset model can be stopped to obtain the first target model. Specifically, the preset convergence condition can be that the preset training times have been reached. For example, the preset training times can be 500 times. Then, when the preset training times are reached, the training of the preset model can be stopped to obtain the target model. The preset training times can be adjusted. Alternatively, the preset convergence condition can also be that the target loss of the preset model does not exceed the preset value for a fixed number of consecutive times. For example, if the target loss is lower than the A value for 10 consecutive times, the training of the preset model can be stopped to obtain the first target model.

[0216] By combining the first loss and the second loss to train the preset model, the accuracy of encrypted malicious traffic detection is improved, so that the trained first target model can make full use of point features and edge features to classify traffic more comprehensively and accurately.

[0217] In some implementations, since the nodes and edges included in the traffic to be detected each carry different information, in order to balance the contribution between different losses and ensure that the preset model can better pay attention to the different characteristics of nodes and edges during the training process, the weights of the first loss and the second loss can be adjusted to improve the overall detection performance of the model. For example, (C.5) may include:

[0218] (C.5.1) obtaining a first adjustment weight set for the first loss, and adjusting the first loss according to the first adjustment weight to obtain a first target loss;

[0219] (C.5.2) obtaining a second adjustment weight set for the second loss, and adjusting the second loss according to the second adjustment weight to obtain a second target loss;

[0220] (C.5.3) Add the first target loss and the second target loss to obtain the target loss;

[0221] (C.5.4) Train the preset model according to the target loss to obtain the target model.

[0222] Among them, the first adjustment weight can be a coefficient set for the first loss, which is used to adjust the proportion of the classification loss (first loss) of the sample node in the entire loss function. The first adjustment weight is used to characterize the relative importance of the sample node classification in the overall training process.

[0223] Among them, the first target loss can be that the first target loss is the node classification loss adjusted by the first adjustment weight, which represents the optimization target of the sample node classification task in the training process.

[0224] The second adjustment weight may be a coefficient set for the sample edge classification loss (second loss) to adjust the proportion of the sample edge classification loss in the entire loss function. The second adjustment weight is used to characterize the relative importance of the sample edge classification in the overall training process.

[0225] The second target loss may be the edge classification loss adjusted by the second adjustment weight, which represents the optimization target of the sample edge classification task during the training process.

[0226] The target loss may be the sum of the first target loss and the second target loss, representing the optimization target of the comprehensive sample node classification and sample edge classification tasks.

[0227] Exemplarily, the target loss is calculated as follows:

[0228] L=α·L node +(1-α)·L edge

[0229] Among them, L represents the target loss, L edge represents the first loss, (1-α) represents the first adjustment weight, L node represents the second loss, and α represents the second adjustment weight.

[0230] By comprehensively considering the sample node classification loss and the sample edge classification loss, it is ensured that the preset model can accurately identify both malicious nodes and malicious edges during the training process, thereby improving the overall performance of encrypted malicious traffic detection.

[0231] The present application obtains the traffic to be detected, and based on multiple Internet Protocol addresses in the traffic to be detected and the data flow interaction relationship between the multiple Internet Protocol addresses, establishes an inter-flow interaction graph corresponding to the traffic to be detected; reconstructs each first data flow between any two Internet Protocol addresses to obtain a second data flow; for at least one second data flow between any two Internet Protocol addresses, performs feature aggregation on multiple data packets contained in the second data flow to obtain the edge features corresponding to the second data flow in the inter-flow interaction graph; for each Internet Protocol address, generates node features of the Internet Protocol address in the inter-flow interaction graph according to at least one first data flow and the corresponding second data flow; identifies each edge feature in the inter-flow interaction graph through a first target model to obtain a first malicious traffic detection result, and identifies each node feature in the inter-flow interaction graph through the first target model to obtain a second malicious traffic detection result. In this way, by constructing an interaction graph between flows, it is possible to accurately capture the interaction relationship between Internet Protocol addresses in the traffic to be detected, and generate fine-grained edge features and node features through the reconstructed second data stream, thereby making full use of the limited set of available features in the traffic to be detected, obtaining a better traffic embedding representation, and thus improving the accuracy of malicious traffic detection.

[0232] Please refer to Figure 3 and Figure 4 In some embodiments, in combination Figure 3 and Figure 4 A general introduction to the malicious traffic detection method of this application is given.

[0233] Exemplarily, training samples for training a preset model can be prepared in advance. Specifically, when it is necessary to detect whether the encrypted traffic is malicious traffic, the network traffic records can be exported from the gateway as pcap file data, and the traffic data can be cleaned to generate an interaction graph between sample flows; and the data packets in each sample data flow between any two sample Internet Protocol addresses can be reconstructed.

[0234] Furthermore, reconstructing the data packets may include rearranging and removing duplicate data packets. Specifically, the order of the data packets may be rearranged in the sample data stream according to the length of the data packets, and duplicate data packets in the sample data stream may be removed.

[0235] Furthermore, the distribution of packet lengths in the sample data streams may be calculated. When the deviation threshold between the average length of the packet and the maximum transmission unit is less than the target threshold, it is determined that packet reorganization may have occurred in the sample data stream, and these sample data streams may be analyzed separately.

[0236] Please refer to Figure 3 ,Furthermore, for each sample data stream, the corresponding intra-stream interaction graph can be constructed according to the direction of the data packets it contains, and the statistical features at the data packet level are aggregated according to the structure of the intra-stream interaction graph to obtain the sample edge features. And for the sample data stream received by each sample node, the data packet length sequences corresponding to each sample data stream before and after reconstruction are spliced, and the sample data streams received by each sample node are spliced ​​in time order to obtain the corresponding sequence embedding as the sample node feature of the interaction graph between sample streams.

[0237] Exemplarily, the sample edge features may be aggregated so that only one sample aggregate edge feature is included between any two sample nodes in the sample flow interaction graph, and the sample nodes and sample edges are arranged so that the sample nodes and sample edges correspond to the structure of the flow interaction graph.

[0238] Furthermore, the preset model can be trained according to the flow interaction graph, sample node features and sample edge features, and the training of the preset model can be stopped when the convergence condition is reached to obtain the first target model.

[0239] Furthermore, the trained first target model can be used to classify the types of nodes (Internet Protocol addresses) and edges (data traffic between any two Internet Protocol addresses) of the traffic to be detected (the processing process of nodes and edges can be referred to Figure 3 ), and feedback malicious nodes and malicious traffic to security personnel so that security personnel can take corresponding measures in time.

[0240] See also Figure 5 The embodiment of the present application further provides a malicious traffic detection device, which can implement the above-mentioned malicious traffic detection method. The malicious traffic detection device includes:

[0241] The acquisition module 51 is used to acquire the traffic to be detected, and establish an inter-flow interaction graph corresponding to the traffic to be detected based on multiple Internet Protocol addresses in the traffic to be detected and the data flow interaction relationship between the multiple Internet Protocol addresses;

[0242] A reconstruction module 52, configured to reconstruct each first data stream between any two Internet Protocol addresses to obtain a second data stream;

[0243] Aggregation module 53, configured to perform feature aggregation on multiple data packets included in at least one second data flow between any two Internet Protocol addresses, and obtain edge features corresponding to the second data flow in the inter-flow interaction graph;

[0244] A generating module 54, configured to generate, for each Internet Protocol address, node features of an Internet Protocol address in an inter-flow interaction graph according to at least one first data flow and a corresponding second data flow;

[0245] The identification module 55 is used to identify each edge feature in the flow interaction graph through the first target model to obtain a first malicious traffic detection result, and to identify each node feature in the flow interaction graph through the first target model to obtain a second malicious traffic detection result.

[0246] The specific implementation of the malicious traffic detection device is basically the same as the specific implementation of the malicious traffic detection method described above, and will not be repeated here. On the premise of meeting the requirements of the embodiment of the present application, the malicious traffic detection device can also be provided with other functional modules to implement the malicious traffic detection method in the above embodiment.

[0247] The embodiment of the present application also provides a computer device, the computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the above malicious traffic detection method when executing the computer program. The computer device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0248] See also Figure 6 , Figure 6 The hardware structure of a computer device according to another embodiment is shown, and the computer device includes:

[0249] The processor 61 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0250] The memory 62 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 62 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 62, and the processor 61 calls and executes the malicious traffic detection method of the embodiment of this application;

[0251] Input / output interface 63, used to implement information input and output;

[0252] Communication interface 64, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WI FI, Bluetooth, etc.);

[0253] A bus 65 that transmits information between the various components of the device (e.g., the processor 61, the memory 62, the input / output interface 63, and the communication interface 64);

[0254] The processor 61 , the memory 62 , the input / output interface 63 and the communication interface 64 are connected to each other in communication within the device via a bus 65 .

[0255] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned malicious traffic detection method is implemented.

[0256] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0257] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0258] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0259] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0260] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0261] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0262] It should be understood that in the present application, "at least one (item)" and "several" refer to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0263] In the several embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0264] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0265] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0266] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0267] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A malicious traffic detection method, characterized in that: The method comprises: Acquire the traffic to be detected, and establish an inter-flow interaction graph corresponding to the traffic to be detected based on multiple Internet Protocol addresses in the traffic to be detected and data flow interaction relationships between the multiple Internet Protocol addresses; Reconstructing each first data stream between any two Internet Protocol addresses to obtain a second data stream; For at least one second data flow between any two Internet Protocol addresses, feature aggregation is performed on a plurality of data packets included in the second data flow to obtain edge features corresponding to the second data flow in the inter-flow interaction graph; For each Internet Protocol address, generating a node feature of an interaction graph between the Internet Protocol address according to at least one first data flow and a corresponding second data flow; Each edge feature in the inter-flow interaction graph is identified through the first target model to obtain a first malicious traffic detection result, and each node feature in the inter-flow interaction graph is identified through the first target model to obtain a second malicious traffic detection result.

2. The malicious traffic detection method according to claim 1, characterized in that: The step of reconstructing each first data stream between any two Internet Protocol addresses to obtain a second data stream includes: For each first data flow between any two Internet Protocol addresses, determining multiple length information of multiple data packets included in the first data flow; Sorting the plurality of data packets in a preset sorting order according to the plurality of length information to obtain a sorted first intermediate data stream; Duplicate data packets are deduplicated on multiple data packets of the first intermediate data stream to obtain a second data stream.

3. The malicious traffic detection method according to claim 2, characterized in that: After reconstructing each first data stream between any two Internet Protocol addresses to obtain a second data stream, the method further includes: For each of the second data flows, averaging the lengths of the multiple data packets according to the multiple length information to obtain an average data packet length corresponding to the second data flow; Obtaining a preset maximum transmission unit, and determining a deviation threshold between the average data packet length and the maximum transmission unit; When there is a target data flow in the second data flow whose deviation threshold is less than the preset target threshold, the corresponding target data flow is input into the second target model to obtain a malicious traffic detection result of the target data flow.

4. The malicious traffic detection method according to claim 1, characterized in that: The step of performing feature aggregation on multiple data packets included in at least one second data flow between any two Internet Protocol addresses to obtain edge features corresponding to the second data flow in the inter-flow interaction graph includes: For at least one second data flow between any two Internet Protocol addresses, constructing an intra-flow interaction graph corresponding to the second data flow according to directions of a plurality of data packets included in the second data flow; The traffic statistical features of each data packet in the second data flow are obtained, and feature aggregation of multiple traffic statistical features corresponding to the multiple data packets is performed according to the intra-flow interaction graph to obtain the edge features corresponding to the second data flow in the inter-flow interaction graph.

5. The malicious traffic detection method according to claim 4, characterized in that: The step of constructing, for at least one second data flow between any two Internet Protocol addresses, an intra-flow interaction graph corresponding to the second data flow according to directions of a plurality of data packets included in the second data flow, comprises: For at least one second data flow between any two Internet Protocol addresses, sequentially determining directions of a plurality of data packets in the second data flow; Determining continuous data packets having the same direction in the second data stream as data clusters, and determining a start data packet and an end data packet of each of the data clusters; Determine in sequence the data layer corresponding to each of the data clusters in the intra-stream interaction graph, and in each of the data layers, connect the data packets contained in each data cluster in sequence; In any two of the data layers, the start data packets of the data clusters between the data layers are correspondingly connected, and the end data packets of the data clusters between the data layers are correspondingly connected to obtain an intra-flow interaction graph corresponding to the second data flow.

6. The malicious traffic detection method according to claim 1, characterized in that: The step of generating, for each Internet Protocol address, node features of an interaction graph between the Internet Protocol addresses according to at least one first data flow and a corresponding second data flow, comprises: For each Internet Protocol address, concatenate the first data stream received by each Internet Protocol address with the corresponding second data stream to obtain a target data stream; Acquire multiple target data streams received by the Internet Protocol address, and splice the multiple target data streams in chronological order to obtain a data stream sequence; The data stream sequence is converted and input into a preset sequence embedding model to obtain the node features of the Internet Protocol address in the interaction graph between the streams.

7. The malicious traffic detection method according to claim 1, characterized in that: Before the first target model is used to identify each edge feature in the flow interaction graph to obtain the first malicious traffic detection result, the method further includes: When there are multiple edge features between any two Internet Protocol addresses, determining an adjustment weight for each edge feature; Based on the multiple adjustment weights of the multiple edge features, weight fusion is performed on the multiple edge features between the two Internet Protocol addresses to obtain an aggregated edge feature; Then, each edge feature in the flow interaction graph is identified by the first target model to obtain a first malicious traffic detection result, including: Each aggregate edge feature in the inter-flow interaction graph is identified through the first target model to obtain a first malicious traffic detection result.

8. The malicious traffic detection method according to claim 1, characterized in that: The first target model is trained by the following steps: Acquire sample traffic, and determine sample edge features and sample node features of the sample traffic; Inputting the sample edge features and the sample node features into a preset model to obtain predicted sample edge labels of the sample edge features and predicted sample node labels of the sample node features; Obtaining a true sample edge label of the sample edge feature, and determining a first loss according to a gap between the predicted sample edge label and the true sample edge label; Obtaining a real sample node label of the sample node feature, and obtaining a second loss according to a gap between the predicted sample node label and the real sample node label; The preset model is trained according to the first loss and the second loss to obtain a target model.

9. The malicious traffic detection method according to claim 8, characterized in that: The step of training the preset model according to the first loss and the second loss to obtain a target model includes: Obtaining a first adjustment weight set for a first loss, and adjusting the first loss according to the first adjustment weight to obtain a first target loss; Obtaining a second adjustment weight set for a second loss, and adjusting the second loss according to the second adjustment weight to obtain a second target loss; Adding the first target loss and the second target loss to obtain a target loss; The preset model is trained according to the target loss to obtain a target model.

10. A malicious traffic detection device, characterized in that: The device comprises: An acquisition module, used for acquiring the traffic to be detected, and establishing a flow interaction graph corresponding to the traffic to be detected based on a plurality of Internet Protocol addresses in the traffic to be detected and a data flow interaction relationship between the plurality of Internet Protocol addresses; A reconstruction module, used for reconstructing each first data stream between any two Internet Protocol addresses to obtain a second data stream; an aggregation module, configured to perform feature aggregation on a plurality of data packets included in at least one second data flow between any two Internet Protocol addresses, and obtain edge features corresponding to the second data flow in the inter-flow interaction graph; A generating module, configured to generate, for each Internet Protocol address, node features of an interaction graph between the Internet Protocol address and the streams according to at least one first data stream and a corresponding second data stream; An identification module is used to identify each edge feature in the inter-flow interaction graph through a first target model to obtain a first malicious traffic detection result, and to identify each node feature in the inter-flow interaction graph through the first target model to obtain a second malicious traffic detection result.

11. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the malicious traffic detection method according to any one of claims 1 to 9 when executing the computer program.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the malicious traffic detection method according to any one of claims 1 to 9 is implemented.

Images