Malicious traffic detection method and device, computer device and readable storage medium

Abstract

Embodiments of the present application provide a malicious traffic detection method and device, computer equipment and a readable storage medium. The method comprises: establishing an inter-flow interaction graph corresponding to the to-be-detected traffic based on a plurality of Internet protocol addresses and a data flow interaction relationship between the plurality of Internet protocol addresses; reconstructing each first data flow between any two Internet protocol addresses to obtain a second data flow; performing feature aggregation on a plurality of data packets contained in the second data flow to obtain an edge feature corresponding to the second data flow in the inter-flow interaction graph; generating a node feature of each Internet protocol address in the inter-flow interaction graph according to at least one first data flow and the corresponding second data flow; identifying each edge feature through a first target model to obtain a first malicious traffic detection result, and identifying each node feature through the first target model to obtain a second malicious traffic detection result. In this way, the accuracy of malicious traffic detection can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of traffic detection, and in particular to a malicious traffic detection method, apparatus, computer equipment, and readable storage medium. Background Art

[0002] Malicious traffic refers to data flows generated by malicious behavior or attack activities on a network. Malicious traffic is often used to attack computer systems, steal data, disrupt services, spread malware, or gain unauthorized access. Therefore, to prevent and respond to network threats, network traffic can be detected to determine if it is malicious, thereby protecting the security and availability of systems, data, and services.

[0003] In related technologies, when detecting network traffic, general feature pooling and feature splicing methods are generally used to combine and process all features, resulting in the model being unable to extract useful information from the data for classification, thereby reducing the accuracy of malicious traffic detection. Summary of the Invention

[0004] The main purpose of the embodiments of the present application is to provide a malicious traffic detection method, apparatus, computer equipment and readable storage medium, which can improve the accuracy of malicious traffic detection.

[0005] To achieve the above objectives, a first aspect of an embodiment of the present application provides a malicious traffic detection method, the method comprising:

[0006] Acquire the traffic to be detected, and establish an inter-flow interaction graph corresponding to the traffic to be detected based on multiple Internet Protocol addresses in the traffic to be detected and data flow interaction relationships between the multiple Internet Protocol addresses;

[0007] Reconstructing each first data stream between any two Internet Protocol addresses to obtain a second data stream;

[0008] For at least one second data flow between any two Internet Protocol addresses, perform feature aggregation on multiple data packets included in the second data flow to obtain edge features corresponding to the second data flow in the inter-flow interaction graph;

[0009] For each Internet Protocol address, generating, based on at least one first data flow and a corresponding second data flow, a node feature of an interaction graph of the Internet Protocol address between the flows;

[0010] A first malicious traffic detection result is obtained by identifying each edge feature in the inter-flow interaction graph through the first target model, and a second malicious traffic detection result is obtained by identifying each node feature in the inter-flow interaction graph through the first target model.

[0011] Accordingly, a second aspect of an embodiment of the present application provides a malicious traffic detection device, the device comprising:

[0012] an acquisition module, configured to acquire the traffic to be detected and, based on a plurality of Internet Protocol addresses in the traffic to be detected and a data flow interaction relationship between the plurality of Internet Protocol addresses, establish an inter-flow interaction graph corresponding to the traffic to be detected;

[0013] a reconstruction module, configured to reconstruct each first data stream between any two Internet Protocol addresses to obtain a second data stream;

[0014] an aggregation module, configured to perform feature aggregation on a plurality of data packets included in at least one second data flow between any two Internet Protocol addresses, and obtain edge features corresponding to the second data flow in the inter-flow interaction graph;

[0015] a generating module configured to generate, for each Internet Protocol address, node features of an interaction graph between the Internet Protocol address and the flows according to at least one first data flow and a corresponding second data flow;

[0016] An identification module is used to identify each edge feature in the inter-flow interaction graph through a first target model to obtain a first malicious traffic detection result, and to identify each node feature in the inter-flow interaction graph through the first target model to obtain a second malicious traffic detection result.

[0017] In some embodiments, the reconstruction module is further configured to:

[0018] For each first data flow between any two Internet Protocol addresses, determining multiple length information of multiple data packets included in the first data flow;

[0019] sorting the plurality of data packets in a preset sorting order according to the plurality of length information to obtain a sorted first intermediate data stream;

[0020] Duplicate data packets are deduplicated on the plurality of data packets of the first intermediate data stream to obtain a second data stream.

[0021] In some embodiments, the malicious traffic detection device further includes an averaging module configured to:

[0022] For each of the second data flows, averaging the lengths of the multiple data packets according to the multiple length information to obtain an average data packet length corresponding to the second data flow;

[0023] Obtaining a preset maximum transmission unit, and determining a deviation threshold between the average data packet length and the maximum transmission unit;

[0024] When there is a target data flow in the second data flow whose deviation threshold is smaller than the preset target threshold, the corresponding target data flow is input into the second target model to obtain a malicious traffic detection result of the target data flow.

[0025] In some embodiments, the aggregation module is further configured to:

[0026] For at least one second data flow between any two Internet Protocol addresses, constructing an intra-flow interaction graph corresponding to the second data flow according to directions of a plurality of data packets included in the second data flow;

[0027] Obtain traffic statistical features of each data packet in the second data flow, and perform feature aggregation of multiple traffic statistical features corresponding to the multiple data packets according to the intra-flow interaction graph to obtain edge features corresponding to the second data flow in the inter-flow interaction graph.

[0028] In some embodiments, the aggregation module is further configured to:

[0029] For at least one second data flow between any two Internet Protocol addresses, sequentially determining directions of a plurality of data packets in the second data flow;

[0030] Determining consecutive data packets having the same direction in the second data stream as data clusters, and determining a start data packet and an end data packet of each of the data clusters;

[0031] sequentially determining the data layer corresponding to each of the data clusters in the intra-stream interaction graph, and sequentially connecting the data packets contained in each data cluster in each of the data layers;

[0032] In any two of the data layers, the start data packets of the data clusters between the data layers are correspondingly connected, and the end data packets of the data clusters between the data layers are correspondingly connected to obtain an intra-flow interaction graph corresponding to the second data flow.

[0033] In some embodiments, the generating module is further configured to:

[0034] For each Internet Protocol address, concatenate the first data stream received by each Internet Protocol address with the corresponding second data stream to obtain a target data stream;

[0035] Acquire multiple target data streams received by the Internet Protocol address, and splice the multiple target data streams in chronological order to obtain a data stream sequence;

[0036] The data stream sequence is converted into an input into a preset sequence embedding model to obtain the node features of the Internet Protocol address in the interaction graph between the streams.

[0037] In some embodiments, the malicious traffic detection device further includes a fusion module configured to:

[0038] When there are multiple edge features between any two Internet Protocol addresses, determining an adjustment weight for each edge feature;

[0039] Based on the multiple adjustment weights of the multiple edge features, weight fusion is performed on the multiple edge features between the two Internet Protocol addresses to obtain an aggregated edge feature;

[0040] Then, each edge feature in the inter-flow interaction graph is identified by the first target model to obtain a first malicious traffic detection result, including:

[0041] Each aggregate edge feature in the inter-flow interaction graph is identified through a first target model to obtain a first malicious traffic detection result.

[0042] In some embodiments, the malicious traffic detection device further includes a training module for:

[0043] Obtaining sample traffic, and determining sample edge features and sample node features of the sample traffic;

[0044] Inputting the sample edge features and the sample node features into a preset model to obtain predicted sample edge labels of the sample edge features and predicted sample node labels of the sample node features;

[0045] Obtaining a true sample edge label of the sample edge feature, and determining a first loss based on a difference between the predicted sample edge label and the true sample edge label;

[0046] Obtaining a true sample node label of the sample node feature, and obtaining a second loss according to a gap between the predicted sample node label and the true sample node label;

[0047] The preset model is trained according to the first loss and the second loss to obtain a target model.

[0048] In some embodiments, the training module is further configured to:

[0049] Obtaining a first adjustment weight set for a first loss, and adjusting the first loss according to the first adjustment weight to obtain a first target loss;

[0050] Obtaining a second adjustment weight set for a second loss, and adjusting the second loss according to the second adjustment weight to obtain a second target loss;

[0051] Adding the first target loss and the second target loss to obtain a target loss;

[0052] The preset model is trained according to the target loss to obtain a target model.

[0053] Correspondingly, the third aspect of the embodiments of the present application proposes a computer device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the malicious traffic detection method described in any one of the embodiments of the first aspect of the present application when executing the computer program.

[0054] Correspondingly, the fourth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the malicious traffic detection method described in any one of the embodiments of the first aspect of the present application.

[0055] The present application obtains the traffic to be detected and establishes an inter-flow interaction graph corresponding to the traffic to be detected based on multiple Internet Protocol addresses in the traffic to be detected and the data flow interaction relationship between the multiple Internet Protocol addresses; reconstructs each first data flow between any two Internet Protocol addresses to obtain a second data flow; for at least one second data flow between any two Internet Protocol addresses, performs feature aggregation on multiple data packets contained in the second data flow to obtain edge features corresponding to the second data flow in the inter-flow interaction graph; for each Internet Protocol address, generates node features of the Internet Protocol address in the inter-flow interaction graph based on at least one first data flow and the corresponding second data flow; identifies each edge feature in the inter-flow interaction graph through a first target model to obtain a first malicious traffic detection result, and identifies each node feature in the inter-flow interaction graph through the first target model to obtain a second malicious traffic detection result. In this way, by constructing an inter-flow interaction graph, we can accurately capture the interaction relationship between Internet Protocol addresses in the traffic to be detected, and generate fine-grained edge features and node features through the reconstructed second data stream. This can make full use of the limited set of available features in the traffic to be detected, obtain a better traffic embedding representation, and thus improve the accuracy of malicious traffic detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is a schematic diagram of the architecture of the malicious traffic detection system provided in an embodiment of the present application;

[0057] Figure 2 This is a flowchart of a malicious traffic detection method provided by an embodiment of the present application;

[0058] Figure 3 This is a general schematic diagram of the malicious traffic detection method provided in an embodiment of the present application;

[0059] Figure 4 This is an overall flow chart of the malicious traffic detection method provided by the embodiment of the present application;

[0060] Figure 5 This is a schematic diagram of the functional modules of the malicious traffic detection device provided in an embodiment of the present application;

[0061] Figure 6 This is a schematic diagram of the hardware structure of the computer device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0063] It should be noted that although the device schematics illustrate functional module divisions and the flowcharts illustrate logical sequences, in certain circumstances, the steps shown or described may be performed in a sequence that differs from the module divisions in the device or the sequence in the flowcharts. The terms "first," "second," and so on, in the specification, claims, and drawings, are used to distinguish similar items and are not necessarily used to describe a specific sequence or precedence.

[0064] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0065] Malicious traffic refers to data flows generated by malicious behavior or attack activities on a network. Malicious traffic is often used to attack computer systems, steal data, disrupt services, spread malware, or gain unauthorized access. Therefore, to prevent and respond to network threats, network traffic can be detected to determine if it is malicious, thereby protecting the security and availability of systems, data, and services.

[0066] In related technologies, when detecting network traffic, general feature pooling and feature splicing methods are generally used to combine and process all features, resulting in the model being unable to extract useful information from the data for classification, thereby reducing the accuracy of malicious traffic detection.

[0067] It's worth noting that related technologies can also make assumptions about homogeneity when classifying malicious traffic. Specifically, when a node is considered malicious, these technologies often classify all edges associated with that node's vector as malicious, resulting in a large number of false positives.

[0068] Based on this, the embodiments of the present application provide a malicious traffic detection method, apparatus, computer equipment and readable storage medium, which can improve the accuracy of malicious traffic detection.

[0069] The malicious traffic detection method, apparatus, computer device, and readable storage medium provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the malicious traffic detection system in the embodiments of the present application is described.

[0070] Please refer to Figure 1 In some implementations, an embodiment of the present application provides a malicious traffic detection system, which includes a terminal 11 and a server 12.

[0071] For example, terminal 11 can be a desktop computer, mobile device, IoT device, industrial control system, etc. Terminal 11 can generate network traffic, which is analyzed by the system for malicious behavior. Furthermore, terminal 11 can also install client software to help the system perform preliminary traffic recording and pre-processing, reducing the pressure on server 12.

[0072] Furthermore, the server 12 can be a cloud server, data center, security gateway, etc. The server 12 collects traffic data from the terminal 11, processes and analyzes it, and identifies malicious traffic using a trained model. The server 12 is responsible for performing core tasks such as traffic cleaning, feature extraction, model training, and classification prediction. Ultimately, it feeds detection results back to security management personnel or automatically executes corresponding security policies.

[0073] The malicious traffic detection method in the embodiment of the present application can be illustrated by the following embodiment.

[0074] It should be noted that in each specific embodiment of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0075] In the embodiment of the present application, the malicious traffic detection device will be described from the perspective of the malicious traffic detection device, which can be integrated into a computer device. Figure 2 , Figure 2This is a flowchart of the steps of the malicious traffic detection method provided in an embodiment of the present application. In this embodiment of the present application, the malicious traffic detection device is specifically integrated into a terminal or server as an example. When the processor on the terminal or server executes the program instructions corresponding to the malicious traffic detection method, the specific process is as follows:

[0076] Step 101: Obtain traffic to be detected, and establish an inter-flow interaction graph corresponding to the traffic to be detected based on multiple Internet Protocol addresses in the traffic to be detected and data flow interaction relationships between the multiple Internet Protocol addresses.

[0077] In some embodiments, in order to analyze the behavior pattern of the traffic to be detected, an inter-flow interaction graph of the traffic to be detected can be constructed with Internet Protocol addresses as nodes and the interaction relationships between Internet Protocol addresses as edges to improve the efficiency and accuracy of detecting the traffic to be detected.

[0078] The traffic to be detected may be network traffic data that needs to be analyzed and detected to determine whether it is malicious traffic. The traffic to be detected may be encrypted traffic data or unencrypted traffic data. The embodiments of this application are mainly described in the context of encrypted traffic. At the same time, the technical solution of this application can also be used in the context of unencrypted traffic. Specifically, the traffic to be detected may include a sequence of data packets, each of which contains information such as the source Internet Protocol (IP) address, the destination IP address, the protocol type, the packet length, and the packet arrival timestamp.

[0079] The Internet Protocol address may be an IP address, which is a unique address used to identify a device on a network. The IP address allows data packets to be addressed and routed on a network, thereby enabling data exchange between different devices.

[0080] The data flow interaction relationship may refer to the communication relationship formed by sending and receiving data packets between different Internet Protocol addresses in the traffic to be detected. The data flow interaction relationship can be represented as the flow of data packets between a pair of Internet Protocol addresses, including information such as the number, direction, and size of the data packets. Each data flow may include multiple data packets, and a pair of Internet Protocol addresses may include multiple data flows.

[0081] The inter-flow interaction graph can be a graph structure consisting of the Internet Protocol addresses in the traffic to be inspected and the data flow interactions between them. In the inter-flow interaction graph, Internet Protocol addresses can be used as nodes, and the data flow interactions between nodes are considered edges. The inter-flow interaction graph can be used to visualize interaction patterns in the traffic to be inspected and help detect malicious traffic.

[0082] For example, data cleaning can be performed on the traffic to be tested, and the interaction relationships between the Internet Protocol addresses and the Internet Protocol addresses can be extracted to construct an inter-flow interaction graph. For example, if it is necessary to test the traffic between Internet Protocol addresses A, B, C, and D, and Internet Protocol address A sent 100 data packets to Internet Protocol address B, Internet Protocol address B responded to Internet Protocol address A with 100 data packets, and Internet Protocol address C sent 500 data packets to Internet Protocol address D, and Internet Protocol address D responded to Internet Protocol address C with 500 data packets, then Internet Protocol addresses A, B, C, and D can be used as nodes of the inter-flow interaction graph, and each node can be connected according to the direction of the traffic sent by the node to construct the inter-flow interaction graph.

[0083] Furthermore, data cleaning of the traffic to be inspected can include obtaining regional network traffic records of the target area collected by the gateway, such as pcap files, and performing a series of processing and cleaning on the unstructured network records in the regional network traffic records to convert them into structured data for subsequent processing. Processing and cleaning can include operations such as feature extraction and elimination of null values ​​and outliers.

[0084] By constructing an interaction graph between flows, we can more effectively capture the communication patterns in the network and conduct in-depth analysis based on them, thereby improving the efficiency and accuracy of identifying malicious traffic and providing a basis for subsequent feature extraction and malicious traffic detection.

[0085] Step 102: reconstruct each first data stream between any two Internet Protocol addresses to obtain a second data stream.

[0086] It is understandable that in the application scenario of encrypted traffic, since the traffic payload in the traffic is ciphertext, it is invisible to the detection personnel and difficult to perform content analysis. If coarse-grained statistical features such as packet length sequence, packet arrival frequency, and flow duration are directly used as original features to express the encrypted traffic, the actual generation process of these features will be greatly affected by network fluctuations and malicious obfuscation behavior. For example, normal network delays or malicious obfuscation by attackers will cause sequence offsets, packet replays, and packet reorganization of the packet length sequence captured by the receiving end, directly causing huge changes in the packet sequence of the same network flow, and also causing significant changes in features such as packet arrival frequency and flow duration. This change directly affects the original traffic features that serve as the basis for deep learning model prediction, making it difficult for the trained model to maintain good results under new network fluctuations. Therefore, in some embodiments, the present application can reconstruct each first data stream between any two Internet Protocol addresses to obtain a second data stream, and then extract edge features and node features to detect malicious traffic, eliminating the influence of network fluctuations and malicious obfuscation behavior, and greatly improving the robustness of features and the accuracy of detection.

[0087] The first data stream may be an original data stream generated when any two Internet Protocol addresses communicate with each other, and may include an encrypted data payload, metadata of a data packet pair, length of the data packet, arrival timestamp, etc.

[0088] The second data stream may be a new data stream obtained by reconstructing the first data stream.

[0089] Exemplarily, the reconstruction processing of the first data stream may include rearranging data packets, deduplicating data packets, completing lost data packets, etc. The specific reconstruction processing type may be adjusted as needed.

[0090] By reconstructing the first data stream to obtain the second data stream, the reliability of the data stream can be ensured, and the detection accuracy and robustness of the system when performing malicious traffic detection can be enhanced.

[0091] In some embodiments, to ensure that the packet sequence remains consistent and stable in the event of network fluctuations or malicious obfuscation (such as out-of-order or repeated packet transmission), the packets contained in each first data flow may be reordered and deduplicated to improve the robustness of the traffic characteristics. For example, step 102 may include:

[0092] (102.1) For each first data flow between any two Internet Protocol addresses, determine multiple length information of multiple data packets included in the first data flow;

[0093] (102.2) Sorting the plurality of data packets according to a preset sorting order based on the plurality of length information to obtain a sorted first intermediate data stream;

[0094] (102.3) Deduplication processing is performed on multiple data packets of the first intermediate data stream to obtain a second data stream.

[0095] A data packet is the basic unit of data transmitted in network communications. Each packet contains header information and a payload (the actual data to be transmitted). The header information typically includes the source IP address, destination IP address, protocol type, packet length, and timestamp. When inspecting encrypted traffic, since the payload is usually encrypted, it is necessary to obtain the packet metadata, especially its length information, and pay close attention to it.

[0096] The length information can be the payload size of a packet, that is, the length of the data portion of the packet excluding the header information. Length information is a crucial feature when inspecting encrypted traffic because it helps construct characteristic patterns in packet sequences even when the encrypted content cannot be viewed.

[0097] The preset sorting order may be a preset sorting logic, such as from large to small, from small to large, etc. Generally speaking, since longer data packets may contain more information, the preset sorting order may be set to sort from large to small to prioritize longer data packets. The sorting order may be set according to different requirements.

[0098] The first intermediate data stream may be a data stream obtained after rearranging the first data stream.

[0099] Exemplarily, reconstructing each first data stream may include reordering and deduplicating data packets of the first data stream.

[0100] Specifically, when reordering data packets, the length information of multiple data packets contained in each first data stream between any two Internet Protocol addresses can be sorted to obtain a sorted first intermediate data stream. For example, the data packets in each first data stream can be reordered from largest to smallest to ensure that the sequence of data packets remains unchanged even when the order is disordered.

[0101] Furthermore, when deduplicating data packets, duplicate data packets in each first intermediate data stream can be removed based on the data packet length and content of each first intermediate data stream, ensuring that the data packet sequence remains unchanged during data replay.

[0102] It should be noted that the reconstruction processing of each data stream is not limited to rearrangement and deduplication processing, but can also include other reconstruction operations, and there is no limit on the order of rearrangement and deduplication processing operations. Rearrangement can be performed first and then deduplication processing, or deduplication processing can be performed first and then rearrangement processing.

[0103] By sorting packets within each primary data stream based on their length, the relative positions of packets remain unchanged even in the presence of network delays or attacker interference. Deduplication within each data stream removes duplicate packets, preventing sequence anomalies caused by packet replay and ensuring the purity and consistency of the packet sequence. This approach eliminates the impact of network fluctuations and malicious obfuscation, significantly improving the robustness of the original traffic characteristics.

[0104] In some embodiments, when the network environment changes or there is malicious obfuscation behavior, the attacker may intentionally merge multiple short data packets into one long data packet, causing the average length of the data packet to be close to the maximum transmission unit (MTU). This behavior will cause the length distribution of the data packets to change significantly, thereby affecting the normal traffic characteristics. In order to more accurately identify this obfuscation behavior, network flows containing more frequent long data packets can be classified separately to ensure that the characteristics of these data packets are not affected by other data packets, thereby improving the overall performance and accuracy of encrypted malicious traffic detection. For example, after step 102, it also includes:

[0105] (A.1) For each second data stream, averaging the lengths of multiple data packets according to the multiple length information to obtain an average data packet length corresponding to the second data stream;

[0106] (A.2) obtaining a preset maximum transmission unit and determining a deviation threshold between the average packet length and the maximum transmission unit;

[0107] (A.3) When there is a target data flow in the second data flow whose deviation threshold is less than the preset target threshold, the corresponding target data flow is input into the second target model to obtain a malicious traffic detection result of the target data flow.

[0108] The average data packet length may be an average value calculated based on length information of multiple data packets for each second data stream.

[0109] The maximum transmission unit may be the maximum size of a data packet under a specific network protocol.

[0110] The deviation threshold may be a difference between an average data packet length and a maximum transmission unit.

[0111] The target threshold may be a preset value used to determine whether the degree of deviation between the average data packet length and the maximum transmission unit requires further analysis.

[0112] The target data flow may be a data flow whose deviation threshold is smaller than the target threshold.

[0113] The second target model can be a model specifically designed to detect whether a target data stream contains malicious traffic. The second target model can quickly determine whether a data stream containing reassembled data packets is malicious traffic. The second target model can be a model trained based on the first preset model, such as a convolutional neural network, a recurrent neural network, a graph neural network, and the like.

[0114] The malicious traffic detection result may be a conclusion obtained by analyzing the target data flow through the second target model to determine whether the data flow contains malicious traffic.

[0115] In some embodiments, taking the second target model and the first preset model as a graph neural network as an example, the first preset model can be pre-trained, and specifically, special training can be performed for data streams in which the deviation threshold between the average data packet length and the maximum transmission unit is less than the preset target threshold, so that the trained second target model has the ability to accurately classify data streams containing reassembled data packets.

[0116] For example, if the maximum transmission unit in enterprise network A is preset to 1500 bytes, if the second data stream a contains 100 data packets, and the average data packet length of the second data stream a is calculated to be 1300 bytes, then the deviation threshold between the average data packet length and the maximum transmission unit is 200 bytes.

[0117] Furthermore, if the target threshold is 300 bytes and the deviation threshold is less than the target threshold, the second data stream a is determined as the target data stream, and the target data stream can be input into the second target model to obtain the malicious traffic detection result of the target data stream.

[0118] By filtering out data streams whose deviation threshold is less than the target threshold, data streams that may contain malicious behavior can be identified more accurately. Even if attackers try to confuse the detection system by merging multiple short data packets, the second target model can still quickly and effectively identify these abnormal data streams, reducing the false alarm rate.

[0119] Step 103 : for at least one second data flow between any two Internet Protocol addresses, perform feature aggregation on multiple data packets included in the second data flow to obtain edge features corresponding to the second data flow in the inter-flow interaction graph.

[0120] In some embodiments, in order to more accurately capture the interaction patterns between data streams and improve the accuracy of malicious traffic detection, after filtering the target data stream in the second data stream (or without filtering the target data stream in the second data stream), the edge features of at least one second data stream between any two Internet Protocol addresses are aggregated to provide richer and more robust feature expressions, thereby improving the accuracy and robustness of malicious traffic detection.

[0121] An edge feature can be a characteristic expression of a second data flow between any two Internet Protocol addresses. It is generated by aggregating the packet features in the second data flow. The edge feature can be used to characterize the properties of the corresponding second data flow in the inter-flow interaction graph. Because multiple second data flows may exist between two Internet Protocol addresses, there may be multiple edge features between the two Internet Protocol addresses.

[0122] Exemplarily, an intra-stream interaction graph of the second data stream can be constructed based on multiple data packets in each second data stream, and based on the intra-stream interaction graph of the second data stream, combined with characteristic information of each data packet, such as packet length, packet duration and other features, the characteristic information can be aggregated using message passing, graph neural networks or other neural networks to obtain an embedded expression that can represent the intra-stream interaction graph as the edge feature of the second data stream.

[0123] By generating edge features to characterize the characteristics of each second data flow between any two Internet Protocol addresses, it is possible to provide richer and more robust feature expressions and improve the accuracy of malicious traffic detection.

[0124] In some embodiments, to better capture subtle behavioral models in the second data flow, an intra-flow interaction graph may be constructed and feature aggregation may be performed based on the intra-flow interaction graph to obtain edge features corresponding to the second data flow in the inter-flow interaction graph, thereby improving the robustness and accuracy of traffic detection. For example, step 103 may include:

[0125] (103.1) For at least one second data flow between any two Internet Protocol addresses, construct an intra-flow interaction graph corresponding to the second data flow based on directions of multiple data packets included in the second data flow;

[0126] (103.2) Obtain traffic statistical features of each data packet in the second data stream, and perform feature aggregation of multiple traffic statistical features corresponding to multiple data packets based on the intra-stream interaction graph to obtain edge features corresponding to the second data stream in the inter-stream interaction graph.

[0127] The intra-stream interaction graph may be a graph structure used to characterize the interaction pattern between data packets within a single second data stream.

[0128] The traffic statistical feature may be an individual attribute of each data packet, such as data packet length, data packet duration, and the like.

[0129] For example, within each second data stream, data packets can be clustered based on their direction (forward or reverse). This means that consecutive data packets traveling in the same direction are considered a data cluster, and each data cluster is considered a data layer in the intra-stream interaction graph. The number of data packets in the cluster determines the number of nodes in that data layer. Each data packet is considered a node in the intra-stream interaction graph, and the connection rule between nodes is that the starting node of each data layer is connected to the starting node of the next data layer, and the ending node of each data layer is connected to the ending node of the next data layer. Data packets within a layer are connected sequentially, thereby constructing the intra-stream interaction graph.

[0130] Furthermore, traffic statistical features, such as packet length, packet duration, etc., can be extracted based on each data packet in the second data flow, and the traffic statistical features of multiple data packets can be aggregated according to the connection relationship between the data packets in the interaction graph within the flow to obtain the edge features of the second data flow.

[0131] For example, when aggregating the traffic statistical features of multiple data packets, message passing, graph neural networks or other neural networks can be used for information aggregation. This application does not limit the aggregation method, and it only needs to generate an embedded expression representing the interaction graph within the corresponding flow as an edge feature.

[0132] By constructing an intra-flow interaction graph of the second data flow and performing feature aggregation to obtain the edge features corresponding to the second data flow, not only the characteristics of a single data packet but also the interaction relationship between data packets can be considered, enabling the first target model to still make accurate judgments when facing complex and diverse malicious traffic.

[0133] In some embodiments, to more precisely capture the dynamic relationships between data packets, an intra-flow interaction graph can be constructed to characterize the interaction patterns between data packets within a single data flow. This allows the edge features corresponding to the second data flow to not only include static information about the data packets (e.g., length and duration), but also reflect the order and directionality between the data packets, thereby more comprehensively expressing the characteristics of the second data flow. For example, (103.1) may include:

[0134] (103.1.1) for at least one second data flow between any two Internet Protocol addresses, sequentially determine directions of a plurality of data packets in the second data flow;

[0135] (103.1.2) in the second data stream, identifying consecutive data packets with the same direction as data clusters, and determining a start data packet and an end data packet of each data cluster;

[0136] (103.1.3) sequentially determine the data layer corresponding to each data cluster in the intra-flow interaction graph, and in each data layer, sequentially connect the data packets contained in each data cluster;

[0137] (103.1.4) In any two data layers, the start data packets of the data clusters between the data layers are correspondingly connected, and the end data packets of the data clusters between the data layers are correspondingly connected to obtain an intra-flow interaction graph corresponding to the second data flow.

[0138] A data cluster may be a set of consecutive data packets in each second data stream that have the same direction (i.e., either all from the source IP address to the destination IP address, or all from the destination IP address back to the source IP address). For example, if data packets are sent from a client to a server, then this series of consecutive transmissions constitutes a forward data cluster; conversely, data packets sent from the server back to the client constitute a reverse data cluster.

[0139] The starting data packet may be the first data packet sent or received in each data cluster, and the starting data packet is the starting point of the corresponding data cluster in the time series.

[0140] The termination data packet may be the last data packet sent or received in each data cluster, and the termination data packet is the end point of the corresponding data cluster in the time series.

[0141] The data layer can be the data layer corresponding to each data cluster in the process of constructing the intra-flow interaction graph, and each data cluster can correspond to a data layer. In other words, each data cluster represents a layer in the graph, and all data packets contained in the data layer are transmitted continuously in the same direction.

[0142] For example, if the second data stream f n Contains a series of data packets, the data packet sequence is recorded as [p1,p2,…,p i ], these data packets change direction during transmission, and the direction of these data packets is regarded as forward or reverse. Forward means that the data packet flows from one Internet Protocol address a to another Internet Protocol address b, and reverse means that the data packet flows from another Internet Protocol address b back to the original Internet Protocol address a.

[0143] Furthermore, the second data stream f can be determined first. n The direction of each data packet in the data packet is determined, and the data packet sequence is divided into multiple data clusters in sequence according to the change of the direction of the consecutive data packets, for example: [p1], [p2, p3], [p4, p5, p6], [p7], [p8, p9, p 10 ]etc.

[0144] Among them, the direction of the p1 data packet is forward, the directions of the p2 and p3 data packets are reverse, the directions of the p4, p5, and p6 data packets are forward, and so on.

[0145] Furthermore, each data cluster can be considered as a data layer, for example, [p1] is the first layer, [p2, p3] is the second layer, and so on. Then, the starting and ending data packets of each data cluster are determined. For data cluster [p1], p1 is both the starting and ending data packets; for [p2, p3], p2 is the starting data packet and p3 is the ending data packet; for data cluster [p4, p5, p6], p4 is the starting data packet and p6 is the ending data packet.

[0146] Furthermore, within each data layer, the corresponding data packets can be connected sequentially, for example, p4, p5, and p6. Between any two data layers, for example, the first and second data layers, the p1 node can be connected to the p2 and p3 nodes based on the corresponding connection of the start and end packets. For another example, between the second and third data layers, the p2 node can be connected to the p4 node, the p3 node to the p6 node, and so on, ultimately forming the intra-flow interaction graph of the second data flow.

[0147] By constructing an intra-flow interaction graph for each second data flow, we can capture fine-grained behavior patterns between data packets, simplify the understanding of complex traffic, and make the system more reliable and efficient when facing complex network environments and potential malicious behaviors.

[0148] Step 104 : For each Internet Protocol address, generate a node feature of an inter-flow interaction graph of the Internet Protocol address based on at least one first data flow and a corresponding second data flow.

[0149] In some embodiments, in order to avoid the problem of inaccurate detection results caused by the homogeneity assumption, the node features of the inter-flow interaction graph can be constructed at the same time as the edge features of the inter-flow interaction graph to reduce the negative impact of the homogeneity assumption and thereby reduce the false alarm rate in the malicious traffic detection process.

[0150] The node feature may be a set of attributes used to describe each node (Internet Protocol address) in the inter-flow interaction graph.

[0151] For example, to preserve both the original features and the reconstructed robust features, the first data stream and the second data stream can be spliced ​​together to obtain a target data stream. Furthermore, the multiple data streams received by each IP address are spliced ​​together in chronological order to obtain a data stream sequence corresponding to each IP address, thereby obtaining the overall behavior pattern of the corresponding IP address.

[0152] Furthermore, the data stream sequence can be input into a preset sequence embedding model to generate node features of the Internet Protocol address in the flow interaction graph. For example, the sequence embedding model can be a recurrent neural network (RNN), a long short-term memory network (LSTM), a bidirectional long short-term memory network (Bi-LSTM), a transformer, and other models. The specific sequence embedding model can be selected according to the actual situation.

[0153] By generating node features for each Internet Protocol address in the flow interaction graph, the overall behavior pattern of the Internet Protocol address in the network can be integrated, which helps to capture the activity patterns of the Internet Protocol address in the network more comprehensively and accurately. At the same time, the rich feature information can help the subsequent first-target model to more accurately identify malicious traffic and reduce the false alarm rate.

[0154] In some embodiments, in order to simultaneously retain the characteristics of the first data stream and the robust characteristics of the processed second data stream, and to ensure that the generated node characteristics contain the details of the original data and are resistant to the influence of network fluctuations and malicious obfuscation behavior, the first data stream received by each Internet Protocol address and the corresponding second data stream can be spliced. In addition, the target data streams received by each Internet Protocol address can be spliced ​​in chronological order to generate a data stream sequence to capture the time series dependencies in the data streams and determine the dynamic behavior patterns of the Internet Protocol addresses in the network, making the malicious traffic detection system more reliable and efficient when facing complex and changing network environments. For example, step 104 can include:

[0155] (104.1) For each Internet Protocol address, concatenate the first data stream received by each Internet Protocol address with the corresponding second data stream to obtain a target data stream;

[0156] (104.2) Acquire multiple target data streams received by the Internet Protocol address, and splice the multiple target data streams in chronological order to obtain a data stream sequence;

[0157] (104.3) The data stream sequence is converted into an input into a preset sequence embedding model to obtain the node features of the Internet Protocol address in the flow interaction graph.

[0158] The target data stream may be a new data stream formed by splicing the first data stream (original data stream) received by each Internet Protocol address and the corresponding second data stream (data stream reconstructed from the original data stream).

[0159] The data stream sequence may be an ordered data stream sequence formed by splicing multiple target data streams received by each Internet Protocol address in chronological order.

[0160] Sequence embedding models can be machine learning models used to process data stream sequences. They can capture the temporal dependencies of data stream sequences and convert them into node features. Sequence embedding models can include recurrent neural networks (RNNs), long short-term memory networks (LSTMs), bidirectional long short-term memory networks (Bi-LSTMs), and transformers, among others.

[0161] Exemplarily, for Internet Protocol address 1, all incoming first data streams and second data streams obtained by reconstructing the first data streams are collected, and the first data streams and the second data streams are spliced ​​into a target data stream.

[0162] Furthermore, if there is only one data flow flowing into the Internet Protocol address 1, the target data flow can be directly input into the sequence embedding model to obtain the node features of the Internet Protocol address in the inter-flow interaction graph.

[0163] Furthermore, if multiple data streams flow into IP address 2, the target data stream corresponding to each data stream can be obtained. For example, if there are three data streams flowing into IP address 2, namely data stream 1 (received at 12:05), data stream 2 (received at 12:10), and data stream 3 (received at 12:15), the target data stream a1 corresponding to data stream 1, the target data stream a2 corresponding to data stream 2, and the target data stream a3 corresponding to data stream 3 are obtained. Target data streams a1, a2, and a3 are concatenated in chronological order to obtain the data stream sequence.

[0164] Furthermore, by inputting the data stream sequence into the sequence embedding model, the node features of the Internet Protocol address in the flow interaction graph can be obtained.

[0165] By generating node features for each Internet Protocol address in the inter-flow interaction graph, we can comprehensively describe the behavior pattern of each Internet Protocol address in the network, enhance the robustness of the features and the accuracy of the detection model, and make the malicious traffic detection system more reliable and efficient in the face of complex and changing network environments.

[0166] In some embodiments, since there may be multiple communications between the same pair of Internet Protocol addresses, these communications form multiple network flows. In order to enable the generated edge features to better reflect the complex interaction patterns between nodes (Internet Protocol addresses), edge features can be aggregated to improve the reliability and efficiency of the malicious traffic detection system. For example, before "identifying each edge feature in the flow interaction graph using the first target model to obtain the first malicious traffic detection result" in step 105, the following steps may also be included:

[0167] (B.1) when there are multiple edge features between any two Internet Protocol addresses, determining an adjustment weight for each edge feature;

[0168] (B.2) Based on the multiple adjustment weights of the multiple edge features, weight fusion is performed on the multiple edge features between the two Internet Protocol addresses to obtain an aggregated edge feature;

[0169] (B.3) Each edge feature in the flow interaction graph is identified by the first target model to obtain the first malicious traffic detection result, including:

[0170] (B.4) Identify each aggregate edge feature in the inter-flow interaction graph through the first target model to obtain the first malicious traffic detection result.

[0171] The adjustment weight may be a weight value assigned to each edge feature when multiple edge features exist between two Internet Protocol addresses. The adjustment weight is used to reflect the importance of different edge features during the aggregation process.

[0172] The aggregated edge feature may be a comprehensive edge feature obtained by aggregating multiple edge features generated between any two Internet Protocol addresses that have an interactive relationship.

[0173] For example, the adjustment weight of each edge feature can be determined by assigning values ​​through an attention mechanism, assigning values ​​through rule matching, directly classifying using a deep learning model and then assigning values ​​based on predicted probabilities, etc. The specific method for obtaining the adjustment weight can be determined based on actual conditions, and the embodiments of the present application do not impose any specific restrictions on this.

[0174] For example, if there are three data flows between node 1 (Internet Protocol address 1) and node 2 (Internet Protocol address 2) in the flow interaction graph, namely flow 1, flow 2 and flow 3, and the corresponding edge features are E1, E2 and E3 respectively, if the attention mechanism determines that the adjustment weight w1 of E1 is 0.4, the adjustment weight w2 of E2 is 0.3, and the adjustment weight w3 of E3 is 0.3, it is assumed that the edge features E1, E2 and E3 are represented by the following vectors:

[0175] E1=[0.5,0.3,0.7];

[0176] E2=[0.4,0.6,0.2];

[0177] E3=[0.3,0.4,0.5];

[0178] Furthermore, based on the adjusted weights, the edge features can be weighted fused to obtain the aggregated edge feature E = w1*E1+w2*E2+w3*E3 = [0.41, 0.42, 0.49].

[0179] In some implementations, the aggregate edge feature may also be obtained by averaging the edge features between any two nodes. For example, in the above embodiment, the aggregate edge feature E may also be equal to (E1+E2+E3) / 3.

[0180] By aggregating the edge features between any two nodes in the above way to obtain aggregated edge features, we can more accurately capture the complex interaction patterns between any two Internet Protocol addresses and generate more robust edge features, thereby improving the accuracy and reliability of the encrypted malicious traffic detection system.

[0181] Step 105 , identifying each edge feature in the flow interaction graph through the first target model to obtain a first malicious traffic detection result, and identifying each node feature in the flow interaction graph through the first target model to obtain a second malicious traffic detection result.

[0182] In some embodiments, in order to comprehensively and accurately detect malicious traffic, each edge feature and each node feature in the inter-flow interaction graph can be identified through the first target model to improve the accuracy of detection, making the malicious traffic detection system more reliable and efficient in complex and changing network environments.

[0183] In some embodiments, when there are multiple edge features between any two nodes in the inter-flow interaction graph, the edge features can be aggregated to obtain the aggregated edge features, and then each aggregated edge feature in the inter-flow interaction graph can be identified through the first target model.

[0184] Among them, the first target model can be a pre-trained machine learning model for identifying node features and edge features in the inter-flow interaction graph. The first target model can detect malicious traffic by identifying node features and edge features in the inter-flow interaction graph.

[0185] The first malicious traffic detection result may be a detection result obtained by identifying each edge feature (when multiple edge features exist between nodes, aggregated edge features are used) in the flow interaction graph using the first target model. The first malicious traffic detection result reflects whether there is suspicious or malicious traffic in the edge feature.

[0186] The second malicious traffic detection result may refer to a detection result obtained by identifying each node feature in the flow interaction graph using the first target model. The second malicious traffic detection result reflects whether there is suspicious or malicious behavior in the node features.

[0187] Exemplarily, the first target model can be a machine learning model for identifying node features and edge features in the inter-flow interaction graph. For example, the first target model can be a point-edge joint graph neural network (Graph Neura lNetwork, GNN), specifically a graph convolutional network (Graph Convolutional Network, GCN), a graph attention network (Graph Attention Network, GAT), etc.

[0188] For example, the node features, edge features and corresponding flow interactions can be Figure 1 The first target model can input both node features and edge features into the first target model, or input only node features and edge features into the first target model. When the first target model identifies edge features, a first malicious traffic detection result can be obtained, indicating that the edge features are malicious edges or benign edges. When the first target model identifies node features, a second malicious traffic detection result can be obtained, indicating that the node features are malicious nodes or benign nodes. Any node that has sent malicious traffic can be marked as a malicious node (malicious Internet Protocol address).

[0189] It is understandable that within traffic, IP addresses or edges classified as malicious may involve offensive behaviors (such as sending scanning packets, attack packets carrying vulnerabilities, etc.), destructive behaviors (such as crawling information and data through mobile phone group control, stealing information, using cheats, and other malicious attacks), and behaviors that flood the target server or its surrounding infrastructure with large-scale Internet traffic to disrupt the target server, service, or normal network traffic. IP addresses or edges classified as benign may involve search engines, statistics and advertising programs, popular domain name queries, newly registered domain name queries, etc. The specific classification can be determined based on actual circumstances.

[0190] Furthermore, when a malicious node or malicious edge is detected, the corresponding malicious node or malicious edge can be fed back to the security personnel so that the security personnel can handle it in a timely manner.

[0191] By identifying the node features and edge features in the flow interaction graph through the first target model, malicious traffic can be comprehensively detected, which improves the accuracy and robustness of detection and ensures that malicious behavior can be discovered and handled in a timely manner in a complex network environment.

[0192] In some embodiments, in order to enable the first target model to learn features that distinguish malicious traffic from normal traffic from data and generalize to unseen data, a preset model can be trained, and the parameters of the preset model can be continuously optimized during the training process, so that the model can accurately identify malicious traffic when faced with new encrypted traffic. Exemplarily, the first target model is trained by the following steps:

[0193] (C.1) Obtain sample traffic and determine the sample edge features and sample node features of the sample traffic;

[0194] (C.2) Inputting the sample edge features and the sample node features into a preset model to obtain predicted sample edge labels of the sample edge features and predicted sample node labels of the sample node features;

[0195] (C.3) Obtain the true sample edge label of the sample edge feature, and determine the first loss based on the gap between the predicted sample edge label and the true sample edge label;

[0196] (C.4) Obtain the true sample node label of the sample node feature, and obtain the second loss based on the gap between the predicted sample node label and the true sample node label;

[0197] (C.5) Train the preset model according to the first loss and the second loss to obtain the target model.

[0198] The sample traffic can be real or simulated network traffic data used to train and test a preset model. The sample traffic can include multiple network flows, each of which consists of a series of data packets that form a certain interaction pattern over time.

[0199] The sample edge feature may be a feature vector of each sample edge (ie, the communication between any two sample Internet Protocol addresses) in the sample flow interaction graph formed according to the sample traffic.

[0200] The sample node feature can be a feature vector of each sample node (i.e., a sample Internet Protocol address) in the sample flow interaction graph. The sample node feature can include information such as packet length sequence and packet arrival frequency, which is used to represent the attributes of the sample node.

[0201] Among them, the preset model can be a model that has not yet been finally optimized. The preset model can be a preliminarily configured point-edge joint graph neural network, such as GCN, GAT, etc., which is used to identify malicious behavior in encrypted traffic.

[0202] The predicted sample edge label can be a predicted label for each sample edge obtained by processing the sample edge features using a preset model, indicating whether the sample edge is malicious traffic. The predicted sample label is typically binary, such as 0 for normal and 1 for malicious, or other classification methods are possible.

[0203] The predicted sample node labels can be obtained by processing the sample node features using a preset model, indicating whether the node is involved in malicious behavior. Similarly, the labels are usually binary, such as 0 for normal and 1 for malicious.

[0204] Among them, the real sample edge label can refer to the actual label of each sample edge feature in the sample traffic, that is, the label marked according to previous experience or a known malicious behavior database, which is used to train the preset model.

[0205] The first loss may be a first loss value calculated based on the difference between the predicted sample edge label and the true sample edge label. The first loss may be a cross entropy loss, mean square error, etc. The first loss focuses on the classification accuracy of the sample edge features.

[0206] The real sample node label refers to the actual label of each sample node feature in the sample traffic, that is, the label marked based on previous experience or a known malicious behavior database. The real sample node label is used to train the preset model.

[0207] The second loss can be calculated based on the difference between the predicted sample node label and the true sample node label. Similar to the first loss, the second loss focuses on the classification accuracy of the sample node features. Both the first and second losses are calculated using the same binary loss function.

[0208] Specifically, the first loss L edge It can be calculated by the following formula:

[0209]

[0210] Among them, y ij The true sample edge label of the sample edge feature between the i-th and j-th sample nodes (sample Internet Protocol addresses) in the sample flow interaction graph. If the sample edge feature is malicious, then y ij =1, otherwise y ij =0; N represents the predicted probability that the sample edge feature between sample node i and sample node j output by the preset model belongs to the malicious category; edges Indicates the number of sample edge features.

[0211] Furthermore, the second loss Lnode It can be calculated by the following formula:

[0212]

[0213] Among them, y i represents the true sample node label of the i-th sample node feature (sample Internet Protocol address) in the sample flow interaction graph. If the sample node is malicious, then y i =1, otherwise y i =0; N represents the predicted probability that the i-th sample node feature output by the preset model belongs to the malicious category; nodes Indicates the number of sample nodes.

[0214] For example, the sample node features, sample edge features and corresponding sample flows can be interacted Figure 1 The sample node features and the sample edge features are input into the preset model at the same time, or only the sample node features and the sample edge features are input into the preset model, and the first loss and the second loss are calculated respectively through the above-mentioned calculation formulas of the first loss and the second loss, and then the preset model is trained by combining the first loss and the second loss to achieve the purpose of improving the detection accuracy of encrypted malicious traffic and reducing the false alarm rate, so that the trained first target model can make full use of the point features and the edge features to perform a more comprehensive and accurate classification of the traffic to be detected.

[0215] Furthermore, the target loss can be constructed by the first loss and the second loss, and the preset model can be trained based on the target loss until the preset convergence condition is reached, and the training of the preset model can be stopped to obtain the first target model. Specifically, the preset convergence condition can be that the preset number of trainings has been reached. For example, the preset number of trainings can be 500 times. Then, when it reaches 500 times, the training of the preset model can be stopped to obtain the target model. The preset number of trainings can be adjusted. Alternatively, the preset convergence condition can also be that the target loss of the preset model does not exceed the preset value for a fixed number of consecutive times. For example, if the target loss is lower than the A value for 10 consecutive times, the training of the preset model can be stopped to obtain the first target model.

[0216] By combining the first loss and the second loss to train the preset model, the accuracy of encrypted malicious traffic detection is improved, so that the trained first target model can make full use of point features and edge features to classify traffic more comprehensively and accurately.

[0217] In some implementations, since the nodes and edges included in the traffic to be detected each carry different information, in order to balance the contributions of different losses and ensure that the preset model can better focus on the different characteristics of nodes and edges during training, the weights of the first loss and the second loss can be adjusted to improve the overall detection performance of the model. For example, (C.5) may include:

[0218] (C.5.1) Obtaining a first adjustment weight set for the first loss, and adjusting the first loss according to the first adjustment weight to obtain a first target loss;

[0219] (C.5.2) Obtaining a second adjustment weight set for the second loss, and adjusting the second loss according to the second adjustment weight to obtain a second target loss;

[0220] (C.5.3) Add the first target loss and the second target loss to obtain the target loss;

[0221] (C.5.4) Train the preset model according to the target loss to obtain the target model.

[0222] Among them, the first adjustment weight can be a coefficient set for the first loss, which is used to adjust the proportion of the classification loss (first loss) of the sample node in the entire loss function. The first adjustment weight is used to characterize the relative importance of the sample node classification in the overall training process.

[0223] The first target loss may be the node classification loss adjusted by the first adjustment weight, representing the optimization target of the sample node classification task during the training process.

[0224] The second adjustment weight can be a coefficient set for the sample edge classification loss (the second loss) to adjust the proportion of the sample edge classification loss in the entire loss function. The second adjustment weight is used to represent the relative importance of the sample edge classification in the overall training process.

[0225] The second target loss may be the edge classification loss adjusted by the second adjustment weight, representing the optimization target of the sample edge classification task during the training process.

[0226] The target loss may be the sum of the first target loss and the second target loss, representing the optimization target of the comprehensive sample node classification and sample edge classification tasks.

[0227] For example, the target loss is calculated as follows:

[0228] L=α·L node +(1-α)·L edge

[0229] Among them, L represents the target loss, L edge represents the first loss, (1-α) represents the first adjustment weight, L node represents the second loss, and α represents the second adjustment weight.

[0230] By comprehensively considering the sample node classification loss and the sample edge classification loss, it is ensured that the preset model can accurately identify both malicious nodes and malicious edges during the training process, thereby improving the overall performance of encrypted malicious traffic detection.

[0231] The present application obtains the traffic to be detected and establishes an inter-flow interaction graph corresponding to the traffic to be detected based on multiple Internet Protocol addresses in the traffic to be detected and the data flow interaction relationship between the multiple Internet Protocol addresses; reconstructs each first data flow between any two Internet Protocol addresses to obtain a second data flow; for at least one second data flow between any two Internet Protocol addresses, performs feature aggregation on multiple data packets contained in the second data flow to obtain edge features corresponding to the second data flow in the inter-flow interaction graph; for each Internet Protocol address, generates node features of the Internet Protocol address in the inter-flow interaction graph based on at least one first data flow and the corresponding second data flow; identifies each edge feature in the inter-flow interaction graph through a first target model to obtain a first malicious traffic detection result, and identifies each node feature in the inter-flow interaction graph through the first target model to obtain a second malicious traffic detection result. In this way, by constructing an inter-flow interaction graph, we can accurately capture the interaction relationship between Internet Protocol addresses in the traffic to be detected, and generate fine-grained edge features and node features through the reconstructed second data stream. This can make full use of the limited set of available features in the traffic to be detected, obtain a better traffic embedding representation, and thus improve the accuracy of malicious traffic detection.

[0232] Please refer to Figure 3 and Figure 4 In some embodiments, combined Figure 3 and Figure 4 This paper provides an overview of the malicious traffic detection method of this application.

[0233] For example, training samples for training a preset model can be prepared in advance. Specifically, when it is necessary to detect whether encrypted traffic is malicious, network traffic records can be exported from the gateway as pcap file data, the traffic data can be cleaned, and an interaction graph between sample flows can be generated; and the data packets in each sample data flow between any two sample Internet Protocol addresses can be reconstructed.

[0234] Furthermore, reconstructing the data packets may include rearranging and removing duplicate data packets. Specifically, the order of the data packets in the sample data stream may be rearranged according to the length of the data packets, and duplicate data packets in the sample data stream may be removed.

[0235] Furthermore, the data packet length distribution in the sample data stream can be calculated. When the deviation threshold between the average length of the data packet and the maximum transmission unit is less than the target threshold, it is determined that the sample data stream may have undergone data packet reorganization, and these sample data streams can be analyzed separately.

[0236] Please refer to Figure 3 Furthermore, for each sample data stream, a corresponding intra-stream interaction graph can be constructed according to the direction of the packets it contains, and the statistical features at the packet level are aggregated according to the structure of the intra-stream interaction graph to obtain sample edge features. For the sample data stream received by each sample node, the packet length sequences corresponding to each sample data stream before and after reconstruction are spliced, and the sample data streams received by each sample node are spliced ​​in chronological order to obtain the corresponding sequence embedding as the sample node feature of the interaction graph between sample streams.

[0237] Exemplarily, the sample edge features can be aggregated so that only one sample aggregate edge feature is included between any two sample nodes in the sample flow interaction graph, and the sample nodes and sample edges are arranged so that the sample nodes and sample edges correspond to the structure of the flow interaction graph.

[0238] Furthermore, the preset model can be trained according to the flow interaction graph, sample node features and sample edge features. When the convergence condition is reached, the training of the preset model can be stopped to obtain the first target model.

[0239] Furthermore, the trained first target model can be used to classify the types of nodes (Internet Protocol addresses) and edges (data traffic between any two Internet Protocol addresses) of the traffic to be detected (the processing process of nodes and edges can be referred to Figure 3 ), and feedback malicious nodes and malicious traffic to security personnel so that security personnel can take corresponding measures in time.

[0240] See also Figure 5 The embodiment of the present application further provides a malicious traffic detection device that can implement the above-mentioned malicious traffic detection method. The malicious traffic detection device includes:

[0241] An acquisition module 51 is configured to acquire the traffic to be detected and establish an inter-flow interaction graph corresponding to the traffic to be detected based on multiple Internet Protocol addresses in the traffic to be detected and data flow interaction relationships between the multiple Internet Protocol addresses;

[0242] a reconstruction module 52, configured to reconstruct each first data stream between any two Internet Protocol addresses to obtain a second data stream;

[0243] an aggregation module 53 configured to perform feature aggregation on multiple data packets included in at least one second data flow between any two Internet Protocol addresses, and obtain edge features corresponding to the second data flow in the inter-flow interaction graph;

[0244] A generating module 54 is configured to generate, for each Internet Protocol address, node features of an inter-flow interaction graph of the Internet Protocol address based on at least one first data flow and a corresponding second data flow;

[0245] The identification module 55 is used to identify each edge feature in the inter-flow interaction graph through the first target model to obtain a first malicious traffic detection result, and to identify each node feature in the inter-flow interaction graph through the first target model to obtain a second malicious traffic detection result.

[0246] The specific implementation of the malicious traffic detection device is basically the same as the specific embodiment of the malicious traffic detection method described above, and will not be repeated here. Under the premise of meeting the requirements of the embodiment of this application, the malicious traffic detection device can also be equipped with other functional modules to implement the malicious traffic detection method in the above embodiment.

[0247] The present application also provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-mentioned malicious traffic detection method. The computer device can be any intelligent terminal including a tablet computer, an in-vehicle computer, or the like.

[0248] See also Figure 6 , Figure 6 The hardware structure of a computer device according to another embodiment is shown. The computer device includes:

[0249] The processor 61 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0250] The memory 62 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 62 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program codes are stored in the memory 62 and are called by the processor 61 to execute the malicious traffic detection method of the embodiments of this application.

[0251] Input / output interface 63, used for information input and output;

[0252] Communication interface 64, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, Wi-Fi, Bluetooth, etc.);

[0253] bus 65 , which transmits information between the various components of the device (e.g., processor 61 , memory 62 , input / output interface 63 , and communication interface 64 );

[0254] The processor 61 , the memory 62 , the input / output interface 63 and the communication interface 64 are connected to each other in communication within the device via a bus 65 .

[0255] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned malicious traffic detection method is implemented.

[0256] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0257] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0258] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0259] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0260] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0261] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0262] It should be understood that in this application, "at least one (item)" and "several" refer to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0263] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For example, the division of the above units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0264] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0265] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0266] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store programs.

[0267] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A malicious traffic detection method, characterized in that: The method comprises: Acquire the traffic to be detected, and establish an inter-flow interaction graph corresponding to the traffic to be detected based on multiple Internet Protocol addresses in the traffic to be detected and data flow interaction relationships between the multiple Internet Protocol addresses; Reconstructing each first data stream between any two Internet Protocol addresses to obtain a second data stream; For at least one second data flow between any two Internet Protocol addresses, perform feature aggregation on multiple data packets included in the second data flow to obtain edge features corresponding to the second data flow in the inter-flow interaction graph; For each Internet Protocol address, generating, based on at least one first data flow and a corresponding second data flow, a node feature of an interaction graph of the Internet Protocol address between the flows; A first malicious traffic detection result is obtained by identifying each edge feature in the inter-flow interaction graph through the first target model, and a second malicious traffic detection result is obtained by identifying each node feature in the inter-flow interaction graph through the first target model.

2. The malicious traffic detection method according to claim 1, characterized in that: The reconstructing each first data stream between any two Internet Protocol addresses to obtain a second data stream includes: For each first data flow between any two Internet Protocol addresses, determining multiple length information of multiple data packets included in the first data flow; sorting the plurality of data packets in a preset sorting order according to the plurality of length information to obtain a sorted first intermediate data stream; Duplicate data packets are deduplicated on the plurality of data packets of the first intermediate data stream to obtain a second data stream.

3. The malicious traffic detection method according to claim 2, characterized in that: After reconstructing each first data stream between any two Internet Protocol addresses to obtain a second data stream, the method further includes: For each of the second data flows, averaging the lengths of the multiple data packets according to the multiple length information to obtain an average data packet length corresponding to the second data flow; Obtaining a preset maximum transmission unit, and determining a deviation threshold between the average data packet length and the maximum transmission unit; When there is a target data flow in the second data flow whose deviation threshold is smaller than the preset target threshold, the corresponding target data flow is input into the second target model to obtain a malicious traffic detection result of the target data flow.

4. The malicious traffic detection method according to claim 1, characterized in that: The step of performing feature aggregation on multiple data packets included in at least one second data flow between any two Internet Protocol addresses to obtain edge features corresponding to the second data flow in the inter-flow interaction graph includes: For at least one second data flow between any two Internet Protocol addresses, constructing an intra-flow interaction graph corresponding to the second data flow according to directions of a plurality of data packets included in the second data flow; Obtain traffic statistical features of each data packet in the second data flow, and perform feature aggregation of multiple traffic statistical features corresponding to the multiple data packets according to the intra-flow interaction graph to obtain edge features corresponding to the second data flow in the inter-flow interaction graph.

5. The malicious traffic detection method according to claim 4, characterized in that: The step of constructing, for at least one second data flow between any two Internet Protocol addresses, an intra-flow interaction graph corresponding to the second data flow according to directions of a plurality of data packets included in the second data flow, includes: For at least one second data flow between any two Internet Protocol addresses, sequentially determining directions of a plurality of data packets in the second data flow; Determining consecutive data packets having the same direction in the second data stream as data clusters, and determining a start data packet and an end data packet of each of the data clusters; sequentially determining the data layer corresponding to each of the data clusters in the intra-stream interaction graph, and sequentially connecting the data packets contained in each data cluster in each of the data layers; In any two of the data layers, the start data packets of the data clusters between the data layers are correspondingly connected, and the end data packets of the data clusters between the data layers are correspondingly connected to obtain an intra-flow interaction graph corresponding to the second data flow.

6. The malicious traffic detection method according to claim 1, characterized in that: The step of generating, for each Internet Protocol address, a node feature of an interaction graph between the flows of the Internet Protocol address according to at least one first data flow and a corresponding second data flow, includes: For each Internet Protocol address, concatenate the first data stream received by each Internet Protocol address with the corresponding second data stream to obtain a target data stream; Acquire multiple target data streams received by the Internet Protocol address, and splice the multiple target data streams in chronological order to obtain a data stream sequence; The data stream sequence is converted into an input into a preset sequence embedding model to obtain the node features of the Internet Protocol address in the interaction graph between the streams.

7. The malicious traffic detection method according to claim 1, characterized in that: Before identifying each edge feature in the inter-flow interaction graph by using the first target model to obtain the first malicious traffic detection result, the method further includes: When there are multiple edge features between any two Internet Protocol addresses, determining an adjustment weight for each edge feature; Based on the multiple adjustment weights of the multiple edge features, weight fusion is performed on the multiple edge features between the two Internet Protocol addresses to obtain an aggregated edge feature; Then, each edge feature in the inter-flow interaction graph is identified by the first target model to obtain a first malicious traffic detection result, including: Each aggregate edge feature in the inter-flow interaction graph is identified through a first target model to obtain a first malicious traffic detection result.

8. The malicious traffic detection method according to claim 1, characterized in that: The first target model is trained by the following steps: Obtaining sample traffic, and determining sample edge features and sample node features of the sample traffic; Inputting the sample edge features and the sample node features into a preset model to obtain predicted sample edge labels of the sample edge features and predicted sample node labels of the sample node features; Obtaining a true sample edge label of the sample edge feature, and determining a first loss based on a difference between the predicted sample edge label and the true sample edge label; Obtaining a true sample node label of the sample node feature, and obtaining a second loss according to a gap between the predicted sample node label and the true sample node label; The preset model is trained according to the first loss and the second loss to obtain a target model.

9. The malicious traffic detection method according to claim 8, characterized in that: The step of training the preset model according to the first loss and the second loss to obtain a target model includes: Obtaining a first adjustment weight set for a first loss, and adjusting the first loss according to the first adjustment weight to obtain a first target loss; Obtaining a second adjustment weight set for a second loss, and adjusting the second loss according to the second adjustment weight to obtain a second target loss; Adding the first target loss and the second target loss to obtain a target loss; The preset model is trained according to the target loss to obtain a target model.

10. A malicious traffic detection device, characterized in that: The device comprises: an acquisition module, configured to acquire the traffic to be detected and, based on a plurality of Internet Protocol addresses in the traffic to be detected and a data flow interaction relationship between the plurality of Internet Protocol addresses, establish an inter-flow interaction graph corresponding to the traffic to be detected; a reconstruction module, configured to reconstruct each first data stream between any two Internet Protocol addresses to obtain a second data stream; an aggregation module, configured to perform feature aggregation on a plurality of data packets included in at least one second data flow between any two Internet Protocol addresses, and obtain edge features corresponding to the second data flow in the inter-flow interaction graph; a generating module configured to generate, for each Internet Protocol address, node features of an interaction graph between the Internet Protocol address and the flows according to at least one first data flow and a corresponding second data flow; An identification module is used to identify each edge feature in the inter-flow interaction graph through a first target model to obtain a first malicious traffic detection result, and to identify each node feature in the inter-flow interaction graph through the first target model to obtain a second malicious traffic detection result.

11. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the malicious traffic detection method according to any one of claims 1 to 9 when executing the computer program.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the malicious traffic detection method according to any one of claims 1 to 9 is implemented.

Images