A detection method and device for covert channel communication based on preset protocol

Abstract

The embodiments of the present application disclose a detection method and device for covert channel communication based on a preset protocol, which relates to the field of network security technology and is invented to effectively detect messages that communicate through covert channels based on preset protocols. The method includes: collecting data messages to be detected in a target detection environment; wherein the data messages to be detected are data messages based on a preset protocol; obtaining feature values ​​of specified features of the data messages to be detected; determining whether the data messages to be detected are malicious messages based on the feature values ​​and a pre-trained decision tree optimization model based on a variable precision rough set, so as to determine whether the data messages to be detected are messages that communicate through covert channels based on preset protocols. The present application is applicable to detecting whether there is a covert channel based on a preset protocol in an environment for communication.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a detection method, device, electronic device and readable storage medium for covert channel communication based on a preset protocol. Background Art

[0002] Since LAMPSON proposed the concept of covert channels in 1973, with the rapid development of Internet technology, covert channels have been widely used by hackers to transmit malware or data due to their high concealment and rich carriers. It is precisely because of the high concealment of covert channels that it is difficult to detect covert channel threat data. At present, there is an urgent need for a technology to detect covert channel threat data. Summary of the invention

[0003] In view of this, the embodiments of the present application provide a method, device, electronic device and readable storage medium for detecting covert channel communication based on a preset protocol, which can effectively detect messages communicated through a covert channel based on a preset protocol.

[0004] In a first aspect, an embodiment of the present application provides a detection method for covert channel communication based on a preset protocol, comprising: collecting data packets to be detected in a target detection environment; wherein the data packets to be detected are data packets based on a preset protocol; obtaining a feature value of a specified feature of the data packets to be detected; determining whether the data packets to be detected are malicious packets based on the feature value and a pre-trained decision tree optimization model based on a variable precision rough set, so as to determine whether the data packets to be detected are packets for communication through a covert channel based on a preset protocol; wherein the pre-trained decision tree optimization model based on a variable precision rough set is obtained according to the following steps: collecting data packets based on a pre-trained decision tree optimization model; Assume multiple training data messages of a protocol; obtain a training sample for each of the multiple training data messages; wherein each training sample includes a feature value of a target feature of the training data message corresponding to itself and a label indicating whether the training data message is a malicious data message; calculate the classification accuracy of each target feature in the multiple training samples based on the multiple training samples and a variable precision rough set model; take the target feature whose classification accuracy is greater than or equal to a preset threshold as a designated feature; and construct a decision tree optimization model based on a variable precision rough set according to each of the designated features in the multiple training samples, the feature value of each of the designated features and the label of each training sample.

[0005] According to a specific implementation method of an embodiment of the present application, obtaining the feature value of the specified feature of the data message to be detected includes: extracting the feature value of the first specified feature of the data message to be detected; and / or, within a preset time, counting the feature value of the specified feature in the target detection environment, and using the feature value of the specified feature obtained by counting as the feature value of the second specified feature of the data message to be detected.

[0006] According to a specific implementation method of an embodiment of the present application, after collecting the data packets to be detected in the target detection environment and before obtaining the feature value of the specified feature of the data packets to be detected, the method also includes: performing data preprocessing on the data packets to be detected; cleaning the data packets to be detected that have completed the data preprocessing; and executing the step of obtaining the feature value of the specified feature of the data packets to be detected for the cleaned data packets to be detected.

[0007] According to a specific implementation method of an embodiment of the present application, a decision tree optimization model based on variable precision rough sets is constructed according to each of the designated features in multiple training samples, the feature values ​​of each of the designated features, and the labels of each training sample, including: calculating the gain rate of each of the designated features according to each of the designated features in each training sample, the feature values ​​of each of the designated features, and the labels of each training sample; taking the first designated feature with the largest gain rate among the designated features as the root node of the decision tree; and determining leaf nodes in sequence according to the feature value of the first designated feature, other designated features among the designated features in each training sample except the first designated feature, the feature values ​​of the other designated features, and the labels of each training sample, so as to construct a decision tree optimization model based on variable precision rough sets.

[0008] According to a specific implementation of an embodiment of the present application, each of the specified features includes a second specified feature; wherein, the gain rate of each of the specified features is calculated according to each of the specified features in each training sample, the feature value of each of the specified features, and the label of each training sample, including: calculating the gain rate of the second specified feature according to the second specified feature in each training sample, the feature value of the second specified feature, and the label of each training sample; wherein the gain rate of the second specified feature is calculated according to the following formula:

[0009]

[0010] in, is the second specified feature, is the gain rate of the second specified characteristic, is the gain of the second specified feature, is a penalty factor for the second specified feature;

[0011]

[0012] in, is the total number of training samples; is the number of samples labeled as malicious in the training samples; is the number of samples labeled as safe in the training samples; For The relevant weights; For The relevant weights; is the number of values ​​of the second specified feature; is greater than or equal to 1 and less than or equal to integer; is the number of the second specified feature in the training sample The number of samples to be taken; The second specified feature The number of samples of the value , the number of samples labeled as malicious; The second specified feature The number of samples of the value , the number of samples with the label safe; For The relevant weights;

[0013]

[0014] in, is the number of values ​​of the second specified feature; is greater than or equal to 1 and less than or equal to integer; is the number of the second specified feature in the training sample The number of samples to be taken; is the total number of training samples; For The relevant weight.

[0015] According to a specific implementation manner of an embodiment of the present application, the specified characteristics include a domain name, characteristics of a domain name request type, a domain name request payload length and / or a request based on a preset protocol.

[0016] In a second aspect, an embodiment of the present application provides a detection device for covert channel communication based on a preset protocol, comprising: a collection module, used to collect data packets to be detected in a target detection environment; wherein the data packets to be detected are data packets based on a preset protocol; an acquisition module, used to obtain feature values ​​of specified features of the data packets to be detected; a determination module, used to determine whether the data packets to be detected are malicious packets based on the feature values ​​and a pre-trained decision tree optimization model based on a variable precision rough set, so as to determine whether the data packets to be detected are packets for communication through a covert channel based on a preset protocol; and also comprising: a model construction module, wherein the model construction module is used to obtain a feature value based on a variable precision rough set according to the following steps. The decision tree optimization model is as follows: a plurality of training data messages based on a preset protocol are collected; a training sample is obtained for each of the plurality of training data messages; each training sample includes a feature value of a target feature of the training data message corresponding to itself and a label indicating whether the training data message is a malicious data message; the classification accuracy of each target feature in the plurality of training samples is calculated according to the plurality of training samples and a variable precision rough set model; the target feature whose classification accuracy is greater than or equal to a preset threshold is taken as a designated feature; a decision tree optimization model based on a variable precision rough set is constructed according to each of the designated features in the plurality of training samples, the feature value of each designated feature and the label of each training sample.

[0017] According to a specific implementation method of an embodiment of the present application, the acquisition module is specifically used to: extract the feature value of the first specified feature of the data message to be detected; and / or, within a preset time, count the feature value of the specified feature in the target detection environment, and use the feature value of the specified feature obtained by counting as the feature value of the second specified feature of the data message to be detected.

[0018] According to a specific implementation method of an embodiment of the present application, the device also includes: a preprocessing module, which is used to perform data preprocessing on the data message to be detected after the acquisition module acquires the data message to be detected in the target detection environment and before the acquisition module acquires the feature value of the specified feature of the data message to be detected; a cleaning module, which is used to clean the data message to be detected that has completed data preprocessing; and a notification module, which is used to notify the acquisition module of the cleaned data message to be detected so that the acquisition module obtains the feature value of the specified feature of the data message to be detected.

[0019] According to a specific implementation method of an embodiment of the present application, the model building module is specifically used to: calculate the gain rate of each of the specified features in each training sample, the feature value of each of the specified features and the label of each training sample; use the first specified feature with the largest gain rate among the specified features as the root node of the decision tree; determine the leaf nodes in turn according to the feature value of the first specified feature, the other specified features among the specified features in each training sample except the first specified feature, the feature values ​​of the other specified features and the label of each training sample, so as to construct a decision tree optimization model based on variable precision rough sets.

[0020] According to a specific implementation of the embodiment of the present application, each of the specified features includes a second specified feature; wherein the model building module is specifically used to: calculate the gain rate of the second specified feature according to the second specified feature in each training sample, the feature value of the second specified feature and the label of each training sample;

[0021] The gain rate of the second specified feature is calculated according to the following formula:

[0022]

[0023] in, is the second specified feature, is the gain rate of the second specified characteristic, is the gain of the second specified feature, is a penalty factor for the second specified feature;

[0024]

[0025] in, is the total number of training samples; is the number of samples labeled as malicious in the training samples; is the number of samples labeled as safe in the training samples; For The relevant weights; For The relevant weights; is the number of values ​​of the second specified feature; is greater than or equal to 1 and less than or equal to integer; is the number of the second specified feature in the training sample The number of samples to be taken; The second specified feature The number of samples of the value , the number of samples labeled as malicious; The second specified feature The number of samples of the value , the number of samples with the label safe; For The relevant weights;

[0026]

[0027] in, is the number of values ​​of the second specified feature; is greater than or equal to 1 and less than or equal to integer; is the number of the second specified feature in the training sample The number of samples to be taken; is the total number of training samples; For The relevant weight.

[0028] According to a specific implementation manner of an embodiment of the present application, the specified characteristics include a domain name, characteristics of a domain name request type, a domain name request payload length and / or a request based on a preset protocol.

[0029] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a shell, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the shell, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the detection method of covert channel communication based on a preset protocol as described in any of the aforementioned implementation methods.

[0030] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for detecting covert channel communication based on a preset protocol as described in any of the aforementioned implementation methods.

[0031] The detection method, device, electronic device and readable storage medium of covert channel communication based on a preset protocol in this embodiment collect data packets to be detected in a target detection environment, obtain characteristic values ​​of specified characteristics of the data packets to be detected, and determine whether the data packets to be detected are malicious packets according to the characteristic values ​​and a pre-trained decision tree optimization model based on a variable precision rough set, so as to further determine whether the data packets to be detected are packets for communication through a covert channel based on a preset protocol, and can effectively detect packets for communication through a covert channel based on a preset protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 A schematic diagram of a flow chart of a method for detecting covert channel communication based on a preset protocol provided in an embodiment of the present application;

[0034] Figure 2 A schematic diagram of the structure of a detection device for covert channel communication based on a preset protocol provided in one embodiment of the present application;

[0035] Figure 3 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0036] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings. It should be clear that the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0037] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0038] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection, an electrical connection, or a communication; it can be a direct connection, or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0039] In order to enable those skilled in the art to better understand the technical concept, implementation plan and beneficial effects of the embodiments of the present application, specific embodiments are described in detail below.

[0040] Figure 1A flow chart of a method for detecting covert channel communication based on a preset protocol provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the detection method of covert channel communication based on a preset protocol in this embodiment may include:

[0041] S101, collecting data messages to be detected in a target detection environment.

[0042] The data message to be detected is a data message based on a preset protocol.

[0043] The preset protocol can be any network protocol, specifically DNS protocol, UDP protocol, TCP / IP protocol, FTP protocol, etc.

[0044] A data message is a unit of data exchanged and transmitted in a network. It contains the complete data information to be sent. Its length is very inconsistent, unlimited and variable.

[0045] The target detection environment may be any device capable of communication. In a specific example, the target detection environment may be a flow detection device.

[0046] S102: Obtain a feature value of a specified feature of a data message to be detected.

[0047] The specified feature may be one feature or multiple features. Each specified feature may include one feature value or multiple feature values.

[0048] S103, determining whether the data message to be detected is a malicious message based on the characteristic value and the pre-trained decision tree optimization model based on the variable precision rough set, so as to determine whether the data message to be detected is a message for communication through a covert channel based on a preset protocol.

[0049] Covert channel communication based on preset protocols is to transmit information by utilizing subtle features or uncommon functions in network protocols.

[0050] The decision tree optimization model based on variable precision rough sets is a feature-based hierarchical classification model that can divide the data set into different decision paths for classification.

[0051] The input of the trained decision tree optimization model based on variable precision rough sets is the feature value of the specified feature of the data message to be detected, and the output is information indicating whether the data message to be detected is a threat message.

[0052] In order to construct a decision tree with a relatively simple structure, in one example, the pre-trained decision tree optimization model based on variable precision rough sets in step S103 is obtained according to the following steps:

[0053] S103a, collecting multiple training data messages based on a preset protocol.

[0054] S103b. For each training data message in the plurality of training data messages, obtain a training sample.

[0055] Each training sample includes a feature value of a target feature of a corresponding training data message and a label indicating whether the training data message is a malicious data message.

[0056] The target feature value and label of each training data message is taken as a training sample, so that multiple training data messages correspond to multiple training samples.

[0057] S103c. Calculate the classification accuracy of each designated feature in the multiple training samples according to the multiple training samples and the variable precision rough set model.

[0058] The following specific example illustrates the calculation process of the classification accuracy of a specified feature.

[0059] Define S=(U,A,V,f)as a decision information system, where U is a non-empty finite set of objects, namely the domain; A is a non-empty finite set of attributes; A=C∪D, C is the conditional attribute set, D is the decision attribute set, and C∩D= ; V = ∪ V a is the value range of attribute set A, where ; f = U × A → V is the information function, which assigns an information value to each attribute of each object, that is, a∈A,x∈U,f(x,a)∈V a 。

[0060] Given an information system S = (U, A, V, f), for each subset x U and the equivalence relation R, U / R={Y1, Y2···, Yn}, then define - Most of the inclusion relationships are:

[0061] x -The lower approximation is =∪{Yi|Yi∈U / R:P(Yi,x)≥ }

[0062] x -The upper approximation is =∪{Yi|Yi∈U / R:P(Yi,x)≥1- }

[0063] The bounding domain of x is =∪{Yi|Yi∈U / R:1- ≤P(Yi,x)≤ }

[0064] Where, P(Yi, x) = is the correct classification rate of set Yi into x; Also known as - positive domain, denoted as , is the maximum set of objects that belong to x with a correctness rate not less than x based on existing knowledge.

[0065] In this embodiment, for a given threshold , an equivalence class X of the conditional attributes and an equivalence class Y of the decision attributes, then the approximate classification accuracy is defined as .

[0066] For multiple training samples (decision systems), each sample includes four attributes (conditional attributes) and a label (decision attribute). For example, the four attributes (conditional attributes) include a, b, c and d, and the label (decision attribute) is e. Calculate the equivalence classes of the attributes of the decision system, such as U / a, U / b, U / c, U / d, U / e,

[0067] At a given threshold In the case of , the positive domain and boundary domain of each conditional attribute are calculated, and then the classification accuracy of each conditional attribute is obtained.

[0068] S103d. The designated feature whose classification accuracy is greater than or equal to the preset threshold is taken as the designated feature.

[0069] The specified features whose classification accuracy is less than the preset threshold are deleted from the training samples, thus reducing the number of features for building the decision tree.

[0070] S103e: Construct a decision tree optimization model based on variable precision rough sets according to each designated feature in a plurality of training samples, the feature value of each designated feature, and the label of each training sample.

[0071] In this embodiment, the number of features for constructing a decision tree is reduced, thereby simplifying the structure of the decision tree.

[0072] In the case of determining whether the data message to be detected is a malicious message, it can be further determined whether the data message to be detected is a message that communicates through a covert channel based on a preset protocol. Specifically, in the case of the data message to be detected being a malicious message, the data message to be detected is a message that communicates through a covert channel based on a preset protocol; in the case of the data message to be detected being not a malicious message, the data message to be detected is not a message that communicates through a covert channel based on a preset protocol.

[0073] In the case where it is detected that the data message to be detected is a malicious message, an alarm can be issued to take relevant measures against the malicious message or the website or host that sends the malicious message to improve the security of the target detection environment.

[0074] In this embodiment, data packets to be detected in the target detection environment are collected, and characteristic values ​​of specified characteristics of the data packets to be detected are obtained. According to the characteristic values ​​and a pre-trained decision tree optimization model based on variable precision rough sets, it is determined whether the data packets to be detected are malicious packets, so that it can be further determined whether the data packets to be detected are packets that communicate through a covert channel based on a preset protocol. The packets that communicate through a covert channel based on a preset protocol can be effectively detected, thereby improving the security of the target detection environment. In addition, in this embodiment, in the process of constructing a decision tree optimization model based on variable precision rough sets, the classification accuracy is used to further determine the specified characteristics from the specified characteristics, thereby simplifying the structure of the decision tree.

[0075] The specified feature of the data message to be detected may be an inherent feature of the data message to be detected, or may be a specified feature obtained by statistics of multiple data messages to be detected. In some examples, the feature value of the specified feature of the data message to be detected in step S102 may include:

[0076] S102a. Extract a feature value of a first specified feature of the data message to be detected.

[0077] The data message to be detected includes the first specified feature, so the feature value of the first specified feature can be extracted from the data message to be detected. In a specific example, the first specified feature is the domain name and / or the domain name request payload length.

[0078] As an alternative embodiment, obtaining the feature value of the specified feature of the data message to be detected in step S102 may include:

[0079] S102b. Within a preset time, count the feature value of the designated feature in the target detection environment, and use the feature value of the designated feature obtained by counting as the feature value of the second designated feature of the data message to be detected.

[0080] The characteristic value of the designated feature can be counted for multiple data packets in the target detection environment within a preset time, and the characteristic value of the designated feature obtained by counting the preset time is used as the characteristic value of the second designated feature of the data packet to be detected. If there are multiple data packets to be detected, and they are all transmitted in the target detection environment within the preset time, the characteristic value of the designated feature obtained by counting the statistics can be used as the characteristic value of the designated feature of multiple data packets to be detected.

[0081] In a specific example, the second specified feature may be a feature of a domain name request type and a request based on a preset protocol. For example, the feature of a domain name request type includes TXT records, the number of changes to TXT records per unit time, and / or changes to TXT records per unit time. Requests based on a preset protocol include the number of requests made by a host to a target host per unit time, the frequency of the number of requests in the total request traffic, and / or the mean deviation of requests.

[0082] It can be understood that when there are multiple specified features of the data message to be detected, some of the multiple specified features of the data message to be detected may be inherent features of the data message to be detected, and another part of the specified features may be specified features obtained based on statistics of multiple data messages to be detected. Therefore, in one embodiment, obtaining the feature value of the specified feature of the data message to be detected in step S102 may include:

[0083] S102a. Extract a feature value of a first specified feature of the data message to be detected.

[0084] S102b. Within a preset time, count the feature value of the designated feature in the target detection environment, and use the feature value of the designated feature obtained by counting as the feature value of the second designated feature of the data message to be detected.

[0085] The feature value of the specified feature may be directly obtained for the data message to be detected, or the data message to be detected may be processed and then the feature value of the specified feature may be obtained. In order to improve the accuracy of obtaining the feature value of the specified feature, in some embodiments, after collecting the data message to be detected in the target detection environment and before obtaining the feature value of the specified feature of the data message to be detected, the method of this embodiment may further include:

[0086] S104: Perform data preprocessing on the data message to be detected.

[0087] Data preprocessing of the data packets to be detected may include:

[0088] (1) Data message parsing: Parsing DNS data messages, including field separators, date and time format, resource record type and quantity, authorized resource records and additional resource records, CNAME chains, domain names and query types.

[0089] (2) Missing value processing: Check and process possible missing values, such as empty fields or records that lack necessary information. You can choose to delete missing value records or fill them in based on the context.

[0090] (3) Outlier processing: Identify and process outliers, such as unreasonable IP addresses, abnormal domain name lengths, abnormal query times, etc. Outliers can be detected by setting thresholds or using statistical methods, and processed according to specific circumstances.

[0091] (4) Data type conversion: Convert the fields in the data into appropriate data types as needed. For example, convert the IP address field into a numeric format, convert the date and time field into a unified time format, etc.

[0092] (5) Domain name processing: Process the domain name field. Standardize the domain name: Convert the domain name to a unified format, such as lowercase letters or remove the www prefix. Extract subdomains: Extract subdomain information from the full domain name for more fine-grained analysis. Domain name encoding: Convert the domain name to a numerical or vector representation.

[0093] S105: Clean the data message to be detected that has completed data preprocessing.

[0094] Perform data cleaning operations based on specific needs, such as removing duplicate records, deleting useless fields, processing redundant information, etc.

[0095] S106: For the cleaned data message to be detected, execute the step of obtaining a feature value of a specified feature of the data message to be detected.

[0096] Based on the designated features included in the training samples, a decision tree can be constructed in a variety of ways. For example, in the process of constructing the decision tree from top to bottom, a random feature from the designated features can be used as the current node of the decision tree. However, the decision tree constructed in this way has many paths, resulting in a more complex structure. To further simplify the structure of the decision tree, in some examples, step 103e constructs a decision tree optimization model based on a variable precision rough set according to each of the designated features in the multiple training samples, the feature values ​​of each of the designated features, and the labels of each training sample, including:

[0097] A1. Calculate the gain rate of each designated feature according to each designated feature in each training sample, the feature value of each designated feature and the label of each training sample.

[0098] A2. The first designated feature with the largest gain rate among all designated features is used as the root node of the decision tree.

[0099] A3. According to the feature value of the first specified feature, other specified features in the specified features in each training sample except the first specified feature, the feature values ​​of other specified features and the labels of each training sample, the leaf nodes are determined in sequence to construct a decision tree optimization model based on variable precision rough sets.

[0100] The process of determining the leaf nodes in sequence can be determined using existing technologies, which will not be described in detail here.

[0101] In one embodiment, each designated feature includes a second designated feature; the second designated feature in this embodiment is any one of the designated features.

[0102] In this embodiment, according to each of the designated features in each training sample, the feature value of each of the designated features and the label of each training sample, calculating the gain rate (A1) of each of the designated features may include:

[0103] A10. Calculate the gain rate of the second designated feature according to the second designated feature in each training sample, the feature value of the second designated feature, and the label of each training sample.

[0104] The gain rate of the second specified feature is calculated according to the following formula:

[0105]

[0106] in, is the second specified feature; is the gain rate of the second specified feature; is the gain of the second specified feature; is a penalty factor for the second specified feature;

[0107]

[0108] in, is the total number of training samples; is the number of samples labeled as malicious in the training samples; is the number of samples labeled as safe in the training samples; For The relevant weights; For The relevant weights; is the number of values ​​of the second specified feature; is greater than or equal to 1 and less than or equal to integer; is the number of the second specified feature in the training sample The number of samples to be taken; The second specified feature The number of samples of the value , the number of samples labeled as malicious; The second specified feature The number of samples of the value , the number of samples with the label safe; For The relevant weight.

[0109] The larger the value of The larger the value of; The larger the value of The larger the value of; The larger the value of The larger the value of;

[0110]

[0111] in, is the number of values ​​of the second specified feature; is greater than or equal to 1 and less than or equal to integer; is the number of the second specified feature in the training sample The number of samples to be taken; is the total number of training samples; For The relevant weight.

[0112] and Can be equal or unequal.

[0113] When building a decision tree, you can also use the C4.5 decision tree algorithm.

[0114] In a specific example, the specified characteristics may include a domain name, characteristics of a domain name request type, a domain name request payload length, and / or a request based on a preset protocol.

[0115] The following uses the DNS protocol as an example to illustrate the specific designated features.

[0116] (1) Domain name

[0117] Due to the limitation of DNS domain name length, feature extraction based on domain name characters is a very effective feature. For example, the most common footprint name field format of covert channel domain names is: [63 characters].[63 characters].[63 characters].[53 characters].attack.com. Therefore, a DNS query message can carry up to 242 characters, and each character can have 37 different values. If you want to use the DNS covert channel to transmit arbitrary data, BASE-32 is often used to encode the data to be transmitted so that it meets the requirements of the standard. In order to carry as much data as possible and reduce requests, the subdomains of the DNS covert channel domain name will be abnormal from normal domain names, with three or more subdomains appearing. The characteristic fields are shown in Table 1:

[0118] (2) Characteristics of domain name request types

[0119] Based on the fact that the content of TXT records does not change frequently, and the TXT records of DNS covert channels are changeable, feature extraction of domain name request types can also be used as an important feature, as shown in Table 2.

[0120]

[0121] (3) Domain name request payload length

[0122] In terms of the domain name request payload length, the DNS covert channel payload is also much longer than the ordinary DNS request, as shown in Table 3.

[0123]

[0124] (4) Requests based on preset protocols

[0125] Due to the limited length of DNS covert channel packets, a large number of DNS query request messages will be generated during communication, and its network traffic distribution characteristics are very obvious. The basic DNS covert channel will generate a large amount of DNS query network traffic from the same host during the passage process, as shown in Table 4.

[0126]

[0127] In this embodiment, based on the analysis of the construction method of the network covert channel based on DNS, the characteristic attributes of the network covert channel based on the DNS protocol are summarized as the input conditions for detecting whether there is a message using the covert channel for communication.

[0128] It is to be understood that, for protocols other than the DNS protocol, the specified characteristics may be determined according to the specific protocol used.

[0129] In one embodiment, the specific implementation steps and codes are as follows:

[0130] a) Data input.

[0131] The JSON data file obtained by feature extraction and sorting is used for data input, and pandas is used for vectorization processing to generate a data set that can be used by the model.

[0132] df = pd.read_json(format_dataset_path, orient="records", lines=True)

[0133] dataSet = pd.DataFrame(df, columns=needs)

[0134] dataSetY = pd.DataFrame(df, columns=needsY)

[0135] trainSet, testSet, trainSetY, testSetY = train_test_split(dataSet, dataSetY, test_size=0.2)

[0136] b) Build a decision tree based on the input data.

[0137] clf = tree.DecisionTreeClassifier(criterion="entropy", max_depth=5)

[0138] clf.fit(trainSet, trainSetY)

[0139] pickle.dump(clf, open(model_path, "wb"))

[0140] c) Load the model and test its accuracy

[0141] test = pickle.load(open(model_path, "rb"))

[0142] score = test.score(testSet, testSetY)

[0143] d) Detect the data message to be detected and obtain the judgment result.

[0144] data_set = pd.DataFrame(df, columns=NEEDS)

[0145] labels = self.clf.predict(data_set)

[0146] alerts = df[labels == 1]

[0147] The embodiments of the present application collect data packets to be detected in the target detection environment, obtain the characteristic values ​​of the specified characteristics of the data packets to be detected, and determine whether the data packets to be detected are malicious packets according to the characteristic values ​​and the pre-trained decision tree optimization model based on the variable precision rough set, so as to further determine whether the data packets to be detected are packets that communicate through a covert channel based on a preset protocol. The packets that communicate through a covert channel based on a preset protocol can be effectively detected, thereby improving the security of the target detection environment. In order to construct a decision tree with a relatively simple structure, the classification accuracy of each specified feature can be calculated, and the specified features with a classification accuracy less than a preset threshold can be removed, thereby reducing the number of specified features and simplifying the structure of the decision tree. The specified features of the data packets to be detected can be The inherent features of the data message to be detected can also be designated features obtained by statistics based on multiple data messages to be detected. To this end, the characteristic value of the designated feature is directly extracted from the data message to be detected, and / or the characteristic value of the designated feature is counted in the target detection environment within a preset time, and the characteristic value of the designated feature obtained by statistics is used as the characteristic value of the designated feature of the data message to be detected. In order to improve the accuracy of obtaining the characteristic value of the designated feature, the data message to be detected can be preprocessed, and the data message to be detected that has undergone data preprocessing can be cleaned. For the cleaned data message to be detected, the step of obtaining the characteristic value of the designated feature of the data message to be detected is executed. For the root node of the decision tree, the corresponding formula is used to determine the feature corresponding to the root node from multiple designated features.

[0148] Figure 2 A schematic diagram of the structure of a detection device for covert channel communication based on a preset protocol provided in an embodiment of the present application, such as Figure 2As shown, the detection device of covert channel communication based on preset protocol in this embodiment includes: a collection module 11, which is used to collect data packets to be detected in the target detection environment; wherein the data packets to be detected are data packets based on preset protocol; an acquisition module 12, which is used to obtain the characteristic value of the specified characteristic of the data packets to be detected; a determination module 13, which is used to determine whether the data packets to be detected are malicious packets according to the characteristic value and a pre-trained decision tree optimization model based on variable precision rough set, so as to determine whether the data packets to be detected are packets for communication through covert channels based on preset protocol; and also includes a model construction module, which is used to obtain according to the following steps : Collect multiple training data messages based on a preset protocol; obtain a training sample for each of the multiple training data messages; wherein each training sample includes a feature value of a target feature of the corresponding training data message and a label indicating whether the training data message is a malicious data message; calculate the classification accuracy of each target feature in the multiple training samples based on the multiple training samples and a variable precision rough set model; take the target feature whose classification accuracy is greater than or equal to a preset threshold as a designated feature; construct a decision tree optimization model based on a variable precision rough set according to each of the designated features in the multiple training samples, the feature value of each of the designated features and the label of each training sample.

[0149] The device of this embodiment can be used to perform Figure 1 The technical solution of the method embodiment shown has similar implementation principles and technical effects, which will not be repeated here.

[0150] The device of this embodiment collects data packets to be detected in the target detection environment, obtains the characteristic values ​​of the specified characteristics of the data packets to be detected, and determines whether the data packets to be detected are malicious packets according to the characteristic values ​​and the pre-trained decision tree optimization model based on variable precision rough sets, so as to further determine whether the data packets to be detected are packets that communicate through a covert channel based on a preset protocol. It can effectively detect packets that communicate through a covert channel based on a preset protocol, thereby improving the security of the target detection environment. In addition, in this embodiment, in the process of constructing a decision tree optimization model based on variable precision rough sets, the classification accuracy is used to further determine the specified characteristics from the specified characteristics, thereby simplifying the structure of the decision tree.

[0151] As an optional implementation, the acquisition module is specifically used to: extract the feature value of the first specified feature of the data message to be detected; and / or, within a preset time, count the feature value of the specified feature in the target detection environment, and use the feature value of the specified feature obtained by counting as the feature value of the second specified feature of the data message to be detected.

[0152] As an optional implementation, the device also includes: a preprocessing module, which is used to perform data preprocessing on the data message to be detected after the acquisition module acquires the data message to be detected in the target detection environment and before the acquisition module acquires the feature value of the specified feature of the data message to be detected; a cleaning module, which is used to clean the data message to be detected that has completed the data preprocessing; and a notification module, which is used to notify the acquisition module of the cleaned data message to be detected so that the acquisition module acquires the feature value of the specified feature of the data message to be detected.

[0153] As an optional implementation, the model building module is specifically used to: calculate the gain rate of each of the designated features in each training sample, the feature value of each of the designated features and the label of each training sample; use the first designated feature with the largest gain rate among the designated features as the root node of the decision tree; determine the leaf nodes in turn according to the feature value of the first designated feature, other designated features among the designated features in each training sample except the first designated feature, the feature values ​​of other designated features and the label of each training sample, so as to construct a decision tree optimization model based on variable precision rough sets.

[0154] As an optional implementation, each of the specified features includes a second specified feature; wherein the model building module is specifically used to: calculate the gain rate of the second specified feature according to the second specified feature in each training sample, the feature value of the second specified feature and the label of each training sample;

[0155] The gain rate of the second specified feature is calculated according to the following formula:

[0156]

[0157] in, is the second specified feature, is the gain rate of the second specified characteristic, is the gain of the second specified feature, is a penalty factor for the second specified feature;

[0158]

[0159] in, is the total number of training samples; is the number of samples labeled as malicious in the training samples; is the number of samples labeled as safe in the training samples; For The relevant weights; For The relevant weights; is the number of values ​​of the second specified feature, is greater than or equal to 1 and less than or equal to integer; is the number of the second specified feature in the training sample The number of samples to be taken; The second specified feature The number of samples of the value , the number of samples labeled as malicious; The second specified feature The number of samples of the value , the number of samples with the label safe; For The relevant weights;

[0160]

[0161] in, is the number of the second specified feature in the training sample The number of samples to be taken; is the total number of training samples; For The relevant weight.

[0162] As an optional implementation, the specified features include a domain name, features of a domain name request type, a domain name request payload length, and / or a request based on a preset protocol.

[0163] The device of the above embodiment can be used to execute the technical solution of the above method embodiment. Its implementation principle and technical effect are similar and will not be repeated here.

[0164] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 3 As shown, it may include: a shell 61, a processor 62, a memory 63, a circuit board 64 and a power supply circuit 65, wherein the circuit board 64 is arranged inside the space enclosed by the shell 61, and the processor 62 and the memory 63 are arranged on the circuit board 64; the power supply circuit 65 is used to supply power to various circuits or devices of the above-mentioned electronic equipment; the memory 63 is used to store executable program codes; the processor 62 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 63, so as to execute any one of the detection methods for covert channel communication based on the preset protocol provided in the aforementioned embodiments, and thus can also achieve corresponding beneficial technical effects, which have been described in detail in the previous text and will not be repeated here.

[0165] The above electronic devices exist in many forms, including but not limited to:

[0166] (1) Mobile communication devices: These devices are characterized by their mobile communication functions and their main purpose is to provide voice and data communications. These terminals include: smart phones (such as iPhone), multimedia phones, feature phones, and low-end phones.

[0167] (2) Ultra-mobile personal computer devices: These devices fall into the category of personal computers and have computing and processing capabilities, and generally also have mobile Internet access features. These terminals include: PDAs, MIDs, and UMPC devices, such as the iPad.

[0168] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

[0169] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general-purpose computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0170] (5) Other electronic devices with data interaction functions.

[0171] Correspondingly, an embodiment of the present application also provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement any of the detection methods for covert channel communications based on a preset protocol provided in the aforementioned embodiments, thereby also being able to achieve the corresponding technical effects, which have been described in detail above and will not be repeated here.

[0172] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0173] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0174] In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0175] For the convenience of description, the above device is described by dividing the functions into various units / modules. Of course, when implementing the present application, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.

[0176] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0177] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for detecting covert channel communication based on a preset protocol, characterized in that: include: Collecting data packets to be detected in the target detection environment; wherein the data packets to be detected are data packets based on a preset protocol; Extracting a feature value of a first specified feature of the data message to be detected; and / or, within a preset time, counting the feature value of a specified feature in a target detection environment, and using the feature value of the specified feature obtained by counting as the feature value of a second specified feature of the data message to be detected; Determine whether the data message to be detected is a malicious message according to the characteristic value and a pre-trained decision tree optimization model based on a variable precision rough set, so as to determine whether the data message to be detected is a message for communication through a covert channel based on a preset protocol; The pre-trained decision tree optimization model based on variable precision rough sets is obtained according to the following steps: Collect multiple training data messages based on a preset protocol; For each of the plurality of training data messages, a training sample is obtained; wherein each training sample includes a feature value of a target feature of the training data message corresponding to itself and a label indicating whether the training data message is a malicious data message; According to multiple training samples and a variable precision rough set model, the classification accuracy of each target feature in the multiple training samples is calculated; The target feature whose classification accuracy is greater than or equal to the preset threshold is taken as the designated feature; Calculating the gain rate of each of the specified features according to each of the specified features in each of the training samples, the feature values ​​of each of the specified features, and the labels of each of the training samples; The first designated feature with the largest gain rate among the designated features is used as the root node of the decision tree; According to the feature value of the first specified feature, other specified features among the specified features in each training sample except the first specified feature, the feature values ​​of other specified features and the labels of each training sample, leaf nodes are determined in sequence to construct a decision tree optimization model based on variable precision rough sets.

2. The method according to claim 1, characterized in that: After collecting the data packets to be detected in the target detection environment and before obtaining the feature value of the specified feature of the data packets to be detected, the method further includes: Performing data preprocessing on the data message to be detected; Cleaning the data message to be detected after the data preprocessing; For the cleaned data message to be detected, the step of obtaining a feature value of a specified feature of the data message to be detected is performed.

3. The method according to claim 1, characterized in that each of the specified characteristics includes a second specified characteristic; The step of calculating the gain rate of each designated feature according to each designated feature in each training sample, the feature value of each designated feature and the label of each training sample includes: Calculating a gain rate of the second specified feature according to the second specified feature in each training sample, a feature value of the second specified feature, and a label of each training sample; The gain rate of the second specified feature is calculated according to the following formula: ； in, is the second specified feature, is the gain rate of the second specified characteristic, is the gain of the second specified feature, is a penalty factor for the second specified feature; ； in, is the total number of training samples; is the number of samples labeled as malicious in the training samples; is the number of samples labeled as safe in the training samples; For The relevant weights; For The relevant weights; is the number of values ​​of the second specified feature; is greater than or equal to 1 and less than or equal to integer; is the number of the second specified feature in the training sample The number of samples to be taken; The second specified feature The number of samples of the value , the number of samples labeled as malicious; The second specified feature The number of samples of the value , the number of samples with the label safe; For The relevant weights; ； in, is the number of values ​​of the second specified feature; is greater than or equal to 1 and less than or equal to integer; is the number of the second specified feature in the training sample The number of samples to be taken; is the total number of training samples; For The relevant weight.

4. The method according to claim 1, characterized in that: The specified characteristics include a domain name, characteristics of a domain name request type, a domain name request payload length, and / or a request based on a preset protocol.

5. A detection device for covert channel communication based on a preset protocol, characterized in that: include: A collection module, used for collecting data packets to be detected in a target detection environment; wherein the data packets to be detected are data packets based on a preset protocol; an acquisition module, used to extract a feature value of a first specified feature of the data message to be detected; and / or, within a preset time, count the feature values ​​of the specified feature in the target detection environment, and use the feature value of the specified feature obtained by counting as the feature value of the second specified feature of the data message to be detected; A determination module, used to determine whether the data message to be detected is a malicious message according to the characteristic value and a pre-trained decision tree optimization model based on a variable precision rough set, so as to determine whether the data message to be detected is a message for communication through a covert channel based on a preset protocol; It also includes a model building module, which is used to obtain a decision tree optimization model based on variable precision rough sets according to the following steps: Collect multiple training data messages based on a preset protocol; For each of the plurality of training data messages, a training sample is obtained; wherein each training sample includes a feature value of a target feature of the training data message corresponding to itself and a label indicating whether the training data message is a malicious data message; According to multiple training samples and a variable precision rough set model, the classification accuracy of each target feature in the multiple training samples is calculated; The target feature whose classification accuracy is greater than or equal to the preset threshold is taken as the designated feature; Calculating the gain rate of each of the specified features according to each of the specified features in each of the training samples, the feature values ​​of each of the specified features, and the labels of each of the training samples; The first designated feature with the largest gain rate among the designated features is used as the root node of the decision tree; According to the feature value of the first specified feature, other specified features among the specified features in each training sample except the first specified feature, the feature values ​​of other specified features and the labels of each training sample, leaf nodes are determined in sequence to construct a decision tree optimization model based on variable precision rough sets.

6. An electronic device, characterized in that: The electronic device comprises: a housing, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method described in any one of the preceding claims 1-4.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method according to any one of claims 1 to 4.

Images