High-concealment attack detection method based on irregular pulse signal flow mode

Abstract

The invention discloses a high-concealment attack detection method based on an irregular pulse signal flow mode, and belongs to the technical field of network security. In order to solve the problem of high-concealment attack detection in a traffic mode, the method comprises the following steps: dividing destination IP addresses into a white list, a black list and a grey list according to IP address security conditions; for the IP addresses in the grey list set, forming an access flow statistical sequence one by one according to a fixed period; carrying out analysis and calculation by referring to the pulse signal, and calculating a pulse state in the access traffic statistical sequence; setting a matching condition of the non-hidden attack detection model, and if the non-hidden attack is judged, dividing the corresponding IP address into a white list set; calculating a pulse state in the access traffic statistical sequence; setting a hidden attack detection model matching condition, and if a hidden attack is judged, dividing a corresponding IP address into a blacklist set; and setting a triggering detection model data exception condition. The method is used for high-concealment attack detection in the traffic mode.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a highly concealed attack detection method based on irregular pulse signal flow patterns. Background Art

[0002] With the rapid development of network technology, network attacks have become more diverse, and highly complex network attacks continue to emerge. Attackers will lurk for a long time and gradually penetrate into the target network to steal sensitive information, destroy information facilities, or create other malicious activities. This type of attack is highly concealed. Attackers may exist in the target network for a long time without being detected. They will use advanced technical means to move laterally within the network, penetrate deeper systems and data, and use masking methods such as unknown vulnerabilities and customized malware to break through existing monitoring methods, making monitoring and detection difficult.

[0003] The Internet entry and exit IP addresses of general units are relatively fixed, and the attack traffic is hidden in the normal Internet access traffic. Identifying network attack traffic in normal traffic has always been a research hotspot in the field of network security. The current network attack traffic detection method is mainly used to detect large-volume attacks such as DDoS attacks to clean up the attack traffic and ensure normal access to the website, but this method cannot be applied to highly concealed attacks. Highly concealed attacks are often highly planned, generally including intelligence collection, attack detection, attack execution, post-penetration attack, and cleanup of traces. In order to evade detection, attacks are often not carried out continuously between different stages or within the same stage, but are carried out intermittently, thereby presenting the characteristics of irregular pulse signals in traffic characteristics. Highly concealed attacks are often aimed at stealing high-value data or destroying information facilities, and the attack traffic is relatively small. Summary of the invention

[0004] The problem to be solved by the present invention is the problem of high-concealment attack detection of traffic patterns, and a high-concealment attack detection method based on irregular pulse signal traffic patterns is proposed.

[0005] To achieve the above object, the present invention is implemented through the following technical solutions:

[0006] A highly concealed attack detection method based on irregular pulse signal traffic patterns comprises the following steps:

[0007] Step 1. Divide the destination IP addresses into whitelist, blacklist and greylist according to the IP address security situation, forming a whitelist set SWIP, a blacklist set SBIP and a greylist set SGIP of the destination IP addresses;

[0008] Step 2. For the IP addresses in the gray list set obtained in step 1, a statistical sequence of access traffic is formed one by one at a fixed period;

[0009] Step 3. Analyze and calculate the access traffic statistics sequence obtained in step 2 with reference to the pulse signal, and calculate the pulse state in the access traffic statistics sequence;

[0010] Step 4. Set the pulse width set to SPW, the duty cycle set to SDC, and clear SPW and SDC;

[0011] Step 5. Set the non-covert attack detection model matching condition, and determine whether the pulse state in the access traffic statistics sequence obtained in step 3 meets the non-covert attack detection model matching condition. If it is a non-covert attack, the corresponding IP address is classified into the whitelist set and returns to step 2. If it is not, proceed to the next step;

[0012] Step 6. Calculate the pulse state in the access traffic statistics sequence obtained in step 3, construct the pulse width set SPW and calculate the standard deviation S of SPW SPW , construct the duty cycle set SDC and calculate the standard deviation S of SDC SDC , and get the calculation result;

[0013] Step 7. Set the covert attack detection model matching condition, and determine whether the covert attack detection model matching condition is met based on the calculation result obtained in step 6. If it is a covert attack, the corresponding IP address is classified into the blacklist set and returns to step 2. If it is not, proceed to the next step;

[0014] Step 8. Set the trigger detection model data abnormality conditions. If the trigger detection model data abnormality conditions are met, return to step 4. If not, return to step 6 until the detection is completed.

[0015] Furthermore, in step 1, the whitelist refers to trusted access targets, the blacklist refers to access targets that are confirmed to be malicious, and the graylist refers to access targets that are neither in the whitelist nor in the blacklist.

[0016] Furthermore, in step 2, the access traffic statistics of the IP addresses in the gray list set SGIP are recorded one by one according to a fixed cycle cycle, and the fixed cycle cycle is set to 1 hour or 1 day to form an access traffic statistics sequence LF, LF = (flow1, flow2, ... flow i ...flow n ), flow i is the cumulative flow rate in the i-th fixed cycle.

[0017] Furthermore, the method for analyzing and calculating the pulse signal in step 3 is:

[0018] Set the low level to 0bps and the high level to greater than 0bps;

[0019] A pulse state is a complete alternation process of high level and low level. The pulse width pw is set to the number of fixed cycles of high level in the pulse state. The working cycle dc is the sum of the number of fixed cycles of high level and low level in the pulse state. The expression is:

[0020] pw=∑flow i High level

[0021] dc=pw+∑flow i is low level.

[0022] Furthermore, in step 4, SPW={}, SDC={}.

[0023] Furthermore, in step 5, the matching condition of the non-covert attack detection model is set to set the pulse state coefficient to k. If the high level is maintained for k consecutive fixed cycles, it is determined to be a non-covert attack.

[0024] Furthermore, the specific method for calculating the pulse state in step 6 is:

[0025] Step 6.1. Calculate the pulse width of the pulse state to form a pulse width set SPW, expressed as:

[0026] SPW={pw1,pw2,...pw i ...pw n};

[0027] Step 6.2. Calculate the SPW standard deviation S SPW , the calculation expression is:

[0028]

[0029] in, is the average value of the pulse width;

[0030] Step 6.3. Calculate the duty cycle of the pulse signal in the pulse state to form a duty cycle set SDC, which is expressed as:

[0031] SDC={dc1,dc2,...dc i ...dc n}

[0032] Step 6.4. Calculate the SDC standard deviation S SDC , the calculation expression is:

[0033]

[0034] in, is the average value of the working cycle.

[0035] Furthermore, in step 7, the matching conditions of the covert attack detection model are set as follows:

[0036] Set the minimum standard deviation of SPW to MIN SPW , the maximum value is MAX SPW , the minimum standard deviation of SDC is MIN SDC , the maximum value is MAX SDC , the minimum cardinality of set SPW and set SDC is MIN n , the maximum value is MAX n , if MIN SPW ≤S SPW ≤MAX SPW And MIN SDC≤ S SDC ≤MAX SDC And MIN n ≤n≤MAX n , it is determined that a covert attack is discovered.

[0037] Furthermore, in step 8, the trigger detection model data anomaly conditions are set as follows:

[0038] Assume the pulse width factor is q, the duty cycle factor is w, if or Or n>MAX n , determine whether the data anomaly conditions of the trigger detection model are met.

[0039] Beneficial effects of the present invention:

[0040] The highly concealed attack detection method based on irregular pulse signal traffic patterns described in the present invention focuses on the traffic characteristics of highly concealed attacks, solves the problem of highly concealed attack detection based on traffic patterns, and improves the detection capability of network security products. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 The present invention is a flowchart of a highly concealed attack detection method based on irregular pulse signal traffic patterns. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the present invention more clear, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention, that is, the specific embodiments described are only part of the embodiments of the present invention, rather than all of the specific embodiments. The components of the specific embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations, and the present invention can also have other embodiments.

[0043] Therefore, the following detailed description of the specific embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents the selected specific embodiments of the present invention. Based on the specific embodiments of the present invention, all other specific embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0044] In order to further understand the content, features and effects of the present invention, the following specific implementation methods are given as examples, and the attached Figure 1 The detailed instructions are as follows:

[0045] Embodiment 1:

[0046] A highly concealed attack detection method based on irregular pulse signal traffic patterns comprises the following steps:

[0047] Step 1. Divide the destination IP addresses into whitelist, blacklist and greylist according to the IP address security situation, forming a whitelist set SWIP, a blacklist set SBIP and a greylist set SGIP of the destination IP addresses;

[0048] Furthermore, in step 1, the whitelist refers to trusted access targets, the blacklist refers to access targets that are confirmed to be malicious, and the graylist refers to access targets that are neither in the whitelist nor in the blacklist;

[0049] Step 2. For the IP addresses in the gray list set obtained in step 1, a statistical sequence of access traffic is formed one by one at a fixed period;

[0050] Furthermore, in step 2, the access traffic statistics of the IP addresses in the gray list set SGIP are recorded one by one according to a fixed cycle cycle, and the fixed cycle cycle is set to 1 hour or 1 day to form an access traffic statistics sequence LF, LF = (flow1, flow2, ... flow i ...flow n ), flow i is the cumulative flow in the i-th fixed cycle;

[0051] Step 3. Analyze and calculate the access traffic statistics sequence obtained in step 2 with reference to the pulse signal, and calculate the pulse state in the access traffic statistics sequence;

[0052] Furthermore, the method for analyzing and calculating the pulse signal in step 3 is:

[0053] Set the low level to 0bps and the high level to greater than 0bps;

[0054] A pulse state is a complete alternation process of high level and low level. The pulse width pw is set to the number of fixed cycles of high level in the pulse state. The working cycle dc is the sum of the number of fixed cycles of high level and low level in the pulse state. The expression is:

[0055] pw=Σflow i High level

[0056] dc=pw+Σflow i is low level.

[0057] Step 4. Set the pulse width set to SPW, the duty cycle set to SDC, and clear SPW and SDC;

[0058] Furthermore, in step 4, SPW={}, SDC={}.

[0059] Step 5. Set the non-covert attack detection model matching condition, and determine whether the pulse state in the access traffic statistics sequence obtained in step 3 meets the non-covert attack detection model matching condition. If it is a non-covert attack, the corresponding IP address is classified into the whitelist set and returns to step 2. If it is not, proceed to the next step;

[0060] Furthermore, in step 5, the matching condition of the non-covert attack detection model is set to set the pulse state coefficient to k. If the high level is maintained for k consecutive fixed cycles, it is determined to be a non-covert attack.

[0061] Step 6. Calculate the pulse state in the access traffic statistics sequence obtained in step 3, construct the pulse width set SPW and calculate the standard deviation S of SPW SPW , construct the duty cycle set SDC and calculate the standard deviation S of SDC SDC , and get the calculation result;

[0062] Furthermore, the specific method for calculating the pulse state in step 6 is:

[0063] Step 6.1. Calculate the pulse width of the pulse state to form a pulse width set SPW, expressed as:

[0064] SPW={pw1,pw2,...pw i ...pw n};

[0065] Step 6.2. Calculate the SPW standard deviation S SPW , the calculation expression is:

[0066]

[0067] in, is the average value of the pulse width;

[0068] Step 6.3. Calculate the duty cycle of the pulse signal in the pulse state to form a duty cycle set SDC, which is expressed as:

[0069] SDC={dc1,dc2,...dc i ...dc n}

[0070] Step 6.4. Calculate the SDC standard deviation S SDC , the calculation expression is:

[0071]

[0072] in, is the average value of the working cycle.

[0073] Step 7. Set the covert attack detection model matching condition, and determine whether the covert attack detection model matching condition is met based on the calculation result obtained in step 6. If it is a covert attack, the corresponding IP address is classified into the blacklist set and returns to step 2. If it is not, proceed to the next step;

[0074] Furthermore, in step 7, the matching conditions of the covert attack detection model are set as follows:

[0075] Set the minimum standard deviation of SPW to MIN SPW , the maximum value is MAX SPW , the minimum standard deviation of SDC is MIN SDC , the maximum value is MAX SDC , the minimum cardinality of set SPW and set SDC is MIN n , the maximum value is MAX n , if MIN SPW ≤S SPW ≤MAX SPW And MIN SDC≤ S SDC ≤MAX SDC And MIN n ≤n≤MAX n , it is determined that a covert attack is discovered.

[0076] Step 8. Set the trigger detection model data abnormality conditions. If the trigger detection model data abnormality conditions are met, return to step 4. If not, return to step 6 until the detection is completed.

[0077] Furthermore, in step 8, the trigger detection model data anomaly conditions are set as follows:

[0078] Assume the pulse width factor is q, the duty cycle factor is w, if or Or n>MAX n , determine whether the data anomaly conditions of the trigger detection model are met.

[0079] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0080] Although the present application has been described above with reference to specific embodiments, various modifications may be made thereto and parts thereof may be replaced with equivalents without departing from the scope of the present application. In particular, as long as there is no structural conflict, the various features in the specific embodiments disclosed in the present application may be used in combination with each other in any manner, and the fact that these combinations are not exhaustively described in this specification is only for the sake of omitting space and saving resources. Therefore, the present application is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A highly concealed attack detection method based on irregular pulse signal traffic pattern, characterized in that: The steps include: Step 1. Divide the destination IP addresses into whitelist, blacklist and greylist according to the IP address security situation, forming a whitelist set SWIP, a blacklist set SBIP and a greylist set SGIP of the destination IP addresses; Step 2. For the IP addresses in the gray list set obtained in step 1, a statistical sequence of access traffic is formed one by one at a fixed period; Step 3. Analyze and calculate the access traffic statistics sequence obtained in step 2 with reference to the pulse signal, and calculate the pulse state in the access traffic statistics sequence; Step 4. Set the pulse width set to SPW, the duty cycle set to SDC, and clear SPW and SDC; Step 5. Set the non-covert attack detection model matching condition, and determine whether the pulse state in the access traffic statistics sequence obtained in step 3 meets the non-covert attack detection model matching condition. If it is a non-covert attack, the corresponding IP address is classified into the whitelist set and returns to step 2. If it is not, proceed to the next step; Step 6. Calculate the pulse state in the access traffic statistics sequence obtained in step 3, construct the pulse width set SPW and calculate the standard deviation S of SPW SPW , construct the duty cycle set SDC and calculate the standard deviation S of SDC SDC , and get the calculation result; Step 7. Set the covert attack detection model matching condition, and determine whether the covert attack detection model matching condition is met based on the calculation result obtained in step 6. If it is a covert attack, the corresponding IP address is classified into the blacklist set and returns to step 2. If it is not, proceed to the next step; Step 8. Set the trigger detection model data abnormality conditions. If the trigger detection model data abnormality conditions are met, return to step 4. If not, return to step 6 until the detection is completed.

2. According to claim 1, a highly concealed attack detection method based on irregular pulse signal traffic pattern is characterized in that: In step 1, the whitelist refers to trusted access targets, the blacklist refers to access targets that are confirmed to be malicious, and the graylist refers to access targets that are neither in the whitelist nor in the blacklist.

3. A highly concealed attack detection method based on irregular pulse signal traffic pattern according to claim 2, characterized in that: In step 2, the access traffic statistics of the IP addresses in the gray list set SGIP are recorded one by one according to the fixed cycle cycle, and the fixed cycle cycle is set to 1 hour or 1 day to form an access traffic statistics sequence LF, LF = (flow1, flow2, ... flow i ...flow n ), flow i is the cumulative flow rate in the i-th fixed cycle.

4. According to claim 3, a highly concealed attack detection method based on irregular pulse signal traffic pattern is characterized in that: The method for analyzing and calculating the pulse signal in step 3 is: Set the low level to 0bps and the high level to greater than 0bps; A pulse state is a complete alternation process of high level and low level. The pulse width pw is set to the number of fixed cycles of high level in the pulse state. The working cycle dc is the sum of the number of fixed cycles of high level and low level in the pulse state. The expression is: pw=Σflow i High level dc=pw+∑flow i is low level.

5. A highly concealed attack detection method based on irregular pulse signal traffic pattern according to claim 4, characterized in that: In step 4, SPW={}, SDC={}.

6. A highly concealed attack detection method based on irregular pulse signal traffic pattern according to claim 5, characterized in that: In step 5, the matching condition of the non-covert attack detection model is set to set the pulse state coefficient to k. If the high level is maintained for k consecutive fixed cycles, it is determined to be a non-covert attack.

7. A highly concealed attack detection method based on irregular pulse signal traffic pattern according to claim 6, characterized in that: The specific method for pulse state calculation in step 6 is: Step 6.

1. Calculate the pulse width of the pulse state to form a pulse width set SPW, expressed as: SPW={pw1,pw2,...pw i ...pw n }; Step 6.

2. Calculate the SPW standard deviation S SPW , the calculation expression is: in, is the average value of the pulse width; Step 6.

3. Calculate the duty cycle of the pulse signal in the pulse state to form a duty cycle set SDC, which is expressed as: SDC={dc1,dc2,...dc i ...dc n } Step 6.

4. Calculate the SDC standard deviation S SDC , the calculation expression is: in, is the average value of the working cycle.

8. A highly concealed attack detection method based on irregular pulse signal traffic pattern according to claim 7, characterized in that: In step 7, the matching conditions of the covert attack detection model are set as follows: Set the minimum standard deviation of SPW to MIN SPW , the maximum value is MAX SPW , the minimum standard deviation of SDC is MIN SDC , the maximum value is MAX SDC , the minimum cardinality of set SPW and set SDC is MIN n , the maximum value is MAX n , If MIN SPW ≤S SPW ≤MAX SPW And MIN SDC≤ S SDC ≤MAX SDC And MIN n ≤n≤MAX n , it is determined that a covert attack is discovered.

9. A highly concealed attack detection method based on irregular pulse signal traffic pattern according to claim 8, characterized in that: In step 8, the trigger detection model data anomaly conditions are set as follows: Assume the pulse width factor is q, the duty cycle factor is w, if or Or n>MAX n , determine whether the data anomaly conditions of the trigger detection model are met.

Images