A highly concealed attack detection method based on irregular pulse signal traffic patterns

Abstract

A highly concealed attack detection method based on irregular pulse signal traffic patterns belongs to the field of network security technology. To solve the problem of highly concealed attack detection in traffic patterns, the present invention includes dividing the destination IP address into a whitelist, a blacklist, and a graylist according to the security status of the IP address; forming an access traffic statistical sequence for each IP address in the graylist set at a fixed period; analyzing and calculating with reference to the pulse signal to calculate the pulse state in the access traffic statistical sequence; setting a non-covert attack detection model matching condition, and if it is determined to be a non-covert attack, the corresponding IP address is divided into a whitelist set; calculating the pulse state in the access traffic statistical sequence; setting a covert attack detection model matching condition, and if it is determined to be a covert attack, the corresponding IP address is divided into a blacklist set; and setting a trigger detection model data abnormality condition. The present invention is used for highly concealed attack detection in traffic patterns.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a highly concealed attack detection method based on irregular pulse signal traffic patterns. Background Art

[0002] With the rapid development of network technology, cyberattacks are becoming increasingly diverse. Highly complex attacks are constantly emerging, with attackers lurking for extended periods and gradually penetrating target networks to steal sensitive information, damage information infrastructure, or engage in other malicious activities. These attacks are highly covert, allowing attackers to remain undetected for extended periods within target networks. They utilize advanced techniques to move laterally within the network, infiltrating deeper systems and data. They employ covert tactics such as exploiting unknown vulnerabilities and custom malware to circumvent existing detection methods, making them challenging to detect.

[0003] The internet entry and exit IP addresses of most organizations are relatively fixed, and attack traffic is often hidden within normal internet traffic. Identifying network attack traffic from normal traffic has long been a research hotspot in the field of network security. Current network attack traffic detection methods are primarily used to detect high-volume attacks, primarily DDoS attacks, to eliminate attack traffic and ensure normal website access. However, these methods are inapplicable to highly stealthy attacks. Highly stealthy attacks are often highly planned, typically consisting of intelligence gathering, attack detection, attack execution, post-exploitation, and cleanup. To evade detection, attacks are often carried out intermittently, not continuously between or within each stage, resulting in irregular pulses in traffic characteristics. Highly stealthy attacks often aim to steal high-value data or damage information infrastructure, and their attack traffic is relatively small. Summary of the Invention

[0004] The problem to be solved by the present invention is the problem of highly concealed attack detection in traffic patterns, and a highly concealed attack detection method based on irregular pulse signal traffic patterns is proposed.

[0005] To achieve the above object, the present invention is implemented through the following technical solutions:

[0006] A highly concealed attack detection method based on irregular pulse signal traffic patterns comprises the following steps:

[0007] Step 1. Divide the destination IP addresses into whitelist, blacklist, and graylist according to the IP address security status, forming a whitelist set SWIP, a blacklist set SBIP, and a graylist set SGIP for the destination IP addresses;

[0008] Step 2. For each IP address in the gray list obtained in step 1, generate an access traffic statistics sequence at a fixed period.

[0009] Step 3. Analyze and calculate the access traffic statistics sequence obtained in step 2 with reference to the pulse signal to calculate the pulse state in the access traffic statistics sequence;

[0010] Step 4. Set the pulse width set to SPW, the duty cycle set to SDC, and clear SPW and SDC;

[0011] Step 5. Set the matching conditions for the non-covert attack detection model and determine whether the pulse state in the access traffic statistics sequence obtained in Step 3 meets the matching conditions for the non-covert attack detection model. If it is a non-covert attack, the corresponding IP address is assigned to the whitelist and the process returns to Step 2. If not, proceed to the next step.

[0012] Step 6. Calculate the pulse state in the access traffic statistics sequence obtained in step 3, construct the pulse width set SPW and calculate the standard deviation S of SPW SPW , construct the duty cycle set SDC and calculate the standard deviation S of SDC SDC , get the calculation result;

[0013] Step 7. Set the covert attack detection model matching conditions. Based on the calculation results obtained in step 6, determine whether the covert attack detection model matching conditions are met. If it is a covert attack, the corresponding IP address is assigned to the blacklist set and the process returns to step 2. If not, proceed to the next step.

[0014] Step 8. Set the trigger detection model data abnormality conditions. If the trigger detection model data abnormality conditions are met, return to step 4. If not, return to step 6 until the detection is completed.

[0015] Furthermore, in step 1, the whitelist refers to trusted access targets, the blacklist refers to access targets that are confirmed to be malicious, and the graylist refers to access targets that are neither in the whitelist nor in the blacklist.

[0016] Furthermore, in step 2, the access traffic statistics of the IP addresses in the gray list set SGIP are recorded one by one according to a fixed cycle cycle, and the fixed cycle cycle is set to 1 hour or 1 day to form an access traffic statistics sequence LF, LF = (flow1, flow2, ... flow i ...flow n ), flow i is the cumulative flow rate in the i-th fixed cycle.

[0017] Furthermore, the method for analyzing and calculating the pulse signal in step 3 is:

[0018] Set the low level to 0bps and the high level to greater than 0bps;

[0019] A pulse state is a complete alternation process of high level and low level. The pulse width pw is set to the number of fixed cycles of high level in the pulse state. The working cycle dc is the sum of the number of fixed cycles of high level and low level in the pulse state. The expression is:

[0020] pw=∑flow i High level

[0021] dc=pw+∑flow i is low level.

[0022] Furthermore, in step 4, SPW={}, SDC={}.

[0023] Furthermore, in step 5, the matching condition of the non-covert attack detection model is set to set the pulse state coefficient to k. If the high level is maintained for k consecutive fixed cycles, it is determined to be a non-covert attack.

[0024] Furthermore, the specific method for calculating the pulse state in step 6 is:

[0025] Step 6.1. Calculate the pulse width of the pulse state to form a pulse width set SPW, which is expressed as:

[0026] SPW={pw1,pw2,...pw i ...pw n};

[0027] Step 6.2. Calculate the SPW standard deviation S of the set SPW , the calculation expression is:

[0028]

[0029] in, is the average value of the pulse width;

[0030] Step 6.3. Calculate the duty cycle of the pulse signal in the pulse state to form the duty cycle set SDC, which is expressed as:

[0031] SDC={dc1,dc2,...dc i ...dc n}

[0032] Step 6.4. Calculate the SDC standard deviation S SDC , the calculation expression is:

[0033]

[0034] in, is the average value of the working cycle.

[0035] Furthermore, in step 7, the matching conditions of the covert attack detection model are set as follows:

[0036] Set the minimum standard deviation of SPW to MIN SPW , the maximum value is MAX SPW , the minimum standard deviation of SDC is MIN SDC , the maximum value is MAX SDC , the minimum cardinality of set SPW and set SDC is MIN n , the maximum value is MAX n , if MIN SPW ≤S SPW ≤MAX SPW And MIN SDC≤ S SDC ≤MAX SDC And MIN n ≤n≤MAX n , it is determined that a covert attack is discovered.

[0037] Furthermore, in step 8, the trigger detection model data anomaly conditions are set as follows:

[0038] Assume the pulse width coefficient is q, the duty cycle coefficient is w, if or Or n>MAX n , determine whether the data anomaly conditions of the trigger detection model are met.

[0039] Beneficial effects of the present invention:

[0040] The present invention provides a highly concealed attack detection method based on irregular pulse signal traffic patterns, focusing on the traffic characteristics of highly concealed attacks, solving the problem of highly concealed attack detection based on traffic patterns, and improving the detection capabilities of network security products. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a flow chart of a highly concealed attack detection method based on irregular pulse signal traffic patterns described in the present invention. DETAILED DESCRIPTION

[0042] In order to make the objectives, technical solutions, and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present invention and are not intended to limit the present invention. That is, the specific embodiments described herein are only some embodiments of the present invention, not all embodiments. Generally, the components of the specific embodiments of the present invention described and illustrated in the drawings herein can be arranged and designed in various different configurations, and the present invention can also have other embodiments.

[0043] Therefore, the following detailed description of the specific embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but is merely representative of selected specific embodiments of the present invention. All other specific embodiments obtained by those skilled in the art based on the specific embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0044] In order to further understand the content, features and effects of the present invention, the following specific embodiments are given as examples, and the attached Figure 1 The detailed instructions are as follows:

[0045] Example 1:

[0046] A highly concealed attack detection method based on irregular pulse signal traffic patterns comprises the following steps:

[0047] Step 1. Divide the destination IP addresses into whitelist, blacklist, and graylist according to the IP address security status, forming a whitelist set SWIP, a blacklist set SBIP, and a graylist set SGIP for the destination IP addresses;

[0048] Furthermore, in step 1, the whitelist refers to trusted access targets, the blacklist refers to access targets that are confirmed to be malicious, and the graylist refers to access targets that are neither in the whitelist nor in the blacklist;

[0049] Step 2. For each IP address in the gray list obtained in step 1, generate an access traffic statistics sequence at a fixed period.

[0050] Furthermore, in step 2, the access traffic statistics of the IP addresses in the gray list set SGIP are recorded one by one according to a fixed cycle cycle, and the fixed cycle cycle is set to 1 hour or 1 day to form an access traffic statistics sequence LF, LF = (flow1, flow2, ... flow i ...flow n ), flow i is the cumulative flow in the i-th fixed cycle;

[0051] Step 3. Analyze and calculate the access traffic statistics sequence obtained in step 2 with reference to the pulse signal to calculate the pulse state in the access traffic statistics sequence;

[0052] Furthermore, the method for analyzing and calculating the pulse signal in step 3 is:

[0053] Set the low level to 0bps and the high level to greater than 0bps;

[0054] A pulse state is a complete alternation process of high level and low level. The pulse width pw is set to the number of fixed cycles of high level in the pulse state. The working cycle dc is the sum of the number of fixed cycles of high level and low level in the pulse state. The expression is:

[0055] pw=Σflow i High level

[0056] dc=pw+Σflow i is low level.

[0057] Step 4. Set the pulse width set to SPW, the duty cycle set to SDC, and clear SPW and SDC;

[0058] Furthermore, in step 4, SPW={}, SDC={}.

[0059] Step 5. Set the matching conditions for the non-covert attack detection model and determine whether the pulse state in the access traffic statistics sequence obtained in Step 3 meets the matching conditions for the non-covert attack detection model. If it is a non-covert attack, the corresponding IP address is assigned to the whitelist and the process returns to Step 2. If not, proceed to the next step.

[0060] Furthermore, in step 5, the matching condition of the non-covert attack detection model is set to set the pulse state coefficient to k. If the high level is maintained for k consecutive fixed cycles, it is determined to be a non-covert attack;

[0061] Step 6. Calculate the pulse state in the access traffic statistics sequence obtained in step 3, construct the pulse width set SPW and calculate the standard deviation S of SPW SPW , construct the duty cycle set SDC and calculate the standard deviation S of SDC SDC , get the calculation result;

[0062] Furthermore, the specific method for calculating the pulse state in step 6 is:

[0063] Step 6.1. Calculate the pulse width of the pulse state to form a pulse width set SPW, which is expressed as:

[0064] SPW={pw1,pw2,...pw i ...pw n};

[0065] Step 6.2. Calculate the SPW standard deviation S of the set SPW , the calculation expression is:

[0066]

[0067] in, is the average value of the pulse width;

[0068] Step 6.3. Calculate the duty cycle of the pulse signal in the pulse state to form the duty cycle set SDC, which is expressed as:

[0069] SDC={dc1,dc2,...dc i ...dc n}

[0070] Step 6.4. Calculate the SDC standard deviation S SDC , the calculation expression is:

[0071]

[0072] in, is the average value of the working cycle.

[0073] Step 7. Set the covert attack detection model matching conditions. Based on the calculation results obtained in step 6, determine whether the covert attack detection model matching conditions are met. If it is a covert attack, the corresponding IP address is assigned to the blacklist set and the process returns to step 2. If not, proceed to the next step.

[0074] Furthermore, in step 7, the matching conditions of the covert attack detection model are set as follows:

[0075] Set the minimum standard deviation of SPW to MIN SPW , the maximum value is MAX SPW , the minimum standard deviation of SDC is MIN SDC , the maximum value is MAX SDC , the minimum cardinality of set SPW and set SDC is MIN n , the maximum value is MAX n , if MIN SPW ≤S SPW ≤MAX SPW And MIN SDC≤ S SDC ≤MAX SDC And MIN n ≤n≤MAX n , it is determined that a covert attack is discovered.

[0076] Step 8. Set the trigger detection model data abnormality conditions. If the trigger detection model data abnormality conditions are met, return to step 4. If not, return to step 6 until the detection is completed.

[0077] Furthermore, in step 8, the trigger detection model data anomaly conditions are set as follows:

[0078] Assume the pulse width coefficient is q, the duty cycle coefficient is w, if or Or n>MAX n , determine whether the data anomaly conditions of the trigger detection model are met.

[0079] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0080] Although the present application has been described above with reference to specific embodiments, various modifications may be made thereto and components may be substituted with equivalents without departing from the scope of the present application. In particular, as long as there are no structural conflicts, the various features of the embodiments disclosed herein may be combined with each other in any manner, and the omission of an exhaustive description of these combinations in this specification is solely for the sake of space and resource conservation. Therefore, the present application is not limited to the specific embodiments disclosed herein, but includes all technical solutions within the scope of the claims.

Claims

1. A highly concealed attack detection method based on irregular pulse signal traffic patterns, characterized in that: The steps include: Step 1. Divide the destination IP addresses into whitelist, blacklist, and graylist according to the IP address security status, forming a whitelist set SWIP, a blacklist set SBIP, and a graylist set SGIP for the destination IP addresses; Step 2. For each IP address in the gray list obtained in step 1, generate an access traffic statistics sequence at a fixed period. In step 2, the access traffic statistics of the IP addresses in the gray list set SGIP are recorded one by one according to a fixed cycle cycle, and the fixed cycle cycle value is set to 1 hour or 1 day to form an access traffic statistics sequence LF, LF=(flow1,flow2,...flow i ...flow n ), flow i is the cumulative flow in the i-th fixed cycle; Step 3. Analyze and calculate the access traffic statistics sequence obtained in step 2 with reference to the pulse signal to calculate the pulse state in the access traffic statistics sequence; The method for analyzing and calculating the pulse signal in step 3 is: Set the low level to 0bps and the high level to greater than 0bps; A pulse state is a complete alternation process of high level and low level. The pulse width pw is set to the number of fixed cycles of high level in the pulse state. The working cycle dc is the sum of the number of fixed cycles of high level and low level in the pulse state. The expression is: pw=∑flow i High level dc=pw+∑flow i is low level; Step 4. Set the pulse width set to SPW, the duty cycle set to SDC, and clear SPW and SDC; Calculate the pulse width of the pulse state to form a pulse width set SPW; calculate the duty cycle of the pulse signal of the pulse state to form a duty cycle set SDC; Step 5. Set the matching conditions for the non-covert attack detection model and determine whether the pulse state in the access traffic statistics sequence obtained in Step 3 meets the matching conditions for the non-covert attack detection model. If it is a non-covert attack, the corresponding IP address is assigned to the whitelist and the process returns to Step 2. If not, proceed to the next step. In step 5, the matching condition of the non-covert attack detection model is set to set the pulse state coefficient to k. If the high level is maintained for k consecutive fixed cycles, it is determined to be a non-covert attack; Step 6. Calculate the pulse state in the access traffic statistics sequence obtained in step 3, construct the pulse width set SPW and calculate the standard deviation S of SPW SPW , construct the duty cycle set SDC and calculate the standard deviation S of SDC SDC , get the calculation result; Step 7. Set the covert attack detection model matching conditions. Based on the calculation results obtained in step 6, determine whether the covert attack detection model matching conditions are met. If it is a covert attack, the corresponding IP address is assigned to the blacklist set and the process returns to step 2. If not, proceed to the next step. In step 7, set the covert attack detection model matching conditions as follows: Set the minimum standard deviation of SPW to MIN SPW , the maximum value is MAX SPW , the minimum standard deviation of SDC is MIN SDC , the maximum value is MAX SDC , the minimum cardinality of set SPW and set SDC is MIN n , the maximum value is MAX n , if MIN SPW ≤S SPW ≤MAX SPW And MIN SDC≤ S SDC ≤MAX SDC And MIN n ≤n≤MAX n , it is determined that a covert attack is discovered; Step 8. Set the trigger detection model data abnormality conditions. If the trigger detection model data abnormality conditions are met, return to step 4. If not, return to step 6 until the detection is completed.

2. A highly concealed attack detection method based on irregular pulse signal traffic patterns according to claim 1, characterized in that: In step 1, the whitelist refers to trusted access targets, the blacklist refers to access targets that are confirmed to be malicious, and the graylist refers to access targets that are neither in the whitelist nor in the blacklist.

3. A highly concealed attack detection method based on irregular pulse signal traffic patterns according to claim 2, characterized in that: In step 4, SPW={}, SDC={}.

4. A highly concealed attack detection method based on irregular pulse signal traffic patterns according to claim 3, characterized in that: The specific method for pulse state calculation in step 6 is: Step 6.

1. Calculate the pulse width of the pulse state to form a pulse width set SPW, which is expressed as: SPW={pw1,pw2,...pw i ...pw n }; Step 6.

2. Calculate the SPW standard deviation S of the set SPW , the calculation expression is: in, is the average value of the pulse width; Step 6.

3. Calculate the duty cycle of the pulse signal in the pulse state to form the duty cycle set SDC, which is expressed as: SDC={dc1,dc2,...dc i ...dc n } Step 6.

4. Calculate the SDC standard deviation S SDC , the calculation expression is: in, is the average value of the working cycle.

5. A highly concealed attack detection method based on irregular pulse signal traffic patterns according to claim 4, characterized in that: In step 8, the trigger detection model data anomaly conditions are set as follows: Set the pulse width coefficient to q and the duty cycle coefficient to w. If pw n >q*pw or dc n >w*dc or n>MAX n , determine whether the data anomaly conditions of the trigger detection model are met.

Images