Data stream attack identification method and device, equipment and storage medium
By dividing the original data stream into sub-data streams and extracting features to identify network attacks, the problem of coarse identification granularity and single behavior pattern in the existing technology is solved, and the accuracy of network attack detection is improved.
Patent Information
- Application Number
- CN202310883722.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-07-18
- Publication Date
- 2025-01-21
AI Technical Summary
The prior art has a coarse granularity in identification of network attacks and a single recognition behavior pattern, which makes it impossible to accurately detect network attacks.
By dividing the original data stream to be identified into multiple sub-data streams, feature extraction is performed on the multiple sub-data streams and the original data stream to obtain sub-data features and original data features, and attack identification is performed on the original data stream based on these features. .
It realizes diversified analysis of data characteristics and improves the accuracy of network attack detection.
Smart Images
Figure CN119341756A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a data stream attack identification method, device, equipment and storage medium. Background Art
[0002] In recent years, with the widespread use of encryption protocols and encrypted traffic, attackers use encrypted communications to evade security software detection, control infected machines, and cause major security incidents such as information leakage and local information destruction. Network supply behavior has complex multi-stage interactive behaviors between clients and servers. However, the current recognition of network attacks is relatively coarse and the recognition behavior pattern is single, which makes it impossible to accurately detect network attacks.
[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention
[0004] The main purpose of the present invention is to provide a data stream attack identification method, device, equipment and storage medium, aiming to solve the technical problem that the existing technology has a coarse identification granularity for network attacks and a single identification behavior pattern, resulting in the inability to accurately detect network attacks.
[0005] To achieve the above object, the present invention provides a data flow attack identification method, the method comprising the following steps:
[0006] Splitting the original data stream to be identified into multiple sub-data streams;
[0007] Performing feature extraction on the multiple sub-data streams and the original data stream respectively to obtain sub-data features corresponding to each sub-data stream and original data features of the original data stream;
[0008] Attack identification is performed on the original data stream according to the sub-data features and the original data features.
[0009] Optionally, the performing attack identification on the original data flow according to the sub-data feature and the original data feature includes:
[0010] Aggregating a plurality of the sub-data features to construct a feature set of the sub-data stream;
[0011] Performing feature analysis on the original data stream according to the feature set and the original data feature to obtain a feature vector of the original data stream;
[0012] Attack identification is performed on the original data stream according to the feature vector.
[0013] Optionally, before dividing the original data stream to be identified into a plurality of sub-data streams, the method further includes:
[0014] Monitor the target network communication environment to determine the network communication behaviors that meet the preset identification conditions that occur in the target network communication environment;
[0015] Obtain the original data stream to be identified in the network communication behavior.
[0016] Optionally, the obtaining the original data stream to be identified in the network communication behavior includes:
[0017] Obtaining original data packets in the network communication behavior;
[0018] Aggregating the original data packets to obtain an initial data stream;
[0019] The original data stream to be identified is screened out from the initial data stream.
[0020] Optionally, the performing data aggregation on the original data packets to obtain the initial data stream includes obtaining communication multiple information of the original data packets;
[0021] classifying the original data packets according to the communication multivariate information;
[0022] The original data packets are aggregated according to the classification result to obtain an initial data stream.
[0023] Optionally, the filtering out the original data stream to be identified from the initial data stream includes:
[0024] Obtaining the duration of the initial data stream;
[0025] According to the duration, a target data stream that meets a preset duration condition is screened out from the initial data stream, and the target data stream is used as the original data stream to be identified.
[0026] Optionally, dividing the original data stream to be identified into a plurality of sub-data streams includes:
[0027] Determining adjacent data packets in the original data stream to be identified;
[0028] Obtaining the time interval between each of the adjacent data packets;
[0029] The original data stream is divided into a plurality of sub-data streams according to the time interval.
[0030] Optionally, the extracting features from the multiple sub-data streams and the original data stream respectively to obtain sub-data features corresponding to each sub-data stream and original data features of the original data stream includes:
[0031] Performing feature extraction on the multiple sub-data streams and the original data stream respectively to obtain sub-data stream block features of each sub-data stream and original data features of the original data stream;
[0032] Determining adjacent sub-data streams among the plurality of sub-data streams;
[0033] Performing similarity analysis on the adjacent sub-data streams to obtain similarity features of the adjacent sub-data streams;
[0034] The sub-data features corresponding to each sub-data stream are determined according to the sub-data stream block features and the similarity features.
[0035] Optionally, the performing attack identification on the original data stream according to the feature vector includes:
[0036] Inputting the feature vector into a pre-built recognition and detection model for attack recognition;
[0037] When the original data flow is identified as an attack data flow, a response alarm is issued.
[0038] Optionally, before inputting the feature vector into a pre-built recognition and detection model for attack recognition, the method further includes:
[0039] Obtaining a sample data stream from a preset attack sample library;
[0040] Splitting the sample data stream into a plurality of sub-sample data streams;
[0041] Performing feature extraction on the multiple sub-sample data streams and the sample data stream respectively to obtain sub-sample data features corresponding to each sub-sample data stream and sample data features of the sample data stream;
[0042] Constructing a training set according to the sub-sample data characteristics and the sample data characteristics;
[0043] Obtain test samples from a preset normal sample library;
[0044] Constructing a test set according to the test samples;
[0045] A recognition detection model is constructed based on the training set and the test set.
[0046] In addition, to achieve the above-mentioned purpose, the present invention also proposes a data flow attack identification device, the data flow attack identification device comprising:
[0047] A data stream segmentation module is used to segment the original data stream to be identified into multiple sub-data streams;
[0048] A feature extraction module, used to extract features from the multiple sub-data streams and the original data stream respectively, to obtain sub-data features corresponding to each sub-data stream and original data features of the original data stream;
[0049] An attack identification module is used to identify attacks on the original data stream according to the sub-data features and the original data features.
[0050] Optionally, the attack identification module is further used to aggregate multiple sub-data features to construct a feature set of the sub-data stream; perform feature analysis on the original data stream according to the feature set and the original data features to obtain a feature vector of the original data stream; and perform attack identification on the original data stream according to the feature vector.
[0051] Optionally, the data flow attack identification device further includes:
[0052] The network detection module is used to monitor the target network communication environment, determine the network communication behavior that meets the preset identification conditions occurring in the target network communication environment, and obtain the original data stream to be identified in the network communication behavior.
[0053] Optionally, the network detection module is further used to obtain original data packets in the network communication behavior; perform data aggregation on the original data packets to obtain initial data streams; and filter out original data streams to be identified from the initial data streams.
[0054] Optionally, the network detection module is further used to obtain communication multi-element information of the original data packet; classify the original data packet according to the communication multi-element information; and perform data aggregation on the original data packet according to the classification result to obtain an initial data stream.
[0055] Optionally, the network detection module is further used to obtain the duration of the initial data stream; filter out a target data stream that meets a preset duration condition from the initial data stream according to the duration, and use the target data stream as the original data stream to be identified.
[0056] Optionally, the data stream segmentation module is further used to determine adjacent data packets in the original data stream to be identified; obtain the time interval between each of the adjacent data packets; and segment the original data stream into multiple sub-data streams according to the time interval.
[0057] Optionally, the feature extraction module is also used to perform feature extraction on the multiple sub-data streams and the original data stream respectively to obtain sub-data stream block features of each sub-data stream and original data features of the original data stream; determine each adjacent sub-data stream among the multiple sub-data streams; perform similarity analysis on each adjacent sub-data stream to obtain similarity features of each adjacent sub-data stream; and determine the sub-data features corresponding to each sub-data stream based on the sub-data stream block features and the similarity features.
[0058] In addition, to achieve the above-mentioned purpose, the present invention also proposes a data flow attack identification device, which includes: a memory, a processor, and a data flow attack identification program stored in the memory and executable on the processor, and the data flow attack identification program is configured to implement the steps of the data flow attack identification method described above.
[0059] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a data flow attack identification program is stored, and when the data flow attack identification program is executed by a processor, the steps of the data flow attack identification method described above are implemented.
[0060] The present invention divides the original data stream to be identified into multiple sub-data streams, extracts features from the multiple sub-data streams and the original data stream respectively, obtains sub-data features corresponding to each sub-data stream and original data features of the original data stream, and identifies attacks on the original data stream according to the sub-data features and the original data features; because the present invention extracts the original data features of the original data stream and the sub-data features of the sub-data streams after the original data is divided respectively, and then identifies the original data stream to be identified according to the sub-data features and the original data features, it realizes diversified analysis of data features and improves the accuracy of network attack detection. BRIEF DESCRIPTION OF THE DRAWINGS
[0061] Figure 1 It is a structural diagram of a data flow attack identification device in a hardware operating environment involved in an embodiment of the present invention;
[0062] Figure 2 It is a flow chart of the first embodiment of the data stream attack identification method of the present invention;
[0063] Figure 3 A schematic diagram of a flow chart of a second embodiment of a method for identifying data stream attacks according to the present invention;
[0064] Figure 4 A schematic diagram of a flow chart of a third embodiment of a method for identifying data stream attacks according to the present invention;
[0065] Figure 5Schematic diagram of the identification and detection model training process in the third embodiment of the data stream attack identification method of the present invention;
[0066] Figure 6 This is a structural block diagram of the first embodiment of the data stream attack identification device of the present invention.
[0067] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION
[0068] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.
[0069] Reference Figure 1 , Figure 1 The present invention is a schematic diagram of the structure of a data flow attack identification device in a hardware operating environment according to an embodiment of the present invention.
[0070] like Figure 1 As shown, the data flow attack identification device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.
[0071] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the data flow attack identification device, and may include more or less components than those shown in the figure, or combine certain components, or arrange the components differently.
[0072] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a data flow attack identification program.
[0073] exist Figure 1In the data flow attack identification device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the data flow attack identification device of the present invention can be set in the data flow attack identification device, and the data flow attack identification device calls the data flow attack identification program stored in the memory 1005 through the processor 1001, and executes the data flow attack identification method provided by the embodiment of the present invention.
[0074] The embodiment of the present invention provides a data flow attack identification method, referring to Figure 2 , Figure 2 The figure is a flow chart of a first embodiment of a method for identifying data stream attacks according to the present invention.
[0075] In this embodiment, the data flow attack identification method includes the following steps:
[0076] Step S10: dividing the original data stream to be identified into multiple sub-data streams.
[0077] It should be noted that when this embodiment is applied to monitor attack behaviors in a target network environment, the original data features of the original data stream and the sub-data features of the sub-data stream after the original data is segmented are extracted respectively, and then the original data stream to be identified is provided and identified based on the sub-data features and the original data features, thereby realizing diversified analysis of data features and improving the accuracy of network attack detection.
[0078] It should be understood that the executor of the method of this embodiment can be a data flow attack identification device with data processing, network communication and program running functions, such as a computer, or other devices or equipment that can achieve the same or similar functions. The above-mentioned data flow attack identification device (hereinafter referred to as the attack identification device) is used as an example for explanation.
[0079] It should be noted that the original data stream can be the traffic or data packets of the TCP and / or UDP protocol that need to be identified for attack in the network environment. For example, the original data stream can be defined as a stream with a duration of more than 1 minute. For TCP and UDP, if the time interval between the two packets that meet the same triplet exceeds 5 seconds, it is divided into two flows; otherwise, it is the same flow. If the duration exceeds 1 minute, it is the filtered flow with a longer duration. The above sub-data streams can be multiple sub-data streams obtained after the original data stream is divided or split.
[0080] It should be understood that the original data stream may be a flow of relatively long duration. Therefore, in order to effectively analyze and identify the original data stream, this embodiment divides the original data stream to be identified into multiple sub-data streams, and then analyzes the sub-data streams, thereby improving the accuracy and efficiency of data analysis.
[0081] In a specific implementation, the original data stream to be identified may be composed of data packets in a network environment. Therefore, when segmenting the original data stream, this embodiment may segment two adjacent data packets in the original data stream into different sub-data streams.
[0082] Furthermore, in order to accurately segment the original data stream, the above step S10 may include:
[0083] Determining adjacent data packets in the original data stream to be identified;
[0084] Obtaining the time interval between each of the adjacent data packets;
[0085] The original data stream is divided into a plurality of sub-data streams according to the time interval.
[0086] It should be noted that in the C&C (command and control) phase, attackers will send a large number of control commands and receive feedback. Since manual or automated operations are performed in stages, there will be time intervals between different control commands. Currently, the 1-second time interval setting can effectively split the data traffic of two control commands. After the split, each sub-data stream corresponds to a control command sending and feedback behavior. In this way, through statistical analysis of each sub-data stream, the network data level feature description of each control command and feedback behavior is achieved. The above-mentioned adjacent data packets can be two adjacent data packets in the original data stream, and the time interval can be the adjacent time interval between two adjacent data packets.
[0087] It should be understood that the attack identification device determines each adjacent data packet in the original data stream to be identified, obtains the time interval between each adjacent data packet, and divides the data packets whose adjacent time interval exceeds a preset time length into different sub-data streams. For example, the above-mentioned preset time length can be 1 second.
[0088] Step S20: extracting features from the multiple sub-data streams and the original data stream respectively to obtain sub-data features corresponding to each sub-data stream and original data features of the original data stream.
[0089] It should be noted that the substream data features may include the number of uplink / downlink data packets in the substream, the length of the uplink / downlink payload, the number of empty packets of the uplink / downlink data packets, the number of full packets of the uplink / downlink data packets, the duration of the substream, etc. The above-mentioned original data stream features may include the number of uplink / downlink data packets, the length of the uplink / downlink payload, the number of empty packets of the uplink / downlink data packets, the number of full packets of the uplink / downlink data packets, the duration of the substream, etc.
[0090] Furthermore, in order to accurately improve the data stream characteristics, the above step S20 may include:
[0091] Extracting features from the multiple sub-data streams and the original data stream respectively to obtain sub-stream block features of each sub-data stream and original data features of the original data stream;
[0092] Determining adjacent sub-streams among the plurality of sub-data streams;
[0093] Performing similarity analysis on the adjacent sub-flows to obtain similarity features of the adjacent sub-flows;
[0094] The sub-data features corresponding to each sub-data stream are determined according to the sub-stream block features and the similarity features.
[0095] It should be noted that the sub-data feature can be a behavior block feature of a sub-data stream, and the behavior block feature can include two categories: sub-data stream block feature and similarity feature between sub-data streams. Among them, the above-mentioned sub-data stream block feature can be a feature extracted for each sub-data stream, reflecting the traffic characteristics of the sub-data stream itself. The sub-data stream block feature includes: the number of uplink / downlink data packets in the sub-data stream, the uplink / downlink load length, the number of empty packets of uplink / downlink data packets, the number of full packets of uplink / downlink data packets, the duration of the sub-data stream, etc. The above-mentioned similarity feature between sub-data streams can be used to describe the similarity between two adjacent sub-data streams. The similarity between sub-data streams of attack behavior traffic is relatively large, and the similarity between sub-data streams of normal network traffic is relatively small. The similarity feature between sub-data streams may include: the ratio of the number of data packets of two adjacent sub-data streams, the load ratio, the duration ratio, etc.
[0096] The characteristic calculation method of the above-mentioned original data stream is similar to the characteristic calculation method of the sub-data stream block, namely, the number of uplink / downlink data packets of the original data stream, the uplink / downlink payload length, the number of empty packets of the uplink / downlink data packets, the number of full packets of the uplink / downlink data packets, the duration of the sub-data stream, etc.
[0097] Step S30: performing attack identification on the original data stream according to the sub-data features and the original data features.
[0098] It should be understood that this embodiment achieves diversified feature analysis of data streams by analyzing the original data features of the original data stream and analyzing the sub-data features of the sub-data streams. By aggregating the sub-data stream block features of the sub-data streams and the similarity features between the sub-data streams, it is possible to summarize the information of multiple sub-data streams for subsequent analysis of long streams, and then perform a comprehensive analysis in combination with the features of the original data stream, thereby improving the accuracy of attack identification.
[0099] Furthermore, in order to improve the accuracy of feature analysis, the above step S30 may include:
[0100] Aggregating a plurality of the sub-data features to construct a feature set of the sub-data stream;
[0101] Performing feature analysis on the original data stream according to the feature set and the original data feature to obtain a feature vector of the original data stream;
[0102] Attack identification is performed on the original data stream according to the feature vector.
[0103] It should be noted that the feature vector can be a feature obtained by combining the features of the original data stream and the statistical features of the sub-data stream. For example, the number of uplink / downlink data packets, the uplink / downlink payload length, the number of empty packets of the uplink / downlink data packets, the number of full packets of the uplink / downlink data packets, and the duration of the sub-data stream are calculated for the original data stream to obtain 9 dimensional features. For the sub-data stream, 4*(9+3)=48 dimensional features are calculated, that is, the total features are 9+48=57 dimensions.
[0104] It should be understood that aggregation means summarizing the information of multiple sub-data streams of a long flow for subsequent analysis of the long flow. The sub-data stream features after aggregation are the collection of sub-data stream behavior blocks of each sub-data stream. Aggregation to the original flow means that for the N sub-data streams corresponding to an original flow, each sub-data stream contains m features. Taking m features as a unit, the four statistical indicators of the maximum value, minimum value, mean value, and variance of the N values are calculated respectively, that is, the original N*m feature data is converted into 4*m statistical feature data.
[0105] This embodiment divides the original data stream to be identified into multiple sub-data streams, extracts features from the multiple sub-data streams and the original data stream respectively, obtains sub-data features corresponding to each sub-data stream and original data features of the original data stream, and identifies attacks on the original data stream according to the sub-data features and the original data features. Since the present invention extracts the original data features of the original data stream and the sub-data features of the sub-data streams after the original data is divided respectively, and then identifies the original data stream to be identified according to the sub-data features and the original data features, it realizes diversified analysis of data features and improves the accuracy of network attack detection.
[0106] refer to Figure 3 , Figure 3 The figure is a flow chart of a second embodiment of a method for identifying data stream attacks according to the present invention.
[0107] Based on the first embodiment above, in this embodiment, before step S10, the following steps are included:
[0108] Step S11: monitor the target network communication environment to determine the network communication behavior that meets the preset identification conditions that occurs in the target network communication environment.
[0109] It should be noted that the target network communication environment may be a network environment that requires network security monitoring. The above-mentioned preset identification conditions may be pre-set screening identification conditions for screening suspicious network communication behaviors. The network communication behavior that meets the preset identification conditions may be a long-term network communication behavior at the network traffic level, in which the attacker continuously and massively sends control commands to the attacked, and obtains corresponding feedback information.
[0110] It should be understood that the attack identification device of this embodiment monitors the target network communication environment, identifies and screens various network communication behaviors occurring in the target network communication environment according to preset identification conditions, and determines the network communication behaviors occurring in the target network communication environment that meet the preset identification conditions.
[0111] Step S12: Acquire the original data stream to be identified in the network communication behavior.
[0112] It should be noted that the original data flow to be identified in the network communication behavior can be a data flow with a longer duration, for example, a data flow with a duration of more than 1 minute. For TCP and UDP, if the time interval between the two packets that meet the same triplet exceeds 5 seconds, they are divided into two flows; otherwise, they are the same flow. If the duration exceeds 1 minute, it is the filtered flow with a longer duration.
[0113] It should be understood that this embodiment obtains data packets in network communication behavior and then aggregates the data packets into data streams. In order to improve the subsequent analysis efficiency, invalid data streams that do not need to be analyzed are filtered out, and only the original data streams to be identified in the network communication behavior are retained.
[0114] Furthermore, in order to accurately screen out the suspicious data stream to be identified, the above step S12 may include:
[0115] Step S121: obtaining the original data packet in the network communication behavior;
[0116] Step S122: Aggregating the original data packets to obtain an initial data stream;
[0117] Step S123: Filter out the original data stream to be identified from the initial data stream.
[0118] It should be noted that the original data packet may be a data packet included in the network communication behavior. The above initial data flow may be the traffic obtained by aggregating one or more data packets. If the time interval between adjacent data packets is close, the above adjacent data packets are aggregated into the same traffic. If the time interval between adjacent data packets is far, the above adjacent data packets are treated as two different traffics.
[0119] It should be understood that the attack identification device of this embodiment determines each data packet in the network communication behavior, and divides the two data packets that satisfy the same triplet into two flows if the time interval between the two data packets exceeds 5 seconds; otherwise, it is the same flow, and one or more data flows are obtained according to the division results. Each of the data flows is screened, and the data flows with longer duration are screened out as the original data flows to be identified.
[0120] Furthermore, in order to effectively aggregate the data, the above step S122 may include:
[0121] Step S1221: Acquire communication multiple information of the original data packet;
[0122] Step S1222: classifying the original data packet according to the communication multivariate information;
[0123] Step S1223: Aggregate the original data packets according to the classification result to obtain an initial data stream.
[0124] It should be noted that the communication multi-tuple information may be triplet information or quintuple information. For example, the communication multi-tuple information may include communication information such as the source IP, destination IP and destination port of the data packet.
[0125] It should be understood that since the attacker may send control commands and receive feedback based on different source ports, this embodiment obtains the communication multi-element information of the original data packet, determines the source port of each data packet, and aggregates the traffic using different source ports in a triplet (source IP, destination IP, destination port) manner, that is, the original data packet is aggregated according to the classification result to obtain the initial data stream.
[0126] In a specific implementation, during the C&C (command and control) phase of a network attack, the attacker will continuously and massively send control commands to the attacked, and receive corresponding feedback information. Therefore, this behavior is reflected in the network traffic level as a long-term network communication behavior. Since the attacker may send control commands and receive feedback based on different source ports, the attack identification device of this embodiment can aggregate the traffic using different source ports in a triplet (source IP, destination IP, destination port) manner to obtain a complete attack traffic behavior for subsequent analysis.
[0127] Furthermore, in order to improve the analysis efficiency, the traffic that does not need to be identified is eliminated, and only the original data flow that needs to be identified is retained. The above step S123 may include:
[0128] Step S1231: Obtain the duration of the initial data stream;
[0129] Step S1232: Filter out a target data stream that meets a preset duration condition from the initial data stream according to the duration, and use the target data stream as the original data stream to be identified.
[0130] It should be noted that the duration may be the duration of the initial data flow. The above preset duration condition may be a condition for determining whether the duration of the initial data flow is too long. If the duration is too long, it is determined to be suspicious long traffic and is used as the original data flow to be identified.
[0131] It should be understood that the attack identification device obtains the duration of each initial data flow, determines whether each initial data flow is a long flow that lasts for a long time (for example, a flow that lasts for more than 1 minute is determined to be a long flow) according to a preset duration condition, and takes the initial data flow that lasts for a long time as the original data flow to be identified.
[0132] It should be noted that this embodiment describes and characterizes the original data flow by integrating the original data flow's own characteristics, sub-data flow aggregation characteristics, and sub-data flow similarity evaluation in multiple dimensions, and achieves good recognition effects on verification data sets, cross-data sets, and historical traffic sample data sets. It can identify traffic transmission controlled by malicious traffic commands across sample families, and verify that the command control channel does have long-term characteristics. For the strategy of command execution channel confrontation detection for flow cutting and flow layer load balancing, the method of aggregated flow is adopted to aggregate communication and triple information in multiple dimensions through IP.
[0133] This embodiment monitors the target network communication environment, determines the network communication behaviors that occur in the target network communication environment and meet the preset identification conditions, and obtains the original data streams to be identified in the network communication behaviors; because this embodiment monitors the network communication environment, thereby screening out the network communication behaviors that need to be identified, and then identifies the data streams in the network communication behaviors, thereby obtaining the original data streams to be identified in the network communication behaviors, it achieves secure monitoring of the network communication environment and improves network security.
[0134] refer to Figure 4 , Figure 4 The figure is a flow chart of a third embodiment of a method for identifying data stream attacks according to the present invention.
[0135] Based on the above first embodiment, in this embodiment, step S30 includes:
[0136] Step S301: inputting the feature vector into a pre-built recognition detection model for attack recognition;
[0137] Step S302: When the original data flow is identified as an attack data flow, a response alarm is issued.
[0138] It should be noted that the recognition and detection model may be a classifier pre-trained to control malicious command channel traffic. For example, the recognition and detection model may be a deep learning model for command control channel recognition and detection.
[0139] It should be understood that referring to Figure 5 , Figure 5 As a schematic diagram of the identification detection model training process, the attack identification device of this embodiment aggregates the network traffic set through triples, screens and filters long flows (i.e., data flows with a long duration), obtains the original data flow to be identified, divides the original data flow into sub-flows, extracts features from the sub-flows (i.e., sub-data flows) obtained after the division, and then aggregates the features back to the original data flow to characterize the behavior, forming a feature vector of the original data flow, and trains the model based on the feature vector.
[0140] In the specific implementation, this embodiment first aggregates the traffic according to triples and filters out the original data flow to be identified; obtains the feature vector (sub-flow feature and long flow feature) of the obtained original data flow, inputs the feature vector into the trained model, obtains the detection result of the model, and generates a response alarm for the data flow identified as an attack behavior by the model.
[0141] Furthermore, in order to train a model with a high recognition rate, before the above step S301, the following steps are further included:
[0142] Step S31: obtaining a sample data stream in a preset attack sample library;
[0143] Step S32: dividing the sample data stream into a plurality of sub-sample data streams;
[0144] Step S33: extracting features from the multiple sub-sample data streams and the sample data stream respectively to obtain sub-sample data features corresponding to each sub-sample data stream and sample data features of the sample data stream;
[0145] Step S34: constructing a training set according to the sub-sample data features and the sample data features;
[0146] Step S35: Obtain a test sample from a preset normal sample library;
[0147] Step S36: constructing a test set according to the test samples;
[0148] Step S37: constructing a recognition detection model based on the training set and the test set.
[0149] It should be noted that the preset attack sample library may be a sample database pre-constructed based on the attack samples, and the preset attack sample library contains multiple attack sample examples, and the attack sample examples may be open source C&C malicious traffic. The above-mentioned sample data stream may be an attack sample data stream in the preset attack sample library. The above-mentioned preset sample library may be a pre-constructed database containing multiple normal behavior data streams, and the test sample may be normal office data traffic. In this embodiment, a training set may be constructed based on the sample data stream, and a test set may be constructed based on the test sample. For example, the sample data stream and the test sample may be divided into a training set and a test set according to a ratio of 80% and 20%.
[0150] It should be understood that the sub-data features can be the behavior block features of the sub-sample data stream, and the behavior block features can include two categories: sub-sample data stream block features and similarity features between sub-sample data streams. Among them, the above-mentioned sub-sample data stream block features can be features extracted for each sub-sample data stream, reflecting the traffic characteristics of this sub-sample data stream itself. The sub-sample data stream block features include: the number of uplink / downlink data packets in the sub-sample data stream, the uplink / downlink load length, the number of empty packets of uplink / downlink data packets, the number of full packets of uplink / downlink data packets, the duration of the sub-sample data stream, etc. The above-mentioned similarity features between sub-sample data streams can be used to describe the similarity between two adjacent sub-sample data streams. The similarity between the sub-sample data streams of the attack behavior traffic is relatively large, and the similarity between the sub-sample data streams of the normal network traffic is relatively small. The similarity features between sub-sample data streams may include: the ratio of the number of data packets, the load ratio, the duration ratio, etc. of two adjacent sub-sample data streams.
[0151] The characteristic calculation method of the above-mentioned sample data stream is similar to the characteristic calculation method of the sub-sample data stream block, namely, the number of uplink / downlink data packets in the sample data stream, the uplink / downlink payload length, the number of empty packets in the uplink / downlink data packets, the number of full packets in the uplink / downlink data packets, the duration of the sub-sample data stream, etc.
[0152] This embodiment performs attack identification by inputting the feature vector into a pre-built recognition and detection model, and performs a response alarm when the original data stream is identified as an attack data stream. Since this embodiment performs attack identification by using a pre-built recognition and detection model, and performs a response alarm when the original data stream is identified as an attack data stream, the efficiency and accuracy of attack identification are effectively improved, and attack behaviors are discovered in a timely manner, and attack behavior response alarms are performed, which effectively avoids the problem of untimely discovery of attack behaviors and inability to issue timely alarms.
[0153] In addition, an embodiment of the present invention further provides a storage medium, on which a data flow attack identification program is stored. When the data flow attack identification program is executed by a processor, the steps of the data flow attack identification method described above are implemented.
[0154] Since the storage medium adopts all the technical solutions of all the above embodiments, it has at least all the beneficial effects brought by the technical solutions of the above embodiments, which will not be described one by one here.
[0155] Reference Figure 6 , Figure 6 This is a structural block diagram of the first embodiment of the data stream attack identification device of the present invention.
[0156] like Figure 6 As shown, the data stream attack identification device proposed in the embodiment of the present invention includes:
[0157] The data stream segmentation module 10 is used to segment the original data stream to be identified into multiple sub-data streams;
[0158] A feature extraction module 20, configured to perform feature extraction on the plurality of sub-data streams and the original data stream respectively, to obtain sub-data features corresponding to each sub-data stream and original data features of the original data stream;
[0159] The attack identification module 30 is used to identify attacks on the original data flow according to the sub-data features and the original data features.
[0160] Furthermore, the attack identification module 30 is also used to aggregate multiple sub-data features to construct a feature set of the sub-data stream; perform feature analysis on the original data stream according to the feature set and the original data features to obtain a feature vector of the original data stream; and perform attack identification on the original data stream according to the feature vector.
[0161] Furthermore, the data flow attack identification device further includes:
[0162] The network detection module 40 is used to monitor the target network communication environment, determine the network communication behaviors that meet the preset identification conditions occurring in the target network communication environment, and obtain the original data stream to be identified in the network communication behaviors.
[0163] Furthermore, the network detection module 40 is also used to obtain original data packets in the network communication behavior; perform data aggregation on the original data packets to obtain initial data streams; and filter out the original data streams to be identified from the initial data streams.
[0164] Furthermore, the network detection module 40 is also used to obtain communication multiple information of the original data packet; classify the original data packet according to the communication multiple information; and aggregate the original data packet according to the classification result to obtain an initial data stream.
[0165] Furthermore, the network detection module 40 is also used to obtain the duration of the initial data flow; filter out the target data flow that meets the preset duration condition from the initial data flow according to the duration, and use the target data flow as the original data flow to be identified.
[0166] Furthermore, the data stream segmentation module 10 is also used to determine adjacent data packets in the original data stream to be identified; obtain the time interval between each of the adjacent data packets; and segment the original data stream into multiple sub-data streams according to the time interval.
[0167] Furthermore, the feature extraction module 20 is also used to perform feature extraction on the multiple sub-data streams and the original data stream respectively to obtain sub-data stream block features of each sub-data stream and original data features of the original data stream; determine each adjacent sub-data stream in the multiple sub-data streams; perform similarity analysis on each adjacent sub-data stream to obtain similarity features of each adjacent sub-data stream; and determine the sub-data features corresponding to each sub-data stream based on the sub-data stream block features and the similarity features.
[0168] Furthermore, the attack identification module 30 is further configured to input the feature vector into a pre-built identification detection model for attack identification; and to issue a response alarm when the original data stream is identified as an attack data stream.
[0169] Furthermore, the attack identification module 30 is also used to obtain a sample data stream in a preset attack sample library; divide the sample data stream into multiple sub-sample data streams; perform feature extraction on the multiple sub-sample data streams and the sample data stream respectively to obtain sub-sample data features corresponding to each sub-sample data stream, and sample data features of the sample data stream; construct a training set based on the sub-sample data features and the sample data features; obtain a test sample in a preset normal sample library; construct a test set based on the test sample; and construct an identification detection model based on the training set and the test set.
[0170] This embodiment divides the original data stream to be identified into multiple sub-data streams, extracts features from the multiple sub-data streams and the original data stream respectively, obtains sub-data features corresponding to each sub-data stream and original data features of the original data stream, and identifies attacks on the original data stream according to the sub-data features and the original data features. Since the present invention extracts the original data features of the original data stream and the sub-data features of the sub-data streams after the original data is divided respectively, and then identifies the original data stream to be identified according to the sub-data features and the original data features, it realizes diversified analysis of data features and improves the accuracy of network attack detection.
[0171] It should be understood that the above is only an example and does not constitute any limitation on the technical solution of the present invention. In specific applications, technicians in this field can make settings as needed, and the present invention does not limit this.
[0172] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.
[0173] In addition, for technical details not fully described in this embodiment, reference may be made to the data stream attack identification method provided in any embodiment of the present invention, and will not be repeated here.
[0174] The present invention provides A1, a data flow attack identification method, the data flow attack identification method comprising:
[0175] Splitting the original data stream to be identified into multiple sub-data streams;
[0176] Performing feature extraction on the multiple sub-data streams and the original data stream respectively to obtain sub-data features corresponding to each sub-data stream and original data features of the original data stream;
[0177] Attack identification is performed on the original data stream according to the sub-data features and the original data features.
[0178] A2. The data stream attack identification method as described in A1, wherein the attack identification is performed on the original data stream according to the sub-data feature and the original data feature, comprising:
[0179] Aggregating a plurality of the sub-data features to construct a feature set of the sub-data stream;
[0180] Performing feature analysis on the original data stream according to the feature set and the original data feature to obtain a feature vector of the original data stream;
[0181] Attack identification is performed on the original data stream according to the feature vector.
[0182] A3. The data stream attack identification method as described in A2, before dividing the original data stream to be identified into multiple sub-data streams, further comprising:
[0183] Monitor the target network communication environment to determine the network communication behaviors that meet the preset identification conditions that occur in the target network communication environment;
[0184] Obtain the original data stream to be identified in the network communication behavior.
[0185] A4. The data stream attack identification method as described in A3, wherein obtaining the original data stream to be identified in the network communication behavior comprises:
[0186] Obtaining original data packets in the network communication behavior;
[0187] Aggregating the original data packets to obtain an initial data stream;
[0188] The original data stream to be identified is screened out from the initial data stream.
[0189] A5. The data flow attack identification method as described in A4, wherein the original data packets are aggregated to obtain an initial data flow, including:
[0190] Acquire communication multiple information of the original data packet;
[0191] classifying the original data packets according to the communication multivariate information;
[0192] The original data packets are aggregated according to the classification result to obtain an initial data stream.
[0193] A6. The data stream attack identification method as described in A4, wherein the filtering out the original data stream to be identified from the initial data stream comprises:
[0194] Obtaining the duration of the initial data stream;
[0195] According to the duration, a target data stream that meets a preset duration condition is screened out from the initial data stream, and the target data stream is used as the original data stream to be identified.
[0196] A7. The data stream attack identification method as described in A1, wherein the original data stream to be identified is divided into a plurality of sub-data streams, including:
[0197] Determining adjacent data packets in the original data stream to be identified;
[0198] Obtaining the time interval between each of the adjacent data packets;
[0199] The original data stream is divided into a plurality of sub-data streams according to the time interval.
[0200] A8. The data stream attack identification method as described in A1, wherein the feature extraction is performed on the multiple sub-data streams and the original data stream respectively to obtain the sub-data features corresponding to each sub-data stream and the original data features of the original data stream, including:
[0201] Performing feature extraction on the multiple sub-data streams and the original data stream respectively to obtain sub-data stream block features of each sub-data stream and original data features of the original data stream;
[0202] Determining adjacent sub-data streams among the plurality of sub-data streams;
[0203] Performing similarity analysis on the adjacent sub-data streams to obtain similarity features of the adjacent sub-data streams;
[0204] The sub-data features corresponding to each sub-data stream are determined according to the sub-data stream block features and the similarity features.
[0205] A9. The data stream attack identification method as described in any one of A1 to A8, wherein the attack identification on the original data stream according to the feature vector comprises:
[0206] Inputting the feature vector into a pre-built recognition and detection model for attack recognition;
[0207] When the original data flow is identified as an attack data flow, a response alarm is issued.
[0208] A10. The data stream attack identification method as described in A9, before inputting the feature vector into a pre-built identification and detection model for attack identification, further comprising:
[0209] Obtaining a sample data stream from a preset attack sample library;
[0210] Splitting the sample data stream into a plurality of sub-sample data streams;
[0211] Performing feature extraction on the multiple sub-sample data streams and the sample data stream respectively to obtain sub-sample data features corresponding to each sub-sample data stream and sample data features of the sample data stream;
[0212] Constructing a training set according to the sub-sample data characteristics and the sample data characteristics;
[0213] Obtain test samples from a preset normal sample library;
[0214] Constructing a test set according to the test samples;
[0215] A recognition detection model is constructed based on the training set and the test set.
[0216] The present invention also discloses B11, a data flow attack identification device, the data flow attack identification device comprising:
[0217] A data stream segmentation module is used to segment the original data stream to be identified into multiple sub-data streams;
[0218] A feature extraction module, used to extract features from the multiple sub-data streams and the original data stream respectively, to obtain sub-data features corresponding to each sub-data stream and original data features of the original data stream;
[0219] An attack identification module is used to identify attacks on the original data stream according to the sub-data features and the original data features.
[0220] B12. In the data stream attack identification device as described in A11, the attack identification module is further used to aggregate multiple sub-data features to construct a feature set of the sub-data streams; perform feature analysis on the original data stream according to the feature set and the original data features to obtain a feature vector of the original data stream; and perform attack identification on the original data stream according to the feature vector.
[0221] B13. The data stream attack identification device as described in A12, wherein the data stream attack identification device further comprises:
[0222] The network detection module is used to monitor the target network communication environment, determine the network communication behavior that meets the preset identification conditions occurring in the target network communication environment, and obtain the original data stream to be identified in the network communication behavior.
[0223] B14. In the data flow attack identification device as described in A13, the network detection module is further used to obtain original data packets in the network communication behavior; perform data aggregation on the original data packets to obtain initial data streams; and filter out the original data streams to be identified from the initial data streams.
[0224] B15. In the data flow attack identification device as described in A14, the network detection module is also used to obtain communication multi-dimensional information of the original data packet; classify the original data packet according to the communication multi-dimensional information; and aggregate the original data packet according to the classification result to obtain an initial data flow.
[0225] B16. In the data stream attack identification device as described in A14, the network detection module is also used to obtain the duration of the initial data stream; based on the duration, a target data stream that meets a preset duration condition is screened out from the initial data stream, and the target data stream is used as the original data stream to be identified.
[0226] B17. In the data stream attack identification device as described in A11, the data stream segmentation module is further used to determine each adjacent data packet in the original data stream to be identified; obtain the time interval between each adjacent data packet; and segment the original data stream into multiple sub-data streams according to the time interval.
[0227] B18. In the data stream attack identification device as described in A11, the feature extraction module is further used to perform feature extraction on the multiple sub-data streams and the original data stream respectively to obtain sub-data stream block features of each sub-data stream and original data features of the original data stream; determine each adjacent sub-data stream in the multiple sub-data streams; perform similarity analysis on each adjacent sub-data stream to obtain similarity features of each adjacent sub-data stream; and determine the sub-data features corresponding to each sub-data stream based on the sub-data stream block features and the similarity features.
[0228] The present invention also discloses C19, a data flow attack identification device, the device comprising: a memory, a processor, and a data flow attack identification program stored in the memory and executable on the processor, the data flow attack identification program being configured to implement the data flow attack identification method as described above.
[0229] The present invention also discloses D20, a storage medium, on which a data flow attack identification program is stored, and when the data flow attack identification program is executed by a processor, the data flow attack identification method as described above is implemented.
[0230] In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.
[0231] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.
[0232] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.
[0233] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.
Claims
1. A data stream attack identification method, characterized in that: The data flow attack identification method comprises: Splitting the original data stream to be identified into multiple sub-data streams; Performing feature extraction on the multiple sub-data streams and the original data stream respectively to obtain sub-data features corresponding to each sub-data stream and original data features of the original data stream; Attack identification is performed on the original data stream according to the sub-data features and the original data features.
2. The data stream attack identification method according to claim 1, characterized in that: The performing attack identification on the original data stream according to the sub-data feature and the original data feature includes: Aggregating a plurality of the sub-data features to construct a feature set of the sub-data stream; Performing feature analysis on the original data stream according to the feature set and the original data feature to obtain a feature vector of the original data stream; Attack identification is performed on the original data stream according to the feature vector.
3. The data stream attack identification method according to claim 2, characterized in that: Before the original data stream to be identified is divided into a plurality of sub-data streams, the method further includes: Monitor the target network communication environment to determine the network communication behaviors that meet the preset identification conditions that occur in the target network communication environment; Obtain the original data stream to be identified in the network communication behavior.
4. The data stream attack identification method according to claim 3, characterized in that: The obtaining of the original data stream to be identified in the network communication behavior includes: Obtaining original data packets in the network communication behavior; Aggregating the original data packets to obtain an initial data stream; The original data stream to be identified is screened out from the initial data stream.
5. The data stream attack identification method according to claim 4, characterized in that: The data aggregation of the original data packets to obtain the initial data stream includes: Acquire communication multiple information of the original data packet; classifying the original data packets according to the communication multivariate information; The original data packets are aggregated according to the classification result to obtain an initial data stream.
6. The data stream attack identification method according to claim 4, characterized in that: The step of filtering out the original data stream to be identified from the initial data stream comprises: Obtaining the duration of the initial data stream; According to the duration, a target data stream that meets a preset duration condition is screened out from the initial data stream, and the target data stream is used as the original data stream to be identified.
7. The data stream attack identification method according to claim 1, characterized in that: The step of dividing the original data stream to be identified into a plurality of sub-data streams includes: Determining adjacent data packets in the original data stream to be identified; Obtaining the time interval between each of the adjacent data packets; The original data stream is divided into a plurality of sub-data streams according to the time interval.
8. A data stream attack identification device, characterized in that: The data flow attack identification device comprises: A data stream segmentation module is used to segment the original data stream to be identified into multiple sub-data streams; A feature extraction module, used to extract features from the multiple sub-data streams and the original data stream respectively, to obtain sub-data features corresponding to each sub-data stream and original data features of the original data stream; An attack identification module is used to identify attacks on the original data stream according to the sub-data features and the original data features.
9. A data stream attack identification device, characterized in that: The data flow attack identification device comprises: a memory, a processor, and a data flow attack identification program stored in the memory and executable on the processor, wherein the data flow attack identification program is configured to implement the data flow attack identification method according to any one of claims 1 to 7.
10. A storage medium, characterized in that: The storage medium stores a data flow attack identification program, and when the data flow attack identification program is executed by the processor, the data flow attack identification method according to any one of claims 1 to 7 is implemented.