Efficient and credible message anomaly detection method based on automaton

Abstract

The invention discloses an efficient and credible message anomaly detection method based on an automaton, and the method comprises the steps: firstly carrying out the preprocessing of message data, and obtaining a message data set; calculating the importance of each message feature in the message data set by using a random forest algorithm, and selecting the message features with high importance in the message data set to form a feature data set; a neural network model is adopted to carry out training detection on the feature data set, and a message anomaly detection result is obtained; and finally, inputting the output of the neural network model into the message finite automaton, and carrying out anomaly detection on the message data according to a migration function rule of the message finite automaton, thereby verifying an output result of the neural network model. According to the method, the advantages of the neural network model and the finite automaton are combined, so that the reliability and efficiency of message data detection are effectively improved.

Description

Technical Field

[0001] The invention relates to the technical field of computer network security, and in particular to an efficient and reliable message anomaly detection method based on automata. Background Art

[0002] With the widespread popularity of network communications and applications, message anomaly detection has become particularly important. Although the existing neural network-based message anomaly detection methods have performed well in processing large-scale abnormal message data detection, their detection results have not been rigorously proven, and the reliability of the detection results of the neural network model cannot be guaranteed. This is because the neural network model is usually regarded as a black box, its internal judgment logic is not transparent, and there is a lack of formal modeling and verification methods. Therefore, the reliability of the detection results cannot be guaranteed. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide an efficient and reliable message anomaly detection method based on automata, which effectively improves the reliability and efficiency of message data detection by combining the advantages of neural network models and finite automata.

[0004] The technical solution of the present invention is:

[0005] An efficient and reliable message anomaly detection method based on automata specifically includes the following steps:

[0006] (1) Data preprocessing: First, preprocess the message data to obtain a message data set;

[0007] (2) Feature selection: Use the random forest algorithm to calculate the importance of each message feature in the message data set, select the message features with high importance in the message data set, and form a feature data set;

[0008] (3) Using a neural network model to train and test the feature data set to obtain a trained neural network model. At the same time, after the neural network model is trained and tested, a message anomaly detection result is obtained;

[0009] (4) Input the output of the neural network model into the message finite automaton, perform anomaly detection on the message data according to the transition function rule of the message finite automaton, and thus verify the output result of the neural network model.

[0010] The preprocessing of the message data specifically includes sending the message data to a message segment generator, decomposing the message data into byte segments, and then converting the decomposed message segments into a series of integer segments to form a message data set, each integer segment including the same features.

[0011] The specific steps of using the random forest algorithm to calculate the importance of each message feature in the message data set, selecting message features with high importance in the message data set, and forming the feature data set are:

[0012] S21. Build a decision tree and calculate the Gini index value G of the x-th decision tree node y ini,x,y , see the following formula (1) for details:

[0013]

[0014] In formula (1), p y,i Indicates the proportion of the i-th type of messages in the x-th decision tree node y;

[0015] S22, calculate each message feature X z The importance D of node y in the xth decision tree vim,z,x,y , see the following formula (2):

[0016] D vim,z,x,y =G ini,x,y -G ini,x,e -G ini,x,r (2);

[0017] In formula (2), G ini,x,e and G ini,x,r They are the Gini index values ​​of the first new node and the second new node after the branch of node y in the x-th decision tree;

[0018] S23, calculate each message feature X z The importance of D vim,z , see the following formula (3) for details:

[0019]

[0020] S24. The importance of all message features D vim,z Sorting is performed, and message features with high importance in the message data set are selected to form a feature data set, wherein each integer segment in the feature data set includes the selected message features with high importance.

[0021] The output of the neural network model includes a feature data set and a message anomaly detection result obtained after the neural network model is trained.

[0022] The message finite automaton PFA is represented by a six-tuple, as shown in the following formula (4):

[0023] PFA={S,T,Σ,S F ,S0,P} (4);

[0024] In formula (4), S represents the state set, and each state in S is determined by the current node state si , the previous node status s i-1 and abnormal states e Composition; T represents the set of migration function rules, the current node state s i The previous node state s i-1 After the transfer function rule T i Then we get; Σ represents the finite alphabet of input characters, and each component in Σ is called an input character; S F ∈S means Accept, which is the terminal state; S0∈S means the initial state; P means the message protocol.

[0025] The input of the construction algorithm of the message finite automaton is the message protocol P, the state set S, the message finite automaton M to be constructed, and the Exception function. The Exception function is a setting function. The Exception function regards the nodes that do not meet the rules of the migration function as abnormal states s e ,s e Belongs to the terminal state S F ;

[0026] The construction algorithm extracts the set T of transition function rules according to the message protocol P, constructs and outputs the constructed message finite automaton M according to the set T of transition function rules, and constructs an Exception node for each state in the state set, pointing to the abnormal state s e .

[0027] The message finite automaton includes a message content anomaly detection automaton and a historical message anomaly detection automaton; the message content anomaly detection automaton is used to perform anomaly detection on the content of message data, and the historical message anomaly detection automaton is used to perform anomaly detection on historical message data, detecting anomalies of the historical message data in the time dimension.

[0028] The detection of the message content anomaly detection automaton is to input the entire message data and the constructed message content anomaly detection automaton into the construction algorithm for detection. Each time the entire message data is input into the constructed message content anomaly detection automaton, the message data segment in the entire message data is intercepted into the state according to the message protocol P. Each time the migration function rule is called, when the intercepted message data segment meets the migration function rule, the message content anomaly detection automaton enters the next node state, and when it does not meet the migration function rule, it enters the abnormal state s e Repeat the above steps until the entire message data is intercepted and detected, and all intercepted message data segments do not enter an abnormal state. e , indicating that the entire message data is a normal message.

[0029] The detection of the historical message anomaly detection automaton is to input a single historical message data in the historical message data and the constructed historical message anomaly detection automaton into the construction algorithm for detection;

[0030] A single piece of historical message data is taken as the state set S, as shown in the following formula (5):

[0031]

[0033] In formula (5), S i (ack) indicates message S i Response message, EmptyS i (ack) indicates message S i No response message;

[0034] Define a set T of migration function rules, which includes rules T a , Rule T b , Rule T c , Rule T d and Rule T e ; Among them, rule T a Indicates that the message is continuous, that is, T a →{S i ,S i+1 ,S i+2 …}; Rule T b For the same type of message, it means message S i And message S i The response message S i (ack) complies with rule T b , that is, T b →{S i ,S i (ack)}; Rule T c Indicates message S i No response message, that is, T c →{S i ,EmptyS i (ack)}; Rule T d Indicates that a single historical message data lacks a response message, that is, T d →{S i ,S i (ack),S i+1 ,EmptyS i+1 (ack)}; Rule T e Indicates that there are duplicate messages in a single historical message data. i And the response message S i (ack), repeated message S i Composition set {Si}, repeated response message S i (ack) forms a set {S i (ack)}, that is, T e →{S i}||{S i (ack)};

[0035] Finally, according to the state set S and the set T of transition function rules, the initial state S0 and the terminal state S are given. F , when state S i Comply with rule T i+1 , and enter the next state S i+1 , and can walk to S F , it means that a single piece of historical message data complies with the historical rules, which is recorded as {S0,T1,S1,…,T i ,S i ,T i+1 ,S i+1 ,…,S F}→S F ; When state S i Does not comply with the rules T i+1 ,Right now Indicates that a single piece of historical message data does not conform to historical rules and is an abnormal message.

[0036] Advantages of the present invention:

[0037] (1) Improving detection reliability: The present invention combines the neural network model with the message finite automaton, and effectively verifies the output result of the neural network model through the message finite automaton, thereby ensuring the reliability of message data anomaly detection and reducing false positives and missed positives.

[0038] (2) Reducing the state explosion problem: The present invention adopts the random forest algorithm for feature selection, which significantly reduces the dimension of the neural network model and the message finite automaton input data, thereby effectively alleviating the state explosion problem that is prone to occur when the finite automaton processes large-scale message data, and improving the detection efficiency.

[0039] (3) Strong flexibility: The present invention pre-processes the message data. On the one hand, because the application layer messages are more difficult to extract than the network layer messages; on the other hand, because the information captured by the network layer is not complete, and the application layer messages are usually more flexible and are custom encapsulated based on the network layer protocol, the present invention uses a message segment generator to generate integer segments and create a data set, which is more conducive to the subsequent training of the neural network model.

[0040] (4) Strong adaptability: The present invention can adapt to different types of network traffic and application scenarios, has strong versatility and flexibility, and can be widely used in message data anomaly detection in various network environments.

[0041] (5) Promote network security: The present invention helps to improve the security of network communications, prevent potential network attacks and data leakage, and protect the information security of users and enterprises by timely and accurately detecting and identifying abnormal message data in the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a flow chart of the present invention.

[0043] Figure 2 It is a principle block diagram of the message finite automaton of the present invention.

[0044] Figure 3 It is a feature importance bar chart of each feature in the message data set of the embodiment of the present invention.

[0045] Figure 4 It is a quantitative result diagram of the neural network model message anomaly detection and message finite automaton judgment detection in the embodiment of the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] See Figure 1 , an efficient and reliable message anomaly detection method based on automaton, specifically comprising the following steps:

[0048] (1) Data preprocessing: First, the message data is preprocessed to obtain a message data set; specifically, the message data is sent to a message segment generator, the message data is decomposed into byte segments, and then the decomposed message segments are converted into a series of integer segments to form a message data set; see Table 1 below, each message data (date date) includes 12 features, specifically the start frame (packetStart) of the message, the check bit (virefy), the length (length), the type (type), the number (number), the firmware number (fixnumber), the serial number (terminal, terminal1), and the data identifier carried by the message (tag1, tag2, tag3, tag4);

[0049] Table 1

[0050]

[0051] (2) Feature selection: Use the random forest algorithm to calculate the importance of each message feature in the message data set, select the message features with high importance in the message data set, and form a feature data set. The specific steps are as follows:

[0052] S21. Build a decision tree and calculate the Gini index value G of the x-th decision tree node y ini,x,y , see the following formula (1) for details:

[0053]

[0054] In formula (1), p u,i Indicates the proportion of the i-th type of messages in the x-th decision tree node y;

[0055] S22, calculate each message feature X z The importance D of node y in the xth decision tree vim,z,x,y , see the following formula (2):

[0056] D vim,z,x,y =G ini,x,y -G ini,x,e -G ini,x,r (2);

[0057] In formula (2), G ini,x,e and G ini,x,r They are the Gini index values ​​of the first new node and the second new node after the branch of node y in the x-th decision tree;

[0058] S23, calculate each message feature X z The importance of D vim,z , see the following formula (3) for details:

[0059]

[0060] See Figure 3 ,Among the 12 features, the importance of two features (5 and 10) is 0, which means that the importance is very low;

[0061] S24. The importance of all message features D vim,2 Sorting is performed, and message features with high importance in the message data set are selected (the ten features remaining after removing features 5 and 10), and a feature data set is obtained. Each integer segment in the feature data set includes ten message features with high importance.

[0062] (3) Use the neural network (LSTM) model to train and test the feature data set: First, select and set the parameters of the neural network model: the maximum number of iterations MaxEpochs, set to 1000; the initial learning rate InitialLearnRate: 0.01; the learning rate scheduling method LearnRateSchedule: set to 'piecewise', indicating piecewise adjustment of the learning rate; the learning rate reduction factor

[0063] LearnRateDropFactor: 0.1; Learning rate drop period LearnRateDropPeriod: 750, which means that after every 750 trainings, the learning rate is multiplied by 0.1;

[0064] After the training and testing is completed, a trained neural network model is obtained. At the same time, after the training and testing of the neural network model, a message anomaly detection result is obtained;

[0065] (4) Define the message finite automaton PFA. PFA is represented by a six-tuple, as shown in the following formula (4):

[0066] PFA={S,T,Σ,S F ,S0,P} (4);

[0067] In formula (4), S represents the state set, and each state in S is determined by the current node state s i , the previous node status s i-1 and abnormal states e Composition; T represents the set of migration function rules, the current node state s i The previous node state s i-1 After the transfer function rule T i Then we get; Σ represents the finite alphabet of input characters, and each component in Σ is called an input character; S F ∈S, means Accept, which is the terminal state; S0∈S, means the initial state; P means the message protocol;

[0068] (5) Construct a message finite automaton. The input of the construction algorithm of the message finite automaton is the message protocol P, the state set S, the message finite automaton M to be constructed, and the Exception function. The Exception function is a setting function. The Exception function regards nodes that do not meet the rules of the migration function as abnormal states s e ,s e Belongs to the terminal state S F ;

[0069] The construction algorithm extracts the set T of transition function rules according to the message protocol P, constructs and outputs the constructed message finite automaton M according to the set T of transition function rules, and constructs an Exception node for each state in the state set, pointing to the abnormal state s e ;

[0070] (6) Input the output of the neural network model (including the feature data set and the message anomaly detection result obtained after the neural network model is trained) into the message finite automaton, and perform anomaly detection on the message data according to the transition function rule of the message finite automaton, thereby verifying the output result of the neural network model;

[0071] See Figure 3 The message finite automaton includes a message content anomaly detection automaton and a historical message anomaly detection automaton; the message content anomaly detection automaton is used to perform anomaly detection on the content of the message data, and the historical message anomaly detection automaton is used to perform anomaly detection on the historical message data, and detect the anomaly of the historical message data in the time dimension;

[0072] S61. The detection of the message content anomaly detection automaton is to input the entire message data and the constructed message content anomaly detection automaton into the construction algorithm for detection. Each time the entire message data is input into the constructed message content anomaly detection automaton, the message data segment in the entire message data is intercepted into the state according to the message protocol P. Each time the migration function rule is called, when the intercepted message data segment meets the migration function rule, the message content anomaly detection automaton enters the next node state. When it does not meet the migration function rule, it enters the abnormal state s e Repeat the above steps until the entire message data is intercepted and detected, and all intercepted message data segments do not enter an abnormal state. e , indicating that the entire message data is a normal message;

[0073] When the entire message data is determined to be an abnormal message, the subsequent historical message abnormality detection is not performed. When the entire message data is determined to be a normal message, the subsequent historical message abnormality detection is continued.

[0074] S62, the detection of the historical message anomaly detection automaton is to input a single historical message data in the historical message data and the constructed historical message anomaly detection automaton into the construction algorithm for detection;

[0075] A single piece of historical message data is taken as the state set S, as shown in the following formula (5):

[0076]

[0077] In formula (5), S i (ack) indicates message Si Response message, EmptyS i (ack) indicates message S i No response message;

[0078] Define a set T of migration function rules, which includes rules T a , Rule T b , Rule T c , Rule T d and Rule T e ; Among them, rule T a Indicates that the message is continuous, that is, T a →{S i ,S i+1 ,S i+2 …}; Rule T b For the same type of message, it means message S i And message S i The response message S i (ack) complies with rule T b , that is, T b →{S i ,S i (ack)}; Rule T c Indicates message S i No response message, that is, T c →{S i ,EmptyS i (ack)}; Rule T d Indicates that a single historical message data lacks a response message, that is, T d →{S i ,S i (ack),S i+1 ,EmptyS i+1 (ack)}; Rule T e Indicates that there are duplicate messages in a single historical message data. i And the response message S i (ack), repeated message S i Composition set {S i}, repeated response message S i (ack) forms a set {S i (ack)}, that is, T e →{S i}||{S i (ack)};

[0079] Finally, according to the state set S and the set T of transition function rules, the initial state S0 and the terminal state S are given. F , when state S i Comply with rule Ti+1 , and enter the next state S i+1 , and can walk to S F , it means that a single piece of historical message data complies with the historical rules, which is recorded as {S0,T1,S1,…,T i ,S i ,T i+1 ,S i+1 ,…,S F}→S F ; When state S i Does not comply with the rules T i+1 ,Right now Indicates that a single piece of historical message data does not conform to historical rules and is an abnormal message.

[0080] Experimental results and analysis

[0081] See Figure 4 , when the number of features in the feature data set is 12, 10, 9, and 8 respectively, the neural network (LSTM) model can detect 1223, 850, 1006, and 1123 abnormal messages, and the final real number of abnormal messages determined by the message finite automaton is 1134, 910, 935, and 1038 abnormal messages respectively, indicating that the detection result of the neural network model is unreliable; and it shows that the message finite automaton of the present invention can detect the message that the neural network model detects incorrectly. In order to solve the problem of unreliable neural network model, the output of the neural network model is used as the input of the message finite automaton defined and verified in a formal language, which improves the reliability of message anomaly detection and reduces the problem of false positives.

[0082] As shown in Table 2 below, when the number of features in the feature data set is 12, 10, 9, and 8 respectively, the execution time of the message finite automaton is 60, 29, 49, and 58 (ms) respectively. The message finite automaton effectively determines the abnormal content of the message and the abnormal history of the message that are falsely reported by the LSTM model, and the detection rate of the message with a feature number of 10 per unit time is also about 66% higher than that of the message with a feature number of 12.

[0083] Table 2

[0084]

[0085] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An efficient and reliable message anomaly detection method based on automata, characterized in that: The specific steps include: (1) Data preprocessing: First, preprocess the message data to obtain a message data set; (2) Feature selection: Use the random forest algorithm to calculate the importance of each message feature in the message data set, select the message features with high importance in the message data set, and form a feature data set; (3) Using a neural network model to train and test the feature data set to obtain a trained neural network model. At the same time, after the neural network model is trained and tested, a message anomaly detection result is obtained; (4) Input the output of the neural network model into the message finite automaton, perform anomaly detection on the message data according to the transition function rule of the message finite automaton, and thus verify the output result of the neural network model.

2. According to claim 1, an efficient and reliable message anomaly detection method based on automaton is characterized in that: The preprocessing of the message data specifically includes sending the message data to a message segment generator, decomposing the message data into byte segments, and then converting the decomposed message segments into a series of integer segments to form a message data set, each integer segment including the same features.

3. The efficient and reliable message anomaly detection method based on automaton according to claim 2 is characterized in that: The specific steps of using the random forest algorithm to calculate the importance of each message feature in the message data set, selecting message features with high importance in the message data set, and forming the feature data set are: S21. Build a decision tree and calculate the Gini index value G of the x-th decision tree node y ini,x,y , see the following formula (1) for details: In formula (1), py,i represents the proportion of the i-th type of messages in the x-th decision tree node y; S22, calculate each message feature X z The importance of node y in the x-th decision tree D vim,z,x，y , see the following formula (2): D vim,z，x，y =G ini,x,y -G ini，x，e -G ini，x，r (2); In formula (2), G ini，x，e and G ini，x，r They are the Gini index values ​​of the first new node and the second new node after the branch of node y in the x-th decision tree; S23, calculate each message feature X z The importance of D vim，z , see the following formula (3) for details: S24. The importance of all message features D vim，z Sorting is performed, and message features with high importance in the message data set are selected to form a feature data set, wherein each integer segment in the feature data set includes the selected message features with high importance.

4. The efficient and reliable message anomaly detection method based on automaton according to claim 3 is characterized in that: The output of the neural network model includes a feature data set and a message anomaly detection result obtained after the neural network model is trained.

5. The efficient and reliable message anomaly detection method based on automaton according to claim 4 is characterized in that: The message finite automaton PFA is represented by a six-tuple, as shown in the following formula (4): PFA={S,T,∑,S F ,S0,P} (4); In formula (4), S represents the state set, and each state in S is determined by the current node state s i , the previous node status s i-1 and abnormal status e Composition; T represents the set of migration function rules, the current node state s i The previous node state s i-1 After the transfer function rule T i Afterwards, ∑ represents a finite alphabet of input characters, and each element in ∑ is called an input character; S F ∈S means Accept, which is the terminal state; S0∈S means the initial state; P means the message protocol.

6. The efficient and reliable message anomaly detection method based on automaton according to claim 5 is characterized in that: The input of the construction algorithm of the message finite automaton is the message protocol P, the state set S, the message finite automaton M to be constructed, and the Exception function. The Exception function is a setting function. The Exception function regards the nodes that do not meet the rules of the migration function as abnormal states s e ,s e Belongs to the terminal state S F ; The construction algorithm extracts the set T of transition function rules according to the message protocol P, constructs and outputs the constructed message finite automaton M according to the set T of transition function rules, and constructs an Exception node for each state in the state set, pointing to the abnormal state s e .

7. The efficient and reliable message anomaly detection method based on automaton according to claim 6 is characterized in that: The message finite automaton includes a message content anomaly detection automaton and a historical message anomaly detection automaton; the message content anomaly detection automaton is used to perform anomaly detection on the content of message data, and the historical message anomaly detection automaton is used to perform anomaly detection on historical message data, detecting anomalies of the historical message data in the time dimension.

8. The efficient and reliable message anomaly detection method based on automaton according to claim 7 is characterized in that: The detection of the message content anomaly detection automaton is to input the entire message data and the constructed message content anomaly detection automaton into the construction algorithm for detection. Each time the entire message data is input into the constructed message content anomaly detection automaton, the message data segment in the entire message data is intercepted into the state according to the message protocol P, and the migration function rule is called each time. When the intercepted message data segment meets the migration function rule, the message content anomaly detection automaton enters the next node state. When it does not meet the migration function rule, it enters the abnormal state s e Repeat the above steps until the entire message data is intercepted and detected, and all intercepted message data segments do not enter an abnormal state. e , indicating that the entire message data is a normal message.

9. The efficient and reliable message anomaly detection method based on automaton according to claim 7 is characterized in that: The detection of the historical message anomaly detection automaton is to input a single historical message data in the historical message data and the constructed historical message anomaly detection automaton into the construction algorithm for detection; A single piece of historical message data is taken as the state set S, as shown in the following formula (5): S→{S1,S1(ack),S2,S2(ack),S3,S3(ack),S4,S4(ack),...,S i ,S i (ack),...,S n ,S n (ack),EmptyS i (ack)} (5); In formula (5), S i (ack) indicates message S i Response message, EmptyS i (ack) indicates message S i No response message; Define a set T of migration function rules, which includes rules T a , Rule T b , Rule T c , Rule T d and Rule T e ; Among them, rule T a Indicates that the message is continuous, that is, T a →(S i , S i+1 , S i+2 …}; Rule Tb is for the same type of message, indicating that message S i And message S i The response message S i (ack) complies with rule T b , that is, T b →{S i , S i (ack)}; Rule T c Indicates message S i No response message, that is, T c →{S i , EmptyS i (ack)}; Rule T d Indicates that a single historical message data lacks a response message, that is, T d →{S i , S i (ack), S i+1 , EmptyS i+1 (ack)}; Rule T e Indicates that there are duplicate messages in a single historical message data. i And the response message S i (ack), repeated message S i Composition set {S i }, repeated response message S i (ack) forms a set {S i (ack)}, that is, T e →{S i }||{S i (ack)}; Finally, according to the state set S and the set T of transition function rules, the initial state S0 and the terminal state S are given. F , when state S i Comply with rule T i+1 , and enter the next state S i+1 , and can walk to S F , it means that a single piece of historical message data complies with the historical rules, recorded as {S0, T1, S1, ..., T i , S i , T i+1 , S i+1 , ..., S F }→S F ; When state S i Does not comply with the rules T i+1 ,Right now Indicates that a single piece of historical message data does not conform to historical rules and is an abnormal message.

Images