Encrypted malicious traffic detection method and system for cloud computing environment

Abstract

The invention discloses an encrypted malicious traffic detection method and system oriented to a cloud computing environment. The method mainly comprises the following steps: preprocessing encrypted traffic; spatial features and time features of the preprocessed encrypted traffic are extracted by using a deep learning model, and after feature extraction is completed, feature fusion is performed on the two features by using a feature fusion technology based on a cross attention mechanism; cloud service entity knowledge in the cloud environment is mined to assist the model in encrypted malicious traffic detection in the cloud environment; the model fuses the spatial-temporal characteristics of the encrypted traffic and cloud service entity knowledge, and detects the encrypted malicious traffic in the cloud environment. According to the invention, based on the deep learning model, the multi-mode technology and external knowledge of the cloud environment are utilized at the same time, the problem of encrypted malicious traffic detection in the cloud environment can be effectively solved, and the network security of the cloud environment is maintained.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, and in particular to a method and system for detecting encrypted malicious traffic in a cloud computing environment. Background Art

[0002] Cloud computing is based on open collaboration between multiple cloud service entities. Through the deep integration of multi-party cloud resources, it is convenient for developers to customize cloud services and create cloud value through "software-defined" methods. It is a new generation of cloud computing paradigm that can achieve cross-cloud collaboration and integrated network service customization. Cloud computing can achieve interconnection between clouds, making cloud, edge, end and other entities highly collaborative. It is the underlying support technology for the Internet of Everything scenario, with many advantages such as high performance, large capacity and high availability.

[0003] Compared with the traditional cloud environment, the number of cloud service providers and cloud service consumers in the inter-cloud environment is huge, and the sources are numerous. Large-scale diversified data interaction and data collaboration have become the norm. Data cross-cloud and cross-organization collaboration is an important way of collaboration in the inter-cloud computing environment. However, the complexity and diversity of the inter-cloud environment also leads to greater security challenges. There are many interrelated entities and various complex cloud service links in the inter-cloud environment. There are a lot of collaborative work and resource sharing behaviors between various entities. These behaviors are realized through the interaction of network traffic. The frequent flow of network traffic also makes the inter-cloud environment face a huge risk of being attacked by malicious traffic. Among them, encrypted malicious traffic can encrypt the communication content through various encryption algorithms and protocols to avoid detection and interception. Its existence brings huge hidden dangers to the ecology of the inter-cloud environment. It is very necessary to study the detection of encrypted malicious traffic in the inter-cloud environment. Traditional encrypted malicious traffic detection mainly includes three categories: rule-based detection algorithm, machine learning or deep learning detection algorithm based on manual feature extraction, and deep learning detection algorithm based on feature self-learning. The detection algorithm based on rules has low recognition efficiency; the machine learning or deep learning detection algorithm based on manual feature extraction is complex and laborious; the deep learning detection algorithm based on feature self-learning has excellent performance in traditional network environments due to its good nonlinear modeling ability. These traditional encrypted malicious traffic detection algorithms have good performance in conventional network environments, but due to the large amount of data interaction in the cloud environment, many service entities, and complex collaborative links, traditional detection methods are difficult to apply to the cloud environment.

[0004] Compared with the research on encrypted malicious traffic detection in traditional network environments, the encrypted malicious traffic detection in cloud environments faces the following challenges: (1) Different from conventional network environments and cloud environments, the network traffic data in cloud environments is often larger and contains a lot of redundant information. The research on encrypted malicious traffic detection needs to process more complex data; (2) There are a large number of entities in the cloud environment, and the cloud service links are complex. The complex behaviors such as resource sharing and collaborative work between entities allow encrypted malicious traffic to have a larger flow space, making it impossible to meet the requirements for detection efficiency and accuracy; (3) The current encrypted malicious traffic detection methods used in traditional network environments are difficult to cope with the complex cloud environment.

[0005] It can be seen that the research problem of encrypted malicious traffic detection in cloud environments needs to be solved urgently. Summary of the invention

[0006] In response to the above defects or improvement needs of the prior art, the present invention provides an encrypted malicious traffic detection method for a cloud computing environment, thereby solving the technical problem of poor detection effect of the existing methods and filling the research gap of encrypted malicious traffic detection in a cloud environment.

[0007] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0008] A first aspect provides an encrypted malicious traffic detection method for a cloud computing environment, comprising:

[0009] Preprocess the original encrypted traffic data to obtain an encrypted traffic graph;

[0010] The encrypted traffic recognition network built based on the BoTNet model is used to integrate global features through the self-attention mechanism to extract the spatial features of the encrypted traffic image;

[0011] The BiLSTM model is used to extract the temporal features containing forward and backward time series information in the encrypted traffic image;

[0012] The extracted spatial features and temporal features are fused using feature fusion technology based on cross-attention mechanism;

[0013] Mining cloud service entity knowledge in cloud environments;

[0014] Encrypted malicious traffic in the cloud environment is detected based on the fused features and mined cloud service entity knowledge.

[0015] In one implementation, preprocessing the original encrypted traffic data to obtain an encrypted traffic graph includes:

[0016] The original encrypted traffic data is segmented and cleaned, and the length of the data packets is unified. Finally, each data packet is converted into a grayscale image.

[0017] In one embodiment, an encrypted traffic identification network built based on the BoTNet model builds a backbone network based on the BoTNet model, which includes a total of 4 stages. The first 3 stages are composed of Bottleneck, which are internally connected by a residual network. The fourth stage is a BoT module including a multi-head self-attention mechanism.

[0018] In one implementation, an encrypted traffic identification network built based on the BoTNet model is used to extract spatial features of encrypted traffic images by integrating global features through a self-attention mechanism, including:

[0019] Use Bottleneck to extract features from encrypted traffic graphs:

[0020] Y = ReLU(W3*ReLU(W2*ReLU(W1*x neck ))+x neck )

[0021] Where Y represents the output of each Bottleneck, x neck represents the feature input of Bottleneck, W1, W2, W3 represent the weight matrices of three convolutions respectively, * represents the convolution operation, and ReLU is the activation function;

[0022] The BoT module is used to aggregate the feature information captured by the convolutional network through a global self-attention mechanism:

[0023] F S =ReLU(W3*MHSA(ReLU(W1*x BoT ))+x BoT )

[0024] where x BoT represents the feature input of the BoT module, W1 and W3 represent the weight matrices of the two convolutions respectively, MHSA represents the multi-head self-attention mechanism, * represents the convolution operation, ReLU is the activation function, and the output feature map F S As spatial characteristics of encrypted traffic.

[0025] In one implementation, the extracted spatial features and temporal features are fused using a feature fusion technique based on a cross-attention mechanism, including:

[0026] Based on the cross-attention mechanism, two independent embedding sequences of the same dimension are combined together in an asymmetric way on the input. The cross-attention mechanism uses two input sequences, one as the query input and the other as the key and value input. The query input corresponds to the spatial features of the encrypted traffic, and the key and value inputs correspond to the temporal features of the encrypted traffic.

[0027] In one embodiment, mining cloud service entity knowledge in a cloud environment includes:

[0028] The correlation degree between various entities involved in cloud services is mined, and the detection weight corresponding to each entity is generated.

[0029] In one implementation, mining the association degree between various entities participating in the cloud service and generating a detection weight corresponding to each entity includes:

[0030] Determine the factors that influence the degree of association;

[0031] Different weights are assigned to the determined influencing factors to reflect the importance of each influencing factor to the degree of association of the host. For two cloud service entities A and B in the cloud environment, the degree of association calculation formula is:

[0032]

[0033] Where R(A, B) represents the degree of association between A and B, S(A, B) represents the resource sharing frequency between A and B, C(A, B) represents the number of collaborative tasks between A and B, T(A, B) represents the network topological distance between A and B, and α1, α2 and α3 represent the weights corresponding to different influencing factors;

[0034] Normalize the degree of association:

[0035]

[0036] Among them, max(R) is the maximum value of all association degrees, and mmin(R) is the minimum value of all association degrees;

[0037] A correlation matrix is ​​established to represent the entity correlation in the entire cloud environment. The correlation matrix is:

[0038]

[0039] Where n represents the number of entities, R(A i , A j ) represents the association between entity i and entity j. If i = j, then R(A i , A j )=1;

[0040] The detection weight corresponding to each entity is generated according to the association degree matrix. The detection weight of the i-th entity is:

[0041] W i =R(A i , A1)+R(A i , A2)+…+R(A i , A n )

[0042] Normalize the detection weights:

[0043]

[0044] Where max(W) is the maximum value of all detection weights, min(W) is the minimum value of all detection weights, and W i is the detection weight of the i-th entity, W′ i is the normalized detection weight of the i-th entity.

[0045] Based on the same inventive concept, the second aspect of the present invention provides an encrypted malicious traffic detection system for a cloud computing environment, comprising:

[0046] The encrypted traffic preprocessing module is used to preprocess the original encrypted traffic data to obtain an encrypted traffic graph;

[0047] The encrypted traffic feature extraction module is used to extract the spatial features of the encrypted traffic image by integrating global features through the self-attention mechanism using the encrypted traffic identification network built based on the BoTNet model;

[0048] And use the BiLSTM model to extract the time features containing forward and backward time series information in the encrypted traffic image;

[0049] The cloud service entity knowledge mining module is used to fuse the extracted spatial features and temporal features using feature fusion technology based on the cross-attention mechanism;

[0050] The cloud service entity knowledge mining module is used to mine the cloud service entity knowledge in the cloud environment;

[0051] The cloud-based encrypted malicious traffic detection module is used to detect encrypted malicious traffic in the cloud environment based on the fused features and mined cloud service entity knowledge.

[0052] Based on the same inventive concept, the third aspect of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the encrypted malicious traffic detection method for a cloud computing environment described in the first aspect is implemented.

[0053] Based on the same inventive concept, the fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the encrypted malicious traffic detection method for a cloud computing environment described in the first aspect is implemented.

[0054] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0055] (1) The present invention adopts multimodal technology and deep learning models to build an encrypted malicious traffic identification network in a cloud environment, and improves the model's ability to process complex network traffic data in a cloud environment by integrating features of different modalities.

[0056] (2) The present invention proposes a method for mining cloud service entity knowledge. The method is used to mine the degree of association between various entities participating in cloud services, generate detection weights for each entity and thereby assist the entire model in detecting cloud-encrypted malicious traffic, thereby effectively improving the detection effect of the model in a cloud environment.

[0057] (3) The present invention converts encrypted network traffic data into encrypted traffic graphs, uses a model to capture the global and local features of encrypted traffic, fuses all features in an attention-based manner, and effectively combines cloud service entity knowledge into specific detection links, providing a new solution for the research on encrypted malicious traffic detection in cloud environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 The overall flow chart of the encrypted malicious traffic detection method for cloud computing environment according to an embodiment of the present invention;

[0060] Figure 2 A schematic diagram of a process flow for preprocessing encrypted traffic provided by an embodiment of the present invention;

[0061] Figure 3 Schematic diagram of the structure of an encrypted traffic identification network built based on the BoTNet model in an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The present invention discloses a method for detecting encrypted malicious traffic in a cloud computing environment, which mainly includes the following steps: preprocessing the encrypted traffic; extracting the spatial and temporal features of the preprocessed encrypted traffic using a deep learning model, and after the feature extraction is completed, using a feature fusion technology based on a cross-attention mechanism to fuse the two features; mining the cloud service entity knowledge in the cloud environment to assist the model in detecting encrypted malicious traffic in the cloud environment; the model fuses the spatiotemporal features of the encrypted traffic and the cloud service entity knowledge to detect the encrypted malicious traffic in the cloud environment. The present invention is based on a deep learning model and simultaneously utilizes multimodal technology and external knowledge of the cloud environment, which can effectively solve the problem of detecting encrypted malicious traffic in the cloud environment and maintain the network security of the cloud environment.

[0063] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] Embodiment 1

[0065] The present invention discloses a method for detecting encrypted malicious traffic in a cloud computing environment, comprising:

[0066] S1: preprocess the original encrypted traffic data to obtain an encrypted traffic graph;

[0067] S2: The encrypted traffic recognition network built based on the BoTNet model is used to integrate global features through the self-attention mechanism to extract the spatial features of the encrypted traffic image;

[0068] S3: Use the BiLSTM model to extract the temporal features containing forward and backward time series information in the encrypted traffic image;

[0069] S4: The extracted spatial features and temporal features are fused using feature fusion technology based on cross-attention mechanism;

[0070] S5: Mining inter-cloud service entity knowledge in inter-cloud environments;

[0071] S6: Detect encrypted malicious traffic in the cloud environment based on the fused features and mined cloud service entity knowledge.

[0072] Specifically, the BoTNet model is the Bottleneck Transformer model, which is a deep learning model proposed by Google that combines the advantages of Transformer and ResNet and is suitable for computer vision tasks. The BiLSTM (Bidirectional Long Short-Term Memory) model is a neural network model that combines forward LSTM and backward LSTM.

[0073] In one implementation, preprocessing the original encrypted traffic data to obtain an encrypted traffic graph includes:

[0074] The original encrypted traffic data is segmented and cleaned, and the length of the data packets is unified. Finally, each data packet is converted into a grayscale image.

[0075] During the specific implementation process, the specific steps of encrypted traffic preprocessing are as follows:

[0076] A1. Traffic segmentation and encryption: The original traffic is encrypted during the communication process, so the encryption algorithm encrypts the application layer data, but the data packet still has visible fields. The pcap file of the network traffic data is segmented into smaller files according to the session standard, and the traffic is split into a two-way communication flow plus the representation of all protocols.

[0077] A2. Traffic cleaning: deleting duplicate packets and packets that do not carry a payload, reducing redundant information in the traffic.

[0078] A3. Unify the data length. Since the length and number of each sample data packet are different, they cannot be directly input into the neural network, so the data length needs to be unified. Here, the method based on retaining the complete data packet is adopted, the UDP header of the data packet is filled to 20 bytes, the first 784 bytes of each traffic data packet are intercepted, and the data packet length is less than 784 bytes. 0 is added.

[0079] A4. Convert data packets into images. Divide each session into data packets, and then further convert each data packet into a grayscale image. The specific image size is 28×28.

[0080] In one embodiment, an encrypted traffic identification network built based on the BoTNet model builds a backbone network based on the BoTNet model, which includes a total of 4 stages. The first 3 stages are composed of Bottleneck, which are internally connected by a residual network. The fourth stage is a BoT module including a multi-head self-attention mechanism.

[0081] In one implementation, an encrypted traffic identification network built based on the BoTNet model is used to extract spatial features of encrypted traffic images by integrating global features through a self-attention mechanism, including:

[0082] Use Bottleneck to extract features from encrypted traffic graphs:

[0083] Y = ReLU(W3*ReLU(W2*ReLU(W1*x neck ))+x neck )

[0084] Where Y represents the output of each Bottleneck, x neck represents the feature input of Bottleneck, W1, W2, W3 represent the weight matrices of three convolutions respectively, * represents the convolution operation, and ReLU is the activation function;

[0085] The BoT module is used to aggregate the feature information captured by the convolutional network through a global self-attention mechanism:

[0086] F S =ReLU(W′3*MHSA(ReLU(W′1*x BoT ))+x BoT )

[0087] where x BoT represents the feature input of the BoT module, W′1 and W′3 represent the weight matrices of two convolutions respectively, MHSA represents the multi-head self-attention mechanism, * represents the convolution operation, ReLU is the activation function, and the output feature map F S As spatial characteristics of encrypted traffic.

[0088] Specifically, the feature extraction of the present invention is divided into two parts: encrypted traffic spatial feature extraction and encrypted traffic temporal feature extraction. The encrypted traffic spatial feature extraction builds a backbone network based on the BoTNet model. The BoTNet multi-layer residual block extracts low-resolution encrypted traffic feature maps layer by layer, and then uses the BoT block to integrate the global spatial feature information.

[0089] See also Figure 3 The encrypted traffic identification network built based on the BoTNet model consists of four stages. The first three stages are composed of Bottleneck. The fourth stage integrates global encrypted traffic features through the BoT module containing a multi-head self-attention mechanism. Compared with Bottleneck, the BoT module simply replaces its 3×3 convolution with a multi-head self-attention mechanism. The BoT module can aggregate the feature information captured by the convolutional network through the global self-attention mechanism. It retains both the local feature extraction capability and the global information capture capability.

[0090] The process of spatial feature extraction is as follows:

[0091] The original encrypted traffic graph is used as input and input into the Bottleneck module. After passing through multiple Bottleneck modules, feature extraction is performed layer by layer (the original encrypted traffic graph is used as the input of the first Bottleneck module, the features extracted by the first Bottleneck module are used as the input of the second Bottleneck module, and the output of the second Bottleneck module is used as the input of the third Bottleneck module). The extracted features then enter the BoT module for the final feature extraction, and finally F is obtained. S The encrypted traffic time feature extraction builds a backbone network based on the BiLSTM model, which is parallel to the encrypted traffic spatial feature extraction part. BiLSTM extracts the time feature information containing forward and backward time features in the original traffic. LSTM contains a multi-layer LSTM network, and each layer uses 32 hidden units.

[0092] In one implementation, the extracted spatial features and temporal features are fused using a feature fusion technique based on a cross-attention mechanism, including:

[0093] Based on the cross attention mechanism, two independent embedding sequences of the same dimension are combined together in an asymmetric way on the input, where the cross attention mechanism uses two input sequences, one as the query input and the other as the key and value input.

[0094] Specifically, the specific calculation formula with cross attention is as follows:

[0095] Q=X1W Q

[0096] K=V=X2W K

[0097]

[0098] Where X1 is the spatial feature of the input, X2 is the temporal feature of the input, Q is the query vector, K is the key vector, V is the value vector, and W Q is the query weight matrix, W K is the key weight matrix, d2 is the dimension of the key vector, and Softmax is the normalization function.

[0099] In one embodiment, mining cloud service entity knowledge in a cloud environment includes:

[0100] The correlation degree between various entities involved in cloud services is mined, and the detection weight corresponding to each entity is generated.

[0101] Specifically, since the strength of the correlation between service entities in the cloud environment also affects the trend of encrypted malicious traffic, for example, multiple cloud service providers that share the same resources are often more vulnerable to malicious attacks. Based on this, this embodiment proposes a method for mining cloud service entity knowledge, which is used to mine the correlation between various entities participating in cloud services, generate detection weights for each entity, and use this to assist the entire model in detecting cloud encrypted malicious traffic;

[0102] In the specific implementation process, when mining the degree of association between various entities participating in cloud services, we first extract the factors that affect the association between various entities, including: resource sharing frequency, resource integration degree, task collaboration times, data exchange volume, and network topology distance. Different weights are assigned to the above factors to reflect their importance to the entity association. The measurement formula for each factor is set, and then the final degree of association is obtained by comprehensive calculation. After normalizing all the degrees of association, the detection weight corresponding to each entity is generated.

[0103] In one implementation, mining the association degree between entities participating in the cloud service and generating a detection weight corresponding to each entity includes:

[0104] B1. Determine the factors affecting the degree of association;

[0105] B2. Different weights are assigned to the determined influencing factors to reflect the importance of each influencing factor to the degree of association of the host. For two cloud service entities A and B in the cloud environment, the degree of association calculation formula is:

[0106]

[0107] Where R(A, B) represents the degree of association between A and B, S(A, B) represents the resource sharing frequency between A and B, C(A, B) represents the number of collaborative tasks between A and B, T(A, B) represents the network topological distance between A and B, and α1, α2 and α3 represent the weights corresponding to different influencing factors;

[0108] B3. Normalize the degree of association:

[0109]

[0110] Where max(R) is the maximum value among all association degrees, and min(R) is the minimum value among all association degrees;

[0111] B4. Establish a correlation matrix to represent the entity correlation in the entire cloud environment. The correlation matrix is:

[0112]

[0113] Where n represents the number of entities, R(A i , A j ) represents the association between entity i and entity j. If i = j, then R(A i , A j )=1;

[0114] B5. Generate the detection weight corresponding to each entity according to the association degree matrix. The detection weight of the i-th entity is:

[0115] W i =R(A i , A1)+R(A i , A2)+…+R(A i , A n )

[0116] B6. Normalize the detection weights:

[0117]

[0118] Where max(W) is the maximum value of all detection weights, min(W) is the minimum value of all detection weights, and W i is the detection weight of the i-th entity, W′ i is the normalized detection weight of the i-th entity.

[0119] Specifically, the factors affecting the degree of association determined in B1 include: resource sharing frequency, task collaboration times, and network topology distance. In order to ensure the comparability of the association between different entities, each indicator is normalized through B3 by scaling the maximum and minimum values ​​of each indicator. When there are n entities, the association matrix in B4 is an n×n matrix. B5 calculates the sum of each row of the matrix to obtain the detection weight of the corresponding entity.

[0120] Embodiment 2

[0121] Based on the same inventive concept, this embodiment discloses an encrypted malicious traffic detection system for a cloud computing environment, including:

[0122] The encrypted traffic preprocessing module is used to preprocess the original encrypted traffic data to obtain an encrypted traffic graph;

[0123] The encrypted traffic feature extraction module is used to extract the spatial features of the encrypted traffic image by integrating global features through the self-attention mechanism using the encrypted traffic identification network built based on the BoTNet model;

[0124] And use the BiLSTM model to extract the time features containing forward and backward time series information in the encrypted traffic image;

[0125] The cloud service entity knowledge mining module is used to fuse the extracted spatial features and temporal features using feature fusion technology based on the cross-attention mechanism;

[0126] The cloud service entity knowledge mining module is used to mine the cloud service entity knowledge in the cloud environment;

[0127] The cloud-based encrypted malicious traffic detection module is used to detect encrypted malicious traffic in the cloud environment based on the fused features and mined cloud service entity knowledge.

[0128] Specifically, the cloud-to-cloud encrypted malicious traffic detection module provided by the present invention is used to integrate the information provided by the feature fusion module and the cloud-to-cloud entity knowledge mining module, and use the trained classifier to identify the encrypted malicious traffic in the cloud environment. The input of the cloud-to-cloud encrypted malicious traffic module consists of the spatiotemporal feature information provided by the feature fusion module and the cloud-to-cloud entity detection weights provided by the cloud-to-cloud entity knowledge mining module, and its output is the detection result of the encrypted traffic. The cloud-to-cloud encrypted malicious traffic detection module pays attention to the global situation. It assigns different detection weights to different entities in the cloud environment based on the information provided by the cloud service entity knowledge mining module, so as to improve the overall detection capability of the model for encrypted malicious traffic in the cloud environment.

[0129] In the specific implementation process, the detection threshold is adjusted according to the detection weight in the inference stage of the model to control the detection sensitivity of different entities. Each entity has an independent detection threshold. For entities with higher weights, the threshold can be lowered to make the model more sensitive to the entity's traffic (that is, it is easier to judge the traffic as malicious); for entities with lower weights, the threshold can be increased to reduce false positives. Calculate the personalized threshold for each entity:

[0130] Threshold i =BaseThreshold×(1-t B ×W′ i )

[0131] Where BaseThreshold is the default detection threshold of the model, t B is the balance coefficient of the detection weight, W′ i is the normalized weight of entity i. When the probability detected by the model is higher than the threshold Threshold i , the model determines that it is encrypted malicious traffic and outputs the result.

[0132] Since the system introduced in the second embodiment of the present invention is a system used to implement the encrypted malicious traffic detection method for cloud computing environment in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the system, so it is not repeated here. All systems used in the method in the first embodiment of the present invention belong to the scope of protection of the present invention.

[0133] Embodiment 3

[0134] Based on the same inventive concept, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in the first embodiment is implemented.

[0135] Since the computer-readable storage medium introduced in the third embodiment of the present invention is the computer-readable storage medium used to implement the encrypted malicious traffic detection method for cloud computing environment in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the computer-readable storage medium, so it is not repeated here. All computer-readable storage media used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0136] Embodiment 4

[0137] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in Embodiment 1 when executing the program.

[0138] Since the computer device introduced in the fourth embodiment of the present invention is a computer device used to implement the encrypted malicious traffic detection method for cloud computing environment in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the computer device, so it is not repeated here. All computer devices used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0139] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0140] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0141] Although preferred embodiments of the present invention have been described, additional changes and modifications may be made to these embodiments by those skilled in the art once the basic creative concepts are known. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations of the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for detecting encrypted malicious traffic in a cloud computing environment, characterized in that: include: Preprocess the original encrypted traffic data to obtain an encrypted traffic graph; The encrypted traffic recognition network built based on the BoTNet model is used to integrate global features through the self-attention mechanism to extract the spatial features of the encrypted traffic image; The BiLSTM model is used to extract the temporal features containing forward and backward time series information in the encrypted traffic image; The extracted spatial features and temporal features are fused using feature fusion technology based on cross-attention mechanism; Mining cloud service entity knowledge in cloud environments; Encrypted malicious traffic in the cloud environment is detected based on the fused features and mined cloud service entity knowledge.

2. The method for detecting encrypted malicious traffic in a cloud computing environment as claimed in claim 1, characterized in that: The original encrypted traffic data is preprocessed to obtain the encrypted traffic graph, including: The original encrypted traffic data is segmented and cleaned, and the length of the data packets is unified. Finally, each data packet is converted into a grayscale image.

3. The method for detecting encrypted malicious traffic in a cloud computing environment as claimed in claim 1, characterized in that: The encrypted traffic identification network built based on the BoTNet model builds a backbone network based on the BoTNet model, which includes 4 stages. The first 3 stages are composed of Bottleneck, which are internally connected by a residual network. The fourth stage is a BoT module that includes a multi-head self-attention mechanism.

4. The method for detecting encrypted malicious traffic in a cloud computing environment as claimed in claim 3, characterized in that: The encrypted traffic identification network built based on the BoTNet model is used to integrate global features through the self-attention mechanism to extract the spatial features of the encrypted traffic image, including: Use Bottleneck to extract features from encrypted traffic graphs: Y=ReLU(W3*ReLU(W2*ReLU(W1*x neck ))+x neck ) Where Y represents the output of each Bottleneck, x neck represents the feature input of Bottleneck, W1, W2, W3 represent the weight matrices of three convolutions respectively, * represents the convolution operation, and ReLU is the activation function; The BoT module is used to aggregate the feature information captured by the convolutional network through a global self-attention mechanism: F S =ReLU(W′3*MHSA(ReLU(W′1*x BoT ))+x BoT ) where x BoT represents the feature input of the BoT module, W′1 and W′3 represent the weight matrices of two convolutions respectively, MHSA represents the multi-head self-attention mechanism, * represents the convolution operation, ReLU is the activation function, and the output feature map F S As spatial characteristics of encrypted traffic.

5. The method for detecting encrypted malicious traffic in a cloud computing environment as claimed in claim 1, characterized in that: The extracted spatial features and temporal features are fused using feature fusion technology based on cross-attention mechanism, including: Based on the cross-attention mechanism, two independent embedding sequences of the same dimension are combined together in an asymmetric way on the input. The cross-attention mechanism uses two input sequences, one as the query input and the other as the key and value input. The query input corresponds to the spatial features of the encrypted traffic, and the key and value inputs correspond to the temporal features of the encrypted traffic.

6. The method for detecting encrypted malicious traffic in a cloud computing environment as claimed in claim 5, characterized in that: Mining cloud service entity knowledge in cloud environments, including: The correlation degree between various entities involved in cloud services is mined, and the detection weight corresponding to each entity is generated.

7. The method for detecting encrypted malicious traffic in a cloud computing environment as claimed in claim 6, characterized in that: Mining the correlation between entities involved in cloud services, generating detection weights corresponding to each entity, including: Determine the factors that influence the degree of association; Different weights are assigned to the determined influencing factors to reflect the importance of each influencing factor to the degree of association of the host. For two cloud service entities A and B in the cloud environment, the degree of association calculation formula is: Where R(A,B) represents the degree of association between A and B, S(A,B) represents the resource sharing frequency between A and B, C(A,B) represents the number of collaborative tasks between A and B, T(A,B) represents the network topological distance between A and B, and α1, α2 and α3 represent the weights corresponding to different influencing factors; Normalize the degree of association: Among them, max(R) is the maximum value among all association degrees, and min(R) is the minimum value among all association degrees; A correlation matrix is ​​established to represent the entity correlation in the entire cloud environment. The correlation matrix is: Where n represents the number of entities, R(A i ,A j ) represents the association between entity i and entity j. If i = j, then R(A i ,A j )=1; The detection weight corresponding to each entity is generated according to the association degree matrix. The detection weight of the i-th entity is: W i =R(A i ,A1)+R(A i ,A2)+…+R(A i ,A n ) Normalize the detection weights: Where max(W) is the maximum value of all detection weights, min(W) is the minimum value of all detection weights, and W i is the detection weight of the i-th entity, W′ i is the normalized detection weight of the i-th entity.

8. An encrypted malicious traffic detection system for cloud computing environment, characterized in that: include: The encrypted traffic preprocessing module is used to preprocess the original encrypted traffic data to obtain an encrypted traffic graph; The encrypted traffic feature extraction module is used to extract the spatial features of the encrypted traffic image by integrating global features through the self-attention mechanism using the encrypted traffic identification network built based on the BoTNet model; And use the BiLSTM model to extract the time features containing forward and backward time series information in the encrypted traffic image; The cloud service entity knowledge mining module is used to fuse the extracted spatial features and temporal features using feature fusion technology based on the cross-attention mechanism; The cloud service entity knowledge mining module is used to mine the cloud service entity knowledge in the cloud environment; The cloud-based encrypted malicious traffic detection module is used to detect encrypted malicious traffic in the cloud environment based on the fused features and mined cloud service entity knowledge.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, it implements the encrypted malicious traffic detection method for a cloud computing environment as described in any one of claims 1 to 7.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the encrypted malicious traffic detection method for a cloud computing environment is implemented as described in any one of claims 1 to 7.

Images