Malicious traffic remodeling method based on feature serialization

Abstract

The invention relates to the technical field of network security and network simulation, and discloses a malicious traffic remodeling method based on feature serialization. The method comprises the following steps: collecting traffic data of a target network environment, extracting serialization features of a load and a time interval, and further performing statistics to obtain session flow features; according to Pareto distribution, normal distribution, logarithmic normal distribution and Poisson distribution probability distribution models, serialization features conforming to target network flow features are generated, and the probability distribution model with the highest similarity with the target network flow is selected by calculating the Euclidean distance; and finally, on the basis of the model, remodeling the load and time interval sequence of the malicious traffic, and generating the network attack traffic which is difficult to detect. According to the method, the concealment of the malicious traffic is effectively improved, so that the malicious traffic is more difficult to identify by an existing detection system; the generated malicious traffic can effectively test and evaluate the capability of the network intrusion detection system.

Description

Technical Field

[0001] The present invention relates to the technical field of network security and network simulation, and in particular to a malicious traffic reshaping method based on feature serialization. Background Art

[0002] With the rapid development of the Internet and the widespread application of information technology, the types and methods of network attacks are also constantly evolving and upgrading. As a core component of network security defense, traditional Network Intrusion Detection Systems (NIDS) mainly rely on real-time monitoring and analysis of network traffic to identify potential security threats. However, with the increasing complexity of attack technologies, traditional NIDS based on signature detection and rule matching have gradually become incapable of doing so. These systems perform well in the face of known threats, but their detection capabilities are severely challenged when dealing with emerging threats such as Advanced Persistent Threat (APT), zero-day attacks, and hybrid attacks.

[0003] Existing NIDS mainly rely on two detection mechanisms: feature-based detection and behavior-based detection. Feature-based detection methods identify malicious traffic by matching predefined attack signatures, but this method has significant limitations, especially when facing evolving attack methods. Attackers can bypass these signatures through simple obfuscation and deformation techniques, making NIDS unable to effectively identify them. Behavior-based detection identifies potential threats by monitoring abnormal behaviors of network traffic. Although it has certain generalization capabilities, it is not effective in identifying highly concealed attack behaviors.

[0004] In the context of network attack and defense confrontation, malicious traffic generation technology has become a research hotspot. The purpose of malicious traffic generation is to generate offensive malicious traffic by simulating or forging normal traffic characteristics in order to test and evaluate the robustness of NIDS. However, there are multiple technical difficulties in the existing malicious traffic generation technology. First, the generated malicious traffic often lacks sufficient concealment, making it easy to be detected by NIDS, which loses the meaning of simulating real attacks. Secondly, the characteristics of the generated traffic are difficult to match the real traffic characteristics of the target network, which makes it difficult for the generated traffic to disguise as legitimate traffic in the network environment, thereby increasing the risk of detection. In addition, existing malicious traffic generation methods usually rely on predefined traffic distribution models and lack flexibility and adaptability. This generation method that relies on fixed patterns performs poorly in complex and changeable network environments and is difficult to cope with the diverse traffic characteristics under different network conditions. Summary of the invention

[0005] In view of the above problems, the purpose of the present invention is to provide a malicious traffic reshaping method based on feature serialization. By optimizing the network traffic generator through sampling test method, malicious network traffic with concealment and aggressiveness can be generated, thereby improving the ability to resist network intrusion detection system (NIDS). The technical solution is as follows:

[0006] A malicious traffic reshaping method based on feature serialization includes the following steps:

[0007] Step 1: Collect traffic data during peak hours and off-peak hours from the target network environment, and capture data packets at key nodes through a network sniffer; and pre-process and extract features from the collected traffic data to obtain serialization features and session flow features of the target network; the serialization features include load serialization features and time serialization features;

[0008] Step 2: Generate several serialization features and session flow features that meet the given flow statistical features according to several probability distribution models;

[0009] Step 3: Use the Euclidean distance to measure the similarity between the serialization features and conversation flow features generated under different probability distribution models and the serialization features and conversation flow features of the target network traffic, and select the probability distribution model with the minimum Euclidean distance as the probability distribution model for generating the target network traffic;

[0010] Step 4: Calculate the session flow features of the malicious traffic that needs to be reshaped, and then generate serialization features according to the selected probability distribution model; based on the generated load serialization features, sequentially extract data from the application layer payload of the merged original malicious traffic to build a new data packet; at the same time, based on the generated time serialization features, assign corresponding timestamps according to the order of the data packets; finally, generate the corresponding network traffic through Scapy.

[0011] Furthermore, the extraction of serialization features in step 1 is specifically as follows:

[0012] Step 1.1: Extract the load serialization features: Count the size of each data packet in the traffic data and form a load feature sequence. Let X = {x1, x2, x3..., x m} is the payload size set of the data packet, where x i Indicates the size of the i-th data packet, i = 1, 2, ..., m;

[0013] Step 1.2: Time series feature: Record the sending time of each data packet in the traffic data and calculate the time difference between adjacent data packets to form a time interval sequence; let T = {t1, t2, t3..., t n} is the time interval set of the data packet, where t jRepresents the time interval between the jth data packet and the j-1th data packet, j = 1, 2, …, n.

[0014] Furthermore, in step 2, several probability distribution models include: Pareto distribution, normal distribution, lognormal distribution and Poisson distribution, and the generation process is as follows:

[0015] 1) The process of generating a Pareto distribution is as follows: first, the number of packets is estimated based on the total data volume and the average packet size; then the initial packet size is generated using the Pareto distribution; then a function is defined to adjust the packet sizes to meet specific statistical requirements including total size, average size, and variance; and optimization is performed to determine the optimal packet size; finally, the adjusted packet size is ensured to be within the set minimum and maximum ranges, and the adjusted packet sequence and its new features are returned;

[0016] 2) The lognormal distribution is equivalent to the normal distribution on a logarithmic scale; the process of generating a lognormal distribution is as follows: first, determine the length of the sequence based on the specified sum and target mean; then initialize a base array with the target mean, and adjust each element by multiplying it by an exponential adjustment factor generated from a normal distribution so that the array conforms to a lognormal distribution; the adjusted values ​​are clipped to ensure that the generated sequence conforms to the minimum and maximum limits; then an adjustment factor is calculated to ensure that the sum of the array is consistent with the target sum, and clipped again to meet the minimum and maximum constraints; finally, a lognormal distribution sequence that has been adjusted and conforms to the specified statistical properties is returned.

[0017] 3) The process of generating Poisson distribution is as follows: first, an initial time interval sequence is generated according to the average occurrence rate of Poisson distribution; then, the initial time interval sequence is adjusted to meet the requirements of sum, mean, variance, maximum and minimum values.

[0018] Furthermore, the step 3 is specifically as follows:

[0019] Calculate the Euclidean distance between the serialization features and session flow features generated by different probability distribution models and the serialization features and session flow features of the target network traffic:

[0020] D A =α*D se +β*D sa

[0021] In the formula, s A is the total Euclidean distance, s se is the Euclidean distance between the generated serialization features and the serialization features of the target network traffic, D sais the Euclidean distance between the generated conversation flow features and the conversation flow features of the target network traffic, α and β are D se and D sa The weight coefficient is used to adjust its contribution ratio.

[0022] Furthermore, the step 4 is specifically as follows:

[0023] The process of reshaping threat traffic through the generated payload serialization features is as follows: first, the application layer payloads in the original threat traffic session flow are spliced ​​together, then the application layer payloads are re-divided according to the generated payload serialization features, and finally inserted into the data packet; in this process, the TCP checksum, IP header checksum, and Ethernet frame checksum are modified accordingly.

[0024] The beneficial effects of the present invention are:

[0025] 1) In view of the problem that the probability distribution model of the target network is difficult to accurately determine, the present invention proposes a probability distribution model selection method based on sampling comparison. By generating a variety of commonly distributed network traffic and comparing the similarity with the sampled network traffic, the probability distribution model closest to the target network can be effectively determined. This method draws on the idea of ​​selecting the best and provides a scientific basis for generating traffic that is consistent with the characteristics of the target network traffic, thereby improving the similarity and concealment between the generated traffic and the actual target network traffic, and enhancing the concealment and difficulty of detection of malicious traffic.

[0026] 2) The present invention also proposes a method for generating malicious traffic based on feature serialization. By reshaping the load and time interval sequence of the malicious traffic, this method ensures that the generated malicious traffic has probability distribution model characteristics consistent with the target network, and is difficult to distinguish from normal traffic in terms of time and load characteristics, thereby improving the concealment of the malicious traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is a flow chart of the malicious traffic reshaping method based on feature serialization in the present invention.

[0028] Figure 2 Schematic diagram of the probability distribution model selection method based on sampling comparison in the present invention. DETAILED DESCRIPTION

[0029] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0030] The present invention proposes a malicious traffic reshaping method based on feature serialization. By collecting traffic data of the target network environment, the serialization features of load and time interval are extracted, and the session flow features are further statistically obtained. Then, according to the Pareto distribution, normal distribution, log-normal distribution and Poisson distribution probability distribution models, the serialization features that meet the characteristics of the target network traffic are generated, and the probability distribution model with the highest similarity to the target network traffic is selected by calculating the Euclidean distance. Finally, based on this model, the load and time interval sequence of the malicious traffic is reshaped to generate network attack traffic that is difficult to detect. The flow chart is as follows Figure 1 As shown, the specific steps are as follows:

[0031] Step 1: Collect traffic data during peak and non-peak hours from the target network environment, and capture data packets at key nodes through a network sniffer; and pre-process and extract features from the collected traffic data to obtain serialization features and session flow features of the target network; the serialization features include load serialization features and time serialization features.

[0032] To obtain traffic data from the target network environment, you can use network sniffing tools such as Wireshark or tcpdump to capture data packets at key nodes. To ensure the representativeness and comprehensiveness of the sample, the collected data should cover peak and non-peak hours.

[0033] The collected network traffic data usually contains a large amount of raw information, including many unnecessary details that may interfere with analysis and simulation. Therefore, it is necessary to preprocess the data to extract useful information and exclude noise. Data preprocessing includes: removing damaged, incomplete or irrelevant data packets; reorganizing the filtered data packets by flow, taking the network communication session flow as the basic unit of processing; removing session flows containing no more than 6 data packets.

[0034] After preprocessing and feature extraction of the collected data, the serialization features and session flow features of the target network are obtained.

[0035] Serialization feature: refers to the set of data packet payload sizes and the set of time intervals between data packets. The former is called the payload serialization feature, and the latter is called the time serialization feature. The two are collectively called serialization features.

[0036] Session flow characteristics: refers to the sum, average, variance, maximum and minimum values ​​of the payload bytes of all packets in a session flow. It also includes the sum, average, variance, maximum and minimum values ​​of the session duration.

[0037] The extraction of load characteristics involves counting the size of each data packet in the traffic, thereby forming a load characteristic sequence. Let X = {x1, x2, x3..., x m} is the payload size set of the data packet, where x i Indicates the size of the i-th data packet.

[0038] The extraction of time interval features includes recording the sending time of each data packet in the traffic and calculating the time difference between adjacent data packets to generate a time interval sequence. Let T = {t1, t2, t3..., t n} is the time interval set of the data packet, where t j Represents the time interval between the jth packet and the j-1th packet.

[0039] Step 2: Generate multiple serialization features that conform to the given flow statistical characteristics based on multiple common probability distribution models (such as Pareto distribution, normal distribution, lognormal distribution, and Poisson distribution).

[0040] The Pareto distribution is known for its "long tail" characteristics. The process of generating a Pareto distribution is as follows: first, the number of packets is estimated based on the total data volume and the average packet size; then, the initial packet size is generated using the Pareto distribution; then, a function is defined to adjust these packet sizes to meet specific statistical requirements, such as total size, mean, and variance; after that, optimization is performed to determine the optimal packet size; finally, the adjusted packet size is ensured to be within the set minimum and maximum ranges, and the adjusted packet sequence and its characteristics are returned.

[0041] The normal distribution, also known as the Gaussian distribution, is a common probability distribution model characterized by a symmetrical bell-shaped curve. The lognormal distribution is equivalent to the normal distribution on a logarithmic scale. The steps to generate a lognormal distribution are as follows: First, the sequence length is determined based on the specified sum and target mean; then, a base array is initialized with the target mean, and each element is adjusted by multiplying it by an exponential adjustment factor generated from a normal distribution so that the array conforms to a lognormal distribution. To ensure that the generated sequence meets the minimum and maximum requirements, the adjusted values ​​are clipped. Subsequently, an adjustment factor is calculated to ensure that the sum of the array is consistent with the target sum, and it is clipped again to meet the minimum and maximum constraints. Finally, the algorithm returns a lognormal distribution sequence that has been adjusted and meets the specified statistical properties.

[0042] Poisson distribution is used to describe the number of times a random event occurs within a specific time period or spatial range. When using Poisson distribution to generate time series data, you can simulate the random occurrence of events in continuous time periods. The steps to generate Poisson distribution are as follows: First, generate an initial time interval sequence based on the average occurrence rate of Poisson distribution. Then, adjust the sequence to meet the requirements of sum, mean, variance, maximum and minimum values.

[0043] Step 3: Evaluate the similarity between the serialization features and session flow features generated by different probability distribution models and the serialization features and session flow features of the target network traffic by calculating the Euclidean distance, and finally select the probability distribution model with the smallest Euclidean distance as the probability distribution model for generating the target network traffic.

[0044] Specifically, the Euclidean distance between the features generated by different probability distribution models and the features of the target network traffic is calculated:

[0045] D A =α*D se +β*D sa

[0046] Where D A is the total Euclidean distance, D se is the Euclidean distance between the generated serialization features and the serialization features of the target network traffic, D sa is the Euclidean distance between the generated conversation flow features and the conversation flow features of the target network traffic, α and β are D se and D sa The weight coefficient is used to adjust its contribution ratio.

[0047] The schematic diagram of the probability distribution model selection method based on sampling comparison is as follows Figure 2 shown.

[0048] Step 4: First, calculate the session flow features of the malicious traffic that needs to be reshaped, and then generate the corresponding serialization features according to the selected probability distribution model. Based on the generated load serialization features, extract data one by one from the application layer payload of the merged original malicious traffic to construct new data packets. At the same time, use the generated time serialization features to assign corresponding timestamps to these data packets. Finally, generate the corresponding network traffic through Scapy.

[0049] In the process of reshaping malicious traffic, the application layer payloads of the original threat traffic are first spliced, and then these application layer payloads are re-divided according to the generated payload serialization characteristics and inserted into new packets. In this process, necessary adjustments need to be made to the TCP checksum, IP header checksum, and Ethernet frame checksum.

Claims

1. A malicious traffic reshaping method based on feature serialization, characterized in that: The following steps are involved: Step 1: Collect traffic data during peak hours and off-peak hours from the target network environment, and capture data packets at key nodes using a network sniffer; The collected traffic data is preprocessed and feature extracted to obtain serialization features and session flow features of the target network; the serialization features include load serialization features and time serialization features; Step 2: Generate several serialization features and session flow features that meet the given flow statistical features according to several probability distribution models; Step 3: Use the Euclidean distance to measure the similarity between the serialization features and conversation flow features generated under different probability distribution models and the serialization features and conversation flow features of the target network traffic, and select the probability distribution model with the minimum Euclidean distance as the probability distribution model for generating the target network traffic; Step 4: Calculate the session flow features of the malicious traffic that needs to be reshaped, and then generate serialization features according to the selected probability distribution model; Based on the generated load serialization features, data is sequentially extracted from the application layer payload of the merged original malicious traffic to construct a new data packet. At the same time, based on the generated time serialization features, corresponding timestamps are assigned according to the order of the data packets. Finally, the corresponding network traffic is generated through Scapy.

2. The method for reshaping malicious traffic based on feature serialization according to claim 1 is characterized in that: The extraction of serialization features in step 1 is specifically as follows: Step 1.1: Extract load serialization features: Count the size of each data packet in the traffic data and form a load feature sequence. Let X = {x1, x2, x3..., x m } is the payload size set of the data packet, where x i represents the size of the i-th data packet, i = 1, 2, ..., m; Step 1.2: Time series feature: Record the sending time of each data packet in the traffic data and calculate the time difference between adjacent data packets to form a time interval sequence; let T = {t1, t2, t3..., t n } is the time interval set of the data packet, where t j Represents the time interval between the jth data packet and the j-1th data packet, j = 1, 2, …, n.

3. The method for reshaping malicious traffic based on feature serialization according to claim 1 is characterized in that: In step 2, several probability distribution models include: Pareto distribution, normal distribution, lognormal distribution and Poisson distribution, and the generation process is as follows: 1) The process of generating a Pareto distribution is as follows: first, the number of packets is estimated based on the total data volume and the average packet size; then the initial packet size is generated using the Pareto distribution; then a function is defined to adjust the packet sizes to meet specific statistical requirements including total size, average size, and variance; and optimization is performed to determine the optimal packet size; finally, the adjusted packet size is ensured to be within the set minimum and maximum ranges, and the adjusted packet sequence and its new features are returned; 2) The lognormal distribution is equivalent to the normal distribution on a logarithmic scale; the process of generating a lognormal distribution is as follows: first, the length of the sequence is determined based on the specified sum and target mean; then a base array is initialized with the target mean, and each element is adjusted by multiplying it by an exponential adjustment factor generated from the normal distribution so that the array conforms to the lognormal distribution; the adjusted values ​​are clipped to ensure that the generated sequence meets the minimum and maximum constraints; then an adjustment factor is calculated to ensure that the sum of the array is consistent with the target sum, and clipped again to meet the minimum and maximum constraints; finally, the algorithm returns a lognormal distribution sequence that has been adjusted and meets the specified statistical properties; 3) The process of generating Poisson distribution is as follows: first, an initial time interval sequence is generated according to the average occurrence rate of Poisson distribution; then, the initial time interval sequence is adjusted to meet the requirements of sum, mean, variance, maximum and minimum values.

4. The method for reshaping malicious traffic based on feature serialization according to claim 1 is characterized in that: The step 3 is specifically as follows: Calculate the Euclidean distance between the serialization features and session flow features generated by different probability distribution models and the serialization features and session flow features of the target network traffic: D A =α*D se +β*D sa Where D A is the total Euclidean distance, D se is the Euclidean distance between the generated serialization features and the serialization features of the target network traffic, D sa is the Euclidean distance between the generated conversation flow features and the conversation flow features of the target network traffic, α and β are D se and D sa The weight coefficient is used to adjust its contribution ratio.

5. The method for reshaping malicious traffic based on feature serialization according to claim 1 is characterized in that: The step 4 is specifically as follows: The process of reshaping threat traffic through the generated payload serialization features is as follows: first, the application layer payloads in the original threat traffic session flow are spliced ​​together, then the application layer payloads are re-divided according to the generated payload serialization features, and finally inserted into the data packet; in this process, the TCP checksum, IP header checksum, and Ethernet frame checksum are modified accordingly.

Images