A collaborative detection method and system for encrypted malicious disguised traffic

Abstract

The present invention relates to the field of collaborative detection technology, and in particular to a collaborative detection method and system for encrypted malicious disguised traffic, wherein the method comprises: in response to an encrypted traffic detection request sent by a sending end, performing traffic parsing on the encrypted traffic to be detected; using a Bloom filter to perform preliminary screening on the parsed traffic; using a firewall to perform deep detection on the preliminary screening result; wherein the deep detection is performed using an LSTM model, and the input value of the LSTM model includes: the timing characteristics of the operation code in the traffic, the long-term timing characteristics of the IP jump address, and the third characteristic, wherein the third characteristic refers to the characteristic learned from the long-term timing characteristics of the IP jump address based on the HMM; performing consistency check on the deep detection result to obtain the detection result of the encrypted traffic. The confidentiality and security of the transmitted data are guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of collaborative detection technology, and in particular to a collaborative detection method and system for encrypted malicious disguised traffic. Background Art

[0002] In the untrusted 5G mobile IoT communication network, there is a lot of user sensitive information. In order to protect the privacy of users and the security of network communications, and to prevent attackers from eavesdropping and intercepting users' private information, encrypted transmission is usually used. However, the introduction of encrypted transmission also provides many opportunities for attackers. On the one hand, attackers can use encrypted traffic to hide their malicious behaviors, such as maliciously transmitting loads and returning data. On the other hand, the encryption mechanism also makes it easier for attackers to disguise threat activities as normal network communications, which will bring more serious threats to network security.

[0003] Since the encryption process converts the original stream data into a pseudo-random meaningless character sequence, the traditional detection method based on Deep Packet Inspection (DPI) is no longer applicable. Although some machine learning-based methods attempt to process encrypted malicious traffic, this is usually cumbersome and relies on manually designed functions. Existing encrypted malicious traffic detection methods usually use deep learning or graph neural networks to capture the spatiotemporal characteristics of encrypted traffic such as flow duration, packet time interval, packet size, number of packets, etc. Since malware lacks security and formality guarantees, the various information negotiated in the TLS handshake phase is different from normal communication. Therefore, some research methods also use the TLS data features in the handshake phase to detect encrypted malicious traffic.

[0004] With the rapid development of artificial intelligence, some malicious attackers have applied Generative Adversarial Networks (GAN) to traffic camouflage technology (such as traffic deformation, link filling, etc.). Before transmitting malicious code, attackers use benign traffic as a learning object to generate adversarial traffic that is indistinguishable from benign traffic, thereby bypassing the method of using deep learning / graph neural network to detect encrypted malicious traffic based on traffic characteristics, making the current mainstream encrypted malicious traffic detection method ineffective. Summary of the invention

[0005] In order to address the deficiencies in the prior art, the present invention provides a collaborative detection method and system for encrypted malicious disguised traffic; the Bloom filter and the firewall are enabled to collaboratively detect disguised encrypted malicious traffic, and the detection can be completed with very high efficiency, breaking the existing limitations of using artificial intelligence technology to detect encrypted malicious traffic characteristics. At the same time, when the transmitted data is ciphertext, the legitimacy of the operation code in the transmitted content can be detected, thereby ensuring the confidentiality and security of the transmitted data.

[0006] On the one hand, a collaborative detection method for encrypted malicious disguised traffic is provided, including:

[0007] In response to the encrypted traffic detection request sent by the sending end, the encrypted traffic to be detected is analyzed;

[0008] For the parsed traffic, Bloom filters are used for preliminary screening;

[0009] For the preliminary screening results, a firewall is used to perform deep detection; the deep detection is performed using an LSTM model, and the input values ​​of the LSTM model include: the timing characteristics of the operation code in the traffic, the long-term timing characteristics of the IP jump address, and the third feature, which refers to the feature learned from the long-term timing characteristics of the IP jump address based on the HMM;

[0010] Perform consistency check on the deep detection results to obtain the detection results of encrypted traffic.

[0011] On the other hand, a collaborative detection system for encrypted malicious disguised traffic is provided, including:

[0012] A parsing module, configured to: perform traffic parsing on the encrypted traffic to be detected in response to an encrypted traffic detection request sent by a sending end;

[0013] A preliminary screening module, which is configured to: perform preliminary screening on the parsed traffic using a Bloom filter;

[0014] A deep detection module is configured to: perform deep detection on the preliminary screening results using a firewall; wherein the deep detection is performed using an LSTM model, and the input values ​​of the LSTM model include: the timing characteristics of the operation code in the traffic, the long-term timing characteristics of the IP jump address, and a third characteristic, wherein the third characteristic refers to a characteristic learned from the long-term timing characteristics of the IP jump address based on the HMM;

[0015] The verification module is configured to: perform consistency verification on the deep detection result to obtain the detection result of the encrypted traffic.

[0016] The above technical solution has the following advantages or beneficial effects:

[0017] The method allows the firewall to perform dual detection of unknown encrypted malicious disguised traffic in combination with the Bloom filter, thereby improving the accuracy and reliability of the detection and ensuring the security of the user's communication network. Specifically, the method proposed in the present invention is divided into two stages: the preliminary screening stage and the deep detection stage, and the preliminary screening stage precedes the deep detection stage. In the preliminary screening stage, the Bloom filter first performs a legitimacy screening based on the opcode operation code hash value in the transmitted content. This is the first method for detecting encrypted malicious code based on content opcode operation code.

[0018] At the same time, in order to prevent false positives of the Bloom filter, the present invention transmits the preliminary detection results of the Bloom filter to the firewall, and the firewall performs further deep detection. In the deep detection stage, in order to prevent encrypted malicious disguised traffic from bypassing the detection of the current deep learning / deep learning malicious traffic detection method based on traffic characteristics, increase the difficulty of the attacker's disguise and make it impossible for him to correctly learn the user's traffic characteristics, the present invention uses a dynamic defense method to randomize the IP address of the user's transmission information and the jump cycle artificial intelligence detection method of the dynamically changing IP address.

[0019] Then, the firewall further learns the timing characteristics of the opcodes in the traffic of the initial detection results of the Bloom filter through the long short-term memory network (LSTM), the long-term timing characteristics of the IP hop address, and the output of the IP hop timing transfer characteristics learned based on the HMM as additional input features of the LSTM. The LSTM further performs in-depth detection on possible false positive traffic by comprehensively learning the input features, discovers potential encrypted malicious disguised traffic and processes it.

[0020] By using the present invention, the coordinated monitoring of encrypted malicious disguised traffic by Bloom filters and firewalls is realized, and efficient detection of unknown disguised encrypted malicious traffic can be obtained. Compared with other patents, the present invention combines the use of Bloom filters to perform preliminary screening based on content operation codes opcodes in the transmission traffic and the use of firewalls to perform further deep detection of encrypted malicious disguised traffic that may be false positives. Putting the Bloom filter that can quickly screen malicious traffic into the preliminary screening stage reduces the processing pressure of the firewall. In the deep detection stage, the firewall only needs to perform deep inspection on the remaining traffic and concentrate resources to process potential abnormal traffic. The two work together to significantly improve the detection performance and accuracy, which is very suitable for the security protection of high-traffic networks. Compared with existing encrypted malicious traffic detection systems, the present invention has low computational complexity, is easy to deploy, does not require special security hardware, and can directly embed the Bloom filter into the firewall through software or hardware expansion. It has the advantage of being more flexible and can be suitable for most network traffic detection scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0022] Figure 1 This is a flow chart of the method of embodiment 1. DETAILED DESCRIPTION

[0023] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0024] Terminology explanation:

[0025] Bloom Filter (BF) is a probabilistic data structure that can quickly and space-efficiently check whether an element is in a set. It may have false positives but will not miss any, so it is often used as a tool to quickly query whether an element belongs to a set.

[0026] The Bloom filter mainly consists of a A bit array and a set of The Bloom filter bit array is initially set to 0, which is used to record the mapping results. A hash function is used to map the input value to the corresponding bit of the bit array. Specifically, when an element is added to the Bloom filter, the hash function of the Bloom filter is used to perform a hash operation on it. According to the obtained hash value, the value of the corresponding subscript is set to 1 in the bit array. When the present invention needs to determine whether an element exists in the Bloom filter, the same hash calculation is performed on the given element, and the obtained value is used to determine whether each element in the bit array is 1. If the values ​​are all 1, it means that this value is in the Bloom filter. If there is a value that is not 1, it means that the element is not in the Bloom filter.

[0027] The specific workflow of Bloom filter is as follows:

[0028] Step 1: Insert data: When inserting a Bloom filter, use Hash functions right Perform hash calculation to get data of Units index value ; Correspondingly, set the values ​​corresponding to these index positions in the Bloom filter bit array to 1.

[0029] Step 2: Query data: determine the element When it is in the set, use the same hash function as in the first step right Perform hash calculation and calculate data of Hash value . Check the Bloom filter bit array corresponding to Are all positions 1:

[0030] If all are 1, then it is probably present (possibly a false positive).

[0031] If any position has a value of 0, then Must not exist in this set.

[0032] A firewall is a network security device or software that monitors, filters, and controls inbound and outbound traffic flowing through a network to protect computer systems or networks from unauthorized access and attacks. As the first line of defense for network security, firewalls play a vital role. Whether it is a personal network or an enterprise network, using a firewall can significantly reduce the risk of being attacked, and at the same time, it can form a more complete security system in conjunction with other security tools (such as anti-virus software and SIEM systems).

[0033] The main functions of a firewall include:

[0034] Access control: Determine whether to allow or deny traffic to enter or leave the network through predefined security rules. Release or intercept traffic based on matching rules such as IP address, port number, and protocol type.

[0035] Traffic filtering: Filter illegal or abnormal traffic according to its source, destination, and content. Common applications include prohibiting access to malicious websites or restricting certain protocols (such as P2P).

[0036] Logging and monitoring: Recording traffic behavior helps administrators monitor network security status and identify potential threats.

[0037] Protect the internal network: Prevent sensitive data leakage and malicious traffic intrusion by isolating the internal network and the external network.

[0038] Defense against attacks: Identify and block traffic of specific network attacks, such as identifying and blocking network scans and typical denial of service attack traffic based on feature libraries, intercepting typical Trojan attacks and phishing emails, etc.; linking with other security systems to achieve a more powerful defense system against attacks.

[0039] Content inspection: Detects viruses, malicious code, or illegal content (such as sensitive file transfers) in traffic.

[0040] Security audit, alarm and statistics: record all network access and audit records, and manage event logs; conduct statistical analysis on network usage; generate alarms when network attacks or unsafe incidents are detected.

[0041] Embodiment 1

[0042] This embodiment provides a collaborative detection method for encrypted malicious disguised traffic;

[0043] A collaborative detection method for encrypted malicious disguised traffic, comprising:

[0044] S101: In response to an encrypted traffic detection request sent by a sending end, performing traffic analysis on the encrypted traffic to be detected;

[0045] S102: using a Bloom filter to perform preliminary screening on the parsed traffic;

[0046] S103: For the preliminary screening results, a firewall is used to perform deep detection; wherein, the deep detection is performed using an LSTM model, and the input values ​​of the LSTM model include: the timing characteristics of the operation code in the traffic, the long-term timing characteristics of the IP hopping address, and a third feature, wherein the third feature refers to a feature learned from the long-term timing characteristics of the IP hopping address based on the HMM;

[0047] S104: Perform consistency check on the deep detection result to obtain the detection result of the encrypted traffic.

[0048] Further, in response to the encrypted traffic detection request sent by the sending end, the specific operations of the sending end include:

[0049] (1-1): The sender uses a hash function to perform a hash operation on the opcode in the original traffic data to generate a hash value of the opcode;

[0050] (1-2): Encrypt the operation code opcode and data date in the original traffic data using the symmetric encryption algorithm AES to obtain encrypted traffic data;

[0051] (1-3): Combine the generated opcode hash value and encrypted traffic data, and send the combined result to the receiving end.

[0052] For example, generate the hash value of the opcode: The original traffic data to be sent The opcodes in use The hash function of the bit is used to perform hash operation and generate the hash value of the opcode 。

[0053] Encrypt the original traffic data: Encrypt the operation code in the original traffic data and data Through symmetric encryption algorithm Encrypt to ciphertext and obtain encrypted traffic data: .

[0054] Combined transfer content: The generated opcode hash value and encrypted traffic data Combined together and sent to the receiving end , the transmission format is: .

[0055] Further, S101: performing traffic analysis on the encrypted traffic to be detected, including:

[0056] Parsing the encrypted traffic to be detected to obtain parsed content, the parsed content including: data packet header information, protocol feature information, operation code hash value, command and feature code;

[0057] Extract key information from the encrypted traffic to be detected, the key information including: opcode hash value, IP address, current timestamp of IP address, and features of payload.

[0058] Exemplarily, performing traffic parsing on the encrypted traffic to be detected includes:

[0059] Parsing Encrypted Traffic: The Sending Side The transmitted encrypted traffic first passes through the network boundary device firewall and is parsed by the firewall. The parsed content mainly includes: packet header information (such as source IP, destination IP, port, protocol type, etc.), protocol feature information (such as URL, POST data, HTTP method (GET, POST, etc.) in HTTP request), as well as operation code hash value, command, feature code, etc.

[0060] Extract key information: Extract key information from the transmitted encrypted traffic based on known rules or protocol formats, such as opcode hash values, IP addresses, current timestamps of IP addresses, features of payloads, etc. For HTTP traffic, the requested URL or specific HTTP method may be extracted. For TCP or UDP traffic, the IP address, port, etc. may be extracted.

[0061] Furthermore, the S102: using a Bloom filter to perform preliminary screening on the parsed traffic includes:

[0062] The opcode hash value of the encrypted traffic to be detected is hashed by the built-in hash function of the Bloom filter to obtain the bit index value of the opcode hash value in the Bloom filter;

[0063] Then go to the corresponding index position of the Bloom filter to see if its value is 1;

[0064] If the values ​​are all 1, it means that the opcode hash value is in the Bloom filter, and it is legitimate traffic;

[0065] If there is a value that is not 1, it means that the opcode hash value is not in the Bloom filter, then it is malicious traffic.

[0066] Exemplarily, the Bloom filter obtains the encrypted traffic and the opcode hash value: the firewall sends the encrypted traffic flowing through it and the opcode hash value in the key information of the encrypted traffic extracted by it to the Bloom filter.

[0067] Bloom filter query: The Bloom filter maps the obtained opcode hash value information to the Bloom filter through its built-in hash function.

[0068] Matching result: If the opcode hash value of the encrypted traffic is in the Bloom filter, the corresponding hash value can be matched, and the Bloom filter marks the corresponding encrypted traffic as "suspected to be trusted" and allows it to pass directly. If it does not match, the Bloom filter marks the corresponding encrypted traffic as "abnormal / malicious" and discards it directly.

[0069] Send the results to the firewall: The Bloom filter sends the suspected trusted traffic that it has initially screened to the firewall, which performs further in-depth inspection operations.

[0070] Furthermore, the S103: using a firewall to perform in-depth detection on the preliminary screening results includes:

[0071] The timing features of the opcodes in the suspected credible encrypted traffic, the long-term timing features of the IP hop addresses, and the third feature are input into the trained LSTM model. The LSTM model outputs the detection result of whether the current encrypted traffic is legitimate encrypted traffic or malicious encrypted traffic.

[0072] The timing characteristics of the operation code opcode include: the opcode value in the traffic data, the timestamp of the opcode, the session duration of a certain opcode, and the data transmission time of the data packet interval of a certain opcode;

[0073] Among them, the long-term timing characteristics of the IP hop address include: the timestamp of a certain IP sending traffic data, the session duration of a certain IP, and the data packet interval time of a certain IP sending data.

[0074] Furthermore, the features learned from the long-term time series features of the IP hopping addresses based on the HMM are obtained by inputting the long-term time series features of the IP hopping addresses in the suspected credible encrypted traffic into the trained HMM model.

[0075] Furthermore, the training process of the trained LSTM model includes:

[0076] Constructing a training set, wherein the training set is encrypted traffic with known legitimate encrypted traffic and malicious encrypted traffic labels; the encrypted traffic includes: timing features of the opcode, long-term timing features of the IP hop address, and a third feature;

[0077] The training set is input into the LSTM model to train the LSTM model. When the loss function value of the LSTM model no longer decreases, the training is stopped to obtain the trained LSTM model.

[0078] Furthermore, the training process of the trained HMM model includes:

[0079] The training set is input into the HMM model, and the HMM model is trained. When the loss function value of the HMM model no longer decreases, the training is stopped to obtain the trained HMM model.

[0080] Furthermore, the selection strategy of the IP hop address of the training set includes:

[0081] (3-1): Define the randomness function of IP address change;

[0082] (3-2): According to the user's protection requirements, select the IP hopping period and the IP hopping heuristic factor corresponding to the IP hopping period;

[0083] (3-3): Based on the randomness of the IP hopping address change and the IP hopping heuristic factor corresponding to the IP hopping period, the selection probability function of the IP hopping address is calculated;

[0084] (3-4): Based on the selection probability function of the IP hop address, the IP hop address is randomly selected as the source IP address for transmitting traffic data.

[0085] Furthermore, the (3-1): defining a randomness function for changing an IP hopping address includes:

[0086] ;

[0087] Randomness of IP address changes For the The first IP hopping cycle The degree of randomization of the IP hop address, Indicates the frequency parameter, that is, the IP jump address in the previous The total number of times an IP hopping cycle is used. The more times an IP hopping address is used, the smaller the randomness. Indicates the status parameter of the IP hopping address, indicating the IP hopping address in the most recent hopping cycle, i.e. Whether the IP hopping address is used in the previous hopping cycle; if the IP hopping address is used in the previous hopping cycle, the randomness of the IP hopping address at the current moment is smaller.

[0088] Furthermore, the (3-2): selecting an IP hopping period and an IP hopping heuristic factor corresponding to the IP hopping period according to the user's protection requirements includes:

[0089] The degree to which users value their transmission traffic data, i.e., the protection needs of users, is , .in Represents the heuristic factor for ants to explore new IP hop addresses in the ant colony algorithm.

[0090] When users have lower protection requirements for the traffic data they transmit :The data stream transmitted by the user selects an IP address with a larger IP hopping period. At this time, the IP hopping heuristic factor is , ;

[0091] When users have high protection requirements for transmitted data traffic : The data stream transmitted by the user selects an IP address with a smaller IP hopping period. At this time, the IP hopping heuristic factor is , .

[0092] Furthermore, the (3-3): based on the randomness of the IP hopping address change and the IP hopping heuristic factor corresponding to the IP hopping period, the selection probability function of the IP hopping address is calculated, including:

[0093] Calculate the selection probability of the IP hop address:

[0094] ;

[0095] Calculate each available IP hop address in the k The probability that a hopping cycle is selected for data transmission. For the kSecondary t IP address at all times The accumulated pheromone represents the inverse of the current IP hopping cycle in the present invention; the random degree function of the change For the k Secondary Node j The degree of randomization, The larger the value of k The greater the probability of being selected; It indicates the influence factor of pheromones on ants at the IP hop address that can be sensed by ants; represents the heuristic factor for ants to explore new IP addresses, .

[0096] Furthermore, the (3-4): based on the selection probability function of the IP hop address, randomly selecting the IP hop address as the source IP address for transmitting the traffic data includes:

[0097] Each ant probabilistically selects a function from the available IP address space. Randomly select an IP hop address as the source IP address for transmitting traffic data.

[0098] It should be understood that based on the preliminary screening results of the received Bloom filter, the firewall will use deep detection based on the dynamic defense-based hidden Markov model (HMM) and long short-term memory network (LSTM) fusion model for the encrypted traffic marked as "suspected trusted", and conduct further deep fusion detection to improve the detection accuracy of encrypted malicious disguised traffic.

[0099] Normal traffic feature enhancement based on dynamic defense: By learning the traffic features of normal traffic, encrypted malicious disguised traffic is disguised as normal traffic, thereby bypassing the detection of current deep learning / deep learning malicious traffic detection methods based on traffic features. In order to increase the difficulty of the attacker's disguise and make it impossible for him to correctly learn the user's traffic features, the present invention uses a dynamic defense method to randomize the IP address in the user's transmission information and the jump cycle of the dynamically changing IP address, thereby enhancing the IP address features in normal traffic and increasing the difficulty and distinguishability of the attacker's disguise.

[0100] Normal traffic IP hop address selection based on ant colony algorithm: For the traffic information to be transmitted, according to the user's protection needs, the present invention randomly and dynamically selects the IP hop address of the sending user based on the ant colony algorithm, so as to maximize the security and disguise difficulty of the IP address characteristics in the user's legitimate traffic.

[0101] Collection of IP address timing information of current traffic and extraction of OPcode features: The firewall collects and extracts the time series information of the IP addresses of the preliminary screening traffic transmitted to it by the Bloom filter (for example, the timestamp of a certain IP sending traffic data, the session duration of a certain IP, the time between packets of a certain IP sending data, etc.) and the time series information of the OPcode (for example, the OPcode value in the traffic data, the timestamp of the OPcode, the session duration of a certain OPcode, the time between packets of a certain OPcode sending data, etc.).

[0102] HMM prediction of base IP address jump timing characteristics: Through the initialization phase, the IP jump timing transition status of normal traffic and malicious disguised traffic is learned. Based on the timing feature information of the IP address extracted from the current traffic, the HMM model is used to obtain the current traffic IP address jump timing transition probability, thereby outputting the probability of normal traffic and malicious traffic at each moment.

[0103] Fusion HMM output LSTM input features: The output of HMM at each moment (i.e., hidden state, such as malicious traffic or normal traffic) is used as part of the next LSTM input to help the LSTM model introduce the influence of the hidden state of IP hop timing transfer, and improve the accuracy of the LSTM model in identifying malicious disguised traffic. At the same time, LSTM also needs to learn the time feature attributes of the opcode value and IP hop address in the current traffic to capture the long-term dependency of the time series features of the opcode value and IP hop address in the traffic.

[0104] Identification of encrypted malicious disguised traffic based on LSTM: The LSTM model comprehensively considers various input features to effectively classify malicious disguised encrypted traffic and user normal data flow.

[0105] Deep detection result processing of encrypted malicious disguised traffic: After further detection by the firewall, it is considered to be legitimate traffic and is directly released and transmitted to the receiving end Traffic that is considered malicious will be blocked, discarded, logged, and reported, and will not be transmitted to the receiving user. .

[0106] Furthermore, the S104: performing consistency check on the deep detection result to obtain the detection result of the encrypted traffic includes:

[0107] (4-1): The receiving end obtains the encrypted traffic transmitted by the firewall, and obtains the hash value of the operation code and the ciphertext of the operation code and the transmitted data from the encrypted traffic;

[0108] (4-2): The receiving end uses the shared key to decrypt the ciphertext of the operation code and the transmitted data to obtain the decrypted operation code and data;

[0109] (4-3): Use the hash function to perform hash calculation on the decrypted operation code to obtain the hash value of the decrypted operation code;

[0110] (4-4): Determine whether the hash value of the operation code obtained from the encrypted traffic is equal to the hash value of the decrypted operation code. If they are equal, it means that the data sent by the sender is credible and the data is received; otherwise, the data sent by the sender is considered untrustworthy and the untrustworthy data is discarded.

[0111] For example, in order to prevent attackers from transmitting forged legitimate opcode values ​​for detection in order to evade the double detection of Bloom filters and firewalls, and finally using malicious opcode values ​​in the encrypted data transmitted to the user. The transmitted opcode hash value Is it equal to the receiving end? Decrypting ciphertext Then use the hash value generated by the hash operation , thereby further ensuring the accuracy of the dual detection of Bloom filters and firewalls and the security of transmitted data.

[0112] Capturing Encrypted Traffic: Receiving Side Receive encrypted traffic from the firewall After that, the hash value of the opcode is obtained And the ciphertext of the operation code and the transmitted data .

[0113] Decryption: Receiving Side Using a shared key Decrypt the ciphertext of the opcode and the transmitted data , get the original opcode and data .

[0114] Regenerate the hash value of the opcode: To prevent attackers from maliciously tampering with the opcode hash value sent to the Bloom filter for detection, the receiving end The decrypted opcode , also use CityHash 64-bit hash function to hash it and generate the hash value of the opcode .

[0115] Opcode Hash Comparison: Receiver Verify the sender The transmitted opcode hash value Is it equal to the receiving end? Decrypting ciphertext Then use the hash value generated by the hash operation If it is equal, it means that the sender The opcode sent to the Bloom filter for detection and the opcode sent to the receiver Ciphertext data The operation codes in the sender are consistent. If the opcode used for detection is not tampered with, then the receiving end The data sent is considered to be credible and legal, and the sender will receive the data. The data sent. If they are inconsistent, the receiving end The sender considers the data to be untrustworthy or potentially malicious and discards it. The data sent.

[0116] It should be understood that collaborative detection is a new type of encrypted malicious traffic detection technology that is currently widely used. It can provide more efficient and accurate detection services. In the current encrypted malicious traffic collaborative detection scheme, the method of extracting a variety of different traffic features in the encrypted traffic is usually adopted, which can more accurately identify different types of encrypted malicious traffic, thereby improving the security of the communication network. However, some attackers take advantage of this and learn the various different features of user benign traffic through the generative adversarial network GAN, and generate encrypted malicious traffic that is indistinguishable from user benign traffic through traffic disguise, thereby bypassing the current encrypted malicious traffic detection method based on traffic features.

[0117] Considering the advantages of collaborative detection and this new type of encrypted malicious disguised traffic, the present invention proposes a collaborative detection method for encrypted malicious disguised traffic based on content operation code opcode and dynamic defense, such as Figure 1As shown. Its core principle is to perform collaborative detection on the content operation code opcode features in the traffic based on the Bloom filter and the IP jump features in the traffic based on the firewall. The basic idea is to jointly detect the encrypted malicious disguised traffic through the two stages of preliminary screening of the content operation code opcode in the traffic by the Bloom filter and deep detection of the IP jump features by the firewall, so as to make the detection of the encrypted malicious disguised traffic more accurate. The Bloom filter used in the present invention detects the operation code hash value in the transmission encrypted traffic. The operation code (Opcode) is a field in the protocol, which is used to identify the type of operation, such as read, write, query, connect, etc. The RETR (download) or STOR (upload) commands in the FTP protocol can be regarded as operation codes. The operation code can directly expose the behavior type of the traffic and quickly identify abnormal operations. When an encrypted malicious traffic is disguised by an attacker using multiple benign traffic features, it is easy to be first detected by the Bloom filter through the operation code (Opcode) in its transmission traffic. Even if it escapes the detection of the Bloom filter, the firewall will then perform further deep detection based on the IP jump features and opcode features. Therefore, the collaborative detection method based on Bloom filters and firewalls can identify encrypted malicious disguised traffic more accurately and efficiently. Moreover, it detects the opcode hash value of the transmitted data, which can effectively prevent the leakage of transmitted traffic data and ensure the confidentiality and security of the transmitted data. It is a very useful encrypted malicious disguised traffic detection technology.

[0118] In the present invention, it is assumed that a Bloom filter is used It can also perform collaborative detection with a firewall, or set multiple Bloom filters and multiple firewalls based on the situation of its own network. Here, the present invention takes a Bloom filter and a firewall as an example. , a receiving end , the original traffic data transmitted between the sender and the receiver is The present invention uses symmetric encryption to transmit traffic data between the sender and the receiver. To encrypt, they use the symmetric key .

[0119] Initialization: Count the legal operation codes in common network protocols opcode and map them one by one to Bloom filters In. Use normal traffic and malicious disguised encrypted traffic to train HMM model and LSTM model. Input: original traffic data [Operation code opcode , data data ]. Output: After double detection by Bloom filter and firewall, and the receiving end user All encrypted traffic detected by the receiving end will be take over.

[0120] Embodiment 2

[0121] This embodiment provides a collaborative detection system for encrypted malicious disguised traffic, including:

[0122] A parsing module, configured to: perform traffic parsing on the encrypted traffic to be detected in response to an encrypted traffic detection request sent by a sending end;

[0123] A preliminary screening module, which is configured to: perform preliminary screening on the parsed traffic using a Bloom filter;

[0124] A deep detection module is configured to: perform deep detection on the preliminary screening results using a firewall; wherein the deep detection is performed using an LSTM model, and the input values ​​of the LSTM model include: the timing characteristics of the operation code in the traffic, the long-term timing characteristics of the IP jump address, and a third characteristic, wherein the third characteristic refers to a characteristic learned from the long-term timing characteristics of the IP jump address based on the HMM;

[0125] The verification module is configured to: perform consistency verification on the deep detection result to obtain the detection result of the encrypted traffic.

[0126] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A collaborative detection method for encrypted malicious disguised traffic, characterized in that: include: In response to the encrypted traffic detection request sent by the sending end, the encrypted traffic to be detected is analyzed; The analyzed traffic is initially screened using a Bloom filter: the opcode hash value of the encrypted traffic to be detected is hashed using the hash function built into the Bloom filter to obtain the bit index value of the opcode hash value in the Bloom filter; then the corresponding index position of the Bloom filter is checked to see if its value is all 1; if the values ​​are all 1, it means that the opcode hash value is in the Bloom filter, and it is suspected credible encrypted traffic; if there is a value that is not 1, it means that the opcode hash value is not in the Bloom filter, and it is malicious traffic; The Bloom filter sends suspected trusted encrypted traffic to the firewall as preliminary screening results; For the preliminary screening results, a firewall is used to perform deep detection; the deep detection is performed using an LSTM model, and the input values ​​of the LSTM model include: the timing characteristics of the operation code in the traffic, the long-term timing characteristics of the IP jump address, and the third feature, which refers to the feature learned from the long-term timing characteristics of the IP jump address based on the HMM; The preliminary screening results are tested in depth using firewalls, including: The timing features of the opcodes in the suspected credible encrypted traffic, the long-term timing features of the IP hop addresses, and the third feature are input into the trained LSTM model. The LSTM model outputs the detection result of whether the current encrypted traffic is legitimate encrypted traffic or malicious encrypted traffic. The timing characteristics of the operation code opcode include: the opcode value in the traffic data, the timestamp of the opcode, the session duration of a certain opcode, and the data transmission time of the data packet interval of a certain opcode; Among them, the long-term timing characteristics of the IP hop address include: the timestamp of a certain IP sending traffic data, the session duration of a certain IP, and the interval between packets of a certain IP sending data; The features learned from the long-term time series features of the IP hopping addresses based on the HMM are obtained by inputting the long-term time series features of the IP hopping addresses in the suspected credible encrypted traffic into the trained HMM model; The training process of the trained LSTM model includes: Constructing a training set, wherein the training set is encrypted traffic with known legitimate encrypted traffic and malicious encrypted traffic labels; the encrypted traffic includes: timing features of the opcode, long-term timing features of the IP hop address, and a third feature; Input the training set into the LSTM model, train the LSTM model, and stop training when the loss function value of the LSTM model no longer decreases to obtain the trained LSTM model; The training process of the trained HMM model includes: Input the training set into the HMM model, train the HMM model, and stop training when the loss function value of the HMM model no longer decreases to obtain the trained HMM model; Perform consistency check on the deep detection results to obtain the detection results of encrypted traffic.

2. A collaborative detection method for encrypted malicious disguised traffic as claimed in claim 1, characterized in that: include: The response to the encrypted traffic detection request sent by the sending end, wherein the specific operation of the sending end includes: The sender uses a hash function to perform a hash operation on the opcode in the original traffic data to generate a hash value of the opcode; The operation code opcode and data date in the original traffic data are encrypted by the symmetric encryption algorithm AES to obtain encrypted traffic data; The generated opcode hash value is combined with the encrypted traffic data, and the combined result is sent to the receiving end.

3. A collaborative detection method for encrypted malicious disguised traffic as claimed in claim 1, characterized in that: include: Perform traffic analysis on the encrypted traffic to be detected, including: Parsing the encrypted traffic to be detected to obtain parsed content, the parsed content including: data packet header information, protocol feature information, operation code hash value, command and feature code; Extract key information from the encrypted traffic to be detected, the key information including: opcode hash value, IP address, current timestamp of IP address, and features of payload.

4. The collaborative detection method of encrypted malicious disguised traffic as claimed in claim 1, characterized in that: include: The selection strategy of the IP hop address of the training set includes: Define the randomness function of IP hopping address changes; According to the user's protection requirements, select the IP hopping period and the IP hopping heuristic factor corresponding to the IP hopping period; Based on the randomness of the IP hopping address change and the IP hopping heuristic factor corresponding to the IP hopping period, the selection probability function of the IP hopping address is calculated; Based on the selection probability function of the IP hop address, an IP hop address is randomly selected as the source IP address for transmitting traffic data.

5. A collaborative detection method for encrypted malicious disguised traffic as claimed in claim 4, characterized in that: include: Define the randomness function of IP address change, including: ； Randomness of IP address changes For the The first IP hopping cycle The degree of randomization of the IP hop address, represents the frequency parameter, Indicates that the IP jump address is before The total number of times an IP hopping cycle is used. The more times an IP hopping address is used, the smaller the randomness. Indicates the status parameter of the IP jump address. Indicates Whether the IP hopping address is used in the previous hopping cycle; if the IP hopping address is used in the previous hopping cycle, the randomness of the IP hopping address at the current moment is smaller; The method of calculating the selection probability function of the IP hopping address based on the randomness of the change of the IP hopping address and the IP hopping heuristic factor corresponding to the IP hopping period includes: Calculate the selection probability of the IP hop address: ； Calculate each available IP hop address in the k The probability that a hopping cycle is selected for data transmission; For the k Second t IP address at all times The pheromone accumulated on the surface; the random degree function of the change For the k Secondary Node j The degree of randomization, The larger the value of k The greater the probability of being selected; It indicates the influence factor of pheromones on ants at the IP hop address that can be sensed by ants; It represents the heuristic factor for ants to explore new IP hop addresses. ; The method of randomly selecting an IP hopping address as a source IP address for transmitting traffic data based on a selection probability function of the IP hopping address includes: Each ant probabilistically selects a function from the available IP address space. Randomly select an IP hop address as the source IP address for transmitting traffic data.

6. A collaborative detection method for encrypted malicious disguised traffic as claimed in claim 1, characterized in that: include: Perform consistency check on the deep detection results to obtain the detection results of encrypted traffic, including: The receiving end obtains the encrypted traffic transmitted by the firewall, and obtains the hash value of the operation code and the ciphertext of the operation code and the transmitted data from the encrypted traffic; The receiving end uses the shared key to decrypt the ciphertext of the operation code and the transmitted data to obtain the decrypted operation code and data; Using a hash function, the decrypted operation code is hashed to obtain a hash value of the decrypted operation code; Determine whether the hash value of the operation code obtained from the encrypted traffic is equal to the hash value of the decrypted operation code. If they are equal, it means that the data sent by the sender is credible and the data is received; otherwise, the data sent by the sender is considered untrustworthy and the untrustworthy data is discarded.

7. A collaborative detection system for encrypted malicious disguised traffic, characterized in that: include: A parsing module, configured to: perform traffic parsing on the encrypted traffic to be detected in response to an encrypted traffic detection request sent by a sending end; The preliminary screening module is configured as follows: for the parsed traffic, a Bloom filter is used for preliminary screening: the opcode hash value of the encrypted traffic to be detected is hashed by the hash function built into the Bloom filter to obtain the bit index value of the opcode hash value in the Bloom filter; then the corresponding index position of the Bloom filter is checked to see if its value is all 1; if the value is all 1, it means that the opcode hash value is in the Bloom filter, and it is suspected credible encrypted traffic; if there is a value that is not 1, it means that the opcode hash value is not in the Bloom filter, and it is malicious traffic; The Bloom filter sends suspected trusted encrypted traffic to the firewall as preliminary screening results; A deep detection module is configured to: perform deep detection on the preliminary screening results using a firewall; wherein the deep detection is performed using an LSTM model, and the input values ​​of the LSTM model include: the timing characteristics of the operation code in the traffic, the long-term timing characteristics of the IP jump address, and a third characteristic, wherein the third characteristic refers to a characteristic learned from the long-term timing characteristics of the IP jump address based on the HMM; The preliminary screening results are tested in depth using firewalls, including: The timing features of the opcodes in the suspected credible encrypted traffic, the long-term timing features of the IP hop addresses, and the third feature are input into the trained LSTM model. The LSTM model outputs the detection result of whether the current encrypted traffic is legitimate encrypted traffic or malicious encrypted traffic. The timing characteristics of the operation code opcode include: the opcode value in the traffic data, the timestamp of the opcode, the session duration of a certain opcode, and the data transmission time of the data packet interval of a certain opcode; Among them, the long-term timing characteristics of the IP hop address include: the timestamp of a certain IP sending traffic data, the session duration of a certain IP, and the interval between packets of a certain IP sending data; The features learned from the long-term time series features of the IP hopping addresses based on the HMM are obtained by inputting the long-term time series features of the IP hopping addresses in the suspected credible encrypted traffic into the trained HMM model; The training process of the trained LSTM model includes: Constructing a training set, wherein the training set is encrypted traffic with known legitimate encrypted traffic and malicious encrypted traffic labels; the encrypted traffic includes: timing features of the opcode, long-term timing features of the IP hop address, and a third feature; Input the training set into the LSTM model, train the LSTM model, and stop training when the loss function value of the LSTM model no longer decreases to obtain the trained LSTM model; The training process of the trained HMM model includes: Input the training set into the HMM model, train the HMM model, and stop training when the loss function value of the HMM model no longer decreases to obtain the trained HMM model; The verification module is configured to: perform consistency verification on the deep detection result to obtain the detection result of the encrypted traffic.

Images