Remote control type abnormal flow detection method and related equipment

Abstract

The embodiment of the invention provides a remote control type abnormal traffic detection method and related equipment. The remote control type abnormal traffic detection method comprises the following steps: acquiring a current traffic data packet, wherein the current traffic data packet is a data packet from current traffic; extracting session features from the current traffic data packet; and inputting the session features into a traffic detection model to obtain a result whether the current traffic is a remote control type abnormal traffic. According to the technical scheme, the problem that a malicious software detection method in the prior art cannot adapt to rapid change and update of malicious software at the present stage is solved.

Description

Technical Field

[0001] The present application relates to the field of computer and communication technology, and in particular to a remote control abnormal flow detection method and related equipment. Background Art

[0002] With the development of Internet technology, malware is constantly changing and updating, threatening the public's network security. At present, traditional malware detection methods such as signature identification, heuristic killing, digital signatures and virtual machine technology can only find known malware, but cannot detect malware that has changed and updated. For software with advanced adversarial capabilities, there is a high false positive rate. On the other hand, it is more dependent on expert experience, with high labor costs and high false positive rates, so it cannot adapt to the rapid changes and updates of malware at this stage. Summary of the invention

[0003] The embodiments of the present application provide a remote-controlled abnormal traffic detection method and related equipment, which can at least to some extent overcome the problem that the malware detection methods in the prior art cannot adapt to the rapid changes and updates of malware at this stage.

[0004] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0005] According to one aspect of an embodiment of the present application, a remote-controlled abnormal traffic detection method is provided, comprising: obtaining a current traffic data packet, wherein the current traffic data packet is a data packet from the current traffic; extracting session features from the current traffic data packet; inputting the session features into a traffic detection model to obtain a result of whether the current traffic is a remote-controlled abnormal traffic.

[0006] In some embodiments of the present application, extracting the session features from the current traffic data packet specifically includes: parsing the current traffic data packet to obtain parsing information; and extracting the session features based on the parsing information.

[0007] In some embodiments of the present application, extracting the session feature according to the parsed information specifically includes: locating each session information according to the parsed information; and extracting the session feature from each session information.

[0008] In some embodiments of the present application, extracting the session features from each of the session information specifically includes: extracting a feature vector of each of the session information from each of the session information; and arranging the feature vectors of each of the session information in chronological order to obtain a session feature matrix.

[0009] In some embodiments of the present application, parsing the current traffic data packet to obtain parsing information specifically includes: splitting the current traffic data packet in units of sessions to obtain multiple sessions; parsing the traffic behavior information in each of the sessions to obtain parsing information corresponding to each of the sessions.

[0010] In some embodiments of the present application, obtaining the current traffic data packet specifically includes: using a network analyzer to capture the target data packet of the current traffic; capturing the target data packet of the current traffic to obtain captured data; storing the captured data in a predetermined file format to obtain the current traffic data packet.

[0011] In some embodiments of the present application, the method also includes: obtaining a flow data packet sample set, the flow data packet sample set including multiple flow data packet samples, each of the flow data packet samples having a label indicating whether it is a remote-controlled abnormal flow; extracting corresponding session feature samples from the flow data packet samples; inputting the session feature samples one by one into the flow detection model to obtain a result of whether the flow detection model outputs a remote-controlled abnormal flow; updating the parameters of the flow detection model according to the label of the flow data packet sample and the result output by the flow detection model until a predetermined condition is met, stopping training, and obtaining a trained flow detection model.

[0012] According to one aspect of an embodiment of the present application, a remote-controlled abnormal traffic detection device is provided, and the remote-controlled abnormal traffic detection device includes: a traffic acquisition module, used to obtain a current traffic data packet, and the current traffic data packet is a data packet from the current traffic; a feature extraction module, used to extract session features from the current traffic data packet; a model judgment module, used to input the session features into a traffic detection model to obtain a result of whether the current traffic is a remote-controlled abnormal traffic.

[0013] In some embodiments of the present application, the feature extraction module specifically includes: an information parsing submodule, used to parse the current traffic data packet to obtain parsing information; and a feature extraction submodule, used to extract the session feature based on the parsing information.

[0014] In some embodiments of the present application, the feature extraction submodule specifically includes: a session positioning unit, used to locate each session information according to the parsing information; and a feature extraction unit, used to extract the session feature from each session information.

[0015] In some embodiments of the present application, the feature extraction unit specifically includes: a feature vector subunit, used to extract a feature vector of each session information from each session information; and a feature matrix subunit, used to arrange the feature vectors of each session information in chronological order to obtain a session feature matrix.

[0016] In some embodiments of the present application, the information parsing submodule specifically includes: a session splitting unit, used to split the current traffic data packet in units of sessions to obtain multiple sessions; and an information parsing unit, used to parse the traffic behavior information in each of the sessions to obtain parsing information corresponding to each of the sessions.

[0017] In some embodiments of the present application, the traffic acquisition module specifically includes: a data packet capture sub-module, which is used to use a network analyzer to capture the target data packet of the current traffic; a data packet capture sub-module, which is used to capture the target data packet of the current traffic to obtain captured packet data; and a format conversion sub-module, which is used to store the captured packet data in a predetermined file format to obtain the current traffic data packet.

[0018] In some embodiments of the present application, the remote-controlled abnormal traffic detection device also includes: a sample acquisition module, used to obtain a traffic data packet sample set, the traffic data packet sample set includes multiple traffic data packet samples, each of the traffic data packet samples has a label indicating whether it is a remote-controlled abnormal traffic; a sample feature module, used to extract corresponding session feature samples from the traffic data packet samples; a sample input module, used to input the session feature samples one by one into the traffic detection model to obtain a result of whether the traffic detection model outputs the remote-controlled abnormal traffic; a parameter updating module, used to update the parameters of the traffic detection model according to the label of the traffic data packet sample and the result output by the traffic detection model until a predetermined condition is met, stop training, and obtain a trained traffic detection model.

[0019] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the remote-controlled abnormal flow detection method as described in the above embodiment is implemented.

[0020] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the remote control abnormal flow detection method as described in the above embodiments.

[0021] In the technical solutions provided in some embodiments of the present application, on the one hand, the session characteristics of the traffic are used as the basic input unit to determine whether it is abnormal. The core features in the session characteristics of the traffic will not change due to updates and changes, so it can be unaffected by update and modification technologies such as packing, obfuscation, and blurring, and it can be determined in real time and accurately whether there is remote-controlled abnormal traffic, and then determine whether there is remote-controlled malware running; on the other hand, by inputting the session characteristics of the traffic into the traffic detection model for automatic judgment, not only manpower is saved, but also the accuracy is improved and the false alarm rate is reduced through the learning of the neural network model, thereby overcoming the problem that the malware detection method in the prior art cannot adapt to the rapid changes and updates of malware at this stage.

[0022] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0024] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solution of the embodiments of the present application can be applied is shown.

[0025] Figure 2 A schematic diagram of a process of remote control abnormal flow detection provided in an embodiment of the present application is shown.

[0026] Figure 3 Shown according to Figure 2 A specific implementation flow chart of step S200 in the remote control abnormal flow detection method shown in the corresponding embodiment.

[0027] Figure 4 Shown according to Figure 3 A specific implementation flow chart of step S220 in the remote control abnormal flow detection method shown in the corresponding embodiment.

[0028] Figure 5 A schematic structural diagram of a remote-controlled abnormal flow detection device provided in an embodiment of the present application is shown.

[0029] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0030] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0031] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0032] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0033] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0034] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solution of the embodiments of the present application can be applied is shown.

[0035] like Figure 1 As shown, the system architecture may include terminal devices (such as Figure 1 The embodiment of the present invention is a schematic diagram of a mobile phone 101, a tablet computer 102, a portable computer 103, a desktop computer, etc., a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the terminal device and the server 105. The network 104 may include various connection types, such as a wired communication link, a wireless communication link, etc.

[0036] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. According to the implementation requirements, there may be any number of terminal devices, networks and servers. For example, the server 105 may be a server cluster composed of multiple servers.

[0037] The user can use the terminal device to interact with the server 105 through the network 104 to receive or send messages, etc. The server 105 can be a server that provides various services. For example, the user uses the terminal device 103 (or the terminal device 101 or 102) to upload the current traffic data packet to the server 105, and the server 105 can extract the session features from the current traffic data packet; input the session features into the traffic detection model to obtain the result of whether the current traffic is remote control type abnormal traffic.

[0038] It should be noted that the remote control abnormal flow detection method provided in the embodiment of the present application is generally executed by the server 105, and accordingly, the remote control abnormal flow detection device is generally arranged in the server 105. However, in other embodiments of the present application, the terminal device may also have similar functions as the server, so as to execute the remote control abnormal flow detection solution provided in the embodiment of the present application.

[0039] The implementation details of the technical solution of the embodiment of the present application are described in detail below:

[0040] Figure 2 A flowchart of a remote control abnormal traffic detection method according to an embodiment of the present application is shown. The remote control abnormal traffic detection method can be executed by a server, which can be Figure 1 Refer to the server shown in . Figure 2 As shown, the remote control abnormal flow detection method at least includes:

[0041] Step S100, obtaining a current traffic data packet, wherein the current traffic data packet is a data packet from the current traffic.

[0042] Step S200, extracting session features from the current traffic data packet.

[0043] Step S300: input the session feature into a traffic detection model to obtain a result of whether the current traffic is remote control type abnormal traffic.

[0044] In an embodiment of the present application, the current traffic data packet is first captured, and the session features are extracted after various processing is performed on the current traffic data packet as a session; the session features are then input into a traffic detection model, and the traffic detection model determines whether the current traffic is remote-controlled abnormal traffic, and further determines whether there is remote-controlled malware.

[0045] On the one hand, the present application uses the session characteristics of the traffic as the basic input unit to determine whether it is abnormal. The core features in the session characteristics of the traffic will not change due to updates and changes, so it can be unaffected by update and modification technologies such as packing, obfuscation, and blurring. It can accurately determine in real time whether there is remote-controlled abnormal traffic, and then determine whether there is remote-controlled malware running.

[0046] On the other hand, the present application not only saves manpower by inputting the session characteristics of the traffic into the traffic detection model for automatic judgment, but also improves the accuracy and reduces the false alarm rate through the learning of the neural network model, thereby overcoming the problem that the malware detection methods in the prior art cannot adapt to the rapid changes and updates of malware at this stage.

[0047] In step S100, a network analyzer such as Wireshark, Tcpdump or WinDump may be used to capture current traffic data packets.

[0048] Specifically, in some embodiments, the specific implementation of step S100 can refer to the following embodiments. Figure 2 The detailed description of step S100 in the remote control abnormal flow detection method shown in the corresponding embodiment, in the remote control abnormal flow detection method, step S100 may include the following steps:

[0049] Use a network analyzer to capture target packets of the current traffic.

[0050] Capturing target data packets of the current flow to obtain captured data;

[0051] The captured packet data is stored in a predetermined file format to obtain the current traffic data packet.

[0052] In an embodiment of the present application, a network analyzer such as Wireshark, Tcpdump or WinDump is used to capture the target data packet of the current flow, which is generally a TCP / IP data packet. The target data packet is then captured, and after the capture, the flow data is stored as a predetermined file format, i.e., the current flow data packet is obtained. Generally, the predetermined file format can be a Pcap file format, in preparation for subsequent parsing and analysis. The Pcap file format consists of a file header and a plurality of packet headers and packet datagrams.

[0053] In step S200, the toolkit may be used to perform operations such as parsing, extracting, and counting the current traffic data packets to obtain session features.

[0054] Specifically, in some embodiments, the specific implementation of step S200 can be found in Figure 3 . Figure 3 is based on Figure 2 The detailed description of step S200 in the remote control abnormal flow detection method shown in the corresponding embodiment, in the remote control abnormal flow detection method, step S200 may include the following steps:

[0055] Step S210, parse the current traffic data packet to obtain parsing information.

[0056] Step S220: extracting the session features according to the parsed information.

[0057] In the embodiment of the present application, the current traffic data packet is first split and parsed to obtain parsing information, which is based on sessions and is information about various traffic behaviors in each session. Based on the parsing information, the corresponding session features are extracted, which can be session feature vectors, or, more specifically, session feature matrices composed of multiple sessions.

[0058] Specifically, in some embodiments, the specific implementation of step S210 can refer to the following embodiments. Figure 3 The detailed description of step S210 in the remote control abnormal flow detection method shown in the corresponding embodiment, in the remote control abnormal flow detection method, step S210 may include the following steps:

[0059] The current traffic data packet is split in units of sessions to obtain multiple sessions.

[0060] The traffic behavior information in each of the sessions is parsed to obtain parsed information corresponding to each of the sessions.

[0061] In an embodiment of the present application, the Python toolkit scapy can be used to parse the captured current traffic data packets, split the traffic by session, and then parse and obtain the traffic behavior information of all packets in each session. When parsing the packets in the session, only the UDP / TCP protocol data packets are retained to obtain the corresponding parsing information.

[0062] In some embodiments, the above-mentioned parsed information may include five-tuple information such as time, source IP address, source port, destination IP address, destination port, data packet size, and flag bit, so as to determine the corresponding session.

[0063] Specifically, in some embodiments, the specific implementation of step S220 can be found in Figure 4 . Figure 4 is based on Figure 3 The detailed description of step S220 in the remote control abnormal flow detection method shown in the corresponding embodiment, in the remote control abnormal flow detection method, step S220 may include the following steps:

[0064] Step S222: locate each session information according to the parsed information.

[0065] Step S224: extracting the session features from each of the session information.

[0066] In an embodiment of the present application, the corresponding session may be determined based on the parsed information, and then the session features may be extracted from the session information.

[0067] Specifically, in some embodiments, the specific implementation of step S224 can refer to the following embodiments. Figure 4 The detailed description of step S224 in the remote control abnormal flow detection method shown in the corresponding embodiment, in the remote control abnormal flow detection method, step S224 may include the following steps:

[0068] A feature vector of each session information is extracted from each session information.

[0069] The feature vectors of each session information are arranged in chronological order to obtain a session feature matrix.

[0070] In the embodiment of the present application, based on the parsed information obtained in step S210, the feature vector of each session, that is, the feature vector of the session information, can be extracted respectively. Then, the feature vectors of all the session information in the current traffic data packet are arranged in chronological order to form a feature representation matrix of the current traffic data packet of size n*m, where n is the number of sessions in the entire communication traffic, and m is the dimension of the session feature vector.

[0071] It should be noted that the feature vector of session information has multiple vector dimensions, and its vector components may include the number of packets of the Domain Name System (DNS) protocol, the number of packets of the Network Basic Input / Output System (NetBIOS) Name Service (NBNS) protocol, the number of packets of the Link-Local Multicast Name Resolution (LLMNR) protocol, the number of bytes of upstream traffic, the proportion of upstream traffic packets, the proportion of syn packets, the proportion of psh packets, the proportion of small packets, and characteristic attributes such as packet length and time interval.

[0072] In step S300, the traffic detection model is a neural network model. The neural network analyzes and learns the session characteristics of the current traffic data packet, can well capture the locality and other characteristics contained in the data itself, and mine the spatial correlation of the data, and has strong generalization ability and robustness.

[0073] In one embodiment, the above-mentioned traffic detection model may include an input layer, a convolutional layer, an activation layer, a pooling layer, and a fully connected layer.

[0074] The session features are input into the traffic detection model through the input layer, and then passed from the input layer to the convolution layer to extract the data features of the input session features. In some embodiments of the present application, the convolution layer can have multiple layers, and each convolution layer uses multiple filters to extract multi-dimensional features to obtain deeper data features. After the required multi-dimensional and deep data features are obtained through multiple layers of convolution, the multi-dimensional and deep data features are input into the activation layer, and the activation layer uses the activation function to add nonlinear factors to enhance the expressiveness of the traffic detection model, and then enters the pooling layer for pooling feature compression, reducing the feature dimension while retaining important information. In some embodiments of the present application, the maximum pooling method can be used to reduce the feature dimension of the convolution layer output to obtain a low-dimensional feature vector that only retains important information. Finally, after passing through a fully connected layer, the feature vector is flattened into a low-dimensional vector of 1×n, and the low-dimensional vector output is passed to the classifier, which is classified by the classifier to obtain the classification result of whether it is a remote-controlled abnormal traffic.

[0075] Specifically, in the above steps, the fully connected layer outputs a 1×n low-dimensional vector, which has multiple vector dimensions (or multiple vector components). Therefore, the vector components of multiple dimensions can be used as a judgment basis to input the classifier. The classifier identifies traffic data packets with malicious communication behaviors based on these vector components.

[0076] At the same time, during the training process of the neural network model, the low-dimensional vector can be used as the feature input of the sample communication traffic behavior into the classifier for classification learning. The classifier acquires the ability to identify traffic packets with malicious communication behavior by learning a large number of traffic representation vectors of malicious and normal files.

[0077] Among them, the training method of the traffic detection model mainly includes:

[0078] A flow data packet sample set is obtained, wherein the flow data packet sample set includes a plurality of flow data packet samples, and each of the flow data packet samples carries a label indicating whether it is remote control type abnormal flow.

[0079] A corresponding session feature sample is extracted from the traffic data packet sample.

[0080] The session feature samples are input into the traffic detection model one by one to obtain a result of whether the traffic detection model outputs remote control type abnormal traffic.

[0081] According to the label of the traffic data packet sample and the result output by the traffic detection model, the parameters of the traffic detection model are updated until a predetermined condition is met, and the training is stopped to obtain a trained traffic detection model.

[0082] In this embodiment, in order to analyze and learn the feature matrix of the current traffic data packet, the convolutional neural network can well capture the local characteristics contained in the data itself, mine the spatial correlation of the data, and has strong generalization ability and robustness. When training, the conditions for stopping training, that is, the conditions for model training, can be multiple, and the specific embodiments can be referred to as follows.

[0083] Specifically, in some embodiments, updating the parameters of the traffic detection model according to the label of the traffic data packet sample and the result output by the traffic detection model until a predetermined condition is met, stopping the training, and obtaining the trained traffic detection model may specifically include:

[0084] If there are less than a predetermined number of traffic data packet samples in the traffic data packet sample set, and the result of whether it is remote-controlled abnormal traffic output after the session feature sample after feature extraction is input into the parsing model is consistent with the label of whether it is remote-controlled abnormal traffic, then the parameters of the traffic detection model are updated.

[0085] If there are more than a predetermined number of traffic data packet samples in the traffic data packet sample set, and the result of whether it is remote-controlled abnormal traffic output after the session feature sample after feature extraction is input into the parsing model is consistent with the label of whether it is remote-controlled abnormal traffic, then the predetermined end condition is met, the training is ended, and a trained traffic detection model is obtained.

[0086] Specifically, in some other embodiments, updating the parameters of the traffic detection model according to the label of the traffic data packet sample and the result output by the traffic detection model until a predetermined condition is met, stopping the training, and obtaining the trained traffic detection model may specifically include:

[0087] A loss function is determined according to the label of the traffic data packet sample and the result output by the traffic detection model.

[0088] The parameters of the flow detection model are updated according to the loss function until a predetermined end condition is reached, and the training is terminated to obtain a trained flow detection model.

[0089] In this embodiment, the loss function reaching a predetermined end condition may be that the loss function converges or the loss function is less than a predetermined loss (eg, 0.001).

[0090] In the above embodiment, remote control type abnormal traffic identification is performed through a neural network model obtained through multiple trainings to obtain corresponding judgment results. The neural network model is obtained through multiple trainings. The more samples it trains, the more accurate the results obtained. It basically does not require maintenance during operation, which also reduces maintenance costs, improves the efficiency and accuracy of traffic identification, and reduces the false alarm rate.

[0091] The following describes an embodiment of the device of the present application, which can be used to execute the remote control abnormal flow detection method in the above embodiment of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the remote control abnormal flow detection method in the above embodiment of the present application.

[0092] Figure 5 A block diagram of a remote control abnormal flow detection device according to an embodiment of the present application is shown.

[0093] Reference Figure 5 As shown, according to an embodiment of the present application, a remote control abnormal flow detection device 500 includes:

[0094] The traffic acquisition module 510 is used to acquire a current traffic data packet, where the current traffic data packet is a data packet from the current traffic;

[0095] A feature extraction module 520, configured to extract session features from the current traffic data packet;

[0096] The model judgment module 530 is used to input the session features into the traffic detection model to obtain a result of whether the current traffic is remote control type abnormal traffic.

[0097] In some embodiments of the present application, the feature extraction module 520 specifically includes: an information parsing submodule, used to parse the current traffic data packet to obtain parsing information; and a feature extraction submodule, used to extract the session feature based on the parsing information.

[0098] In some embodiments of the present application, the feature extraction submodule specifically includes: a session positioning unit, used to locate each session information according to the parsing information; and a feature extraction unit, used to extract the session feature from each session information.

[0099] In some embodiments of the present application, the feature extraction unit specifically includes: a feature vector subunit, used to extract a feature vector of each session information from each session information; and a feature matrix subunit, used to arrange the feature vectors of each session information in chronological order to obtain a session feature matrix.

[0100] In some embodiments of the present application, the information parsing submodule specifically includes: a session splitting unit, used to split the current traffic data packet in units of sessions to obtain multiple sessions; and an information parsing unit, used to parse the traffic behavior information in each of the sessions to obtain parsing information corresponding to each of the sessions.

[0101] In some embodiments of the present application, the traffic acquisition module 510 specifically includes: a data packet capture submodule, which is used to use a network analyzer to capture the target data packet of the current traffic; a data packet capture submodule, which is used to capture the target data packet of the current traffic to obtain captured packet data; and a format conversion submodule, which is used to store the captured packet data in a predetermined file format to obtain the current traffic data packet.

[0102] In some embodiments of the present application, the remote-controlled abnormal traffic detection device 500 also includes: a sample acquisition module, which is used to obtain a traffic data packet sample set, the traffic data packet sample set includes multiple traffic data packet samples, and each of the traffic data packet samples has a label indicating whether it is a remote-controlled abnormal traffic; a sample feature module, which is used to extract corresponding session feature samples from the traffic data packet samples; a sample input module, which is used to input the session feature samples one by one into the traffic detection model to obtain a result of whether the traffic detection model outputs the remote-controlled abnormal traffic; a parameter updating module, which is used to update the parameters of the traffic detection model according to the label of the traffic data packet sample and the result output by the traffic detection model until a predetermined condition is met, stop training, and obtain a trained traffic detection model.

[0103] In an embodiment of the present application, the current traffic data packet is first captured, and the session features are extracted after various processing is performed on the current traffic data packet as a session; the session features are then input into a traffic detection model, and the traffic detection model determines whether the current traffic is remote-controlled abnormal traffic, and further determines whether there is remote-controlled malware.

[0104] On the one hand, the present application uses the session characteristics of the traffic as the basic input unit to determine whether it is abnormal. The core features in the session characteristics of the traffic will not change due to updates and changes, so it can be unaffected by update and modification technologies such as packing, obfuscation, and blurring. It can accurately determine in real time whether there is remote-controlled abnormal traffic, and then determine whether there is remote-controlled malware running.

[0105] On the other hand, the present application not only saves manpower by inputting the session characteristics of the traffic into the traffic detection model for automatic judgment, but also improves the accuracy and reduces the false alarm rate through the learning of the neural network model, thereby overcoming the problem that the malware detection methods in the prior art cannot adapt to the rapid changes and updates of malware at this stage.

[0106] Figure 6 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.

[0107] It should be noted that Figure 6 The computer system of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0108] like Figure 6 As shown, the computer system includes a central processing unit (CPU) 1801, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 1802 or the program loaded from the storage part 1808 to the random access memory (RAM) 1803, such as executing the method described in the above embodiment. In RAM 1803, various programs and data required for system operation are also stored. CPU 1801, ROM 1802 and RAM 1803 are connected to each other through bus 1804. Input / output (I / O) interface 1805 is also connected to bus 1804.

[0109] The following components are connected to the I / O interface 1805: an input section 1806 including a keyboard, a mouse, etc.; an output section 1807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1808 including a hard disk, etc.; and a communication section 1809 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1809 performs communication processing via a network such as the Internet. A drive 1810 is also connected to the I / O interface 1805 as needed. A removable medium 1811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1810 as needed so that a computer program read therefrom is installed into the storage section 1808 as needed.

[0110] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 1809, and / or installed from a removable medium 1811. When the computer program is executed by a central processing unit (CPU) 1801, various functions defined in the system of the present application are executed.

[0111] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0112] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0113] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0114] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

[0115] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0116] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0117] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the embodiments disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0118] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A remote control abnormal flow detection method, characterized in that: The remote control abnormal flow detection method comprises: Acquire a current traffic data packet, where the current traffic data packet is a data packet from current traffic; Extracting session features from the current traffic data packet; The session feature is input into a traffic detection model to obtain a result of whether the current traffic is remote control type abnormal traffic.

2. The remote control abnormal flow detection method according to claim 1, characterized in that: The extracting the session feature from the current traffic data packet specifically includes: Parsing the current traffic data packet to obtain parsing information; The session features are extracted according to the parsed information.

3. The remote control abnormal flow detection method according to claim 2, characterized in that: The extracting the session feature according to the parsed information specifically includes: Locating each of the session information according to the parsed information; The session feature is extracted from each of the session information.

4. The remote control abnormal flow detection method according to claim 3, characterized in that: The extracting the session feature from each of the session information specifically includes: Extracting a feature vector of each session information from each session information; The feature vectors of each session information are arranged in chronological order to obtain a session feature matrix.

5. The remote control abnormal flow detection method according to claim 2, characterized in that: The parsing of the current traffic data packet to obtain parsing information specifically includes: Splitting the current traffic data packet in units of sessions to obtain multiple sessions; The traffic behavior information in each of the sessions is parsed to obtain parsed information corresponding to each of the sessions.

6. The remote control abnormal flow detection method according to claim 1, characterized in that: The obtaining of the current traffic data packet specifically includes: Using a network analyzer to capture target data packets of the current traffic; Capturing target data packets of the current flow to obtain captured data; The captured packet data is stored in a predetermined file format to obtain the current traffic data packet.

7. The remote control abnormal flow detection method according to claim 1, characterized in that: The method further comprises: Obtain a flow data packet sample set, wherein the flow data packet sample set includes a plurality of flow data packet samples, each of the flow data packet samples is labeled with whether it is remote control type abnormal flow; Extracting corresponding session feature samples from the traffic data packet samples; Input the session feature samples one by one into the traffic detection model to obtain the result of whether the traffic detection model outputs remote control type abnormal traffic; According to the label of the traffic data packet sample and the result output by the traffic detection model, the parameters of the traffic detection model are updated until a predetermined condition is met, and the training is stopped to obtain a trained traffic detection model.

8. A remote control abnormal flow detection device, characterized in that: The remote control abnormal flow detection device comprises: A flow acquisition module, used to acquire a current flow data packet, wherein the current flow data packet is a data packet from the current flow; A feature extraction module, used to extract session features from the current traffic data packet; The model judgment module is used to input the session features into the traffic detection model to obtain a result of whether the current traffic is remote-controlled abnormal traffic.

9. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the remote control abnormal flow detection method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, enables the one or more processors to implement the remote control abnormal flow detection method as described in any one of claims 1 to 7.

Images