Abnormal network detection method and device, equipment and storage medium
By identifying and calculating the similarity between traffic data flows in the detection network, the problem of difficult to track IRC botnet attackers in the prior art is solved, and more efficient and accurate abnormal network detection is achieved, improving network security.
Patent Information
- Application Number
- CN202411668960.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-20
- Publication Date
- 2025-02-18
AI Technical Summary
In the detection of IRC botnets, it is difficult to track attackers and identify abnormal terminal devices, resulting in low detection efficiency and poor accuracy.
By acquiring multiple traffic data in the network to be detected, the characteristic data flow is determined based on the communication information, and the similarity between the characteristic data flows is calculated, thereby identifying abnormal terminals and determining the control terminals of the botnet.
It improves the efficiency and accuracy of identification and detection of abnormal networks, can track the control terminals of the botnet in real time, and improves network security.
Smart Images
Figure CN119484125A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to an abnormal network detection method, device, equipment and storage medium. Background Art
[0002] In a botnet, the behaviors of infected terminal devices have similarity, regularity and traceability in the network. Currently, the main way to detect Internet Relay Chat (IRC) botnets is to search for similarities in network traffic data and perform offline analysis on historical network traffic data.
[0003] However, since the network environment is constantly changing, when an IRC botnet is detected through network log information, the corresponding IRC command and control server may have been moved or shut down. At this time, the attacker cannot be tracked using historical information, and the terminal devices in the botnet (i.e. abnormal terminal devices) cannot be determined. Therefore, the current identification and detection of botnets is inefficient and inaccurate. Summary of the invention
[0004] The present application provides an abnormal network detection method, apparatus, device and storage medium for improving the efficiency and accuracy of identifying and detecting abnormal networks and enhancing network security.
[0005] In order to achieve the above objectives, this application adopts the following technical solutions:
[0006] In a first aspect, an abnormal network detection method is provided, the method comprising: obtaining multiple flow data in a network to be detected, each flow data including communication information, the network to be detected including multiple terminals, each flow data being flow data between any two terminals, and the communication information including: a source address and a destination address; based on the communication information included in each flow data, determining multiple characteristic data streams, each characteristic data stream being composed of flow data based on the same source address and destination address; for any two characteristic data streams in the multiple characteristic data streams, determining the similarity between any two characteristic data streams; based on the similarity between every two characteristic data streams in the multiple characteristic data streams, determining a target terminal from multiple terminals, the target terminal being a control terminal of a botnet.
[0007] In one possible implementation, multiple pieces of traffic data in the network to be detected are obtained, including: preprocessing the traffic data in the network to be detected to obtain multiple pieces of traffic data, the preprocessing including at least one of the following: obtaining traffic data of a preset protocol type, obtaining traffic data with a data transmission rate less than a preset rate and a data length within a preset length range, and removing traffic data including a preset address.
[0008] In a possible implementation, the communication information also includes at least one of the following: time, duration, protocol type, source port number, destination port number, number of outgoing packets, and number of incoming packets; based on the communication information included in each piece of traffic data, multiple characteristic data streams are determined, including: based on the source address and destination address included in each piece of traffic data, traffic data with the same source address and the same destination address are divided into a group of traffic data to obtain multiple groups of traffic data; based on a feature vector composed of at least one piece of traffic data included in each group of traffic data, a characteristic data stream of each group of traffic data is determined to obtain multiple characteristic data streams, each characteristic data stream is used to indicate the communication information of a group of traffic data.
[0009] In a possible implementation, multiple feature data streams are time domain data; for any two feature data streams among the multiple feature data streams, the similarity between any two feature data streams is determined, including: converting the multiple feature data streams that are time domain data into multiple feature data streams of frequency domain data; for any two feature data streams among the multiple feature data streams of frequency domain data, determining the Euclidean distance between any two feature data streams; and determining the similarity between any two feature data streams based on the Euclidean distance between any two feature data streams.
[0010] In a possible implementation, for any two feature data streams among multiple feature data streams of frequency domain data, determining the Euclidean distance between any two feature data streams includes: for any two feature data streams among multiple feature data streams of frequency domain data, based on the number of dimensions of the feature data streams, decomposing each feature data stream of any two feature data streams to obtain multiple sub-data streams of each feature data stream; based on the multiple sub-data streams of each feature data stream of any two feature data streams, determining the Euclidean distance between any two feature data streams by a preset algorithm.
[0011] In a possible implementation, the method also includes: when newly added traffic data is obtained from the network to be detected, based on the communication information included in the newly added traffic data, the newly added traffic data is added to a corresponding set of traffic data; in a case where the newly added traffic data is added to two sets of traffic data corresponding to any two feature data streams, based on the Euclidean distance between the newly added traffic data and any two feature data streams, the similarity between any two feature data streams after the newly added traffic data is determined.
[0012] In one possible implementation, a target terminal is determined from multiple terminals based on the similarity between any two characteristic data streams, including: when the similarity between any two characteristic data streams is greater than a preset similarity, two groups of traffic data corresponding to any two characteristic data streams are determined to be abnormal data; a terminal indicated by a source address and a terminal indicated by a destination address in the traffic data included in the two groups of traffic data are determined to be abnormal terminals; based on abnormal terminals among multiple terminals included in the network to be detected, and the transmission direction of abnormal data transmitted between the abnormal terminals, a terminal that receives a number of abnormal data greater than a preset number and sends a number of abnormal data greater than a preset number is determined as a target terminal.
[0013] In a second aspect, an abnormal network detection device is provided, the abnormal network detection device comprising: an acquisition unit and a processing unit;
[0014] An acquisition unit is used to acquire multiple flow data in a network to be detected, each flow data includes communication information, the network to be detected includes multiple terminals, each flow data is flow data between any two terminals, and the communication information includes: a source address and a destination address; a processing unit is used to determine multiple characteristic data streams based on the communication information included in each flow data, each characteristic data stream is composed of flow data based on the same source address and destination address; the processing unit is also used to determine the similarity between any two characteristic data streams in the multiple characteristic data streams; the processing unit is also used to determine a target terminal from multiple terminals based on the similarity between every two characteristic data streams in the multiple characteristic data streams, and the target terminal is a control terminal of the botnet.
[0015] In one possible implementation, the processing unit is also used to preprocess the traffic data in the network to be detected to obtain multiple traffic data, and the preprocessing includes at least one of the following: obtaining traffic data of a preset protocol type, obtaining traffic data with a data transmission rate less than a preset rate and a data length within a preset length range, and removing traffic data including a preset address.
[0016] In a possible implementation, the communication information also includes at least one of the following: time, duration, protocol type, source port number, destination port number, number of outgoing packets, and number of incoming packets; a processing unit is specifically used to divide the traffic data with the same source address and the same destination address into a group of traffic data based on the source address and destination address included in each traffic data to obtain multiple groups of traffic data; the processing unit is specifically used to determine the characteristic data stream of each group of traffic data based on a characteristic vector composed of at least one traffic data included in each group of traffic data, and obtain multiple characteristic data streams, each characteristic data stream is used to indicate the communication information of a group of traffic data.
[0017] In one possible implementation, the multiple feature data streams are time domain data; the processing unit is specifically used to convert the multiple feature data streams that are time domain data into multiple feature data streams of frequency domain data; the processing unit is specifically used to determine the Euclidean distance between any two feature data streams in the multiple feature data streams of frequency domain data; the processing unit is specifically used to determine the similarity between any two feature data streams based on the Euclidean distance between any two feature data streams.
[0018] In one possible implementation, the processing unit is specifically used to decompose each of any two feature data streams among multiple feature data streams of frequency domain data based on the number of dimensions of the feature data streams to obtain multiple sub-data streams of each feature data stream; the processing unit is specifically used to determine the Euclidean distance between any two feature data streams through a preset algorithm based on the multiple sub-data streams of each feature data stream among any two feature data streams.
[0019] In one possible implementation, the processing unit is further used to, when newly added traffic data is obtained from the network to be detected, add the newly added traffic data to a corresponding set of traffic data based on the communication information included in the newly added traffic data; the processing unit is further used to, when the newly added traffic data is added to the two sets of traffic data corresponding to any two feature data streams, determine the similarity between any two feature data streams after the newly added traffic data is added, based on the Euclidean distance between the newly added traffic data and any two feature data streams.
[0020] In one possible implementation, the processing unit is specifically used to determine that two groups of traffic data corresponding to any two characteristic data streams are abnormal data when the similarity between any two characteristic data streams is greater than a preset similarity; the processing unit is specifically used to determine that the terminal indicated by the source address and the terminal indicated by the destination address in the traffic data included in the two groups of traffic data are abnormal terminals; the processing unit is specifically used to determine, as a target terminal, a terminal that receives a greater number of abnormal data than a preset number and sends a greater number of abnormal data than a preset number based on the abnormal terminals among multiple terminals included in the network to be detected and the transmission direction of the abnormal data transmitted between the abnormal terminals.
[0021] In a third aspect, an electronic device comprises: a processor and a memory; wherein the memory is used to store one or more programs, and the one or more programs include computer execution instructions. When the electronic device is running, the processor executes the computer execution instructions stored in the memory to enable the electronic device to perform an abnormal network detection method as in the first aspect.
[0022] In a fourth aspect, a computer-readable storage medium storing one or more programs is provided. The one or more programs include instructions. When the instructions are executed by a computer, the computer executes an abnormal network detection method as described in the first aspect.
[0023] The present application provides an abnormal network detection method, device, equipment and storage medium, which are applied to the scene of identifying and detecting abnormal networks and determining botnets. The flow data transmitted between any two terminals in the network to be detected including multiple terminals can be obtained, so as to form multiple characteristic data streams based on the flow data including the same source address and destination address according to the communication information included in each flow data. In this way, since the flow data including the same source address and destination address is the data transmitted between the same two terminals, the flow data including the same source address and destination address is formed into a characteristic data stream, and the data transmitted between the same two terminals can be uniformly processed. Then, for any two characteristic data streams in the multiple characteristic data streams, the similarity between any two characteristic data streams can be determined. Therefore, according to the similarity between each two characteristic data streams in the multiple characteristic data streams, when the similarity is high, it can be considered as abnormal data transmitted between abnormal terminals, and the control terminal of the botnet can be determined from the multiple terminals. Based on the above scheme, a characteristic data stream can be constructed according to the flow data transmitted in the network, so as to judge the abnormal terminal and abnormal flow data according to the similarity between the characteristic data streams, and determine the control terminal of the botnet. This can improve the efficiency and accuracy of identifying and detecting abnormal networks and enhance network security. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] Figure 1 A schematic diagram of botnet classification provided for an embodiment of the present application;
[0025] Figure 2 A schematic diagram of a botnet architecture provided for an embodiment of the present application;
[0026] Figure 3 A schematic diagram of the structure of an abnormal network detection system provided in an embodiment of the present application;
[0027] Figure 4 A schematic diagram of another abnormal network detection system structure provided in an embodiment of the present application;
[0028] Figure 5 A schematic diagram of a flow chart of an abnormal network detection method provided in an embodiment of the present application;
[0029] Figure 6 A schematic diagram of a topological structure of an abnormal network provided in an embodiment of the present application;
[0030] Figure 7 A schematic diagram of a topological structure of an abnormal network provided in an embodiment of the present application;
[0031] Figure 8 A schematic diagram of an abnormal network detection effect provided in an embodiment of the present application;
[0032] Fig. 9 A schematic diagram of the structure of an abnormal network detection device provided in an embodiment of the present application;
[0033] Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0034] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.
[0035] In the description of this application, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" and "plurality" refer to two or more. The words "first", "second", etc. do not limit the quantity and execution order, and the words "first", "second", etc. do not limit them to be different.
[0036] Technical term explanation:
[0037] A botnet is a collection of computers that are centrally controlled by an attacker. The attacker (also known as the zombie host controller) can use the command and control channel to manipulate the "zombies" (i.e. the controlled computers) infected with the bot program to synchronously perform the same malicious activities. A botnet is a network composed of a group of malicious code-carrying computers that are controlled through the C&C channel and that coordinately execute malicious attack events.
[0038] A botnet usually consists of the following components:
[0039] 1. The controller (Botmaster), the initiator of the command, is responsible for sending attack instructions, setting the attack type and duration, updating the built-in bot program, etc.
[0040] 2. Command and control server (C&C Server), the botnet has a dedicated channel to communicate with the bot host (Bot). The attacker issues commands through the C&C server, and the Bot receives and sends relevant reports such as command execution results to the attacker through the C&C channel.
[0041] 3. Bot, a controlled host (computer, terminal device), runs secretly in the controlled host, actively receives instructions issued on the control and command channel, and performs corresponding operations. Its functional structure mainly includes: command and control module, propagation module, download and update module, and avoidance detection module.
[0042] like Figure 1 As shown in the figure, botnets can be classified according to different dimensions. When classified according to communication protocols, they can be divided into: IRC botnet, HTTP botnet, DNS botnet, Fast-Flux botnet, Domain-Flux botnet, etc.; when classified according to message delivery mechanisms, they can be divided into: push mechanisms and pull mechanisms; when classified according to topological structures, they can be divided into: centralized, distributed (peer-to-peer, P2P), hybrid, etc.
[0043] The botnet detection involved in this application is mainly for IRC botnet detection. IRC botnet consists of two parts: botnet controller and bot program. Botnet controller is generally built on a public IRC chat server. However, in order to ensure that the attacker has absolute control over the botnet controller, the attacker often chooses a special host to build an IRC botnet control and command server.
[0044] like Figure 2 As shown, an IRC botnet architecture is provided, including a bot controller, a command and control server, multiple bots and an attack target. The bot controller, the command and control server and the multiple bots are in command and control communication, and the multiple bots and the attack target are in malicious attack behavior. It can be seen that with the widespread spread of bot programs, a large number of bots are connected to the designated IRC command and control server through preset bot program instructions, and are controlled by the bot controller, forming a huge IRC botnet system, which then uses the platform to continuously launch malicious attacks on the attack target.
[0045] Currently, the main way to detect IRC botnets is to search for similarities in network traffic data. Most of them are offline analysis of historical network traffic data, focusing on improving the accuracy of detection without considering the speed and real-time nature of detection. As the network environment is constantly changing, it is crucial to obtain the latest botnet information. For example, when an IRC botnet is detected through network log information, the IRC command and control server at that time may have been transferred or closed, and the controller of the bot host cannot be tracked using historical information; in addition, discovering the current IRC botnet activities can provide necessary protection for bot defense and countermeasures, which will greatly reduce the losses caused by bot attacks.
[0046] Since the behaviors of infected terminal devices (i.e. zombie hosts) in a botnet are similar, regular, and traceable in the network, they can be detected through behavioral feature statistical analysis, bot behavior simulation and monitoring, and traffic data feature matching.
[0047] The behavioral feature statistical analysis method refers to the statistics and analysis of abnormal behaviors of botnets based on social engineering before they spread and prepare to launch attacks, such as frequently sending large numbers of data packets, sending spam, scanning specific port numbers, etc., to detect abnormal terminal devices in the network. This method requires monitoring a large number of characteristics of the relevant terminal devices and may require changes to the network architecture or device usage status.
[0048] The bot behavior simulation and monitoring method refers to using the honeypot system to obtain bot samples, and through the bot samples to grasp the behavioral characteristics of the botnet in which it is located, and finally directly match the terminal devices with known botnets in the network to screen the infected terminal devices. This method requires capturing as many botnets as possible. If an extremely secretive or new botnet appears, it is difficult to discover an unknown botnet.
[0049] The traffic data feature matching method focuses on the characteristics of network traffic, distinguishing normal traffic from abnormal traffic, and thus discovering botnets. For example, abnormal events are clustered to identify suspicious bot hosts, and finally the botnet is confirmed by calculating the similarity distance; there is also the use of the synchronization of IRC bot hosts, and the similarity of nicknames and command sequences to propose an IRC botnet detection method based on terminal behavior characteristics; in-depth analysis of the communication volume and communication frequency characteristics of the IRC botnet, fusion of multiple measurement indicators, and finally the use of similarity measurement models to identify botnets. This method mainly analyzes offline data and cannot detect botnets online in real time.
[0050] These methods all detect IRC botnets by searching for similarities in network traffic data. However, these methods all perform offline analysis on historical network traffic data and focus on improving the accuracy of detection without considering the speed and real-time nature of detection.
[0051] An abnormal network detection method provided in an embodiment of the present application can be applied to an abnormal network detection system. Figure 3 FIG. 1 shows a structural diagram of the abnormal network detection system. Figure 3 As shown, the abnormal network detection system 30 includes: an electronic device 31 and a network to be detected 32. The network to be detected 32 includes a plurality of terminals, and the plurality of terminals can send flow data to each other.
[0052] The electronic device 31 is used to obtain multiple flow data in the network to be detected 32, each flow data includes communication information, the network to be detected includes multiple terminals, each flow data is flow data between any two terminals, and the communication information includes: source address and destination address.
[0053] The electronic device 31 is further used to determine a plurality of characteristic data streams based on the communication information included in each piece of traffic data, each characteristic data stream being composed of traffic data including the same source address and destination address.
[0054] The electronic device 31 is further configured to determine the similarity between any two feature data streams among the multiple feature data streams.
[0055] The electronic device 31 is further used to determine a target terminal from multiple terminals based on the similarity between every two feature data streams in the multiple feature data streams, where the target terminal is a control terminal of the botnet.
[0056] In the embodiment of the present application, since the zombie hosts in the IRC botnet have strong correlation and synchronization, this is mainly manifested in two aspects: one is that different zombie hosts communicate with the command and control server at the same time and receive its control instructions; the other is that different zombie hosts initiate malicious behaviors at the same time after receiving the attack instructions, and the correlation between them is relatively large. Therefore, based on these characteristics of the IRC botnet, the synchronization between zombie hosts is utilized to search for similarities in the massive feature data streams, and the traffic data with high similarity will be considered as suspicious zombie traffic. After searching for suspicious zombie traffic, the zombie host is finally confirmed through topological analysis.
[0057] Specifically, Figure 4 As shown, a specific abnormal network detection system is provided. First, the current network traffic (NetFlow) is captured online, and only the network traffic that meets the specific protocol and traffic characteristics is retained by preprocessing operations. Then, feature data streams (such as feature stream 1, feature stream 2, feature stream 3, etc.) are constructed through feature extraction. After that, the high similarity between feature streams is searched by online analysis (i.e., similarity search), and the Fourier coefficients are extracted by incremental discrete Fourier transform to efficiently locate feature streams with high similarity, thereby determining suspicious IRC zombie traffic and determining the candidate zombie set (i.e., abnormal terminals). Finally, the basic structure of the botnet is constructed through topological analysis, and the zombie host is confirmed.
[0058] The following describes an abnormal network detection method provided by an embodiment of the present application in conjunction with the accompanying drawings. Figure 5 As shown, an abnormal network detection method provided in an embodiment of the present application includes S501-S504:
[0059] S501: Acquire multiple pieces of traffic data in a network to be detected.
[0060] Each piece of traffic data includes communication information, the network to be detected includes multiple terminals, each piece of traffic data is traffic data between any two terminals, and the communication information includes: source address and destination address.
[0061] Optionally, multiple pieces of traffic data in the network to be detected may be directly obtained from the operator server, or the traffic data between terminals may be directly obtained from the network to be detected in a specific manner.
[0062] Optionally, the traffic data may be in Netflow format. The communication information included in the traffic data may include, in addition to the source IP address and the destination IP address, at least one of the following important attribute characteristics: time, duration, protocol type, source port number, destination port number, number of outgoing packets, number of incoming packets, etc.
[0063] It should be noted that network traffic data is massive, most of which is normal network data. The detection object space is large, and much of the data obviously does not meet the characteristics of traffic data in a botnet. Therefore, the traffic data needs to be preprocessed before detection to filter out this data in order to reduce the cost of subsequent detection work.
[0064] Optionally, the obtaining of multiple pieces of flow data in the network to be detected includes: preprocessing the flow data in the network to be detected to obtain the multiple pieces of flow data.
[0065] Among them, the preprocessing includes at least one of the following: obtaining traffic data of a preset protocol type, obtaining traffic data with a data transmission rate less than a preset rate and a data length within a preset length range, and removing traffic data including a preset address.
[0066] Specifically, obtaining the traffic data of the preset protocol type can be understood as filtering the traffic data in the network to be detected based on the traffic protocol type. This is because the communication control of the botnet basically adopts the TCP protocol, so all traffic data of non-TCP protocols can be filtered out.
[0067] The data transmission rate being less than the preset rate can be understood as filtering the traffic data based on the traffic characteristics to filter out some traffic data that obviously does not conform to the communication control flow characteristics of the botnet. This is because the communication control process of the botnet generally transmits various commands (such as information query, launching a certain attack, etc.), which has the characteristics of small traffic and small number of packets. Therefore, some high data rate traffic can be filtered, such as data upload and download, software upgrade and update, etc. In addition, very short sequence traffic data and very long sequence traffic data can be filtered, because according to the communication traffic characteristics of the botnet, these two types of traffic obviously do not conform.
[0068] It should be noted that in the actual detection process, the filtering conditions can be modified and updated based on actual needs, and no specific restrictions are made here.
[0069] Removing traffic data including preset addresses can be understood as: by setting a whitelist, traffic to certain destination hosts that are known servers, such as communication traffic data for accessing known websites, can be considered normal traffic, and thus the domain names and IP addresses of these known servers are added to the static whitelist.
[0070] In the embodiment of the present application, the traffic data in the network to be detected is pre-processed to screen and filter the required traffic data that meets the communication control flow characteristics of the botnet, thereby removing a large amount of traffic data that is obviously not a botnet, reducing the workload of subsequent processing of the traffic data and improving the efficiency of data processing.
[0071] S502. Determine multiple characteristic data flows based on the communication information included in each piece of traffic data.
[0072] Each characteristic data flow is composed of traffic data including the same source address and destination address.
[0073] In a specific implementation, the above-mentioned method determines multiple characteristic data streams based on the communication information included in each piece of traffic data, including: based on the source address and destination address included in each piece of traffic data, dividing the traffic data with the same source address and the same destination address into a group of traffic data to obtain multiple groups of traffic data; based on a characteristic vector composed of at least one piece of traffic data included in each group of traffic data, determining the characteristic data stream of each group of traffic data to obtain multiple characteristic data streams, each characteristic data stream is used to indicate the communication information of a group of traffic data.
[0074] It can be understood that in order to capture traffic data with high similarity over a continuous period of time, traffic data of the same category (i.e., with the same source address and the same destination address) can be aggregated to construct a combined flow (i.e., multiple groups of traffic data). Thus, the traffic data with the same source address and destination address within a given time range T constitute a combined flow. That is, the Netflow data is grouped according to the two fields of source address and destination address.
[0075] That is, the embodiment of the present application utilizes the synchronization between zombie hosts: the zombie hosts simultaneously communicate with the command and control server and initiate malicious behaviors at the same time to identify suspicious zombie traffic. In addition, when preprocessing the traffic data, only traffic data that meets specific protocols and traffic characteristics is retained. Then, key features are extracted from these traffic flows to construct feature data streams for subsequent analysis.
[0076] For example, assuming that CS is a combined stream, given the time range T and the basic time unit Δt, the characteristic data stream FS of CS can be expressed as in is a d-dimensional feature vector within Δt, that is
[0077] For example, a three-dimensional feature vector can be constructed by selecting the total number of data packets (i.e., traffic data) of the combined flow within one minute, the total number of bytes, and the average number of bytes per data packet. When the time range of the combined flow is T = 1000 minutes, a feature data stream with a length of 1000 can be constructed.
[0078] In the embodiment of the present application, based on the source address and destination address included in each piece of traffic data, the traffic data with the same source address and the same destination address can be divided into a group of traffic data to obtain multiple groups of traffic data. Therefore, since the similarity of the traffic data transmitted between the same two terminals is high, the traffic data transmitted between the same two terminals can be divided into a group. Then, based on the feature vector composed of at least one piece of traffic data included in each group of traffic data, the feature data stream of each group of traffic data is determined to obtain multiple feature data streams. In the subsequent data processing process, the efficiency and accuracy of data processing can be improved through the feature data stream.
[0079] S503: For any two feature data streams among the multiple feature data streams, determine the similarity between the any two feature data streams.
[0080] Optionally, the multiple feature data streams are time domain data.
[0081] Specifically, the above-mentioned determining the similarity between any two feature data streams among the multiple feature data streams includes: converting the multiple feature data streams of time domain data into multiple feature data streams of frequency domain data; determining the Euclidean distance between any two feature data streams among the multiple feature data streams of frequency domain data; and determining the similarity between any two feature data streams based on the Euclidean distance between the any two feature data streams.
[0082] It should be noted that after the time domain data (i.e., time series data) is converted into frequency domain data (i.e., frequency domain sequence data), it has Euclidean distance invariance. When comparing the similarity of the original sequence, it can be calculated by discrete Fourier coefficients. After the time series is transformed by discrete Fourier transform, most of the coefficients are close to 0, and only a few coefficients retain most of the energy of the sequence. When using Fourier coefficients to calculate similarity, only a few coefficients can be used to approximate the similarity of the original sequence with high accuracy. In this way, the calculation space is greatly compressed, thereby achieving a fast search for similarity.
[0083] Specifically, the discrete Fourier transform is, given a time series Its discrete Fourier transform is shown in formula 1:
[0084]
[0085] Among them, the restriction on X(N) is shown in Formula 2:
[0086]
[0087] It can be seen that and With the same sequence length, discrete Fourier transform simply converts one sequence into another, that is, converting time domain data (i.e. time series data) into frequency domain data (i.e. frequency domain series data).
[0088] In the embodiment of the present application, by converting multiple feature data streams of time domain data into multiple feature data streams of frequency domain data, the Euclidean distance invariance of the data can be guaranteed, so that the Euclidean distance between any two feature data streams can be more accurately determined through multiple feature data streams of frequency domain data, thereby determining the similarity between any two feature data streams. This is because after the time series is discrete Fourier transformed, most of the coefficients are close to 0, and only a few coefficients retain most of the energy of the sequence. When calculating similarity using Fourier coefficients, the similarity of the original sequence can be approximately calculated using very few coefficients, and the accuracy is relatively high.
[0089] Optionally, the above-mentioned determining the Euclidean distance between any two feature data streams among the multiple feature data streams of frequency domain data includes: for any two feature data streams among the multiple feature data streams of frequency domain data, based on the number of dimensions of the feature data streams, decomposing each feature data stream of any two feature data streams to obtain multiple sub-data streams of each feature data stream; and determining the Euclidean distance between any two feature data streams by a preset algorithm based on the multiple sub-data streams of each feature data stream of any two feature data streams.
[0090] Specifically, for the convenience of calculation, firstly, based on the number of dimensions of the feature data stream, the feature data stream is decomposed into d sub-data streams (also called feature sub-data streams), that is, the data of each dimension in the feature data stream constitutes a sub-data stream. The kth sub-data stream obtained by decomposition is FS k = {FS k [1],FS k [2],…,FS k [t],…}, each sub-data stream represents a one-dimensional rectification constructed from a feature in the combined stream.
[0091] In this way, after data standardization, the similarity of any two feature data streams can be judged by calculating the Euclidean distance. The smaller the Euclidean distance, the higher the similarity.
[0092] For example, assuming that the characteristic data stream FS i and FS j The d-dimensional sub-data stream is standardized (i.e., decomposing each feature data stream into multiple sub-data streams), and the window size is w. Then, the Euclidean distance between two feature data streams can be determined by Formula 3:
[0093]
[0094] In this way, based on a preset similarity threshold (Euclidean distance threshold), it can be determined whether the similarity between any two feature data streams meets the conditions, whether the traffic data corresponding to any two feature data streams are abnormal data (i.e., zombie traffic data), and whether the source device and destination device corresponding to the traffic data are abnormal devices (i.e., zombie hosts).
[0095] For example, assuming that the preset similarity threshold is ε, if D i,j <ε, then it is considered that the similarity between any two feature data streams meets the conditions, the corresponding traffic data is abnormal data, and whether the source device and destination device corresponding to the traffic data are abnormal devices.
[0096] In the embodiment of the present application, each of any two feature data streams can be decomposed based on the number of dimensions of the feature data stream to obtain multiple sub-data streams of each feature data stream, and then the Euclidean distance between any two feature data streams can be determined based on the Euclidean distance algorithm. In this way, by decomposing each feature data stream to obtain sub-data streams, the corresponding Euclidean distance can be accurately determined.
[0097] Optionally, since the number of feature data streams in the network is very large, if high similarity is found by pairwise comparison, it will cause a large system overhead. Therefore, the incremental discrete Fourier transform method can be used to quickly locate feature streams with high similarity from a large number of feature data streams.
[0098] Based on this, the above method of the present application may also specifically include: when newly added traffic data is obtained from the network to be detected, based on the communication information included in the newly added traffic data, the newly added traffic data is added to a corresponding set of traffic data; in the case where newly added traffic data is added to two sets of traffic data corresponding to any two feature data streams, based on the Euclidean distance between the newly added traffic data and any two feature data streams, the similarity between any two feature data streams after the newly added traffic data is determined.
[0099] It should be noted that the discrete Fourier transform has the characteristic of keeping the Euclidean distance unchanged. By calculating the similarity through the discrete Fourier transform, the operation efficiency can be greatly improved while ensuring the accuracy of the result. However, the transformation process still requires a certain amount of overhead. For the feature data stream, the data is constantly updated. If the discrete Fourier transform is performed again for each updated data, a large amount of calculation will be generated. However, through the incremental discrete Fourier transform method, when new data is obtained, there is no need to recalculate, thereby greatly reducing the calculation overhead.
[0100] For example, assuming that a set of traffic data corresponding to the characteristic data stream is newly added with traffic data, the characteristic data stream before the newly added traffic data can be expressed as X={X(0),X(1),…,X(w-1)}, the window size is w, and the coefficients of the characteristic data stream X after discrete Fourier transform are {DFT0(X),DFT1(X),…DFT w-1 (X)}. When new traffic data is added, the characteristic data stream X is updated to the characteristic data stream Y = {Y(0), Y(1), ..., Y(w-1), Y(w)}, where X(i) = Y(i) (1≤i≤w-1), and Y(w) is the newly added traffic data. Therefore, the coefficients (i.e., Euclidean distance) of the characteristic data stream Y after discrete Fourier transformation are shown in Formula 4:
[0101]
[0102] Therefore, when the characteristic data stream has new flow data, the new discrete Fourier coefficient (Euclidean distance) can be obtained through the old numerical incremental calculation, thereby avoiding a large number of repeated calculations and greatly improving the calculation efficiency.
[0103] In the embodiment of the present application, when newly added traffic data is added to a set of traffic data corresponding to a feature data stream, the similarity between the feature data streams after the newly added traffic data is added can be determined based on the Euclidean distance between the newly added traffic data and the determined feature data streams. This can avoid a large number of repeated calculations and greatly improve the calculation efficiency.
[0104] S504: Determine a target terminal from multiple terminals based on the similarity between every two feature data streams in the multiple feature data streams.
[0105] Among them, the target terminal is the control terminal of the botnet.
[0106] Optionally, the above-mentioned determining the target terminal from multiple terminals based on the similarity between any two characteristic data streams includes: when the similarity between any two characteristic data streams is greater than a preset similarity, determining that two groups of traffic data corresponding to any two characteristic data streams are abnormal data; determining that the terminal indicated by the source address and the terminal indicated by the destination address in the traffic data included in the two groups of traffic data are abnormal terminals; based on the abnormal terminals among the multiple terminals included in the network to be detected, and the transmission direction of the abnormal data transmitted between the abnormal terminals, determining as the target terminal a terminal that receives a number of abnormal data greater than a preset number and sends a number of abnormal data greater than a preset number.
[0107] Optionally, after determining the abnormal terminals in the network, the knowledge of graph theory can be used to analyze the topological structure between the suspicious zombie hosts (ie, the abnormal terminals), so as to finally confirm the zombie network.
[0108] For example, Figure 6 As shown in the figure, the topological structure between abnormal terminals, the abnormal terminal at the center point can be the control terminal of the botnet (also called the botnet central server), which is connected to multiple abnormal terminals (i.e., zombie hosts). Assume that the set of abnormal terminals is determined to be H = {h1,h2,…,h n}, the corresponding abnormal data set is F = {f1,f2,…,f m}, for any flow data f in F k , based on the flow data f k The transmission direction of F can be regarded as the source terminal and the destination terminal as the starting point and the end point respectively, so as to construct the directed graph D corresponding to F. s (V,U), the vertices in H become D sThe abnormal terminal vertex of (V,U).
[0109] For D s For any vertex v in (V,U), if the arc starting point is an abnormal terminal vertex, then the arc is called an abnormal in-arc (suspicious in-arc) of v. Similarly, if the arc starting point is an abnormal terminal vertex, then the arc is called an abnormal out-arc (suspicious out-arc) of v. The number of abnormal out-arcs of vertex v is called abnormal out-degree (suspicious out-degree), denoted as The number of abnormal in-degrees of vertex v is called abnormal in-degree (suspicious in-degree), denoted by For the preset number N s ,if and The abnormal terminal corresponding to vertex v is considered to be the target terminal (i.e., the control terminal of the botnet), and the abnormal terminal connected to the target terminal is called a zombie host.
[0110] Further exemplary, Figure 7 As shown in the figure, it is a topological diagram of a botnet including a large number of abnormal terminals. By judging whether the number of abnormal data received by the terminal is greater than the preset number, and whether the number of abnormal data sent by the terminal is greater than the preset number, the control terminal of the botnet (represented by the black dots in the figure) can be determined from the determined multiple abnormal terminals (represented by the endpoints of the solid line segments in the figure). The endpoints of the dotted line segments in the figure represent normal terminals. Among them, the size of the node (black dot) represents the size of the node degree. According to the botnet topology analysis, when the suspicious in-and-out degrees of the suspicious bot host are both large, it may be the controller of the botnet (i.e., the control terminal).
[0111] In summary, if Figure 8 As shown in the figure, the detection effect comparison diagram of the running time of the three methods is compared under the premise of different feature streams, using Euclidean distance, discrete Fourier transform and incremental discrete Fourier transform. 1000 feature data streams are constructed in the data set, the sliding window size is set to 200 seconds, and the number of discrete Fourier transform coefficients is selected as 16. As shown in the figure, the running time of the three methods keeps increasing with the increase of the number of feature data streams. The simple operation method of Euclidean distance increases the fastest, the operation time of discrete Fourier transform decreases slightly, and the operation time of incremental discrete Fourier transform is the least, and the growth trend is the most stable. It can be seen that the incremental discrete Fourier transform technology has a high execution efficiency when searching for similarity and is suitable for online detection of botnets.
[0112] In an embodiment of the present application, after determining that two groups of traffic data corresponding to any two characteristic data streams are abnormal data, and the terminals indicated by the source addresses and the terminals indicated by the destination addresses in the traffic data included in the two groups of traffic data are abnormal terminals, a topology map can be constructed based on the abnormal terminals among the multiple terminals included in the network to be detected, and the transmission direction of the abnormal data transmitted between the abnormal terminals. Thus, the terminal that receives more than a preset number of abnormal data and sends more than a preset number of abnormal data is determined as the target terminal. Since the number of abnormal data sent and received by the server (i.e., the target terminal) of the botnet is obviously more than that of the bot host, the target sink terminal can be accurately determined based on the number of abnormal data transmitted between the abnormal terminals.
[0113] The present application provides an abnormal network detection method, which can obtain the flow data transmitted between any two terminals in a network to be detected including multiple terminals, so as to form multiple characteristic data streams based on the flow data including the same communication information according to the communication information included in each flow data. In this way, since the flow data including the same source address and destination address is the data transmitted between the same two terminals, the flow data including the same source address and destination address is formed into a characteristic data stream, and the data transmitted between the same two terminals can be uniformly processed. Then, for any two characteristic data streams in the multiple characteristic data streams, the similarity between any two characteristic data streams can be determined. Therefore, according to the similarity between each two characteristic data streams in the multiple characteristic data streams, when the similarity is high, it can be considered as abnormal data transmitted between abnormal terminals, and the control terminal of the botnet can be determined from the multiple terminals. Based on the above scheme, a characteristic data stream can be constructed according to the flow data transmitted in the network, so as to judge the abnormal terminal and abnormal flow data according to the similarity between the characteristic data streams, and determine the control terminal of the botnet. Thereby, the efficiency and accuracy of identifying and detecting abnormal networks can be improved, and network security can be improved.
[0114] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiment disclosed herein, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.
[0115] The embodiment of the present application can divide the functional modules of an abnormal network detection device according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. Optionally, the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.
[0116] Fig. 9 A schematic diagram of the structure of an abnormal network detection device provided in an embodiment of the present application is shown in FIG. Fig. 9 As shown, an abnormal network detection device 900 is used to improve the efficiency and accuracy of identifying and detecting abnormal networks, and improve network security, for example, for executing Figure 5 An abnormal network detection method is shown. The abnormal network detection device 900 includes: an acquisition unit 901 and a processing unit 902;
[0117] The acquisition unit 901 is used to acquire multiple traffic data in the network to be detected, each traffic data includes communication information, the network to be detected includes multiple terminals, each traffic data is traffic data between any two terminals, and the communication information includes: a source address and a destination address; the processing unit 902 is used to determine multiple characteristic data streams based on the communication information included in each traffic data, each characteristic data stream is composed of traffic data including the same source address and destination address; the processing unit 902 is also used to determine the similarity between any two characteristic data streams in the multiple characteristic data streams; the processing unit 902 is also used to determine the target terminal from the multiple terminals based on the similarity between every two characteristic data streams in the multiple characteristic data streams, and the target terminal is the control terminal of the botnet.
[0118] In one possible implementation, the processing unit 902 is also used to preprocess the traffic data in the network to be detected to obtain multiple traffic data, and the preprocessing includes at least one of the following: obtaining traffic data of a preset protocol type, obtaining traffic data with a data transmission rate less than a preset rate and a data length within a preset length range, and removing traffic data including a preset address.
[0119] In a possible implementation, the communication information also includes at least one of the following: time, duration, protocol type, source port number, destination port number, number of outgoing packets, and number of incoming packets; processing unit 902 is specifically used to divide the traffic data with the same source address and the same destination address into a group of traffic data based on the source address and destination address included in each traffic data, so as to obtain multiple groups of traffic data; processing unit 902 is specifically used to determine the characteristic data stream of each group of traffic data based on a characteristic vector composed of at least one traffic data included in each group of traffic data, and obtain multiple characteristic data streams, each characteristic data stream is used to indicate the communication information of a group of traffic data.
[0120] In one possible implementation, the multiple feature data streams are time domain data; the processing unit 902 is specifically used to convert the multiple feature data streams that are time domain data into multiple feature data streams of frequency domain data; the processing unit 902 is specifically used to determine the Euclidean distance between any two feature data streams in the multiple feature data streams of frequency domain data; the processing unit 902 is specifically used to determine the similarity between any two feature data streams based on the Euclidean distance between any two feature data streams.
[0121] In one possible implementation, the processing unit 902 is specifically used to decompose each of any two feature data streams among multiple feature data streams of frequency domain data based on the number of dimensions of the feature data streams to obtain multiple sub-data streams of each feature data stream; the processing unit 902 is specifically used to determine the Euclidean distance between any two feature data streams through a preset algorithm based on the multiple sub-data streams of each feature data stream among any two feature data streams.
[0122] In one possible implementation, the processing unit 902 is further used to, when newly added traffic data is obtained from the network to be detected, add the newly added traffic data to a corresponding set of traffic data based on the communication information included in the newly added traffic data; the processing unit 902 is further used to, when the newly added traffic data is added to the two sets of traffic data corresponding to any two feature data streams, determine the similarity between any two feature data streams after the newly added traffic data is added, based on the Euclidean distance between the newly added traffic data and any two feature data streams.
[0123] In one possible implementation, the processing unit 902 is specifically used to determine that two groups of traffic data corresponding to any two characteristic data streams are abnormal data when the similarity between any two characteristic data streams is greater than a preset similarity; the processing unit 902 is specifically used to determine that the terminal indicated by the source address and the terminal indicated by the destination address in the traffic data included in the two groups of traffic data are abnormal terminals; the processing unit 902 is specifically used to determine, as a target terminal, a terminal that receives a greater number of abnormal data and sends a greater number of abnormal data than a preset number based on the abnormal terminals among multiple terminals included in the network to be detected and the transmission direction of the abnormal data transmitted between the abnormal terminals.
[0124] In the case of implementing the functions of the above-mentioned integrated modules in the form of hardware, the embodiment of the present application provides another possible structural diagram of the electronic device involved in the above-mentioned embodiment. Fig.10 As shown, an electronic device 100 is used to improve the efficiency and accuracy of identifying and detecting abnormal networks and improve network security, for example, for performing Figure 5 An abnormal network detection method is shown. The electronic device 100 includes a processor 1001, a memory 1002 and a bus 1003. The processor 1001 and the memory 1002 may be connected via the bus 1003.
[0125] The processor 1001 is the control center of the communication device, which can be a processor or a general term for multiple processing elements. For example, the processor 1001 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.
[0126] As an embodiment, the processor 1001 may include one or more CPUs, such as Fig.10 CPU 0 and CPU 1 are shown in .
[0127] The memory 1002 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.
[0128] As a possible implementation, the memory 1002 can exist independently of the processor 1001, and the memory 1002 can be connected to the processor 1001 via the bus 1003 to store instructions or program codes. When the processor 1001 calls and executes the instructions or program codes stored in the memory 1002, an abnormal network detection method provided in an embodiment of the present application can be implemented.
[0129] In another possible implementation, the memory 1002 may also be integrated with the processor 1001 .
[0130] The bus 1003 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.
[0131] It should be pointed out that Fig.10 The structure shown does not constitute a limitation on the electronic device 100. Fig.10 In addition to the components shown, the electronic device 100 may include more or fewer components than shown, or combine certain components, or arrange the components differently.
[0132] As an example, combining Fig. 9 The functions implemented by the acquisition unit 901 and the processing unit 902 in the electronic device are similar to those Fig.10 The function of processor 1001 in is the same.
[0133] Optional, such as Fig.10 As shown, the electronic device 100 provided in the embodiment of the present application may further include a communication interface 1004 .
[0134] The communication interface 1004 is used to connect with other devices through a communication network. The communication network may be Ethernet, wireless access network, wireless local area network (WLAN), etc. The communication interface 1004 may include a receiving unit for receiving data and a sending unit for sending data.
[0135] In one design, in the electronic device provided in the embodiment of the present application, the communication interface can also be integrated into the processor.
[0136] Through the description of the above implementation methods, those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above functional units is used as an example. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.
[0137] An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When a computer executes the instructions, the computer executes each step in the method flow shown in the above method embodiment.
[0138] An embodiment of the present application provides a computer program product including instructions. When the instructions are executed on a computer, the computer is enabled to execute an abnormal network detection method in the above method embodiment.
[0139] Among them, the computer readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk. Random Access Memory (RAM), Read-Only Memory (ROM), Erasable Programmable Read Only Memory (EPROM), registers, hard disks, optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or the above in a suitable combination, or any other form of computer readable storage medium known in the art.
[0140] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be located in an Application Specific Integrated Circuit (ASIC).
[0141] In the embodiments of the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program, which may be used by or in conjunction with an instruction execution system, apparatus, or device.
[0142] Since the electronic device, computer-readable storage medium, and computer program product in the embodiments of the present application can be applied to the above-mentioned method, the technical effects that can be obtained can also refer to the above-mentioned method embodiments, and the embodiments of the present application will not be repeated here.
[0143] The above are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application.
Claims
1. A method for detecting abnormal network, characterized in that: The method comprises: Acquire multiple pieces of flow data in the network to be detected, each piece of flow data includes communication information, the network to be detected includes multiple terminals, each piece of flow data is flow data between any two terminals, and the communication information includes: a source address and a destination address; Based on the communication information included in each piece of traffic data, a plurality of characteristic data flows are determined, each characteristic data flow being composed of traffic data including the same source address and destination address; For any two feature data streams among the multiple feature data streams, determining the similarity between the any two feature data streams; Based on the similarity between every two characteristic data streams in the multiple characteristic data streams, a target terminal is determined from the multiple terminals, and the target terminal is a control terminal of the botnet.
2. The method according to claim 1, characterized in that The step of obtaining a plurality of pieces of traffic data in the network to be detected includes: The traffic data in the network to be detected is preprocessed to obtain the multiple traffic data, and the preprocessing includes at least one of the following: obtaining traffic data of a preset protocol type, obtaining traffic data with a data transmission rate less than a preset rate and a data length within a preset length range, and removing traffic data including a preset address.
3. The method according to claim 1, characterized in that The communication information also includes at least one of the following: time, duration, protocol type, source port number, destination port number, number of outgoing packets, number of incoming packets; The determining of multiple characteristic data flows based on the communication information included in each piece of traffic data includes: Based on the source address and the destination address included in each piece of traffic data, the traffic data with the same source address and the same destination address are divided into a group of traffic data to obtain multiple groups of traffic data; Based on a feature vector formed by at least one piece of traffic data included in each group of traffic data, a feature data stream of each group of traffic data is determined to obtain the multiple feature data streams, each feature data stream being used to indicate communication information of a group of traffic data.
4. The method according to any one of claims 1 to 3, characterized in that The multiple feature data streams are time domain data; The determining, for any two feature data streams among the plurality of feature data streams, the similarity between the any two feature data streams comprises: Convert the multiple feature data streams, which are time domain data, into multiple feature data streams, which are frequency domain data; For any two feature data streams among the plurality of feature data streams of the frequency domain data, determining the Euclidean distance between the any two feature data streams; Based on the Euclidean distance between the arbitrary two feature data streams, the similarity between the arbitrary two feature data streams is determined.
5. The method according to claim 4, characterized in that The determining the Euclidean distance between any two feature data streams among the plurality of feature data streams of the frequency domain data comprises: For any two feature data streams of the multiple feature data streams of the frequency domain data, based on the number of dimensions of the feature data streams, decompose each feature data stream of the any two feature data streams to obtain multiple sub-data streams of each feature data stream; Based on the multiple sub-data streams of each of the arbitrary two feature data streams, the Euclidean distance between the arbitrary two feature data streams is determined by a preset algorithm.
6. The method according to claim 4, characterized in that The method further comprises: When newly added traffic data is obtained from the network to be detected, based on the communication information included in the newly added traffic data, the newly added traffic data is added to a corresponding set of traffic data; When the newly added traffic data is added to the two groups of traffic data corresponding to the any two feature data streams, the similarity between the any two feature data streams after the newly added traffic data is determined based on the Euclidean distance between the newly added traffic data and the any two feature data streams.
7. The method according to any one of claims 1 to 3, characterized in that The determining a target terminal from the plurality of terminals based on the similarity between the any two feature data streams includes: When the similarity between the two arbitrary characteristic data streams is greater than a preset similarity, determining that the two groups of flow data corresponding to the two arbitrary characteristic data streams are abnormal data; Determining that a terminal indicated by a source address and a terminal indicated by a destination address in the traffic data included in the two sets of traffic data are abnormal terminals; Based on abnormal terminals among the multiple terminals included in the network to be detected and the transmission direction of abnormal data transmitted between the abnormal terminals, a terminal that receives a greater number of abnormal data than a preset number and sends a greater number of abnormal data than the preset number is determined as the target terminal.
8. An abnormal network detection device, characterized in that: The abnormal network detection device comprises: an acquisition unit and a processing unit; The acquisition unit is used to acquire multiple pieces of flow data in the network to be detected, each piece of flow data includes communication information, the network to be detected includes multiple terminals, each piece of flow data is flow data between any two terminals, and the communication information includes: a source address and a destination address; The processing unit is used to determine a plurality of characteristic data flows based on the communication information included in each piece of traffic data, each characteristic data flow being composed of traffic data including the same source address and destination address; The processing unit is further configured to determine, for any two feature data streams among the plurality of feature data streams, a similarity between the any two feature data streams; The processing unit is further configured to determine a target terminal from the multiple terminals based on the similarity between every two feature data streams in the multiple feature data streams, wherein the target terminal is a control terminal of the botnet.
9. An electronic device, characterized in that: include: A processor and a memory; wherein the memory is used to store one or more programs, and the one or more programs include computer-executable instructions. When the electronic device is running, the processor executes the computer-executable instructions stored in the memory to enable the electronic device to execute an abnormal network detection method described in any one of claims 1 to 7.
10. A computer-readable storage medium storing one or more programs, characterized in that: The one or more programs include instructions, and when the instructions are executed by a computer, the computer executes an abnormal network detection method according to any one of claims 1 to 7.