Flow filtering identification method and system oriented to directional network attack
By extracting and classifying the network traffic of the power monitoring system, combining protocol detection, parameter inspection and frequency domain analysis, identifying and generating targeted network attack incident alarm information, the problem of difficulty in identifying targeted network attack paths in the existing technology is solved, and effective detection and analysis of targeted network attacks is realized.
Patent Information
- Application Number
- CN202411541646.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-31
- Publication Date
- 2025-02-25
AI Technical Summary
Existing detection methods are difficult to identify the complete attack path in targeted cyber attacks, and traditional solutions cannot detect ongoing attack behaviors and provide attack intelligence from large amounts of traffic information.
A traffic filtering and identification method for targeted network attacks is adopted. By collecting historical traffic, the interactive features between devices are extracted, the training set is constructed and decomposed into the main model and object model, the traffic to be detected is classified, abnormal traffic is filtered out, and the attack characteristics are identified through protocol detection, parameter inspection and frequency domain analysis, and the targeted network attack event alarm information is generated.
It realizes non-real-time detection of targeted network attacks, and can output a variety of targeted attack behaviors contained in the traffic information to be detected, including the directional relationship between devices in the attack event, the specific type of attack, and the duration of the attack, providing reference for the analysis and prediction of targeted network attacks.
Smart Images
Figure CN119520041A_ABST
Abstract
Description
Technical Field
[0001] The invention belongs to the field of network security, and in particular relates to a flow filtering and identification method and system for directional network attacks. Background Art
[0002] In the security protection system of the power monitoring system, the security protection solution focuses on strengthening the network boundary and has a strong protection capability against direct external attacks. In terms of network security event detection, it focuses on the detection of non-continuous security events. However, in a targeted network attack, the attacker will use a variety of targeted professional offensive means to launch a continuous attack on the target network. After breaking through the weak points of protection at the boundary, the attacker will further launch a lateral attack from the inside and finally achieve its attack purpose. When the power monitoring system faces a targeted network attack, the existing detection methods are difficult to identify the complete attack path.
[0003] Existing technologies for defending against targeted network attacks mainly focus on APT attacks against corporate intranets, focusing on hierarchical modeling of attack activities and tracing attackers. The research goal of tracing targeted network attacks is to track and trace the attackers or organizations that launched the attack based on attack intelligence information, while basic attack behavior detection relies on intrusion detection systems. Security devices based on intrusion detection systems can generally detect short-term typical attacks. However, targeted network attacks often evade the detection of intrusion detection systems by continuous attack methods, and traditional solutions cannot detect continuous attack behaviors and provide attack intelligence from a large amount of traffic information. Summary of the invention
[0004] In order to solve the deficiencies in the prior art, the present invention provides a traffic filtering and identification method and system for targeted network attacks to solve the technical problem of non-real-time detection of targeted network attacks.
[0005] In order to solve the above technical problems, the present invention adopts the following technical solutions.
[0006] The present invention first discloses a traffic filtering and identification method for targeted network attacks, the method comprising the following steps:
[0007] Collecting historical traffic of predefined days, extracting interaction features between devices in a traffic filter based on the historical traffic and constructing a training set, decomposing the training set into a subject model and an object model, and using the subject model and the object model to classify the traffic to be detected, filtering out abnormal traffic;
[0008] The abnormal traffic is matched with the pre-set directional network attack features, which include protocol detection, parameter checking and frequency domain analysis. When the matching attack features are identified, the corresponding directional network attack type is determined, and the abnormal traffic information is combined into an attack event to generate directional network attack event alarm information.
[0009] The present invention further includes the following preferred embodiments:
[0010] The step of extracting interaction features between devices in a traffic filter based on the historical traffic and constructing the features as a training set further includes:
[0011] The training set is obtained by statistics of historical normal traffic. The interaction intensity between various network devices within a day under historical normal business scenarios is statistically analyzed, including source address, destination address, and daily average number of sessions. A sparse matrix X with N rows and N columns is described by triples as the training set, where N is the number of active devices detected in the network. In the triples, the source address and destination address are replaced with the row index and column index of the corresponding address in the matrix.
[0012] Decomposing the training set into a subject model and an object model further comprises:
[0013] Perform matrix decomposition on the matrix X described by the triples, and obtain the subject matrix U and object matrix V with N rows and k columns through the following process:
[0014] Step 101: Determine the principal matrix U by random filling method;
[0015] Step 102: Based on the current subject matrix U, let the partial derivative of the loss function Loss with respect to the object matrix V
[0016] is zero, update the object matrix V;
[0017] Step 103: Based on the current object matrix V, let the partial derivative of the loss function Loss with respect to the subject matrix U
[0018] To zero, update the principal matrix U;
[0019] Step 104: Calculate the loss function Loss and determine whether it converges. If the loss function does not converge, return to step 102. If the loss function converges, end.
[0020] The loss function Loss is:
[0021]
[0022] Where K is the set of row and column numbers corresponding to the known elements in the training set, xi,j is the value of the element in the i-th row and j-th column of the training set, u i and v j are the row vectors of the i-th row of the subject matrix and the j-th row of the object matrix respectively, λ is the regularization coefficient, the loss function value is obtained by summing the error term and the regularization term, the error term describes the gap between the current subject matrix and the object matrix for the training set, and the regularization term prevents overfitting.
[0023] The filtering out abnormal traffic further includes:
[0024] For daily traffic, group the traffic by session subject;
[0025] For the traffic of each subject on that day, the normal traffic model is used to calculate the predicted value of the number of normal sessions between each subject and object. First, the corresponding index in the normal traffic model is determined according to the source address and the destination address; secondly, the corresponding row vectors in the subject matrix and the object matrix are extracted according to the index to obtain two k-dimensional vectors; finally, the inner product of the two vectors is calculated to obtain the predicted value of the matrix element in the normal traffic model:
[0026]
[0027] Calculate the percentage of the error between the actual value and the predicted value to the predicted value. If the percentage is greater than a preset threshold, it is determined that there is abnormal traffic, and the specific source address, destination address, and date are recorded in the abnormal traffic record queue;
[0028] According to the abnormal traffic record queue, all relevant traffic is extracted from the traffic information to be detected; according to each abnormal information in the abnormal traffic queue, all traffic information from the source address to the destination address of the day is extracted as the abnormal traffic filtering result.
[0029] The matching of the abnormal traffic with the preset directional network attack features further includes:
[0030] All abnormal traffic is grouped according to the source address to obtain abnormal traffic information of each abnormal device;
[0031] Perform protocol detection on the daily traffic of the current device respectively. If the attack characteristics of the port scan type are met, the specific attack event is recorded according to the specific information in the attack traffic. The recording format is: {current device address, {attacked device address}, "port scan", today's date};
[0032] Perform parameter checks on the daily traffic of the current device respectively. If the attack characteristics of the SQL injection type are met, the specific attack event is recorded according to the specific information in the attack traffic. The recording format is: {current device address, {attacked device address}, "SQL injection", today's date};
[0033] Perform frequency domain analysis on the daily traffic of the current device respectively. If the attack characteristics of the traffic leakage type are met, the attack event is recorded according to the specific information of the current device. The recording format is: {current device address, {}, "traffic leakage", today's date}.
[0034] The combining of abnormal traffic information into attack events and generating targeted network attack event alarm information further includes:
[0035] All attack records are integrated; if an attack event meets the conditions of the same attack device, the same attack type, and adjacent attack dates, these attack events are merged into one attack event in the format of {address of the attack initiating device, {address of the attacked device}, attack type, attack start date, attack end date};
[0036] If the attack events are merged, the set of attacked device addresses is the union of the merged sets, the attack start date is the earliest merged date, and the attack end date is the latest merged date;
[0037] If the attack events are not merged, the attack start date and the attack end date are the same;
[0038] The final merged event set is output as targeted network attack warning information.
[0039] The present invention also discloses a traffic filtering and identifying system for targeted network attacks using the aforementioned traffic filtering and identifying method for targeted network attacks, comprising:
[0040] A traffic filtering module, used to collect historical traffic of predefined days, extract interaction features between devices in the traffic filter based on the historical traffic and construct a training set, decompose the training set into a subject model and an object model, classify the traffic to be detected using the subject model and the object model, and filter out abnormal traffic;
[0041] The attack identification module is used to match the abnormal traffic with pre-set directional network attack features, which include protocol detection, parameter checking and frequency domain analysis. When a matching attack feature is identified, the corresponding directional network attack type is determined, and the abnormal traffic information is combined into an attack event to generate directional network attack event alarm information.
[0042] Accordingly, the present application also discloses a terminal, including a processor and a storage medium;
[0043] The storage medium is used to store instructions;
[0044] The processor is used to operate according to the instructions to execute the steps of the aforementioned traffic filtering and identification method for targeted network attacks.
[0045] Correspondingly, the present application also discloses a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the aforementioned traffic filtering and identification method for targeted network attacks are implemented.
[0046] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a traffic filtering and identification method and system for targeted network attacks, which adopts a non-real-time detection mode to receive historical normal traffic and traffic information to be detected, and outputs a variety of targeted attack behaviors contained in the traffic information to be detected through traffic filtering and attack identification, including the directional relationship between devices in the attack event, the specific type of attack, and the duration of the attack. The traffic filtering module obtains normal traffic information to construct a traffic filter, and extracts abnormal traffic by classifying the traffic. Based on the abnormal traffic information, a variety of attack behavior information is matched from multiple aspects such as protocol detection, parameter inspection, and frequency domain analysis, and attack event alarms are issued, providing a reference for the analysis and prediction of targeted network attacks. BRIEF DESCRIPTION OF THE DRAWINGS
[0047] Figure 1 It is the overall architecture diagram of the targeted network attack detection in the present invention.
[0048] Figure 2 It is the basic flow chart of the flow filtering module in the present invention.
[0049] Figure 3 It is the basic flow chart of the attack identification module in the present invention. DETAILED DESCRIPTION
[0050] In order to make the purpose, technical solution and advantages of the present invention more clear, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.
[0051] The embodiments described in this application are only some embodiments of the present invention, not all embodiments. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the protection scope of the present invention.
[0052] In view of the shortcomings of the prior art, the present invention proposes a traffic filtering and identification method and system for targeted network attacks, which include two functional modules: traffic filtering and attack identification. The traffic filter is constructed using matrix decomposition technology. The traffic to be detected is classified and filtered according to the historical normal traffic, and the abnormal traffic is extracted. The attack behavior in the abnormal traffic information is identified through protocol detection, parameter inspection and frequency domain analysis, so as to realize the alarm of targeted network attacks and provide auxiliary information for analyzing targeted network attacks and predicting attack trends.
[0053] Since the attack cycle of a targeted network attack is generally long, the present invention adopts a non-real-time traffic detection mode to analyze the traffic information of a predefined time period and generate an alarm for a targeted network attack event. The traffic information includes the historical traffic collected under normal business scenarios and the traffic to be detected under actual operation scenarios, wherein the former is used as the normal traffic benchmark and the latter is used as the traffic data to be detected. If a directional network-related anomaly is detected in the traffic to be detected, a directional network attack event alarm information will be generated.
[0054] The core component of the traffic filtering module is the traffic filter, which is used to classify the traffic to be detected and extract the abnormal traffic. The traffic filter is an abnormal traffic classifier based on the whitelist, which builds a model of normal traffic in advance based on historical traffic. After classification, the abnormal traffic is used as the output of this module and is further analyzed in the subsequent attack identification module. The attack identification module analyzes the specific attack type in the targeted network attack, obtains the abnormal traffic obtained by the traffic filtering module, identifies the attack type by matching the pre-set attack features, and constructs a large amount of traffic information into specific attack behaviors, issues an alarm, and assists in determining the attack path of the targeted network attack, providing a reference for predicting the attacker's attack trend and attack purpose.
[0055] The traffic filtering and identification method for targeted network attacks disclosed in the present invention comprises the following steps:
[0056] Step 1: Collect historical traffic of a predefined number of days, extract the interaction features between devices in the traffic filter based on the historical traffic and construct it as a training set, decompose the training set into a subject model and an object model, use the subject model and the object model to classify the traffic to be detected, and filter out abnormal traffic.
[0057] A non-real-time detection mechanism is used to collect traffic information over several consecutive days and detect targeted network attack events during this period. In order to build a normal traffic model, it is also necessary to collect historical normal traffic as a detection benchmark. Historical normal traffic is collected in the network under normal business scenarios.
[0058] In the network traffic filtering module, the traffic filter classifies the traffic to be detected according to the description model of normal traffic, filters the traffic, and extracts abnormal traffic from massive traffic data. In the traffic filter, firstly, the interaction characteristics between devices in the network are statistically analyzed based on historical normal traffic, and a training set is constructed in the form of a matrix; secondly, the training set is decomposed into two low-dimensional matrices through a matrix decomposition algorithm, which serve as the subject model and object model in network interaction; finally, the traffic filter classifies the traffic to be detected according to the subject model and the object model, and extracts abnormal traffic.
[0059] The training set is obtained by statistics of historical normal traffic. The interaction intensity between various network devices within a day under historical normal business scenarios is statistically analyzed, including source address, destination address, and daily average number of sessions. If there are N active devices in the detection network, the triple can describe a sparse matrix X with N rows and N columns as the training set. The training set matrix is large in scale and the known elements are sparse, so it is described in the form of triples, and the source address and destination address are replaced by the row index and column index of the corresponding address in the matrix.
[0060] Perform matrix decomposition on the matrix X described by the triples to obtain the subject matrix U and the object matrix V. Both the subject matrix and the object matrix have N rows and k columns, where k is determined according to the actual situation. After matrix multiplication, the subject matrix and the object matrix should be as close as possible to the matrix represented by the training set, that is, satisfy the following formula:
[0061]
[0062] The subject matrix and the object matrix approximately describe the training set with a lower data scale. In order to determine the similarity between the product of the subject matrix and the object matrix and the training set, the loss function Loss is determined as follows:
[0063]
[0064] Where K is the set of row and column numbers corresponding to the known elements in the training set, x i,j is the value of the element in the i-th row and j-th column of the training set, u i and v j are the row vectors of the i-th row of the subject matrix and the j-th row of the object matrix, respectively, and λ is the regularization coefficient. The loss function value is obtained by summing the error term and the regularization term. The error term describes the gap between the current subject matrix and the object matrix for the training set, and the regularization term prevents overfitting.
[0065] The calculation process of the subject matrix and the object matrix is as follows:
[0066] Step 101: Determine the principal matrix U by random filling method;
[0067] Step 102: Based on the current subject matrix U, let the partial derivative of the loss function Loss with respect to the object matrix V
[0068] is zero, update the object matrix V;
[0069] Step 103: Based on the current object matrix V, let the partial derivative of the loss function Loss with respect to the subject matrix U
[0070] To zero, update the principal matrix U;
[0071] Step 104: Calculate the loss function Loss and determine whether it converges. If the loss function does not converge, return to step 102. If the loss function converges, end.
[0072] The subject matrix and object matrix are obtained by alternating updates, and the obtained subject matrix and object matrix are used as the subject model and object model required by the traffic filter respectively. The traffic to be detected obtained by the traffic filter is grouped according to daily traffic, and the daily traffic information is counted and detected whether there is anomaly, and specific abnormal traffic information is output.
[0073] The workflow of the traffic filter is:
[0074] Step 111: Group the traffic information according to daily traffic, and count the daily network device interaction information. The network device interaction information is represented in the form of a triple, including the source address, the destination address, and the number of sessions on the day.
[0075] Step 112: For daily traffic, group the traffic of the day according to the session subject.
[0076] Step 113: For the traffic of each subject on the day, use the normal traffic model to calculate the predicted value of the number of normal conversations between each subject and object. First, determine the corresponding index in the normal traffic model based on the source address and the destination address; second, extract the corresponding row vectors in the subject matrix and the object matrix based on the index to obtain two k-dimensional vectors; finally, calculate the inner product of the two vectors to obtain the predicted value of the matrix element in the normal traffic model. The calculation formula of the predicted value is as follows:
[0077]
[0078] In the formula, u i,t Take the i-th row of the principal matrix U to get the k-dimensional row vector u i The tth element in v j,t Take the jth row of the object matrix V to get the k-dimensional row vector v j The tth element of , t takes values in the range [1, k] and sums up the products to get the predicted value As a prediction of the normal traffic between the i-th subject and the j-th object.
[0079] Step 114: Calculate the percentage of the error between the actual value and the predicted value to the predicted value. If the percentage is greater than the preset threshold, it means that the number of conversations between the subject and the object on that day is significantly different, and it is determined that there is abnormal traffic. The specific source address, destination address, and date are recorded in the abnormal traffic record queue as a basis for subsequent extraction of abnormal traffic.
[0080] Step 115: extract all relevant traffic from the traffic information to be detected according to the abnormal traffic record queue. According to each abnormal information in the abnormal traffic queue, extract all traffic information from the source address to the destination address on that day as the abnormal traffic filtering result.
[0081] The above is the specific process of the network traffic filtering module, which filters the abnormal traffic from the traffic to be detected. The abnormal traffic will be used as input information for the attack identification module to identify specific attack behaviors.
[0082] Step 2: Match the abnormal traffic with the pre-set directional network attack features, which include protocol detection, parameter checking and frequency domain analysis. When a matching attack feature is identified, the corresponding directional network attack type is determined, and the abnormal traffic information is combined into an attack event to generate directional network attack event alarm information.
[0083] The attack identification module determines the specific attack form by matching different attack patterns, and summarizes the specific attack events based on the specific attack initiating device. The event format is {attack initiating device address, {attacked device address}, attack type, attack date}.
[0084] The present invention identifies the attack type from three aspects: protocol detection, parameter checking, and frequency domain analysis. In order to identify the attack type, identification standards are proposed for the above three aspects. The basic process of the attack identification module is as follows: Figure 3 shown.
[0085] For protocol detection, in a targeted network attack, the traffic protocol has certain attack characteristics in its integrity, which can determine whether there is a port scan type attack. One is that there are TCP request packets with SYN flags sent to multiple ports of a device; the other is that there are incomplete three-way handshakes or four-way handshakes in TCP communication. If one of the above characteristics is met, it means that the device has launched a port scan type attack on the target device.
[0086] For parameter checking, if a SQL injection attack is launched, there may be SQL statements in the traffic parameters. If a large number of SQL statements are matched in the request parameter information, it means that there is an SQL injection type attack in the traffic.
[0087] For frequency domain analysis, if a device has traffic leakage, it will continue to send data packets to the outside, and its traffic has certain identification characteristics in the time period. By sampling the traffic at a fixed time period and performing a discrete Fourier transform on the sampling sequence, the frequency domain distribution of the traffic can be obtained. If the frequency domain distribution is too concentrated, it means that there is a traffic leakage type attack.
[0088] The specific process of the attack identification module is as follows:
[0089] Step 201: Group all abnormal traffic obtained according to source addresses to obtain abnormal traffic information of each abnormal device;
[0090] Step 202: Perform protocol detection on the daily traffic of the current device respectively. If the attack characteristics of the port scan type are met, the specific attack event is recorded according to the specific information in the attack traffic. The recording format is: {current device address, {attacked device address}, "port scan", current date};
[0091] Step 203: Perform parameter checks on the daily traffic of the current device respectively. If the attack characteristics of the SQL injection type are met, the specific attack event is recorded according to the specific information in the attack traffic. The recording format is: {current device address, {attacked device address}, "SQL injection", today's date};
[0092] Step 204: Perform frequency domain analysis on the daily traffic of the current device respectively. If the attack characteristics of the traffic leakage type are met, the attack event is recorded according to the specific information of the current device. The recording format is: {current device address, {}, "traffic leakage", current date};
[0093] Step 205: Integrate all attack records obtained in the above process. If an attack event simultaneously satisfies the same attack device, the same attack type, and adjacent attack dates, these attack events are merged into one attack event in the format of {attack initiator device address, {attacked device address}, attack type, attack start date, attack end date}. If the attack events are merged, the set of attacked device addresses is the union of the merged sets, the attack start date is the earliest merged date, and the attack end date is the latest merged date; if the attack events are not merged, the attack start date and the attack end date are the same. The final merged event set is output as a targeted network attack alarm information.
[0094] The above process detects attack behaviors in directional network attack scenarios through protocol detection, parameter inspection and frequency domain analysis, and integrates them to issue attack event alarms. It provides the directional relationship between devices in the attack event, the specific type of attack and the duration of the attack, which can provide effective auxiliary information for analyzing directional network attack events.
[0095] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a traffic filtering and identification method and system for targeted network attacks, which adopts a non-real-time detection mode to receive historical normal traffic and traffic information to be detected, and outputs a variety of targeted attack behaviors contained in the traffic information to be detected through traffic filtering and attack identification, including the directional relationship between devices in the attack event, the specific type of attack, and the duration of the attack. The traffic filtering module obtains normal traffic information to construct a traffic filter, and extracts abnormal traffic by classifying the traffic. Based on the abnormal traffic information, a variety of attack behavior information is matched from multiple aspects such as protocol detection, parameter inspection, and frequency domain analysis, and attack event alarms are issued, providing a reference for the analysis and prediction of targeted network attacks.
[0096] The present invention may be a system, a method and / or a computer program product. The present invention also discloses a traffic filtering and identification system for targeted network attacks based on the aforementioned traffic filtering and identification method for targeted network attacks, comprising:
[0097] A traffic filtering module, used to collect historical traffic of predefined days, extract interaction features between devices in the traffic filter based on the historical traffic and construct a training set, decompose the training set into a subject model and an object model, classify the traffic to be detected using the subject model and the object model, and filter out abnormal traffic;
[0098] The attack identification module is used to match the abnormal traffic with pre-set directional network attack features, which include protocol detection, parameter checking and frequency domain analysis. When a matching attack feature is identified, the corresponding directional network attack type is determined, and the abnormal traffic information is combined into an attack event to generate directional network attack event alarm information.
[0099] Based on the spirit of the present invention, those skilled in the art can easily think that a computer program product can be obtained based on the aforementioned traffic filtering and identification method for targeted network attacks. The computer program product may include a computer-readable storage medium, which carries computer-readable program instructions for enabling a processor to implement various aspects of the present disclosure. That is, the present application also includes a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the aforementioned traffic filtering and identification method for targeted network attacks.
[0100] Computer readable storage medium can be a tangible device that can keep and store the instructions used by the instruction execution device. Computer readable storage medium can be, for example, - but not limited to - electrical storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or any suitable combination of the above. More specific examples (non-exhaustive list) of computer readable storage medium include: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device, for example, punch card or groove protrusion structure with instructions stored thereon and any suitable combination of the above. Computer readable storage medium used here is not interpreted as instantaneous signal itself, such as radio wave or other free propagating electromagnetic wave, electromagnetic wave propagated by waveguide or other transmission medium (for example, light pulse by optical fiber cable) or electrical signal transmitted by wire.
[0101] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.
[0102] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages-such as Smalltalk, C++, etc., and conventional procedural programming languages-such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network-including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may be personalized by utilizing the state information of a computer-readable program instruction, and the electronic circuit may execute a computer-readable program instruction, thereby realizing various aspects of the present disclosure.
[0103] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.
Claims
1. A traffic filtering and identification method for targeted network attacks, characterized in that: The following steps are involved: Collecting historical traffic of predefined days, extracting interaction features between devices in a traffic filter based on the historical traffic and constructing a training set, decomposing the training set into a subject model and an object model, and using the subject model and the object model to classify the traffic to be detected, filtering out abnormal traffic; The abnormal traffic is matched with the pre-set directional network attack features, which include protocol detection, parameter checking and frequency domain analysis. When the matching attack features are identified, the corresponding directional network attack type is determined, and the abnormal traffic information is combined into an attack event to generate directional network attack event alarm information.
2. The method for traffic filtering and identification of targeted network attacks according to claim 1, characterized in that: The step of extracting interaction features between devices in a traffic filter based on the historical traffic and constructing the features as a training set further includes: Statistics are collected under historical normal business scenarios to determine the interaction intensity between network devices within a day, including source address, destination address, and average number of daily sessions. A sparse matrix X with N rows and N columns is described using triples as a training set. N is the number of active devices detected in the network. In the triples, the source address and destination address are replaced with the row index and column index of the corresponding address in the matrix.
3. The method for traffic filtering and identification of targeted network attacks according to claim 2, characterized in that: Decomposing the training set into a subject model and an object model further comprises: Perform matrix decomposition on the matrix X described by the triples, and obtain the subject matrix U and object matrix V with N rows and k columns through the following process: Step 101: Determine the principal matrix U by random filling method; Step 102: Based on the current subject matrix U, let the partial derivative of the loss function Loss with respect to the object matrix V is zero, update the object matrix V; Step 103: Based on the current object matrix V, let the partial derivative of the loss function Loss with respect to the subject matrix U To zero, update the principal matrix U; Step 104: Calculate the loss function Loss and determine whether it converges. If the loss function does not converge, return to step 102. If the loss function converges, end.
4. The method for traffic filtering and identification of targeted network attacks according to claim 3 is characterized in that: The loss function Loss is: Where K is the set of row and column numbers corresponding to the known elements in the training set, x i,j is the value of the element in the i-th row and j-th column of the training set, u i and v j are the row vectors of the i-th row of the subject matrix and the j-th row of the object matrix respectively, λ is the regularization coefficient, the loss function value is obtained by summing the error term and the regularization term, the error term describes the gap between the current subject matrix and the object matrix for the training set, and the regularization term prevents overfitting.
5. The method for traffic filtering and identification of targeted network attacks according to claim 4 is characterized in that: The filtering out abnormal traffic further includes: For daily traffic, group the traffic by session subject; For the traffic of each subject on that day, the normal traffic model is used to calculate the predicted value of the number of normal sessions between each subject and object. First, the corresponding index in the normal traffic model is determined according to the source address and the destination address; secondly, the corresponding row vectors in the subject matrix and the object matrix are extracted according to the index to obtain two k-dimensional vectors; finally, the inner product of the two vectors is calculated to obtain the predicted value of the matrix element in the normal traffic model: Calculate the percentage of the error between the actual value and the predicted value to the predicted value. If the percentage is greater than a preset threshold, it is determined that there is abnormal traffic, and the specific source address, destination address, and date are recorded in the abnormal traffic record queue; According to the abnormal traffic record queue, all relevant traffic is extracted from the traffic information to be detected; according to each abnormal information in the abnormal traffic queue, all traffic information from the source address to the destination address of the day is extracted as the abnormal traffic filtering result.
6. The traffic filtering and identification system for targeted network attacks according to claim 5 is characterized in that: The matching of the abnormal traffic with the preset directional network attack features further includes: All abnormal traffic is grouped according to the source address to obtain abnormal traffic information of each abnormal device; Perform protocol detection on the daily traffic of the current device respectively. If the attack characteristics of the port scan type are met, the specific attack event is recorded according to the specific information in the attack traffic. The recording format is: {current device address, {attacked device address}, "port scan", today's date}; Perform parameter checks on the daily traffic of the current device. If the attack characteristics of the SQL injection type are met, the specific attack event is recorded according to the specific information in the attack traffic. The recording format is: {current device address, {attacked device address}, "SQL injection", today's date}; Perform frequency domain analysis on the daily traffic of the current device respectively. If the attack characteristics of the traffic leakage type are met, the attack event is recorded according to the specific information of the current device. The recording format is: {current device address, {}, "traffic leakage", today's date}.
7. The traffic filtering and identification system for targeted network attacks according to claim 6 is characterized in that: The combining of abnormal traffic information into attack events and generating targeted network attack event alarm information further includes: All attack records are integrated; if an attack event meets the conditions of the same attack device, the same attack type, and adjacent attack dates, these attack events are merged into one attack event in the format of {address of the attack initiating device, {address of the attacked device}, attack type, attack start date, attack end date}; If the attack events are merged, the set of attacked device addresses is the union of the merged sets, the attack start date is the earliest merged date, and the attack end date is the latest merged date; If the attack events are not merged, the attack start date and the attack end date are the same; The final merged event set is output as targeted network attack warning information.
8. A traffic filtering and identification system for targeted network attacks, characterized in that: include: A traffic filtering module, used to collect historical traffic of predefined days, extract interaction features between devices in the traffic filter based on the historical traffic and construct a training set, decompose the training set into a subject model and an object model, classify the traffic to be detected using the subject model and the object model, and filter out abnormal traffic; The attack identification module is used to match the abnormal traffic with pre-set directional network attack features, which include protocol detection, parameter checking and frequency domain analysis. When a matching attack feature is identified, the corresponding directional network attack type is determined, and the abnormal traffic information is combined into an attack event to generate directional network attack event alarm information.
9. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instruction to execute the steps of the traffic filtering and identification method for targeted network attacks according to any one of claims 1-7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the traffic filtering and identification method for targeted network attacks described in any one of claims 1 to 7 are implemented.