Concealed channel detection method and device, electronic equipment and nonvolatile storage medium

Abstract

The invention discloses a covert channel detection method and device, electronic equipment and a nonvolatile storage medium. The method comprises the steps that a to-be-detected data stream is acquired, a first feature of the data stream is determined, and the first feature is a statistical feature used for representing overall information of the data stream; determining a packet feature sequence corresponding to the data stream, and performing feature extraction on the packet feature sequence to obtain a second feature, the packet feature sequence being a sequence used for representing feature information of each data packet in the data stream, and the second feature being used for representing a time sequence feature in the data stream; and fusing the first feature and the second feature to obtain a target feature, and determining a channel type corresponding to the data stream according to the target feature, the channel type including a covert channel and a non-covert channel. According to the method and the device, the technical problem of poor detection precision caused by adopting a single feature source to carry out covert channel detection in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of machine learning and information security technology, and in particular, to a covert channel detection method, device, electronic device and non-volatile storage medium. Background Art

[0002] With the continuous acceleration of the information process, network security issues have also surfaced. Although the openness and interconnectedness of cyberspace have brought huge development opportunities, they have also led to an endless stream of security issues such as network attacks, data leakage, and privacy violations. In such a complex network security environment, covert channels, as a covert means of information transmission, are gradually becoming a new attack method used by network attackers to evade detection and protection. Covert channels use legal communication paths to transmit unauthorized data. Their concealment makes it difficult for traditional security monitoring methods to detect and defend, and has become a major hidden threat in network security.

[0003] Most of the covert channel detection methods in related technologies start from the perspective of network traffic analysis. However, since the covert channel detection methods in related technologies only use a single feature source for detection, there are technical problems such as poor detection accuracy.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a covert channel detection method, device, electronic device and non-volatile storage medium to at least solve the technical problem of poor detection accuracy caused by using a single feature source for covert channel detection in the related art.

[0006] According to one aspect of an embodiment of the present application, a covert channel detection method is provided, including: obtaining a data stream to be detected, and determining a first feature of the data stream, wherein the first feature is a statistical feature used to characterize the overall information of the data stream; determining a packet feature sequence corresponding to the data stream, and performing feature extraction on the packet feature sequence to obtain a second feature, wherein the packet feature sequence is a sequence used to characterize feature information of each data packet in the data stream, and the second feature is used to characterize a timing feature within the data stream; fusing the first feature and the second feature to obtain a target feature, and determining a channel type corresponding to the data stream based on the target feature, wherein the channel types include: a covert channel and a non-covert channel.

[0007] Optionally, determining the first feature of the data stream includes: determining the statistical features of the data stream, and determining the statistical features as the first features, wherein the statistical features include: flow duration, average packet length, maximum packet length, packet length variance, average time interval, and flow byte count of the data stream, the flow duration is the time span between the first data packet to the last data packet in the data stream, the average packet length is the average number of bytes of all data packets in the data stream, the average time interval is the average of the arrival time difference between two consecutive data packets in the data stream, and the flow byte count is the total number of bytes in the data stream.

[0008] Optionally, determining a packet feature sequence corresponding to a data stream includes: sorting the data packets according to the arrival order of each data packet in the data stream to obtain an initial packet sequence; determining feature information corresponding to each data packet in the initial packet sequence to obtain a packet feature sequence, wherein the feature information includes: a packet length of the data packet, a direction of the packet, an arrival time interval of subsequent packets, and a flag bit representation, the packet length is the number of bytes of the data packet, the direction of the packet includes: a first direction and a second direction, the first direction is used to characterize that the data packet is sent from a source host, and the second direction is used to characterize that the data packet is sent from a destination host, the arrival time interval of subsequent packets is the difference between the arrival time of the current data packet in the data stream and the arrival time of an adjacent data packet that arrives immediately after the data packet, and the flag bit representation is used to characterize the set state of each flag in the data packet.

[0009] Optionally, feature extraction is performed on the packet feature sequence to obtain the second feature, including: determining the third and fourth medians of the feature values ​​corresponding to each data packet in the packet feature sequence, and rewriting the feature values ​​that are greater than the third and fourth medians as the third and fourth medians; determining the mean and variance of the rewritten feature values, and based on the mean and variance, standardizing the feature values ​​corresponding to each data packet in the packet feature sequence to obtain a standardized packet feature sequence; using a deep learning model to extract the timing features of the standardized packet feature sequence to obtain the second feature.

[0010] Optionally, the deep learning model is obtained after self-supervised training of the initial deep learning model, and the self-supervised training is used to improve the model's ability to express temporal features; the training steps of the deep learning model include: obtaining a package feature sequence, and using a masking mark to randomly mask some elements in the package feature sequence to obtain a masked sequence; using the encoder in the initial deep learning model to perform feature representation on the masked sequence; using the decoder in the initial deep learning model to predict the part of the masked sequence covered by the masking mark based on the feature representation output by the encoder to obtain a predicted sequence; determining the error value between the predicted sequence and the original package feature sequence before masking, and updating the model parameters in the initial deep learning model based on the error value to obtain a trained deep learning model.

[0011] Optionally, the encoder includes: a multi-head self-attention layer and a feedforward network layer; the decoder includes: a multi-head attention layer, a feedforward network layer, and an encoder-decoder attention layer; wherein the multi-head attention layer is used to capture the dependencies between elements at different positions in the sequence, the feedforward network layer is used to perform feature transformation on the output of the multi-head attention layer to introduce nonlinear features, and the encoder-decoder attention layer is used to determine the degree of attention of the decoder to the output of the encoder.

[0012] Optionally, determining the channel type corresponding to the data stream based on the target feature includes: using a gating mechanism to fuse the first feature and the second feature to obtain the target feature; using a fully connected layer and an activation function to determine the hidden representation corresponding to the target feature; using a classifier to predict based on the hidden representation of the target feature to obtain the channel type corresponding to the data stream.

[0013] According to another aspect of an embodiment of the present application, a covert channel detection device is also provided, including: a first feature extraction module, used to obtain a data stream to be detected, and determine a first feature of the data stream, wherein the first feature is a statistical feature used to characterize the overall information of the data stream; a second feature extraction module, used to determine a packet feature sequence corresponding to the data stream, and perform feature extraction on the packet feature sequence to obtain a second feature, wherein the packet feature sequence is a sequence used to characterize feature information of each data packet in the data stream, and the second feature is used to characterize the timing characteristics within the data stream; a feature fusion prediction module, used to fuse the first feature and the second feature to obtain a target feature, and determine the channel type corresponding to the data stream based on the target feature, wherein the channel types include: covert channel and non-covert channel.

[0014] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including: a memory and a processor, the processor being configured to run a program stored in the memory, wherein the covert channel detection method is executed when the program is run.

[0015] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, wherein the non-volatile storage medium includes a stored computer program, wherein a device where the non-volatile storage medium is located executes the covert channel detection method by running the computer program.

[0016] According to another aspect of the embodiments of the present application, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps of the covert channel detection method are implemented.

[0017] In an embodiment of the present application, a data stream to be detected is obtained, and a first feature of the data stream is determined, wherein the first feature is a statistical feature used to characterize the overall information of the data stream; a packet feature sequence corresponding to the data stream is determined, and a feature extraction is performed on the packet feature sequence to obtain a second feature, wherein the packet feature sequence is a sequence of feature information used to characterize each data packet in the data stream, and the second feature is used to characterize the timing feature within the data stream; the first feature and the second feature are fused to obtain a target feature, and based on the target feature, a channel type corresponding to the data stream is determined, wherein the channel types include: a covert channel and a non-covert channel. By fusing multi-dimensional feature information, combining the statistical features in the network traffic with the timing change features mined by the deep learning model, the covert channel is classified and identified, thereby achieving the purpose of improving the accuracy of covert channel detection to cope with various types of covert channel attacks, thereby solving the technical problem of poor detection accuracy caused by the use of a single feature source for covert channel detection in the related art. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 It is a hardware structure block diagram of a computer terminal (or electronic device) for implementing a method for covert channel detection provided in an embodiment of the present application;

[0020] Figure 2 is a schematic diagram of a method flow for covert channel detection provided according to an embodiment of the present application;

[0021] Figure 3 It is a schematic diagram of a method flow of covert channel detection based on time series fusion features provided according to an embodiment of the present application;

[0022] Figure 4 It is a schematic diagram of a model pre-training method flow provided according to an embodiment of the present application;

[0023] Figure 5 It is a structural schematic diagram of a covert channel detection device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] With the rapid development of information technology, the Internet is no longer just a tool for information exchange, but has been deeply integrated into all aspects of global society and has become an indispensable infrastructure in the fields of economy, culture, education, and medical care. However, with the continuous acceleration of the process of informatization, network security issues have also surfaced and are increasingly becoming a major challenge faced by enterprises and individuals. Although the openness and interconnectedness of cyberspace have brought huge development opportunities, they have also led to an endless stream of security issues such as cyber attacks, data leakage, and privacy violations. The consequences of these cyber attacks may not only lead to the destruction and functional suspension of key systems, causing a temporary suspension of corporate business or public services, but also trigger large-scale social events. In such a complex network security environment, covert channels, as a covert means of information transmission, are gradually becoming a new attack method used by network attackers to evade detection and protection. Covert channels use legitimate communication paths to transmit unauthorized data. Their concealment makes it difficult for traditional security monitoring methods to detect and defend, and have become a major hidden threat in network security.

[0027] Covert channels are a means of transmitting information by exploiting side channels in network communications or redundant parts in protocols. Depending on the implementation method, covert channels can be divided into time covert channels, storage covert channels, and protocol covert channels. Covert channels are often used by attackers for scenarios such as data leakage, malware communication, and remote control. In advanced persistent threat (APT) attacks, covert channels are often used as the main means of data exfiltration to extract sensitive information from the victim network without being discovered.

[0028] Most of the covert channel detection methods in related technologies start from the perspective of network traffic analysis, and can be divided into detection methods based on statistical features, detection methods based on pattern recognition, and detection methods based on time series analysis according to the detection mode adopted: detection methods based on statistical features, detection methods based on pattern recognition, and detection methods based on time series analysis. For example, the detection method based on statistical features relies on the analysis of statistical features of network traffic, such as packet size, packet interval time, transmission rate, connection duration, etc. By analyzing these features, the detection system can identify abnormal behaviors that do not conform to the normal communication mode, thereby inferring whether there is a covert channel; the detection method based on pattern recognition extracts characteristic patterns with distinguishing characteristics by analyzing a large amount of normal traffic and known covert channel traffic, and uses these patterns to detect abnormal traffic. This type of method usually uses machine learning technology to build classifiers, such as support vector machines (SVM), random forests, etc.; the detection method based on time series analysis models the time series of traffic to identify regular or periodic features hidden in communication, thereby discovering covert channels. This type of method usually uses an autoregressive model (AR), a moving average model (MA), or a more complex long short-term memory network (LSTM) to analyze the temporal correlation of traffic data.

[0029] However, most of the covert channel detection methods in related technologies only use a single feature source for detection, which leads to the problem of poor covert channel detection effect. For example, statistical feature-based and pattern-based methods can identify abnormal behaviors by analyzing the statistical features and patterns of network traffic in covert channel detection, while time series analysis-based methods can capture time series features in traffic. However, after extracting deep features, these methods often ignore the influence of the original content, resulting in the inability to fully consider the contextual information in the traffic data, thus affecting the detection effect. Especially when facing complex covert channels, the disconnection between deep features and original statistical features may lead to an increase in false alarm rate or the occurrence of missed reports.

[0030] In order to solve the above problems, relevant solutions are provided in the embodiments of the present application, which are described in detail below.

[0031] According to an embodiment of the present application, a method embodiment of covert channel detection is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0032] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal (or electronic device) for implementing a covert channel detection method. Figure 1 As shown, the computer terminal 10 (or electronic device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0033] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or electronic device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0034] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the covert channel detection method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned covert channel detection method is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0035] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0036] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or electronic device).

[0037] Under the above operating environment, the embodiment of the present application provides a covert channel detection method. Figure 2 is a schematic diagram of a method flow for covert channel detection provided in an embodiment of the present application, such as Figure 2 As shown, the method comprises the following steps:

[0038] Step S202, obtaining a data stream to be detected, and determining a first feature of the data stream, wherein the first feature is a statistical feature used to characterize overall information of the data stream;

[0039] Step S204, determining a packet feature sequence corresponding to the data stream, and extracting features from the packet feature sequence to obtain a second feature, wherein the packet feature sequence is a sequence used to characterize feature information of each data packet in the data stream, and the second feature is used to characterize a timing feature within the data stream;

[0040] Step S206, fusing the first feature and the second feature to obtain a target feature, and determining a channel type corresponding to the data stream based on the target feature, wherein the channel type includes: a covert channel and a non-covert channel.

[0041] Through the above steps, multi-dimensional feature information is integrated, and the statistical features in the network traffic are combined with the time series change features mined by the deep learning model to classify and identify the covert channels, thereby improving the accuracy of covert channel detection to cope with various types of covert channel attacks, thereby solving the technical problem of poor detection accuracy caused by the use of a single feature source for covert channel detection in related technologies.

[0042] The following further introduces the covert channel detection method in steps S202 to S206 of the embodiment of the present application.

[0043] The embodiment of the present application combines the flow statistics feature of the data flow (i.e., the first feature) with the packet context feature (i.e., the second feature) extracted by the deep learning model, and fully considers the impact of the original traffic content on the detection results. Different from the existing technology that uses a single feature source for analysis, the deep mining feature also retains the impact of the original content, further improving the detection accuracy of the covert channel. After combining multiple information, the scope of application is wider, and the robustness of the detection is further enhanced.

[0044] The specific process is as follows Figure 3 As shown, in this embodiment, the above data flow takes DNS (Domain Name System) flow as an example to illustrate. First, the DNS flow is preprocessed, including two aspects of processing: on the one hand, the overall information of the flow is processed to achieve the description of the original content of the flow; on the other hand, the characteristic information of each data packet in the flow is processed. Afterwards, the two parts of information are extracted and fused using different methods, so as to achieve dual-perspective covert channel detection. The following is a detailed introduction.

[0045] First, statistics may be performed on the overall information of the data stream to determine the statistical characteristics of the data stream, that is, to determine the first characteristics of the data stream. The specific steps are as follows.

[0046] In some embodiments of the present application, determining a first feature of a data stream comprises the following steps: determining a statistical feature of the data stream, and determining the statistical feature as the first feature, wherein the statistical feature comprises: a stream duration, an average packet length, a maximum packet length, a packet length variance, an average time interval, and a number of stream bytes of the data stream, wherein the stream duration is the time span between the first data packet to the last data packet in the data stream, the average packet length is the average number of bytes of all data packets in the data stream, the average time interval is the average value of the arrival time difference between two consecutive data packets in the data stream, and the number of stream bytes is the total number of bytes in the data stream.

[0047] Specifically, in this embodiment, the pcap packet (Packet Capture) corresponding to the data stream can be analyzed with the help of the network protocol analyzer tshark, the specified field of the data packet can be extracted, and the statistical features (i.e., the above-mentioned first feature) can be further calculated. The statistical features of the data stream extracted in the embodiment of the present application include but are not limited to: flow duration, average packet length, maximum packet length, packet length variance, average time interval, and number of stream bytes, wherein the flow duration refers to the time span from the first data packet to the last data packet, which indicates the duration of the network connection or session; the average packet length is the average number of bytes of all data packets in the flow, which reflects the average size of the effective load carried in all data packets; accordingly, the maximum packet length is the number of bytes of the packet with the largest load in the flow; the packet length variance is the variance of the number of bytes of each data packet in the flow, which is used to indicate the change in packet size; the average time interval indicates the average value of the time difference between the arrival of two consecutive data packets in the flow, which reflects the time characteristics of network communication; the number of stream bytes indicates the number of bytes in the entire data stream. This part of the features more completely represents the overall characteristics of the data stream, and is not redundant, and any feature cannot be calculated from other features.

[0048] On the other hand, the timing features of DNS traffic can also be extracted with the help of a deep learning model. Among them, since Transformer has obvious advantages over other methods for long sequences and variable-length sequences, and the parallel computing mode enables it to quickly complete the extraction of timing features, the above-mentioned deep learning model is illustrated using Transformer as an example in this embodiment.

[0049] First, the basic features of all data packets in the data stream need to be formed into a packet feature sequence. The specific steps are as follows.

[0050] In some embodiments of the present application, determining a packet feature sequence corresponding to a data stream includes the following steps: sorting the data packets according to the arrival order of each data packet in the data stream to obtain an initial packet sequence; determining feature information corresponding to each data packet in the initial packet sequence to obtain a packet feature sequence, wherein the feature information includes: a packet length of the data packet, a direction of the packet, an arrival time interval of subsequent packets, and a flag bit representation, the packet length is the number of bytes of the data packet, the direction of the packet includes: a first direction and a second direction, the first direction is used to characterize that the data packet is sent from a source host, and the second direction is used to characterize that the data packet is sent from a destination host, the arrival time interval of subsequent packets is the difference between the arrival time of the current data packet in the data stream and the arrival time of the next adjacent data packet that arrives immediately after the data packet, and the flag bit representation is used to characterize the set state of each flag in the data packet.

[0051] Specifically, firstly, the data packets are sorted according to the arrival order of the data packets in the data stream to form an initial packet sequence, and then the characteristic information of each data packet is extracted, including but not limited to: the packet length of each packet, the direction of the packet, the arrival time interval of the subsequent packets, and the representation of the flag bit, etc. Among them, the packet length is the number of bytes of each packet; the packet direction is whether the packet is sent from the source host or the destination host, 1 represents the forward direction, and -1 represents the reverse direction; the subsequent packet arrival time interval is the arrival time difference of the subsequent adjacent packets after the current packet arrives, if there is no subsequent packet arrival, it is set to 0; the flag bit is represented by one-hot, and the preset 9 bits of information represent the setting of 1 of the 9 flag bits of URG, ACK, PSH, RST, SYN, FIN, ECE, CWR and NS.

[0052] Then, a deep learning model (such as a Transformer model) is used to extract the temporal features in the packet feature sequence to obtain the second feature. The specific steps are as follows.

[0053] In some embodiments of the present application, feature extraction is performed on a packet feature sequence to obtain a second feature, including the following steps: determining the third and fourth medians of the feature values ​​corresponding to each data packet in the packet feature sequence, and rewriting the feature values ​​that are greater than the third and fourth medians as the third and fourth medians; determining the mean and variance of the rewritten feature values, and based on the mean and variance, standardizing the feature values ​​corresponding to each data packet in the packet feature sequence to obtain a standardized packet feature sequence; using a deep learning model to extract the timing features of the standardized packet feature sequence to obtain the second feature.

[0054] It should be noted that in order to accelerate model convergence, the continuity features in the two parts of the features can be standardized in the embodiment of the present application. At the same time, in order to prevent data compression caused by extremely large outlier data, the embodiment of the present application also limits the numerical range of each feature. Specifically, the third and fourth medians of each feature value are first selected as the maximum value, and the values ​​greater than it in each feature are set to this value. The compressed data is then standardized. For example, the Z-score method can be used to further reduce the features to the [-1,1] interval, and the formula is as follows: Where x is the actual value of the feature, μ represents the average value of each feature, σ represents the variance of each feature, and x′ represents the regularized feature value.

[0055] After that, the second feature mentioned above is obtained by extracting features from the standardized packet feature sequence using a deep learning model that has undergone self-supervised training. Finally, the first feature obtained based on statistical features is gated and fused with the second feature obtained by extracting timing features using the model, and the target feature obtained after fusion is used for the final channel detection. This allows the overall information of the flow to be considered while analyzing the timing fluctuations of traffic packets. This comprehensive perspective for covert channel detection can further improve the detection capability. The specific steps are as follows.

[0056] In some embodiments of the present application, determining the channel type corresponding to the data stream based on the target feature includes the following steps: using a gating mechanism to fuse the first feature and the second feature to obtain the target feature; using a fully connected layer and an activation function to determine the hidden representation corresponding to the target feature; using a classifier to predict based on the hidden representation of the target feature to obtain the channel type corresponding to the data stream.

[0057] Specifically, the input of the channel detection model consists of two parts: one part is the preprocessed input sequence (i.e., the standardized packet feature sequence) X, and the other part is the original manually extracted feature (i.e., the first feature mentioned above) F manual :

[0058] X={x1,x2,…,x n} ,F manual ={f1,f2,…,f m}

[0059] Among them, the input sequence X generates an encoded representation () after the self-supervised pre-trained Transformer encoder, which is the second feature mentioned above, as shown in the following formula:

[0060] Z enc = TransformerEncoder(X)

[0061] Then, the encoding representation (second feature) Zenc and the manual feature (first feature) F manual Through the combination of gating mechanisms, the output of the gating mechanism is G out (target feature), as shown in the following formula:

[0062] G out =σ(W g Z enc +b g )⊙F manual +(1-σ(W g Z enc +b g ))⊙Z enc

[0063] Among them, W g and b g is the parameter of the gating mechanism, σ(.) represents the sigmoid activation function, and ⊙ represents the element-wise Hadamard product.

[0064] Finally, the target feature G output by the gating mechanism is out After the fully connected layer and the ReLU activation function, the final hidden representation is generated: H1 = ReLU (W1 G out +b1), and then input into the classifier through the fully connected layer to complete the final prediction process, and obtain the channel type corresponding to the data stream: y ′ =Softmax(W cls H1+b cls ).

[0065] The following is a further introduction to the self-supervised training process of the deep learning model (taking the Transformer model as an example) in the above process.

[0066] First, the Transformer's ability to express temporal features is pre-trained in a self-supervised mode, and then the Transformer is integrated into the overall classification task for fine-tuning, thereby achieving the training of the entire method. Figure 4 The figure shows the process of pre-training the Transformer encoder part, which is designed to prevent the problem of insufficient fitting caused by the complexity of the time series extraction model being much higher than the statistical feature part. The details are as follows.

[0067] In some embodiments of the present application, the deep learning model is obtained after self-supervised training of the initial deep learning model, and the self-supervised training is used to improve the model's ability to express temporal features; the training steps of the deep learning model include: obtaining a package feature sequence, and using a masking mark to randomly mask some elements in the package feature sequence to obtain a masked sequence; using the encoder in the initial deep learning model to perform feature representation on the masked sequence; using the decoder in the initial deep learning model to predict the part of the masked sequence covered by the masking mark based on the feature representation output by the encoder to obtain a predicted sequence; determining the error value between the predicted sequence and the original package feature sequence before masking, and updating the model parameters in the initial deep learning model based on the error value to obtain a trained deep learning model.

[0068] Among them, the encoder includes: a multi-head self-attention layer and a feedforward network layer; the decoder includes: a multi-head attention layer, a feedforward network layer, and an encoder-decoder attention layer; among them, the multi-head attention layer is used to capture the dependencies between elements at different positions in the sequence, the feedforward network layer is used to perform feature transformation on the output of the multi-head attention layer to introduce nonlinear features, and the encoder-decoder attention layer is used to determine the degree of attention of the decoder to the output of the encoder.

[0069] For the input feature sequence, the embodiment of the present application pre-trains the temporal feature expression ability of Transformer based on masked content restoration in a self-supervised learning manner. Specifically, given an input sequence (e.g., a packet feature sequence) X = {x1, x2, ..., x (n)} , where x i Indicates the i-th element in the input sequence. During the self-supervised training process, a portion of the input sequence is randomly selected for masking to obtain the masked sequence, i.e., the masked sequence:

[0070]

[0071] The Mask(…) function randomly replaces some elements in the sequence with special mask marks (such as [MASK]).

[0072] Afterwards, the encoder in the initial deep learning model (consisting of a multi-head attention layer and a feedforward network layer) is used to decode the masked input sequence Extract feature representation:

[0073]

[0074] Inside the encoder, the calculation of the multi-head attention layer is as follows:

[0075]

[0076] Among them, Q, K, and V are query matrix, key matrix, and value matrix respectively. k is the dimension of the matrix. The multi-head attention mechanism combines the outputs of multiple attention heads (joining the outputs of multiple heads together) to perform multi-angle learning, as shown in the following formula:

[0077] MultiHead(Q,K,V)=Concat(head1,head2,…,head h )W O

[0078] Then the output of each layer is residually connected and normalized, as shown in the following formula:

[0079] Z ′ =LayerNorm(Z+MultiHead(Q,K,V))

[0080] Z″=LayerNorm(Z ′ +FFN(Z ′ ))

[0081] Among them, Z ′ is the output of the self-attention layer, FFN(Z ′ ) is the output of the feedforward network layer, and LayerNorm() represents layer normalization.

[0082] Then, the decoder in the initial deep learning model is used to predict the part covered by the masking mark in the masking sequence according to the feature representation output by the encoder to obtain a predicted sequence. In this embodiment, the decoder also includes a multi-head attention layer and a feedforward network layer. The difference is that an encoder-decoder attention layer is added to the decoder, and the multi-head attention mechanism is also adopted, as follows.

[0083] The feature Z output by the decoder will be used to predict the masked content. For the masked element position in the sequence The model outputs the final prediction (i.e. predicted sequence):

[0084]

[0085] Among them, Z i is the feature representation of the corresponding output position in the feature representation Z. Next, the loss (error value) between the prediction result (prediction sequence) and the true value of the original feature (the original package feature sequence before being masked) is calculated. For example, the cross entropy loss function can be used, as shown in the following formula:

[0086]

[0087] The present application scheme classifies and identifies covert channels by integrating multi-dimensional feature information, combining statistical features in network traffic with time series change features mined by deep learning models, fully considering the impact of original traffic content on detection results, improving the accuracy of covert channel detection, and being able to cope with various types of covert channel attacks.

[0088] According to an embodiment of the present application, an embodiment of a covert channel detection device is also provided. Figure 5 is a schematic diagram of the structure of a covert channel detection device provided according to an embodiment of the present application. Figure 5 As shown, the device comprises:

[0089] A first feature extraction module 50 is used to obtain a data stream to be detected and determine a first feature of the data stream, wherein the first feature is a statistical feature used to characterize overall information of the data stream;

[0090] A second feature extraction module 52 is used to determine a packet feature sequence corresponding to the data stream, and extract features from the packet feature sequence to obtain a second feature, wherein the packet feature sequence is a sequence used to characterize feature information of each data packet in the data stream, and the second feature is used to characterize a timing feature within the data stream;

[0091] The feature fusion prediction module 54 is used to fuse the first feature and the second feature to obtain a target feature, and determine the channel type corresponding to the data stream based on the target feature, wherein the channel type includes: a covert channel and a non-covert channel.

[0092] Optionally, determining the first feature of the data stream includes: determining the statistical features of the data stream, and determining the statistical features as the first features, wherein the statistical features include: flow duration, average packet length, maximum packet length, packet length variance, average time interval, and flow byte count of the data stream, the flow duration is the time span between the first data packet to the last data packet in the data stream, the average packet length is the average number of bytes of all data packets in the data stream, the average time interval is the average of the arrival time difference between two consecutive data packets in the data stream, and the flow byte count is the total number of bytes in the data stream.

[0093] Optionally, determining a packet feature sequence corresponding to a data stream includes: sorting the data packets according to the arrival order of each data packet in the data stream to obtain an initial packet sequence; determining feature information corresponding to each data packet in the initial packet sequence to obtain a packet feature sequence, wherein the feature information includes: a packet length of the data packet, a direction of the packet, an arrival time interval of subsequent packets, and a flag bit representation, the packet length is the number of bytes of the data packet, the direction of the packet includes: a first direction and a second direction, the first direction is used to characterize that the data packet is sent from a source host, and the second direction is used to characterize that the data packet is sent from a destination host, the arrival time interval of subsequent packets is the difference between the arrival time of the current data packet in the data stream and the arrival time of an adjacent data packet that arrives immediately after the data packet, and the flag bit representation is used to characterize the set state of each flag in the data packet.

[0094] Optionally, feature extraction is performed on the packet feature sequence to obtain the second feature, including: determining the third and fourth medians of the feature values ​​corresponding to each data packet in the packet feature sequence, and rewriting the feature values ​​that are greater than the third and fourth medians as the third and fourth medians; determining the mean and variance of the rewritten feature values, and based on the mean and variance, standardizing the feature values ​​corresponding to each data packet in the packet feature sequence to obtain a standardized packet feature sequence; using a deep learning model to extract the timing features of the standardized packet feature sequence to obtain the second feature.

[0095] Optionally, the deep learning model is obtained after self-supervised training of the initial deep learning model, and the self-supervised training is used to improve the model's ability to express temporal features; the training steps of the deep learning model include: obtaining a package feature sequence, and using a masking mark to randomly mask some elements in the package feature sequence to obtain a masked sequence; using the encoder in the initial deep learning model to perform feature representation on the masked sequence; using the decoder in the initial deep learning model to predict the part of the masked sequence covered by the masking mark based on the feature representation output by the encoder to obtain a predicted sequence; determining the error value between the predicted sequence and the original package feature sequence before masking, and updating the model parameters in the initial deep learning model based on the error value to obtain a trained deep learning model.

[0096] Optionally, the encoder includes: a multi-head self-attention layer and a feedforward network layer; the decoder includes: a multi-head attention layer, a feedforward network layer, and an encoder-decoder attention layer; wherein the multi-head attention layer is used to capture the dependencies between elements at different positions in the sequence, the feedforward network layer is used to perform feature transformation on the output of the multi-head attention layer to introduce nonlinear features, and the encoder-decoder attention layer is used to determine the degree of attention of the decoder to the output of the encoder.

[0097] Optionally, determining the channel type corresponding to the data stream based on the target feature includes: using a gating mechanism to fuse the first feature and the second feature to obtain the target feature; using a fully connected layer and an activation function to determine the hidden representation corresponding to the target feature; using a classifier to predict based on the hidden representation of the target feature to obtain the channel type corresponding to the data stream.

[0098] It should be noted that each module in the above-mentioned covert channel detection device can be a program module (for example, a set of program instructions that implement a certain specific function) or a hardware module. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0099] It should be noted that the covert channel detection device provided in this embodiment can be used to perform Figure 2 The covert channel detection method shown, therefore, the relevant explanations and descriptions of the above-mentioned covert channel detection method are also applicable to the embodiments of the present application and will not be repeated here.

[0100] An embodiment of the present application also provides a non-volatile storage medium, the non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the following covert channel detection method by running the computer program: obtaining a data stream to be detected, and determining a first feature of the data stream, wherein the first feature is a statistical feature used to characterize the overall information of the data stream; determining a packet feature sequence corresponding to the data stream, and performing feature extraction on the packet feature sequence to obtain a second feature, wherein the packet feature sequence is a sequence used to characterize feature information of each data packet in the data stream, and the second feature is used to characterize the timing characteristics within the data stream; fusing the first feature and the second feature to obtain a target feature, and determining a channel type corresponding to the data stream based on the target feature, wherein the channel types include: covert channel and non-covert channel.

[0101] The embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the covert channel detection method described in each embodiment of the present application: obtaining a data stream to be detected, and determining a first feature of the data stream, wherein the first feature is a statistical feature used to characterize the overall information of the data stream; determining a packet feature sequence corresponding to the data stream, and performing feature extraction on the packet feature sequence to obtain a second feature, wherein the packet feature sequence is a sequence used to characterize feature information of each data packet in the data stream, and the second feature is used to characterize the timing feature within the data stream; fusing the first feature and the second feature to obtain a target feature, and determining the channel type corresponding to the data stream based on the target feature, wherein the channel types include: covert channel and non-covert channel.

[0102] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0103] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0104] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0105] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0106] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0107] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0108] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A covert channel detection method, characterized in that: include: Acquire a data stream to be detected, and determine a first feature of the data stream, wherein the first feature is a statistical feature used to characterize overall information of the data stream; Determine a packet feature sequence corresponding to the data stream, and perform feature extraction on the packet feature sequence to obtain a second feature, wherein the packet feature sequence is a sequence used to characterize feature information of each data packet in the data stream, and the second feature is used to characterize a timing feature within the data stream; The first feature and the second feature are fused to obtain a target feature, and a channel type corresponding to the data stream is determined based on the target feature, wherein the channel type includes: a covert channel and a non-covert channel.

2. The covert channel detection method according to claim 1, characterized in that: Determining a first characteristic of the data stream includes: Determine the statistical characteristics of the data flow, and determine the statistical characteristics as the first characteristics, wherein the statistical characteristics include: flow duration, average packet length, maximum packet length, packet length variance, average time interval, and flow byte number of the data flow, the flow duration is the time span between the first data packet to the last data packet in the data flow, the average packet length is the average number of bytes of all data packets in the data flow, the average time interval is the average value of the arrival time difference between two consecutive data packets in the data flow, and the flow byte number is the total number of bytes in the data flow.

3. The covert channel detection method according to claim 1, characterized in that: Determining a packet feature sequence corresponding to the data stream includes: Sorting the data packets according to the arrival order of each data packet in the data stream to obtain an initial packet sequence; Determine the characteristic information corresponding to each of the data packets in the initial packet sequence to obtain the packet characteristic sequence, wherein the characteristic information includes: the packet length of the data packet, the direction of the packet, the arrival time interval of subsequent packets, and the flag bit representation, the packet length is the number of bytes of the data packet, the direction of the packet includes: a first direction and a second direction, the first direction is used to characterize that the data packet is sent from a source host, the second direction is used to characterize that the data packet is sent from a destination host, the arrival time interval of subsequent packets is the difference between the arrival time of the current data packet in the data stream and the arrival time of an adjacent data packet that arrives immediately after the data packet, and the flag bit representation is used to characterize the setting state of each flag in the data packet.

4. The covert channel detection method according to claim 3, characterized in that: Feature extraction is performed on the packet feature sequence to obtain a second feature including: Determine the third and fourth medians of the characteristic values ​​corresponding to each of the data packets in the packet characteristic sequence, and rewrite the characteristic values ​​of the characteristic values ​​that are greater than the third and fourth medians as the third and fourth medians; Determine the average value and variance of the rewritten characteristic values, and standardize the characteristic values ​​corresponding to each of the data packets in the packet characteristic sequence according to the average value and the variance to obtain the standardized packet characteristic sequence; A deep learning model is used to extract the time series features of the standardized packet feature sequence to obtain the second feature.

5. The covert channel detection method according to claim 4, characterized in that: The deep learning model is obtained after self-supervised training of the initial deep learning model, and the self-supervised training is used to improve the temporal feature expression ability of the model; The training steps of the deep learning model include: Obtaining the package feature sequence, and using a masking mark to randomly mask some elements in the package feature sequence to obtain a masking sequence; Using the encoder in the initial deep learning model to perform feature representation on the masked sequence; Using the decoder in the initial deep learning model, predicting the portion of the cover sequence covered by the cover mark according to the feature representation output by the encoder, to obtain a predicted sequence; Determine the error value between the predicted sequence and the original packet feature sequence before being masked, and update the model parameters in the initial deep learning model according to the error value to obtain the trained deep learning model.

6. The covert channel detection method according to claim 5, characterized in that: The encoder includes: a multi-head self-attention layer and a feedforward network layer; the decoder includes: a multi-head attention layer, a feedforward network layer, and an encoder-decoder attention layer; wherein the multi-head attention layer is used to capture the dependency between elements at different positions in a sequence, the feedforward network layer is used to perform feature transformation on the output of the multi-head attention layer to introduce nonlinear features, and the encoder-decoder attention layer is used to determine the degree of attention of the decoder to the output of the encoder.

7. The covert channel detection method according to claim 1, characterized in that: Determining, according to the target feature, the channel type corresponding to the data stream includes: Using a gating mechanism, the first feature and the second feature are fused to obtain the target feature; Using a fully connected layer and an activation function, determining a hidden representation corresponding to the target feature; A classifier is used to make a prediction based on the hidden representation of the target feature to obtain the channel type corresponding to the data stream.

8. A covert channel detection device, characterized in that: include: A first feature extraction module, used to obtain a data stream to be detected and determine a first feature of the data stream, wherein the first feature is a statistical feature used to characterize overall information of the data stream; A second feature extraction module is used to determine a packet feature sequence corresponding to the data stream, and perform feature extraction on the packet feature sequence to obtain a second feature, wherein the packet feature sequence is a sequence used to characterize feature information of each data packet in the data stream, and the second feature is used to characterize a timing feature within the data stream; The feature fusion prediction module is used to fuse the first feature and the second feature to obtain a target feature, and determine the channel type corresponding to the data stream based on the target feature, wherein the channel type includes: a covert channel and a non-covert channel.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the covert channel detection method according to any one of claims 1 to 7 when running.

10. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the covert channel detection method according to any one of claims 1 to 7 by running the computer program.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the covert channel detection method according to any one of claims 1 to 7 are implemented.

Images