Botnet offline detection method based on deep learning

Abstract

The invention provides a Botnet off-line detection method based on deep learning, and the method comprises the steps: extracting the triple information of each control node in a Botnet from network flow, and constructing a behavior graph of the control nodes according to the triple information; a Botnet malicious behavior path is obtained from the control node behavior graph by using a weighted random walk algorithm, and an embedded vector of the control node behavior graph is obtained through a trained full-connection neural network; and analyzing the embedded vector of the control node behavior graph by using the trained CNN classifier, and outputting a classification result of each control node in the botnet. On the basis of extracting the control node information in the network flow, the control node information is modeled into the control node behavior graph, the embedded representation of the behavior graph is obtained through neural network training, and the behavior graph vectors are classified by using the convolutional neural network, so that the attack effectiveness of the botnet attack tool is enhanced.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a botnet offline detection method based on deep learning. Background Art

[0002] A botnet is a group of non-cooperative user terminals that can be remotely controlled by attackers. Among them, the infected terminals are called zombie hosts, and the controller can perform one-to-many control over the zombie hosts through command and control channels. As a large-scale attack platform, attackers can use botnets to launch large-scale attack activities such as distributed denial of service, malware distribution, and encryption extortion, posing a huge security threat to the Internet. With the in-depth integration of artificial intelligence and network security, compared with traditional network attacks in terms of technology and methods, artificial intelligence-enabled network attacks will completely transform the past labor-intensive and costly attack methods, and develop in the direction of distributed, intelligent, and automated, thus forming more accurate and rapid automated attack methods.

[0003] Using artificial intelligence to achieve self-evolution of attack methods can improve the effectiveness of attacks. Attackers use artificial intelligence to analyze the attack effects and possible countermeasures of the defender under different attack methods, and then automatically select new attack mechanisms based on the weaknesses of the defender, thereby achieving intelligent evolution of attack methods. For example, attackers can use the results of the defender's intrusion detection system as feedback, use artificial intelligence technology to collect and model the feedback data, establish an attack effect model, dynamically adjust the appropriate attack method, and circumvent the intrusion detection system.

[0004] The current structure and behavior patterns of botnets are complex and diverse and are developing rapidly. Traditional physical information network botnet detection methods do not fully characterize botnets and are no longer suitable for the current botnet environment with a large number of variants and rapid development. The present invention constructs a behavioral relationship graph of physical information network zombie nodes and proposes a botnet offline detection method based on deep learning. The detection method provides an intrusion detection scenario that simulates a real defender and is suitable for offline data that is not updated in real time. On the basis of extracting control node information from network traffic, it is modeled as a control node behavior graph, and an embedded representation of the behavior graph is obtained through neural network training. The behavior graph vector is classified using a convolutional neural network, thereby enhancing the attack effectiveness of the botnet attack tool. Summary of the invention

[0005] The purpose of this invention is to study and construct a behavioral relationship diagram of physical information network zombie nodes, and propose a botnet offline detection system based on deep learning to solve the problem that the existing physical information network botnet method has incomplete characterization of botnets, and enhance the attack effectiveness of botnet attack tools.

[0006] The technical solution provided by the present invention is as follows:

[0007] In a first aspect, a botnet offline detection method based on deep learning includes:

[0008] Extracting triplet information of each control node in the botnet from network traffic, and constructing a behavior graph of the control node based on the triplet information; the triplet information includes the number of nodes connected to the control node, a set of line type pairs between the control node and the target node communicating with it, and a set of event sequences of the control node sending instructions to the target node;

[0009] The weighted random walk algorithm is used to obtain the malicious behavior path of the botnet from the control node behavior graph, and the embedded vector of the control node behavior graph is obtained through the trained fully connected neural network;

[0010] The trained CNN classifier is used to analyze the embedded vector of the control node behavior graph and output the classification results of each control node in the botnet.

[0011] In a second aspect, a botnet offline detection device based on deep learning includes:

[0012] one or more processors;

[0013] a storage device for storing one or more programs,

[0014] When the one or more programs are executed by the one or more processors, the one or more processors implement the deep learning-based offline botnet detection method described in the first aspect.

[0015] In a third aspect, a readable storage medium stores a computer program, which, when executed by a processor, implements the botnet offline detection method based on deep learning described in the first aspect.

[0016] In a fourth aspect, a computer program product is provided, comprising: a computer program (also referred to as code or instruction), which, when executed, executes the deep learning-based offline botnet detection method described in the first aspect.

[0017] According to the present invention, a botnet offline detection method based on deep learning has the following features:

[0018] Beneficial effects:

[0019] (1) The present invention proposes a control node behavior graph construction model. By extracting the dependency between different network flows and integrating the basic attributes of network nodes, a botnet control node behavior graph is constructed, and the information of the botnet control node is modeled, thereby achieving a comprehensive characterization of the physical information network botnet.

[0020] (2) The present invention proposes a behavior graph vector generation model, which divides the control node behavior graph into multiple malicious behavior paths by weighted random walk, and uses a fully connected neural network to generate an embedding vector of the botnet control node behavior graph, thereby fully capturing the heterogeneous characteristics of the behavior graph;

[0021] (3) The present invention uses a CNN-based classification module to simply classify network nodes into benign nodes and zombie network nodes according to different task scenarios, or divide network nodes more finely according to different zombie families. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a deep learning based offline botnet detection framework;

[0023] Figure 2 To control the node behavior graph vector generation process;

[0024] Figure 3 It is a CNN-based behavior graph vector classifier. DETAILED DESCRIPTION

[0025] The following detailed description of the present invention will make the features and advantages of the present invention more clear and explicit.

[0026] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0027] The present invention provides a botnet offline detection method based on deep learning, such as Figure 1 As shown, it includes three steps: control node behavior graph construction, behavior graph vector generation and CNN classifier classification.

[0028] In order to achieve a comprehensive characterization of the physical information network botnet, a control node behavior graph construction model is proposed. By extracting the dependencies between different network traffic and integrating the basic attributes of network nodes, the botnet control node behavior graph is constructed to achieve information modeling of the botnet control node. In addition, in order to fully capture the heterogeneous characteristics of the behavior graph, a behavior graph vector generation model is proposed. The control node behavior graph is segmented into multiple malicious behavior paths by weighted random walk, and the embedded vector of the botnet control node behavior graph is generated by neural network. Finally, in order to achieve the classification of the behavior graph embedded vector, a CNN-based classification model is proposed to complete the detection of botnets. Depending on the task scenario, network nodes can be simply classified into benign nodes and botnet nodes, or network nodes can be divided more finely according to different zombie families.

[0029] 1. Construction of control node behavior graph

[0030] In order to achieve a comprehensive characterization of the botnet, the control node behavior graph construction model flow2graph extracts the relevant information of the botnet control node from the network flow F and models it as a behavior graph G;

[0031] G = flow2graph (F)

[0032] First, the model takes the original network traffic as input and converts it into standard network traffic F = f1, f2, f3, ..., f n , information flow f i is defined as follows:

[0033] f i ={sip i , sport i , stype i , dip i , dport i , dtype i ,proto i , timestamp i}

[0034] Among them, sip i , sport i , stype i , dip i , dport i , dtype i ,proto i , timestamp i They are represented by source IP, source port, source type, destination IP, destination port, destination type, protocol, and timestamp respectively.

[0035] Then, extract the triplet information F related to the botnet control node from the standard network traffic F sip = {N sip , T sip , S sip}. Among them, N sip Indicates the number of nodes connected to the control node; T sip represents the set of line type pairs of the control node and the target node it communicates with, T sip ={(stype sip , dtype sip )}; S sip A collection of event sequences representing the control node sending instructions to the destination node.

[0036] Finally, the behavior graph of the control node is constructed based on the triple information. All paths in the behavior graph start from the line type of the control node, connect to the line type of the destination node through the communication event sequence, and the line type of the destination node is connected to the number of destination nodes related to the current path. The path definition is as follows:

[0037]

[0038] In the formula, stype and dtype represent the line types of the source node and the destination node respectively, e represents the communication event, and N represents the number of nodes corresponding to the current path. Represents the edges connecting nodes.

[0039] The botnet control node behavior graph consists of multiple paths:

[0040]

[0041] The control node behavior graph is defined as a heterogeneous information graph G = (V, E), where V represents the node set, E represents the edge set, and the node type mapping function Edge type mapping function φ:E→R. There are three different node types in the behavior graph G: line type (control node line type and destination node line type), communication event, and number of connections. There are four different interactive relationships between different types of nodes, that is, the edges connecting different nodes in the behavior graph contain four different meanings. The edge between the line type and the communication event can represent the first or last step of the communication between the control node and the destination node. Different communication events form a communication event sequence through edge connections. The edge between the line type and the number of connections represents the number of destination nodes connected by the control node through a certain event sequence.

[0042] 2. Behavior Graph Vector Generation

[0043] By analyzing the propagation characteristics of botnets, the representation learning of control node behavior graphs is studied, and a behavior graph vector generation model ccg2vec is proposed to convert the control node behavior graph G into a behavior graph vector X:

[0044] X = ccg2vec (G)

[0045] First, the ccg2vec model uses a weighted random walk strategy to sample paths in the control node behavior graph G and divides the control node behavior graph into multiple subgraphs, each of which represents a malicious behavior path of the corresponding node in the botnet. Then, a fully connected neural network is used to learn the context representation of the behavior subgraph and obtain the embedding vector X = (x1, x2, ..., x n ), where each vector x i The dimension of is N. The method flow is as follows Figure 2 shown.

[0046] 3. CNN Classifier Classification

[0047] After generating the embedding vector of the control node behavior graph, a classifier for identifying the control node behavior graph vector is constructed based on the CNN model to classify the graph vector and complete the detection of the botnet control node. The classifier takes the graph vector as input and finally outputs the classification result of the graph vector through convolution, pooling and output layers. Figure 3 .

[0048] When training the graph vector generation model and CNN classifier, a large number of labeled control node behavior graphs are used for training until the loss value converges. The labels are divided into benign nodes and botnet nodes, and the botnet nodes can also be subdivided according to different zombie families.

[0049] 4. Overall process of botnet offline detection framework

[0050] The botnet detection method proposed in the present invention mainly includes three models: a control node behavior graph construction model, a behavior graph vector generation model and a CNN classifier. During the training process, a large amount of data is used to train the behavior graph vector generation model and the CNN classifier respectively until the loss value converges. After the training is completed, each model can be used to detect the control nodes in the botnet. The detection process is: the input is the network traffic, the time window and the trained control node behavior graph construction model, the behavior graph vector generation model and the CNN classifier. The detection idea is: first, initialize the control node behavior graph G and the behavior graph vector X, and convert the network traffic into standard network traffic. Then, for each control node in the time window, extract the triple information from the network traffic and construct the behavior graph. Then, use the trained behavior graph vector generation model to convert the control node behavior graph into an embedded vector. Finally, the behavior graph vector is analyzed by a CNN-based classifier, and the label of the control node is output according to the different detection targets.

[0051] The present invention also provides a botnet offline detection device based on deep learning, comprising:

[0052] one or more processors;

[0053] a storage device for storing one or more programs,

[0054] When the one or more programs are executed by the one or more processors, the one or more processors implement the deep learning-based offline botnet detection method described in the first aspect.

[0055] The present invention also provides a readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the botnet offline detection method based on deep learning described in the first aspect.

[0056] The readable storage medium includes, but is not limited to, various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0057] The present invention also provides a computer program product, which includes: a computer program (also referred to as code, or instruction), which, when executed, executes the deep learning-based offline botnet detection method described in the first aspect.

[0058] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, microwave, etc.) mode to another website site, computer, server or data center.

[0059] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0060] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device and product can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0061] The present invention has been described in detail above in conjunction with specific implementations and exemplary examples, but these descriptions cannot be understood as limiting the present invention. Those skilled in the art understand that, without departing from the spirit and scope of the present invention, a variety of equivalent substitutions, modifications or improvements may be made to the technical solution of the present invention and its implementation methods, all of which fall within the scope of the present invention. The scope of protection of the present invention shall be subject to the attached claims.

[0062] The contents not described in detail in the specification of the present invention belong to the common knowledge of those skilled in the art.

Claims

1. A botnet offline detection method based on deep learning, characterized in that: include: Extracting triplet information of each control node in the botnet from network traffic, and constructing a behavior graph of the control node based on the triplet information; the triplet information includes the number of nodes connected to the control node, a set of line type pairs between the control node and the target node communicating with it, and a set of event sequences of the control node sending instructions to the target node; The weighted random walk algorithm is used to obtain the malicious behavior path of the botnet from the control node behavior graph, and the embedded vector of the control node behavior graph is obtained through the trained fully connected neural network; The trained CNN classifier is used to analyze the embedded vector of the control node behavior graph and output the classification results of each control node in the botnet.

2. The method for offline detection of botnets based on deep learning according to claim 1, characterized in that: The step of extracting triplet information of each control node in the botnet from network traffic includes: Clean the original traffic and convert it into standard network traffic. i is defined as follows: f i ={sip i ,sport i ,stype i ,dip i ,dport i ,dtype i ,proto i ,timestamp i } Among them, sip i , sport i , stype i , dip i , dport i , dtype i ,proto i , timestamp i Respectively represented as source IP, source port, source type, destination IP, and destination port; Extract triplet information related to botnet control nodes from standard network traffic.

3. The botnet offline detection method based on deep learning according to claim 1 is characterized in that: The step of constructing a behavior graph of the control node according to the triple information, wherein the behavior graph includes three different node types: line type, communication event and number of connections, wherein the line type includes the control node line type and the destination node line type.

4. The method for offline detection of botnets based on deep learning according to claim 1, characterized in that: In the step of constructing a behavior graph of a control node according to triple information, there are four different interaction relationships between different types of nodes, the edge between the line type and the communication event represents the first step connection or the last step connection of the communication between the control node and the destination node, different communication events are connected by edges to form a communication event sequence, and the edge between the line type and the number of connections represents the number of destination nodes connected by the control node through a certain event sequence.

5. The method for offline detection of botnets based on deep learning according to claim 1, characterized in that: The step of constructing a behavior graph of the control node based on the triple information, wherein all paths in the behavior graph start from the line type of the control node, connect to the line type of the destination node through a communication event sequence, and the line type of the destination node is connected to the number of destination nodes related to the current path.

6. The method for offline detection of botnets based on deep learning according to claim 1, characterized in that: In the step of using the trained CNN classifier to analyze the embedded vector of the control node behavior graph and outputting the classification results of each control node in the botnet, the classification results of the control nodes are benign nodes and botnet nodes, or the classification results of the control nodes are benign nodes and subdivided zombie family nodes.

7. A botnet offline detection device based on deep learning, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the deep learning-based offline botnet detection method described in the first aspect.

8. A readable storage medium, characterized in that: A computer program is stored thereon, and when the program is executed by the processor, the botnet offline detection method based on deep learning described in the first aspect is implemented.

9. A computer program product, characterized in that The computer program product includes: a computer program, which, when executed, executes the botnet offline detection method based on deep learning described in the first aspect.

Images