Dynamic and static fusion detection method for multiple ransomware based on network traffic analysis

Abstract

The invention belongs to the field of industrial internet information security, and provides a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis. The invention provides a more accurate and comprehensive method for a large number of multi-ransomware network requests and poor adaptability of a traditional method. Network traffic data are captured and monitored in real time through a network packet capturing tool and a traffic monitoring system, cleaning and feature extraction are carried out on the data, a traffic mode is analyzed to identify abnormal behaviors, then the system comprehensively judges the traffic by combining a static rule and a machine learning model support vector machine for dynamic detection, and when the abnormal behaviors are detected, the abnormal behaviors are detected. According to the method, a response mechanism is automatically triggered, malicious traffic is blocked and an alarm is sent, and finally, by continuously optimizing a rule set and a model, the accuracy and efficiency of detection are improved, and the system can better cope with intrusion attacks.

Description

Technical Field

[0001] The present invention belongs to the field of industrial Internet information security and relates to a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis. Background Art

[0002] Ransomware is a type of malware that demands a ransom by encrypting the victim's files or locking the system. In recent years, such attacks have occurred frequently and have a wide impact, from individual users to large enterprises and government agencies. Attackers usually demand ransoms in cryptocurrency to avoid being tracked. These attacks use social engineering and vulnerability exploitation techniques to spread through phishing emails, malicious attachments, and unsecured network services. Once infected, the victim's files are encrypted and a ransom message is usually displayed, demanding a ransom in exchange for a decryption key. Due to the complexity and diversity of ransomware, traditional defense methods are often difficult to effectively resist, so it is necessary to combine advanced detection and response strategies to strengthen protection.

[0003] In recent years, a ransomware model known as "multi-ransom" has emerged. It combines multiple threat methods. First, the victim's data is encrypted to make it inaccessible. Then, the attacker steals sensitive information and threatens to disclose or sell the data if the ransom is not paid. In addition, the attacker may launch a DDoS attack or threaten the victim's customers and partners to force the victim to pay the ransom. Through multi-level threats and pressure, this model significantly increases the success rate of the attack and the impact on the victim. Traditional ransomware virus detection methods usually rely on file features and system behavior, which may cause delayed detection and be limited by feature library updates. This will lead to poor adaptability, especially slow response to new variants or unknown attacks. Traditional methods are also prone to high false alarm rates, especially when dealing with complex or mutated malware. Multi-ransomware attacks generate a large number of network requests, which provides an opportunity to identify ransomware attacks through network traffic. Network traffic analysis monitors abnormal traffic and communication behavior, detects virus propagation attempts in advance, and adapts to changes in attack forms through updates to machine learning models. Dynamic and static fusion combines real-time traffic analysis and machine learning to quickly respond to new threats, reduce false alarm rates through multi-dimensional analysis, and provide more accurate judgments.

[0004] Therefore, the present invention uses network traffic monitoring tools to capture data in real time, static rules to identify known threats, dynamic analysis to detect abnormal behavior using machine learning models, and combined with dynamic and static strategies, the system quickly determines attacks, automatically triggers response mechanisms, and continuously updates models and rule sets to improve detection accuracy and adaptability, thereby achieving comprehensive protection. Summary of the invention

[0005] The present invention aims to provide a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis. By comprehensively utilizing traffic characteristics and behavioral analysis, this method can quickly identify and respond to ransomware attacks. The dynamic and static combination strategy enables the system to effectively detect unknown variants while identifying known threats, thereby improving the accuracy and efficiency of overall monitoring. Compared with traditional methods, this method can maintain lower complexity in complex network environments and provide comprehensive protection capabilities.

[0006] The technical solution of the present invention is as follows:

[0007] A dynamic and static fusion detection method for multiple ransomware based on network traffic analysis, the steps are as follows:

[0008] Step 1: Data Collection

[0009] Use the network packet capture tool Wireshark and the traffic monitoring system NetFlow to capture data packets in real time, focus on monitoring HTTP and DNS key protocol traffic, deploy network probes, configure switch port mirroring, and copy traffic to the network traffic analyzer. These data packets contain information such as source and destination addresses, protocol types, port numbers, and transmission content. This ensures that network activities are fully captured and lays the foundation for subsequent analysis.

[0010] Step 2: Data preprocessing and feature extraction

[0011] First, the collected data is de-redundant and cleaned, duplicate or irrelevant data packets are filtered out, the data volume is reduced, damaged or incomplete data packets are removed to ensure data quality, and key information such as IP addresses and port numbers are parsed. When extracting features from the data, the traffic pattern is analyzed to identify abnormal traffic surges and suspicious port scanning behaviors. At the same time, the use of non-standard protocols and the characteristics of encrypted traffic are detected, and the traffic is analyzed by calculating the mean, variance, kurtosis, and autocorrelation function of the traffic. Finally, the data is stored in a secure log file or database for real-time analysis and model training to achieve rapid response and detection of potential anomalies. By calculating the traffic, the mean, variance, kurtosis, and autocorrelation function of the data are obtained.

[0012] Step 3: Dynamic and static fusion detection

[0013] Combine the rapid response capabilities of static rules with the in-depth analysis of dynamic detection to make a comprehensive judgment on traffic. Apply predefined static rule sets to quickly match traffic. The rule sets are based on known attack features to identify communications with malicious IP addresses and suspicious domain names to block potential threats. Real-time analysis relies on dynamic detection models and uses machine learning algorithms, support vector machines, to classify traffic behavior in real time. These models are trained to identify abnormal traffic patterns, such as traffic surges, non-standard port usage, and abnormal protocol activity. Z-scores, entropy calculations, support vector machines, and cosine similarity are used to monitor whether network traffic is abnormal or not.

[0014] Step 4: Automated response

[0015] Once abnormal behavior is detected, the response mechanism is automatically triggered, which can block malicious traffic through firewalls and intrusion detection systems (IDS), isolate infected hosts, send alerts to the security team, automatically perform backup recovery and start redundant systems. Automated response ensures that the attack is contained in the initial stage and reduces potential losses.

[0016] Step 5: System feedback and optimization

[0017] During the real-time analysis process, we continuously collect detection results and response data, use new data integration to regularly update the machine learning model, adjust static rules based on feedback and detection results, add newly discovered attack features, remove outdated rules, integrate the latest threat intelligence, update the feature library, enhance the ability to identify new attacks, regularly evaluate the system's false alarm rate and false negative rate, analyze detection data, optimize model parameters and rule sets, and improve detection accuracy and efficiency. Use the F1-Score function to measure the performance indicators of the classification model.

[0018] Beneficial effects of the present invention:

[0019] Real-time data collection and analysis can help detect potential threats in the early stages of an attack and reduce losses. The dynamic and static fusion detection method combines the rapid response capabilities of static rules with the in-depth analysis of dynamic detection. The static rule set is based on known attack features and can quickly match and block known threats, while the dynamic detection model support vector machine identifies unknown attacks by learning new patterns. This combination not only improves detection accuracy, but also significantly reduces the false alarm rate. The system responds quickly and adjusts strategies to further improve defense capabilities. The system uses new data and the latest threat intelligence to update static rule sets and dynamic detection models to adapt to changing attack forms, maintain efficient detection capabilities, and effectively improve detection accuracy and robustness. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1This is a structural diagram of a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis.

[0021] Figure 2 It is a flow chart of a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis.

[0022] Figure 3 It is a structural diagram of data collection.

[0023] Figure 4 It is a flow chart of dynamic and static fusion detection.

[0024] Figure 5 It is a structural diagram of the system's response to intrusion.

[0025] Figure 6 It is a flow chart of system optimization and feedback. DETAILED DESCRIPTION

[0026] The specific implementation of the present invention is further described below in conjunction with the accompanying drawings and technical solutions.

[0027] The invention discloses a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis, which aims to efficiently and accurately detect the intrusion of ransomware by analyzing network traffic and using the dynamic and static fusion detection method, and respond to block the intrusion risk in time. Finally, the model is continuously fed back and optimized based on the collected data. Figure 1 and Figure 2 As shown, the specific implementation steps are as follows:

[0028] Step 1: Data Collection

[0029] In the protected system of the industrial control system, the network packet capture tool Wireshark and the traffic monitoring system NetFlow are used to capture all data packets in the network. When there is a surge in traffic during a certain period of time, the detailed information of the relevant data packets is monitored and recorded. Among them, the traffic of key protocols such as HTTP and DNS should be paid special attention. Through the network probes deployed in the protected system network and the port mirroring function configured on the switch, the obtained network traffic copies are sent to the network traffic analyzer for further analysis. The structural diagram of data collection is shown in the figure below. Figure 3 shown.

[0030] Step 2: Data preprocessing and feature extraction

[0031] For the collected network data, duplicate data packets, irrelevant traffic, and damaged or incomplete data packets are removed, and then the data packets are parsed to record key details such as IP addresses and port numbers. Feature extraction is performed on the processed network data, and the mean, variance, kurtosis, and autocorrelation function of the traffic are statistically calculated. Then, the traffic pattern is further analyzed to identify abnormal traffic surges and suspicious port scanning behaviors. At the same time, the use of non-standard protocols and features of encrypted traffic are detected, and these are recorded and combined for the next step of analysis. Finally, copies of these processed data are securely stored in log files or databases to facilitate subsequent real-time analysis and machine learning model training.

[0032] Perform statistical calculations on network traffic data to obtain relevant data for further analysis:

[0033] (1) The average value μ of the flow rate is:

[0034]

[0035] Where: N is the number of data points, x i is the ith data point.

[0036] (2) Variance of flow σ 2 for:

[0037]

[0038] (3) Measures the degree of deviation of data from the normal distribution; the kurtosis K of the flow is:

[0039]

[0040] in: is the sample mean, and σ is the sample standard deviation.

[0041] (4) The autocorrelation function of lag k is used to analyze the flow time series; the autocorrelation function R(k) of lag k is:

[0042]

[0043] Where: k is the number of lag steps.

[0044] Step 3: Dynamic and static fusion detection

[0045] Analyze the processed data feature information. When abnormal data appears, calculate the Z score, entropy and cosine similarity. If the calculation result indicates that the Z score is far from zero, the entropy value is large or the cosine similarity is low, then use static rules and dynamic detection to make the next comprehensive evaluation of the traffic. Use the predefined static rule set for fast matching, and identify the communication of malicious IP addresses and suspicious domain names based on known attack features; at the same time, use the dynamic detection model for real-time analysis, and use the machine learning algorithm support vector machine to classify traffic behavior in real time. When the existing attack is matched according to the static rule set or the result of the support vector machine is greater than the threshold, it indicates that the system has been invaded by the ransomware virus, which requires the next step of protection. The flowchart of dynamic and static fusion detection is as follows. Figure 4 shown.

[0046] The statistical data related information indicates that abnormal network traffic data has occurred, and the following calculations are performed:

[0047] (1) The Z score is used to represent the traffic statistics characteristics and detect the degree to which the traffic deviates from the normal baseline. The function of the Z score is:

[0048]

[0049] Where: X represents the value of a data point, and σ is the standard deviation of the flow rate.

[0050] (2) Evaluate the randomness of traffic distribution by entropy calculation; the entropy calculation function H(X) is:

[0051]

[0052] Where: p(x i ) is the probability of the ith data point.

[0053] (3) The machine learning model is used to classify normal and abnormal traffic; the function f(x) of the support vector machine in machine learning is:

[0054]

[0055] Where: α i is the Lagrange multiplier, y i is the label of the i-th sample, K(x i ,x) is the kernel function and b is the bias term.

[0056] (4) Cosine similarity is used to compare the similarity of characteristic traffic; the cosine similarity function is:

[0057]

[0058] Where: A and B represent two vectors to be compared, A·B is the dot product of the two vectors, and ||A|| and ||B|| are the moduli of the two vectors.

[0059] Step 4: Automated response

[0060] After the system is determined to have been invaded through dynamic and static fusion detection, the response mechanism is activated, and the firewall and intrusion detection system (IDS) are used to intercept malicious traffic, isolate infected hosts, and send alerts to the security team. In addition, the system automatically performs backup and recovery and starts redundant systems. The structure diagram of the system's intrusion response is shown below. Figure 5 shown.

[0061] Step 5: System feedback and optimization

[0062] The detection results and response data are recorded. The system updates the machine learning model based on these results and data, integrates new data into the model, and adjusts static rules, adds new discovered attack features, removes outdated rules, incorporates the latest threat intelligence, and updates the feature library. At the same time, the false alarm rate and missed alarm rate are evaluated based on the results, and the detection data is analyzed to optimize the model parameters and rule set. The flowchart of system optimization and feedback is as follows: Figure 6 shown.

[0063] Evaluate system performance for continuous optimization:

[0064] (1) The function FPR for evaluating the false alarm rate is:

[0065]

[0066] Among them: FP is the number of false positives, and TN is the number of correctly identified normal ones.

[0067] (2) The function FNR for evaluating the false negative rate is:

[0068]

[0069] Among them: FN is the number of missed reports, and TP is the number of correctly identified attacks.

[0070] (3) The F1-Score function that measures the performance of the classification model is:

[0071]

[0072] Among them: Precision is the accuracy rate, which means the proportion of samples correctly predicted as positive to all samples predicted as positive. Recall is the recall rate, which means the proportion of samples correctly predicted as positive to all samples that are actually positive.

[0073] The lower the false alarm rate and missed alarm rate, the fewer false alarms and missed alarms, the higher the model accuracy, and the stronger the detection capability. The value of the F1-Score function is between 0 and 1. The closer the value is to 1, the better the model performance. In terms of security protection, it is necessary to maximize the precision rate based on a high recall rate.

Claims

1. A dynamic and static fusion detection method for multiple ransomware based on network traffic analysis, characterized in that: Here are the steps: Step 1: Data Collection Use network packet capture tools and traffic monitoring systems to capture data packets in real time, monitor HTTP and DNS protocol traffic, deploy network probes, configure switch port mirroring, and copy traffic to a network traffic analyzer; The data packet contains the source and destination addresses, protocol type, port number, and transmission content; Step 2: Data preprocessing and feature extraction First, the collected data is de-redundant and cleaned, duplicate or irrelevant data packets are filtered out, damaged or incomplete data packets are removed, and IP address and port number information are parsed; when extracting features from the data, the traffic pattern is analyzed to identify abnormal traffic surges and suspicious port scanning behaviors. At the same time, the use of non-standard protocols and the characteristics of encrypted traffic are detected, and traffic statistics are calculated by calculating the mean, variance, kurtosis and autocorrelation function of the traffic; finally, the data is stored in a secure log file or database for real-time analysis and model training, so as to achieve rapid response and detection of potential anomalies; the mean, variance, kurtosis and autocorrelation function of the data are obtained by calculating the traffic; Step 3: Dynamic and static fusion detection Combine the rapid response capability of static rules and the in-depth analysis of dynamic detection to make a comprehensive judgment on traffic; apply predefined static rule sets to quickly match traffic. The rule sets are based on known attack features to identify communications with malicious IP addresses and suspicious domain names to block potential threats; Real-time analysis relies on a dynamic detection model that uses a machine learning algorithm, support vector machine, to classify traffic behavior in real time. The model is trained to identify abnormal traffic patterns. Z-scores, entropy calculations, support vector machines, and cosine similarity are used to detect whether network traffic is abnormal or not. Step 4: Automated response Once abnormal behavior is detected, the response mechanism is automatically triggered to block malicious traffic through firewalls and intrusion detection systems, isolate infected hosts, send alerts to the security team, automatically perform backup and recovery, and start redundant systems; Step 5: System feedback and optimization During the real-time analysis process, detection results and response data are continuously collected, and the machine learning model is regularly updated using new data integration. Static rules are adjusted based on feedback and detection results, newly discovered attack features are added, outdated rules are removed, the latest threat intelligence is integrated, and the feature library is updated to enhance the ability to identify new attacks. The system's false alarm and missed alarm rates are regularly evaluated, and the accuracy and efficiency of detection are improved by analyzing detection data, optimizing model parameters and rule sets. The F1-Score function is used to measure the performance indicators of the classification model.

2. According to claim 1, a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis is characterized in that: In step 2, the traffic characteristics are counted and analyzed using time series, as follows: (1) Statistical characteristics of traffic flow statistics; the average value μ of the traffic flow is: Where: N is the number of data points, x i is the i-th data point; (2) Statistical characteristics of traffic flow; the variance of traffic flow σ 2 for: (3) Measures the degree of deviation of data from the normal distribution; the kurtosis K of the flow is: in: is the sample mean, σ is the sample standard deviation; (4) The autocorrelation function of lag k is used to analyze the flow time series; the autocorrelation function R(k) of lag k is: Where: k is the number of lag steps.

3. According to claim 1, a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis is characterized in that: In step 3, the network traffic is detected to see if it is abnormal and classified, as follows: (1) The Z score is used to represent the traffic statistics characteristics and detect the degree of traffic deviation from the normal baseline; the function of the Z score is: Where: X represents the value of a data point, σ is the standard deviation of the flow; (2) Evaluate the randomness of traffic distribution by entropy calculation; the entropy calculation function H(X) is: Where: p(x i ) is the probability of the i-th data point; (3) The machine learning model is used to classify normal and abnormal traffic; the function f(x) of the support vector machine in machine learning is: Where: α i is the Lagrange multiplier, y i is the label of the i-th sample, K(x i ,x) is the kernel function, b is the bias term; (4) Cosine similarity is used to compare the similarity of characteristic traffic; the cosine similarity function is: Where: A and B represent two vectors to be compared, A·B is the dot product of the two vectors, and ||A|| and ||B|| are the moduli of the two vectors.

4. According to claim 1, a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis is characterized in that: In step five, the system performance is evaluated and optimized continuously, as follows: (1) The function FPR for evaluating the false alarm rate is: Among them: FP is the number of false positives, TN is the number of correctly identified normal; (2) The function FNR for evaluating the false negative rate is: Where: FN is the number of missed reports, TP is the number of correctly identified attacks; (3) The F1-Score function that measures the performance of the classification model is: Among them: Precision is the accuracy rate, which means the proportion of samples correctly predicted as positive to all samples predicted as positive. Recall is the recall rate, which means the proportion of samples correctly predicted as positive to all samples that are actually positive.

Images