Network time covert channel detection method and system based on tree structure algorithm
Through the network time hidden channel detection method based on tree structure algorithm, an isolated binary tree is generated and the hidden channel is determined based on the number of nodes, which solves the problem of low accuracy in detecting new network time hidden channels in the prior art, and achieves a high-accuracy detection effect.
Patent Information
- Application Number
- CN202411456455.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-18
- Publication Date
- 2025-03-11
AI Technical Summary
The prior art is difficult to effectively detect new network time covert channels, and traditional methods reduce detection accuracy when facing complex network protocols and diversified attack methods.
The detection method based on the tree structure algorithm is adopted to collect the arrival time series from the legal communication, generate an isolated binary tree, and determine whether the traffic to be detected is a hidden channel traffic based on the number of nodes.
It realizes effective detection of network time hidden channels under a smaller detection window, improves detection accuracy, better distinguishes between legal traffic and hidden traffic, and enhances the security of network attack prevention measures.
Smart Images
Figure CN119602986A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network information security, and in particular to a network time covert channel detection method and system based on a tree structure algorithm. Background Art
[0002] Network time covert channel is a covert and imperceptible communication method that uses the time field in the network protocol to transmit hidden information. The existence of this covert channel may lead to security threats such as data leakage, unauthorized communication and malicious activities. In traditional network covert channel detection methods, the main focus is on the fields, frequencies and statistical characteristics of data packets. However, with the continuous development of covert channel technology and the increasing complexity of network protocols, traditional detection methods can no longer effectively cope with the increasing number of covert channel technologies and attack methods.
[0003] The concept of covert channel was first proposed by Lampson in 1973. It is defined as a channel that is not intended for normal communication purposes. Through covert channels, attackers can encode secret information into normal data, thereby bypassing the detection of security defense mechanisms and posing a serious threat to users. At present, research on network time covert channel detection mainly focuses on abnormal statistical analysis and machine learning methods.
[0004] The abnormal statistical analysis method is easy to implement, but it only uses statistical indicators to analyze the traffic from a coarse-grained perspective and extracts traffic features to evaluate the degree of abnormality of the traffic. This type of method usually has the problem of too large a detection window and a single detection channel. In contrast, machine learning methods can effectively distinguish between legitimate channel traffic and covert channel traffic by using multiple features and larger data sets to train classifiers. For example, methods such as decision trees and random forests based on supervised learning use a tree-like multi-branch structure, which can make a more detailed distinction between network traffic under multiple features. This type of method can more accurately identify abnormal patterns and improve the accuracy of anomaly detection, but the process of training the classifier model consumes a lot of time and resources. At the same time, since the new network time covert channel can imitate the distribution of normal traffic by injecting outliers, this type of method often mistakenly identifies illegal traffic as legitimate traffic during the detection process, resulting in a decrease in detection performance. . Summary of the invention
[0005] The purpose of the present invention is to solve the problem that it is difficult to detect a new type of network time covert channel in the prior art.
[0006] The technical solution adopted by the present invention to solve the technical problem is: to provide a network time covert channel detection method based on a tree structure algorithm, comprising the following steps:
[0007] Collecting legal arrival interval time series from legal communication network traffic; dividing the legal arrival interval time series into several batches, using each batch of data as the first arrival interval time series to generate an isolated binary tree, and generating a discrimination threshold range based on the number of nodes in the isolated binary tree;
[0008] Collect the arrival interval time sequence from the traffic to be detected, and generate an isolated binary tree as the first arrival interval time sequence. If the number of nodes of the isolated binary tree falls outside the discrimination threshold range, the traffic to be detected is determined to be the traffic of the covert channel.
[0009] The generation process of the isolated binary tree is as follows: the first arrival interval time series is subjected to outlier elimination by using the isolation forest algorithm, and then the sequence with outlier eliminated is sorted from small to large according to the value, so as to obtain the second arrival interval time series T = {t1, t2, ..., t n Generate an isolated binary tree based on the second arrival interval time series.
[0010] Preferably, the method of removing outliers from the first arrival interval time series using an isolation forest algorithm comprises the following steps:
[0011] Construct an isolation forest with i isolated trees based on the first inter-arrival time series;
[0012] Traverse each isolated tree in the isolation forest and calculate the time t in the arrival interval time series i The average path length h(t i );
[0013] For the average path length h(t i ) to perform normalization and calculate the arrival interval time series t i The anomaly score S(t,φ) is expressed as:
[0014]
[0015] Among them, φ represents the number of sample points, H() represents the standardization operation, and c(φ) represents the average path length of building an isolated tree for φ samples;
[0016] Delete the data with the highest anomaly score in the first arrival interval time series.
[0017] Preferably, the step of constructing an isolation forest having i isolated trees based on the first arrival interval time series comprises the following steps:
[0018] S11, randomly select φ sample points from the first arrival interval time sequence to form a subset T', and put the subset into the root node of the isolation tree, and the dimension of each sample is n;
[0019] S12, for sample point t i , randomly specify dimension q from n dimensions, and randomly generate a cutting threshold p in T', where min(x ij ,j=q,x ij ∈X')<p<max(x ij ,j=q,x ij ∈X'); if the specified dimension q is less than p, then the sample t i Put it into the left child node. If the specified dimension q is greater than or equal to p, then sample t i Put it into the right child node; xij represents the value of the jth feature of the i-th sample in the data set X'
[0020] S13, executing S12 for each sample point until all child nodes have only one sample point or the isolated tree has reached a specified height h, generating an isolated tree;
[0021] S14, repeat steps S12 to S13 until i isolated trees are generated.
[0022] Preferably, the number i of isolated trees is preset and determined according to computing power and prediction requirements.
[0023] Preferably, the generating of the isolated binary tree based on the second arrival interval time sequence comprises the following steps:
[0024] S21, using the second arrival interval time sequence as a segmentation list;
[0025] S22, randomly select a time point t from the segmentation list cut As the separation value, remove the point and the time point with the same value as the point from the second arrival interval time sequence to obtain the third arrival interval time sequence; with the separation value as the root node, divide the third arrival interval time sequence into a left subtree sequence and a right subtree sequence, wherein the values in the left subtree sequence are all less than the separation value, and the values in the right subtree sequence are all greater than the separation value;
[0026] S23, using the left subtree sequence and the right subtree sequence as the partition list respectively, and repeating S22 to S23 respectively until each subtree sequence has only one data, thereby generating an isolated binary tree.
[0027] Preferably, the generation of the discrimination threshold range based on the number of nodes of the isolated binary tree is specifically: counting the number of nodes of the isolated binary tree generated by all batches of data in the legal arrival interval time series, and obtaining a node number range as the discrimination threshold range.
[0028] The present invention also provides a network time covert channel detection system based on a tree structure algorithm, comprising:
[0029] The threshold generation module collects the legal arrival interval time series from the network traffic of legal communication, divides the legal arrival interval time series into several batches, generates an isolated binary tree with each batch of data as the first arrival interval time series, and generates a discrimination threshold range based on the number of nodes in the isolated binary tree;
[0030] The traffic detection module collects the arrival interval time sequence from the traffic to be detected and generates an isolated binary tree as the first arrival interval time sequence. If the number of nodes of the isolated binary tree falls outside the discrimination threshold range, the traffic to be detected is determined to be the traffic of the covert channel.
[0031] The generation process of the isolated binary tree is as follows: the first arrival interval time series is subjected to outlier elimination by using the isolation forest algorithm, and then the sequence with outlier eliminated is sorted from small to large according to the value, so as to obtain the second arrival interval time series T = {t1, t2, ..., t n Generate an isolated binary tree based on the second arrival interval time series.
[0032] The present invention has the following beneficial effects:
[0033] (1) The present invention uses the design of an isolation forest module to further amplify the stepwise function characteristics of the hidden time series while ensuring that the various arrival interval time series maintain their original characteristics; by adopting the detection technology of the tree-type classification structure of the stepwise function characteristics, the network time covert channel can be effectively detected in a smaller detection window, and the detection accuracy can be improved, so that it is easier to distinguish between legitimate traffic and covert traffic data samples;
[0034] (2) The present invention effectively extracts the step-by-step function characteristics of traffic by eliminating and sorting discrete values. Combined with the design of an isolated binary tree, it can effectively solve the problem of difficulty in detection caused by the new type of time covert channel using abnormal value injection to imitate the legitimate traffic distribution, and better enhance the security of network attack prevention measures.
[0035] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments, but the present invention is not limited to the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS
[0036] Figure 1 A method step diagram of an embodiment of the present invention;
[0037] Figure 2 This is a feature comparison diagram before and after the isolation forest algorithm is used to process network traffic in an embodiment of the present invention;
[0038] Figure 3is a comparison diagram of the areas under the characteristic curves of the embodiment of the present invention and the detection method based on anomalies in a switch-type covert channel;
[0039] Figure 4 It is a comparison diagram of the areas under the characteristic curves of the embodiment of the present invention and the detection method based on anomalies in an L-bit to N-packet covert channel;
[0040] Figure 5 is a comparison diagram of the areas under the characteristic curves of the embodiment of the present invention and the detection method based on anomalies in a time replay type covert channel;
[0041] Figure 6 It is a comparison diagram of the areas under the characteristic curves of the embodiment of the present invention and the anomaly-based detection method under a loosely coupled covert channel;
[0042] Figure 7 It is a comparison diagram of the areas under the characteristic curves of the embodiment of the present invention and the anomaly-based detection method under a new anomaly injection type covert channel;
[0043] Figure 8 It is a comparison diagram of the areas under the characteristic curves of the embodiment of the present invention and three existing detection methods based on machine learning under a new abnormal injection type covert channel;
[0044] Fig. 9 4 is a system structure diagram of an embodiment of the present invention. DETAILED DESCRIPTION
[0045] See also Figure 1 FIG. 1 is a diagram showing steps of a method according to an embodiment of the present invention, comprising the following steps:
[0046] S101, collecting a legitimate arrival interval time series from the network traffic of legitimate communications;
[0047] S102, dividing the legal arrival interval time sequence into several batches, and generating an isolated binary tree for each batch of data as the first arrival interval time sequence;
[0048] S103, generating a discrimination threshold range based on the number of nodes of the isolated binary tree;
[0049] S104, collecting the arrival interval time sequence from the traffic to be detected and generating an isolated binary tree as the first arrival interval time sequence;
[0050] S105, calculating the number of nodes of the isolated binary tree, if the number of nodes falls outside the discrimination threshold range, then determining that the traffic to be detected is the traffic of the covert channel.
[0051] The generation process of the isolated binary tree is as follows: the first arrival interval time series is subjected to outlier elimination by using the isolation forest algorithm, and then the sequence with outlier eliminated is sorted from small to large according to the value, so as to obtain the second arrival interval time series T = {t1, t2, ..., t n}; Generate an isolated binary tree based on the second arrival interval time sequence. In this embodiment, 1 million legal arrival interval time sequences are collected, and isolated binary trees are generated in batches of 200 time sequences, and 5000 isolated binary trees are finally generated.
[0052] Specifically, in order to reduce the impact of extreme values, for the collected arrival interval time series, all values less than 0 milliseconds and greater than 1 millisecond are first filtered out and then processed as the first arrival interval time series.
[0053] Specifically, the method of using the isolation forest algorithm to remove outliers from the first arrival interval time series includes the following steps:
[0054] Construct an isolation forest with i isolated trees based on the first inter-arrival time series;
[0055] Traverse each isolated tree in the isolation forest and calculate the time t in the arrival interval time series i The average path length h(t i );
[0056] For the average path length h(t i ) to perform normalization and calculate the arrival interval time series t i The anomaly score S(t,φ) is expressed as:
[0057]
[0058] Among them, φ represents the number of sample points, H() represents the standardization operation, and c(φ) represents the average path length of building an isolated tree for φ samples;
[0059] Delete part of the data with the highest abnormal score in the first arrival interval time series; the number of deletions is set according to the actual situation. In this embodiment, the first 5% of the data with the highest abnormal score is deleted, and the arrival interval time series data with abnormal values is eliminated while retaining the original characteristics of the legitimate traffic and the stepwise function.
[0060] Specifically, the step of constructing an isolation forest having i isolated trees based on the first arrival interval time series includes the following steps:
[0061] S11, randomly select φ sample points from the first arrival interval time sequence to form a subset T', and put the subset into the root node of the isolation tree, and the dimension of each sample is n;
[0062] S12, for sample point t i , randomly specify dimension q from n dimensions, and randomly generate a cutting threshold p in T', where min(x ij ,j=q,x ij ∈X')<p<max(x ij ,j=q,x ij ∈X'); if the specified dimension q is less than p, then the sample t i Put it into the left child node. If the specified dimension q is greater than or equal to p, then sample t i Put it into the right child node; xij represents the value of the jth feature of the i-th sample in the data set X'
[0063] S13, executing S12 for each sample point until all child nodes have only one sample point or the isolated tree has reached a specified height h, generating an isolated tree;
[0064] S14, repeat steps S12 to S13 until i isolated trees are generated.
[0065] Specifically, the number i of isolated trees is preset and determined according to computing power and prediction requirements.
[0066] Specifically, the isolated binary tree is generated based on the second arrival interval time series. This embodiment designs a binary tree structure for isolating anomalies, which can effectively identify abnormal situations in the network. The construction of the isolated binary tree is based on the maximum depth of the tree set in advance, and the judgment is made according to whether the arrival interval time series has been divided into leaf nodes or cannot be divided again. The arrival interval time series to be detected is also used as a segmentation list. Each time the algorithm randomly selects a time series value from the segmentation list as a segmentation value, and removes the value and the value of the same time series from the arrival interval time series to avoid repeated selection of the same segmentation value. Once the segmentation value is selected, the time series is divided into a left subtree sequence and a right subtree sequence using the value, wherein the value of the left subtree sequence is less than the segmentation value, and the value of the right subtree sequence is greater than the segmentation value. Then, multiple recursive segmentations are performed on the left and right subtrees, and finally an isolated binary tree is constructed. The threshold interval to which each traffic type belongs can be determined by the node structure characteristics of the tree. This method uses the nodes of the tree as features to classify and categorize traffic, thereby determining the types of different network traffic.
[0067] Specifically, the discrimination threshold range is generated based on the number of nodes of the isolated binary tree, specifically: the number of nodes of the isolated binary tree generated by all batches of data in the legal arrival interval time series is counted, and a node number position is obtained as the discrimination threshold range. For example, a number of isolated binary trees constructed by sampling legal traffic, the number of nodes ranges from 120 to 160, then [120, 160] is the discrimination threshold interval; the number of nodes of the isolated binary tree constructed based on the collected traffic to be detected is 30, and outside the interval [120, 160], it is judged as illegal traffic, that is, covert channel traffic.
[0068] See also Figures 3 to 6 As shown, the area comparison diagrams under the characteristic curves of the present invention and the existing anomaly-based detection methods (Entropy, CCE, KS, Epsilon, Regularity) under the switch network time covert channel (IPCTC), L-bit to N-packet covert channel (LtoNCTC), time replay covert channel (TRCTC), and loosely coupled covert channel (Jitterbug) are compared in turn. It can be seen that under various covert channels, the embodiments of the present invention have a higher detection effect than other anomaly-based detection methods under a small window.
[0069] See also Figure 7 As shown, the area comparison diagrams under the characteristic curves of the present invention and the anomaly-based detection method on the same data set under the new anomaly injection type covert channel (ε-κlibur) and the anomaly injection type enhanced covert channel (ε-κlibur-O) are compared in turn. From the overall experimental results, it can be seen that the embodiment of the present invention can more effectively detect the abnormal injection situation in the network traffic and has a better detection effect.
[0070] See also Figure 8 As shown in the figure, the area comparison diagrams under the characteristic curves of the embodiment of the present invention and the method based on machine learning on the same data set under the new abnormal injection type covert channel (ε-κlibur) and the abnormal injection enhanced covert channel (ε-κlibur-O) are compared in turn. From the overall experimental results, it can be seen that the effect of the embodiment of the present invention in detecting abnormal injection type covert channels is no less than that of the machine learning method, and our method has faster detection speed and higher efficiency.
[0071] See also Fig. 9 As shown, it is a system structure diagram of an embodiment of the present invention, including:
[0072] The threshold generation module 901 collects the legal arrival interval time series from the network traffic of the legal communication, divides the legal arrival interval time series into several batches, generates an isolated binary tree with each batch of data as the first arrival interval time series, and generates a discrimination threshold range based on the number of nodes in the isolated binary tree;
[0073] The traffic detection module 902 collects the arrival interval time series from the traffic to be detected and generates an isolated binary tree as the first arrival interval time series. If the number of nodes of the isolated binary tree falls outside the discrimination threshold range, the traffic to be detected is determined to be the traffic of the covert channel.
[0074] It can be seen that the present invention proposes a network time covert channel detection method based on a tree structure algorithm, which can effectively identify sample anomalies and has a smaller detection statistical window and higher detection accuracy.
[0075] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.
Claims
1. A network time covert channel detection method based on a tree structure algorithm, characterized in that: The steps include: Collecting legal arrival interval time series from legal communication network traffic; dividing the legal arrival interval time series into several batches, using each batch of data as the first arrival interval time series to generate an isolated binary tree, and generating a discrimination threshold range based on the number of nodes in the isolated binary tree; Collect the arrival interval time sequence from the traffic to be detected, and generate an isolated binary tree as the first arrival interval time sequence. If the number of nodes of the isolated binary tree falls outside the discrimination threshold range, the traffic to be detected is determined to be the traffic of the covert channel. The generation process of the isolated binary tree is as follows: the first arrival interval time series is subjected to outlier elimination by using the isolation forest algorithm, and then the sequence with outlier eliminated is sorted from small to large according to the value, so as to obtain the second arrival interval time series T = {t1, t2, ..., t n Generate an isolated binary tree based on the second arrival interval time series.
2. The network time covert channel detection method based on the tree structure algorithm according to claim 1 is characterized in that: The method of using the isolation forest algorithm to remove outliers from the first arrival interval time series includes the following steps: Construct an isolation forest with i isolated trees based on the first inter-arrival time series; Traverse each isolated tree in the isolation forest and calculate the time t in the arrival interval time series i The average path length h(t i ); For the average path length h(t i ) to perform normalization and calculate the arrival interval time series t i The anomaly score S(t,φ) is expressed as: Among them, φ represents the number of sample points, H() represents the standardization operation, and c(φ) represents the average path length of building an isolated tree for φ samples; Delete the data with the highest anomaly score in the first arrival interval time series.
3. The network time covert channel detection method based on the tree structure algorithm according to claim 2 is characterized in that: The step of constructing an isolation forest having i isolated trees based on the first arrival interval time sequence comprises the following steps: S11, randomly select φ sample points from the first arrival interval time sequence to form a subset T', and put the subset into the root node of the isolation tree, and the dimension of each sample is n; S12, for sample point t i , randomly specify dimension q from n dimensions, and randomly generate a cutting threshold p in T', where min(x ij ,j=q,x ij ∈X')<p<max(x ij ,j=q,x ij ∈X'); if the specified dimension q is less than p, then the sample t i Put it into the left child node. If the specified dimension q is greater than or equal to p, then sample t i Put it into the right child node; xij represents the value of the jth feature of the i-th sample in the data set X'; S13, executing S12 for each sample point until all child nodes have only one sample point or the isolated tree has reached a specified height h, generating an isolated tree; S14, repeat steps S12 to S13 until i isolated trees are generated.
4. The network time covert channel detection method based on a tree structure algorithm according to claim 3 is characterized in that: The number i of isolated trees is preset and determined according to computing power and prediction requirements.
5. The network time covert channel detection method based on a tree structure algorithm according to claim 1 is characterized in that: The method of generating an isolated binary tree based on the second arrival interval time sequence comprises the following steps: S21, using the second arrival interval time sequence as a segmentation list; S22, randomly select a time point t from the segmentation list cut As the separation value, remove the point and the time point with the same value as the point from the second arrival interval time sequence to obtain the third arrival interval time sequence; with the separation value as the root node, divide the third arrival interval time sequence into a left subtree sequence and a right subtree sequence, wherein the values in the left subtree sequence are all less than the separation value, and the values in the right subtree sequence are all greater than the separation value; S23, using the left subtree sequence and the right subtree sequence as the partition list respectively, and repeating S22 to S23 respectively until each subtree sequence has only one data, thereby generating an isolated binary tree.
6. The network time covert channel detection method based on a tree structure algorithm according to claim 1 is characterized in that: The generation of the discrimination threshold range based on the number of nodes of the isolated binary tree is specifically as follows: the number of nodes of the isolated binary tree generated by all batches of data in the legal arrival interval time series is counted to obtain a node number range as the discrimination threshold range.
7. A network time covert channel detection system based on a tree structure algorithm, characterized in that: include: The threshold generation module collects the legal arrival interval time series from the network traffic of legal communication, divides the legal arrival interval time series into several batches, generates an isolated binary tree with each batch of data as the first arrival interval time series, and generates a discrimination threshold range based on the number of nodes in the isolated binary tree; The traffic detection module collects the arrival interval time sequence from the traffic to be detected and generates an isolated binary tree as the first arrival interval time sequence. If the number of nodes of the isolated binary tree falls outside the discrimination threshold range, the traffic to be detected is determined to be the traffic of the covert channel. The generation process of the isolated binary tree is as follows: the first arrival interval time series is subjected to outlier elimination by using the isolation forest algorithm, and then the sequence with outlier eliminated is sorted from small to large according to the value, so as to obtain the second arrival interval time series T = {t1, t2, ..., t n Generate an isolated binary tree based on the second arrival interval time series.