Closed internal network-oriented interpretable abnormal traffic detection method

Abstract

The invention discloses an interpretable abnormal traffic detection method for a closed internal network, and belongs to the technical field of network space security. The method comprises the following steps: firstly, learning a deep mode of benign traffic by adopting a deep auto-encoder, and reconstructing the benign traffic; under the guidance of the middle output of the depth auto-encoder, the white list rule is extracted from the reconstructed benign flow features by adopting a gradient ascending method, and the obtained white list rule base can not only keep the good anomaly detection performance of the depth auto-encoder, but also provide clear decision explanation for a user, and the user experience is improved. And the balance between the detection precision and the interpretability is achieved. Meanwhile, the method obviously reduces software and hardware overhead, and is more suitable for a closed internal network.

Description

Technical Field

[0001] The present invention belongs to the field of cyberspace security technology, and relates to deep learning, anomaly detection and rule extraction, and specifically to an explainable abnormal traffic detection method for a closed internal network. Background Art

[0002] Closed internal networks with special purposes have a strong closed topology structure and regular node communication behaviors, making them vulnerable to complex and changeable network threats. According to the kill-chain theory, attacks on closed internal networks include multiple steps such as "reconnaissance", "infiltration", and "payload delivery". Such a complex attack process often leads to abnormal fluctuations in internal network traffic. Therefore, abnormal traffic detection is a necessary pre-measure to discover network threats.

[0003] In practice, due to the ever-changing possible attack methods, the defender has a natural lag in the network attack and defense game. The currently commonly used blacklist rule base and supervised learning model can only detect known types of abnormal traffic, and cannot effectively identify unknown new types of abnormal traffic. Therefore, unsupervised abnormal traffic detection technology based on benign traffic analysis has received more and more attention.

[0004] Compared with abnormal traffic, the characteristics of benign traffic are relatively stable and change less. Moreover, due to the different purposes of implementing network behaviors, no matter how new the abnormal traffic is, its characteristic distribution is still different from that of benign traffic. Unsupervised learning models can fit the deep distribution pattern of benign traffic, and inputs that do not conform to this pattern are judged as abnormal. This method has been proven to be effective in identifying unknown new abnormal traffic. Typical related work includes: density-based methods LOF 【1】 , ECOD based on empirical cumulative distribution method 【2】 , ABOD method based on eigenvector angle 【3】 ; Partition-based method IForest 【4】 , OCSVM method based on single classification hyperplane 【5】 ;Auto Encoder based on reconstruction error 【6】 .

[0005] However, existing unsupervised anomaly detection technologies have some shortcomings. Methods based on density, empirical cumulative distribution, and eigenvector angle all make prior assumptions about the distribution of benign samples, such as normal samples are always densely distributed, normal samples are always common rather than rare in value, and the angle between the eigenvectors of normal samples is small. The introduction of prior assumptions makes these methods easy to understand and explain. However, the distribution of normal traffic samples is complex, and abnormal traffic detection methods based on specific prior assumptions are not always effective. Unless a sufficiently universal prior assumption can be found, which is almost impossible. Methods based on partitioning and single-classification hyperplanes have the disadvantages of large computational complexity, difficulty in convergence, and easy overfitting. The method based on reconstruction error is more robust in principle, but its internal decision-making process is almost completely incomprehensible.

[0006] The most serious shortcoming of existing technologies is the lack of interpretability. The decision-making process of a typical unsupervised learning model is difficult or even incomprehensible to humans. It is closer to a black box model. The rationality of the decision results cannot be fully evaluated, and security operators cannot evaluate and correct the model decision results based on prior knowledge in benign traffic. For internal networks with strong closure and strong constraints on communication behavior, the interpretability requirements of abnormal traffic detection models are relatively strong. The anomaly detection results based on black box models are difficult to trust. Clear and interpretable whitelist rules are obviously the most ideal abnormal traffic detection solution. However, the traditional whitelist rule base is based on expert knowledge, and it requires a lot of manpower and time to approach the detection performance of complex unsupervised learning models.

[0007] The deployment of some typical unsupervised learning abnormal traffic detection methods requires specialized software and hardware support, such as graphics computing cards, CUDA parallel computing libraries, etc. However, the BM requirements of closed internal networks are high, and the introduction of graphics computing cards and open source CUDA libraries from overseas manufacturers is not conducive to the security management and control of the network asset supply chain of the intranet.

[0008] Existing abnormal traffic detection models based on unsupervised learning often contain some hyperparameters that need to be tuned based on abnormal samples. However, attacks on closed internal networks often come from adversary national-level network attack and defense organizations, and the abnormal traffic samples they generate are highly concealed and difficult to collect, which brings great difficulties to hyperparameter tuning.

[0009] References

[0010] [1]Markus M.Breunig,Hans-Peter Kriegel,Raymond T.Ng,and Sander.2000.LOF:identifying density-based local outliers.SIGMOD Rec.29,2(June2000),93–104.

[0011] [2]Z.Li,Y.Zhao,X.Hu,N.Botta,C.Ionescu and G.H.Chen,"ECOD:UnsupervisedOutlier Detection Using Empirical Cumulative Distribution Functions,"in IEEETransactions on Knowledge and Data Engineering,vol.35,no.12,pp.12181-12193,1Dec.2023,doi:10.1109 / TKDE.2022.3159580.

[0012] [3]Hans-Peter Kriegel,Matthias Schubert,and Arthur Zimek.2008.Angle-based outlier detection in high-dimensional data.In Proceedings of the 14thACM SIGKDD international conference on Knowledge discovery and data mining(KDD'08).Association for Computing Machinery,New York,NY,USA,444–452.

[0013] [4]F.T.Liu,K.M.Ting and Z.-H.Zhou,"Isolation Forest,"2008Eighth IEEEInternational Conference on Data Mining,Pisa,Italy,2008,pp.413-422,doi:10.1109 / ICDM.2008.17.

[0014] [5] A.Bounsiar and MGMadden, "One-Class Support Vector Machines Revisited," 2014 International Conference on Information Science & Applications (ICISA), Seoul, Korea (South), 2014, pp.1-4, doi:10.1109 / ICISA.2014.6847442.

[0015] [6] J.Zhai, S.Zhang, J.Chen and Q.He, "Autoencoder and Its VariousVariants," 2018 IEEE International Conference on Systems, Man, and Cybernetics (SMC), Miyazaki, Japan, 2018, pp.415-419, doi:10.1109 / SMC.2018.00080. Summary of the invention

[0016] In view of the problems that the prior art has poor interpretability and limited hyperparameter tuning for abnormal traffic detection in closed internal networks, the present invention proposes an interpretable abnormal traffic detection method for closed internal networks, utilizes the method of extracting whitelist rules from the intermediate output of unsupervised deep learning, uses deep learning technology to ensure detection accuracy, provides a clear decision-making process in the form of an IF-THEN rule base, and takes into account both anomaly detection accuracy and the interpretability of detection results.

[0017] The explainable abnormal traffic detection method for a closed internal network includes the following steps:

[0018] Step 1: Train a deep autoencoder with several benign traffic samples to learn deep patterns in benign traffic.

[0019] The deep autoencoder consists of two parts: encoder and decoder. The training process is:

[0020] Step 101, mapping the original benign traffic sample input vector into a low-dimensional vector through an encoder, and outputting it to a decoder;

[0021] Step 102, the decoder reconstructs the low-dimensional vector into the original input vector, and calculates the reconstruction loss between the reconstructed vector and the original vector;

[0022] The original training data set is denoted as Initialize the autoencoder model M, record the model related parameters (number of hidden layer neurons, learning rate, optimizer, etc.) as θ, use the mean square error as the loss function and record it as Π(), the formula is as follows:

[0023]

[0024] Step 103, determine whether the reconstruction loss has reached convergence. If so, the iteration stops and the deep autoencoder training is completed; otherwise, the decoder and encoder parameters are updated based on the reconstruction loss guidance, and return to step 101 to re-perform encoding mapping and decoding reconstruction and continue iteration.

[0025] Step 2: Benign traffic samples After the trained deep autoencoder is reconstructed and expanded, the expanded feature space is clustered and divided into clusters, each cluster represents a sub-distribution;

[0026] Specifically:

[0027] First, benign traffic samples After the trained deep autoencoder, the reconstruction loss is Π 1 i , using reconstruction loss to transform the original feature vector Expand to The formula is:

[0028]

[0029] Then, after the features of benign traffic are expanded from m dimension to m+1 dimension, the new feature space is recorded as

[0030] Finally, the new feature space is divided into clusters through the clustering algorithm model Cluster_Model, and the cluster set is obtained as follows: Each cluster Represents a sub-distribution of benign traffic.

[0031] The formula for dividing clusters is:

[0032]

[0033] Step 3: Based on the principle of gradient ascent of reconstruction loss, boundary rules are extracted for each sub-distribution;

[0034] The specific process of boundary rule extraction is as follows:

[0035] Step 301, traverse all sub-distributions, generate a minimum hypercube for each cluster, denoted as Mini-Hyper-Cube, and record the maximum reconstruction loss of benign samples in each cluster as thres.

[0036] Step 302 , select a number of sample instances as Explorers in the shallow neighborhood inside each hyperplane of each Mini-Hyper-Cube.

[0037] Step 303, calculate the direction of the gradient increase of the reconstruction loss in each cluster, and move the Explorer along this direction until its reconstruction loss is greater than thres, and record the feature corresponding to the gradient direction at this time The value of and It is a boundary threshold of this feature.

[0038] Step 304, repeat the above process on each hyperplane to obtain the boundary threshold of each feature, and combine them into the boundary rule of the current cluster, which is expressed as:

[0039]

[0040] Among them, 1, 2,…, k are the hyperplane numbers.

[0041] Step 4: Merge the boundary rules of each sub-distribution to form a complete whitelist rule base that describes the global distribution of benign traffic.

[0042] The merging process is: read the boundary rules of a sub-distribution, add them to the overall rule base, and perform redundancy removal operations on the overall rule base until the boundary rules of all sub-distributions are traversed.

[0043] The specific operation of removing redundancy is: if in the overall rule base, there is a boundary rule of a sub-distribution a that is completely contained in the boundary rule of another sub-distribution b, then the boundary rule of sub-distribution b is removed and the boundary rule of sub-distribution a is retained.

[0044] Step 5: Use the whitelist rule library to detect unknown traffic data in a closed internal network and obtain abnormal traffic conditions.

[0045] The advantages of the present invention are:

[0046] (1) The present invention uses a benign traffic sub-distribution delineation method that incorporates the fusion of reconstruction error and original feature distribution to make the analysis of benign traffic more accurate and in-depth. Compared with the sub-distribution delineation method that only clusters feature distribution, this method in the present invention is more scientific and accurate, and the coupling between the delineated sub-distributions is lower, which can more accurately reflect the deep distribution pattern of benign traffic.

[0047] (2) The boundary rule extraction method based on the gradient ascent method in the present invention significantly enhances the interpretability of abnormal traffic detection while taking into account the detection accuracy. This method draws on the idea of ​​adversarial sample generation, and continuously explores the distribution boundary points along the direction of the gradient ascent of the reconstruction loss in each sub-distribution, so as to extract the boundary rules of each sub-distribution. The extracted rules are guided by the intermediate output (reconstruction error) of the autoencoder, which can not only retain the strong anomaly detection ability of the autoencoder, but also facilitate user understanding. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a flowchart of the overall steps of the explainable abnormal traffic detection method for a closed internal network of the present invention;

[0049] Figure 2 A flowchart of training a deep autoencoder in the interpretable abnormal traffic detection method for a closed internal network of the present invention;

[0050] Figure 3 A flow chart of demarcating sub-distributions by fusing reconstruction errors and original features in the explainable abnormal traffic detection method for closed internal networks of the present invention;

[0051] Figure 4 It is a flow chart of extracting sub-distribution boundary rules based on the gradient ascent method in the explainable abnormal traffic detection method for closed internal networks of the present invention;

[0052] Figure 5 It is a flow chart of merging boundary rules of each sub-distribution in the explainable abnormal traffic detection method for a closed internal network of the present invention;

[0053] Figure 6 This is a comparison chart of true positive rates in real intranet traffic using different anomaly detection methods in an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0055] The purpose of the present invention is to provide an explainable abnormal traffic detection method for a closed internal network. The overall process is as follows: Figure 1As shown. A deep autoencoder is used to learn the deep pattern of benign traffic and reconstruct benign traffic with a smaller error. Under the guidance of the intermediate output of the deep autoencoder, the gradient ascent method is used to extract whitelist rules from the benign traffic features, so that the originally unexplainable decision-making process of the black box model is converted into easy-to-understand IF-THEN rules. The whitelist rule base obtained based on the above method can not only retain the good anomaly detection performance of the deep autoencoder, but also provide users with clear decision explanations, achieving a balance between detection accuracy and explainability, and has the advantages of accurate detection, transparent decision-making, and convenient deployment. In addition, users can choose technical solutions to realize the storage and matching of the rule base, which is easy to maintain the security of the software supply chain, significantly reduces the software and hardware overhead, and is more suitable for closed internal networks.

[0056] A method for detecting explainable abnormal traffic in a closed internal network is provided, which includes the following steps:

[0057] Step 1: Train a deep autoencoder with benign traffic samples to learn deep patterns in benign traffic.

[0058] The deep autoencoder consists of two parts: encoder and decoder. Figure 2 As shown, the training process is:

[0059] Step 101, the original benign traffic sample is mapped into a low-dimensional vector by an encoder and output to a decoder;

[0060] Step 102: The decoder reconstructs the low-dimensional vector into the original input vector, and calculates the reconstruction loss between the reconstructed vector and the original vector.

[0061] The original training data set is denoted as Initialize the autoencoder model M, record the model related parameters (number of hidden layer neurons, learning rate, optimizer, etc.) as θ, use the mean square error as the loss function and record it as Π(), the formula is as follows:

[0062]

[0063] Step 103, determine whether the reconstruction loss has reached convergence. If so, the iteration stops and the deep autoencoder training is completed; otherwise, based on the reconstruction loss guidance, the decoder and encoder parameters are updated, and the process returns to step 101 to re-perform encoding mapping and decoding reconstruction, with the goal of minimizing the reconstruction loss, and continues to iterate until the loss value converges to a stable state.

[0064] The deep autoencoder model that has been fully trained with benign traffic can fit the deep pattern of benign traffic and reconstruct the input with a smaller error. If the input is a benign traffic sample, the reconstruction error output by the autoencoder in step 1 will be relatively small; if the input is an abnormal traffic sample, the reconstruction error output by the autoencoder in step 1 will be relatively large. In other words, the reconstruction error calculated by the autoencoder in step 1 for the input sample represents the abnormal index of the input sample.

[0065] Step 2: Based on the reconstruction error provided by the autoencoder, the original feature distribution is collected and the sub-distribution is delineated from the overall benign traffic, such as Figure 3 shown.

[0066] Benign traffic as a whole obeys a complex global distribution. It is undoubtedly difficult to directly extract rules from the global distribution. Dividing it into smaller analysis objects is obviously more conducive to rule extraction. The global distribution can be regarded as a collection of multiple uncoupled sub-distributions. The scope of each sub-distribution is smaller and it is easier to extract rules. The rules of multiple sub-distributions can be combined to form a whitelist rule base that can describe the global distribution of benign traffic. Therefore, accurately delineating sub-distributions is a necessary step of the present invention, which can reduce the difficulty of rule extraction and refine the granularity of the rule base.

[0067] In order to delineate sub-distributions from the overall benign traffic, the present invention adopts a clustering method that combines reconstruction errors and original features. Benign traffic samples from the same sub-distribution have similar reconstruction errors and similar feature distributions, and the deep autoencoder trained in step 1 will calculate similar reconstruction errors for benign traffic samples from the same sub-distribution. The reconstruction loss is Use reconstruction loss to transform the original feature vector Expand to As shown in formula (2)

[0068]

[0069] After using the reconstruction error to expand the features of benign traffic from m dimensions to m+1 dimensions, the new feature space is recorded as In the expanded feature space, the clustering algorithm model Cluster_Model is used to divide the clusters according to formulas (3) and (4). Each cluster Represents a sub-distribution of benign traffic.

[0070]

[0071] In this method, reconstruction error is introduced to expand the original features from K dimensions to K+1 dimensions, and sub-distributions are defined based on clustering of the expanded feature space. Benign traffic samples from the same sub-distribution have similar reconstruction errors, so reconstruction error is also an important basis for defining sub-distributions.

[0072] Step 3: Extract the boundary rules of sub-distribution based on the gradient ascent method, such as Figure 4 shown.

[0073] Through the operation in step 2, the whole benign traffic is divided into multiple different sub-distributions. In the current step, boundary rules are extracted for each sub-distribution. During the actual detection, the rule matching method is used to determine whether the sample to be tested belongs to a specific sub-distribution. If the sample to be tested does not belong to any sub-distribution of benign traffic, it is judged as an abnormal traffic sample. The extraction of sub-distribution boundary rules is the basis for the subsequent organization of the overall rule base. The specific operations are as follows:

[0074] First, generate a minimum hypercube for each cluster, denoted as Mini-Hyper-Cube, and denote the maximum reconstruction loss of benign samples in each cluster as thres. Take a certain number of sample instances as Explorers in the shallow neighborhood inside each hyperplane of Mini-Hyper-Cube. Move Explorers along the direction of the rising reconstruction loss gradient until its reconstruction loss is greater than thres, and record the features corresponding to the gradient direction at this time. The value of and Repeat the above process on each hyperplane to obtain the boundary threshold of each feature and combine them into the boundary rule of the current cluster, as shown in (5).

[0075]

[0076] Step 4: Rules merge, such as Figure 5 shown.

[0077] The boundary rules of each sub-distribution extracted in step 3 are merged to form a complete whitelist rule base that describes the global distribution of benign traffic.

[0078] The results show that:

[0079] Based on the whitelist rule base established by the present invention, anomaly detection is performed on the real intranet traffic. At the same time, anomaly detection is performed on the real intranet traffic using density-based method, partition-based method and empirical cumulative distribution-based method. The results are as follows: Figure 6 shown. Figure 6 In , the horizontal axis represents the observed abnormal traffic detection method, and the vertical axis represents the true positive rate of the observed method in detecting anomalies in real intranet traffic.

[0080] from Figure 6 It can be seen that the method proposed in the present invention achieves a higher true positive rate than the existing typical methods, reaching more than 90%. This shows that the method proposed in the present invention not only provides good interpretability in the form of IF-THEN structure, but also retains the accurate anomaly detection capability of the deep autoencoder, achieving a balance between detection accuracy and interpretability.

Claims

1. A method for detecting explainable abnormal traffic in a closed internal network, characterized in that: The following steps are involved: Step 1: Train the deep autoencoder with several benign traffic samples to learn the deep patterns in benign traffic. The deep autoencoder consists of two parts: encoder and decoder. The training process is: Step 101, mapping the original benign traffic sample input vector into a low-dimensional vector through an encoder, and outputting it to a decoder; Step 102, the decoder reconstructs the low-dimensional vector into the original input vector, and calculates the reconstruction loss between the reconstructed vector and the original vector; The original training data set is denoted as Initialize the autoencoder model M, record the model related parameters as θ, use the mean square error as the loss function and record it as Π(), the formula is as follows: Step 103, determining whether the reconstruction loss has reached convergence, if so, the iteration stops and the deep autoencoder training is completed; Otherwise, the decoder and encoder parameters are updated based on the reconstruction loss guidance, and the process returns to step 101 to re-perform encoding mapping and decoding reconstruction, and the iteration continues; Step 2: Benign traffic samples After the trained deep autoencoder is reconstructed and expanded, the expanded feature space is clustered and divided into clusters, each cluster represents a sub-distribution; Step 3: Based on the principle of gradient ascent of reconstruction loss, boundary rules are extracted for each sub-distribution; The specific process of boundary rule extraction is as follows: Step 301, traverse all sub-distributions, generate a minimum hypercube for each cluster, denoted as Mini-Hyper-Cube, and record the maximum reconstruction loss of benign samples in each cluster as thres; Step 302, taking a number of sample instances as Explorers in the shallow neighborhood inside each hyperplane of each Mini-Hyper-Cube; Step 303, calculate the direction of the gradient increase of the reconstruction loss in each cluster, and move the Explorer along this direction until its reconstruction loss is greater than thres, and record the feature corresponding to the gradient direction at this time The value of and That is a boundary threshold of the feature; Step 304, repeat the above process on each hyperplane to obtain the boundary threshold of each feature, and combine them into the boundary rule of the current cluster, which is expressed as: Among them, 1, 2, ..., k are the hyperplane numbers; Step 4: Merge the boundary rules of each sub-distribution to form a complete whitelist rule base that describes the global distribution of benign traffic; Step 5: Use the whitelist rule library to detect unknown traffic data in a closed internal network and obtain abnormal traffic conditions.

2. According to claim 1, a method for detecting explainable abnormal traffic in a closed internal network is characterized in that: After reconstruction and expansion, the benign traffic samples are divided into clusters as follows: First, benign traffic samples After the trained deep autoencoder, the reconstruction loss is Use reconstruction loss to transform the original feature vector Expand to The formula is: Then, after the features of benign traffic are expanded from m dimension to m+1 dimension, the new feature space is recorded as Finally, the new feature space is divided into clusters through the clustering algorithm model Cluster_Model, and the cluster set is obtained as follows: Each cluster Represents a sub-distribution of benign traffic; The formula for dividing clusters is:

3. The method for detecting explainable abnormal traffic in a closed internal network according to claim 1, characterized in that: The merging process of each sub-distribution boundary rule is: Read the boundary rules of a sub-distribution, add them to the overall rule base, and perform redundancy removal operations on the overall rule base until the boundary rules of all sub-distributions are traversed.

4. The method for detecting explainable abnormal traffic in a closed internal network according to claim 3, characterized in that: The specific operation of removing redundancy is: if in the overall rule base, there is a boundary rule of a sub-distribution a that is completely contained in the boundary rule of another sub-distribution b, then the boundary rule of sub-distribution b is removed and the boundary rule of sub-distribution a is retained.

5. The method for detecting explainable abnormal traffic in a closed internal network according to claim 1, characterized in that: The whitelist rule library established by the present invention performs anomaly detection on real intranet traffic, and the true positive rate reaches more than 90%.

Images