Malicious traffic judgment method, system and equipment and storage medium

Abstract

The invention discloses a malicious traffic judgment method, system and device and a storage medium, and is applied to the technical field of network security, and the method comprises the steps: obtaining a to-be-detected traffic, decoding the to-be-detected traffic, and dividing each data packet obtained after decoding according to different sessions to which the data packets belong; whenever all the data packets belonging to the same session are obtained, based on all the data packets of the session, through feature extraction, obtaining a first feature extraction result used for reflecting the features of the session at the data packet level and a second feature extraction result used for reflecting the features of the session at the session level; respectively inputting the first feature extraction result and the second feature extraction result into a first detection model and a second detection model to obtain a first detection result and a second detection result which are used for reflecting the malicious degree of the session; and obtaining a malicious traffic judgment result of the session based on the first detection result and the second detection result. By applying the scheme of the invention, malicious traffic judgment can be effectively realized, the feasibility is guaranteed, and the detection accuracy is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a malicious traffic determination method, system, device and storage medium. Background Art

[0002] With the widespread application of encryption technology and the increasing requirements for data privacy and security, network structures are becoming increasingly complex, encrypted traffic is growing explosively, and the era of full encryption is quietly approaching. While encryption technology protects user privacy, it also profoundly changes the network security threat landscape, allowing malicious services to take advantage. Traditional traffic detection technologies, such as payload-based deep packet inspection and port-based identification and detection technologies, are often powerless in the face of encrypted malicious traffic.

[0003] One current solution is to decrypt the encrypted traffic for detection, which has high accuracy, but is not easy to be widely used and has poor feasibility. Because such a solution requires security detection equipment to act as a proxy for both parties in communication or the customer to provide a separate decryption certificate, it has a certain impact on network performance, and in many cases, the customer cannot provide a decryption certificate, so decryption cannot be achieved. Another way is to perform security detection without decryption, usually by extracting the context information of TLS (transport Layer Security) or SSL (Secure Sockets Layer) and performing a single-mode detection. Although decryption is not required, the detection accuracy in actual applications is not high, and it is easy to have false detection or missed detection.

[0004] In summary, how to effectively implement malicious traffic determination and ensure feasibility and accuracy of detection is a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0005] The purpose of the present invention is to provide a malicious traffic determination method, system, device and storage medium to effectively implement malicious traffic determination and ensure feasibility and accuracy of detection.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a method for determining malicious traffic, comprising:

[0008] Obtain and decode the traffic to be detected, and divide the decoded data packets into different sessions;

[0009] Whenever all data packets belonging to the same session are obtained, feature extraction is performed based on all data packets of the session according to a first extraction rule to obtain a first feature extraction result reflecting the features of the session at a data packet level, and feature extraction is performed according to a second extraction rule to obtain a second feature extraction result reflecting the features of the session at a session level;

[0010] Inputting the first feature extraction result into a first detection model to obtain a first detection result used to reflect the maliciousness level of the session, and inputting the second feature extraction result into a second detection model to obtain a second detection result used to reflect the maliciousness level of the session;

[0011] A malicious traffic determination result of the session is obtained based on the first detection result and the second detection result.

[0012] On the other hand, the traffic to be detected is obtained and decoded, and each data packet obtained after decoding is divided according to the different sessions to which it belongs, including:

[0013] Obtain and decode the traffic to be detected by mirroring the traffic;

[0014] For each data packet obtained after decoding, determining the source Internet Protocol address, destination Internet Protocol address, source port number, destination port number and protocol type used by the data packet as the data packet division information;

[0015] Based on the division information of each of the data packets, and according to the division rule that data packets with the same division information belong to the same session, the data packets obtained after decoding are divided according to the sessions to which they belong.

[0016] On the other hand, based on all the data packets of the session, feature extraction is performed according to the first extraction rule to obtain a first feature extraction result reflecting the features of the session at the data packet level, including:

[0017] Based on all the data packets of the session, a packet length sequence for reflecting the length of each data packet and a time interval sequence for reflecting the time interval at which each data packet arrives are obtained;

[0018] The packet length sequence and the time interval sequence are taken as the first feature extraction result.

[0019] On the other hand, it also includes:

[0020] Based on all the data packets of the session, obtain the minimum data packet length, the maximum data packet length, the average data packet length, and the length standard deviation of all the data packets, and add one or more of them to the first feature extraction result;

[0021] Based on all the data packets of the session, the minimum time interval, maximum time interval, average time interval, and time interval standard deviation of the time intervals of arrival of all the data packets are obtained, and one or more of them are added to the first feature extraction result.

[0022] On the other hand, it also includes:

[0023] Dividing all the data packets of the session according to the sending and receiving directions, determining the number of data packets of each type of data packet length in the data packets in the sending direction, obtaining a sending data packet length probability distribution vector reflecting the length distribution of each data packet in the sending direction, and adding the vector to the first feature extraction result;

[0024] Determine the number of packets of each packet length in each packet in the receiving direction, obtain a received packet reception probability distribution vector reflecting the length distribution of each packet in the receiving direction, and add it to the first feature extraction result;

[0025] On the other hand, based on all the data packets of the session, feature extraction is performed according to the second extraction rule to obtain a second feature extraction result reflecting the features of the session at the session level, including:

[0026] Based on all data packets of the session, basic session statistics, handshake features and certificate features are obtained as the second feature extraction result.

[0027] On the other hand, the basic statistics of the session include: one or more of the total number of data packets in the session, the duration of the session, the total number of bytes flowing into the session, and the total number of bytes flowing out of the session;

[0028] The handshake features include: one or more of: protocol version, cipher suite, supported extensions, connection status, and public key length;

[0029] The certificate characteristics include: whether the certificate is self-signed, whether the certificate is expired, the certificate version number, the certificate validity period, the certificate chain length, and one or more of the normality of the certificate user.

[0030] On the other hand, it also includes:

[0031] Based on all the data packets of the session, the statistical features of the session window sequence are obtained and added to the second feature extraction result.

[0032] On the other hand, the session window sequence statistical features include: a receiving time interval subsequence for reflecting the time intervals between arrivals of each received data packet, a sending time interval subsequence for reflecting the time intervals between arrivals of each sent data packet, a minimum time interval in received data packets, a maximum time interval in received data packets, an average time interval in received data packets, a standard deviation of time intervals in received data packets, a minimum time interval in sent data packets, a maximum time interval in sent data packets, an average time interval in sent data packets, and a standard deviation of time intervals in sent data packets.

[0033] On the other hand, it also includes:

[0034] Determine the sessions with the same address group as the same session set; wherein the address group represents an address group consisting of a source Internet Protocol address and a destination source Internet Protocol address corresponding to the session;

[0035] Based on all sessions in the same session set, feature extraction is performed according to a third extraction rule to obtain a third feature extraction result reflecting the features of the session at the Internet protocol layer;

[0036] Inputting the third feature extraction result into a third detection model to obtain a third detection result reflecting the maliciousness level of the session set, and using the third detection result as the third detection result of each session in the session set;

[0037] Correspondingly, based on the first detection result and the second detection result, a malicious traffic determination result of the session is obtained, including:

[0038] A malicious traffic determination result of the session is obtained based on the first detection result, the second detection result and the third detection result.

[0039] On the other hand, based on all sessions in the same session set, feature extraction is performed according to the third extraction rule to obtain a third feature extraction result reflecting the features of the session at the Internet protocol layer, including:

[0040] Based on all sessions in the same session set, one or more of the total number of data packets in the session set, the average time interval for the arrival of all data packets, the average length of all data packets, the average number of data packets per session, the number of self-signed flows, the number of expired flows, and the number of flows with too long a validity period are obtained as the third feature extraction result.

[0041] On the other hand, the first detection model includes N detection units that are different from each other, and the second detection model includes M detection units that are different from each other, and N and M are both positive integers;

[0042] Inputting the first feature extraction result into a first detection model to obtain a first detection result used to reflect the maliciousness of the session, and inputting the second feature extraction result into a second detection model to obtain a second detection result used to reflect the maliciousness of the session, including:

[0043] Inputting the first feature extraction results into N detection units in a first detection model respectively, to obtain detection results output by each of the N detection units and used to reflect the maliciousness level of the session;

[0044] Based on the weight coefficients of the N detection units in the first detection model, the detection results output by the N detection units are weighted and superimposed, and then the average value is calculated, and the obtained result is used as the first detection result;

[0045] Inputting the second feature extraction results into M detection units in a second detection model respectively, to obtain detection results output by each of the M detection units and used to reflect the maliciousness level of the session;

[0046] Based on the weight coefficients of the M detection units in the second detection model, the detection results output by the M detection units are weighted and superimposed, and then the average value is calculated, and the obtained result is used as the second detection result;

[0047] Based on the weight coefficients of the first detection result and the second detection result, the first detection result and the second detection result are weighted and superimposed, and the obtained result is used as the risk value to be determined;

[0048] It is determined whether the risk value to be determined is higher than a preset risk threshold; if so, it is determined that the session belongs to malicious traffic; otherwise, it is determined that the session does not belong to malicious traffic.

[0049] In a second aspect, the present invention provides a malicious traffic determination system, comprising:

[0050] The acquisition and decoding module is used to obtain and decode the traffic to be detected, and divide the data packets obtained after decoding according to the different sessions they belong to;

[0051] a feature extraction module configured to, after obtaining all data packets belonging to the same session, perform feature extraction according to a first extraction rule based on all data packets of the session to obtain a first feature extraction result reflecting the features of the session at a data packet level, and perform feature extraction according to a second extraction rule to obtain a second feature extraction result reflecting the features of the session at a session level;

[0052] a classification detection module, configured to input the first feature extraction result into a first detection model to obtain a first detection result used to reflect the maliciousness of the session, and input the second feature extraction result into a second detection model to obtain a second detection result used to reflect the maliciousness of the session;

[0053] The result determination module is used to obtain a malicious traffic determination result of the session based on the first detection result and the second detection result.

[0054] In a third aspect, the present invention provides a malicious traffic determination device, comprising:

[0055] Memory for storing computer programs;

[0056] The processor is used to execute the computer program to implement the steps of the malicious traffic determination method as described above.

[0057] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the malicious traffic determination method as described above are implemented.

[0058] By applying the technical solution provided by the embodiment of the present invention, there is no need to perform decryption, and the feasibility can be effectively guaranteed. Specifically, after obtaining the traffic to be detected and decoding it, each data packet obtained after decoding will be divided according to the different sessions to which it belongs. Whenever all the data packets belonging to the same session are obtained, considering that the detection accuracy of a single method is not high, it is easy to have false detection or missed detection. Therefore, in the solution of the present application, based on all the data packets of the session, feature extraction is performed according to the first extraction rule to obtain a first feature extraction result for reflecting the characteristics of the session at the data packet level, and feature extraction is performed according to the second extraction rule to obtain a second feature extraction result for reflecting the characteristics of the session at the session level. After obtaining the feature extraction results of these two levels, they are respectively input into the first detection model and the second detection model, and the first detection result for reflecting the malicious degree of the session and the second detection result for reflecting the malicious degree of the session can be obtained. Finally, the first detection result and the second detection result are combined to obtain the malicious traffic determination result of the session. It can be seen that the solution of the present application is based on the characteristics of the session at the data packet level and the characteristics at the session level. The analysis and processing are performed separately. Compared with the detection of a single method, this method can effectively improve the accuracy of the determination result.

[0059] In summary, the present application scheme can effectively implement malicious traffic determination, ensure feasibility, and improve detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0061] Figure 1 A flowchart of a method for determining malicious traffic provided by a specific embodiment of the present invention;

[0062] Figure 2 A schematic diagram of the principle of malicious traffic determination in a specific implementation manner of the present invention;

[0063] Figure 3 A schematic diagram of the structure of a malicious traffic determination system provided by a specific implementation method of the present invention;

[0064] Figure 4 A schematic diagram of the structure of a malicious traffic determination device provided by a specific implementation mode of the present invention;

[0065] Figure 5 The present invention is a schematic diagram of the structure of a computer-readable storage medium. DETAILED DESCRIPTION

[0066] The core of the present invention is to provide a malicious traffic determination method, system, device and storage medium, which can effectively realize malicious traffic determination, ensure feasibility and improve detection accuracy.

[0067] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0068] Please refer to Figure 1 , Figure 1 The following is a flowchart of a malicious traffic determination method provided by a specific embodiment of the present invention. The malicious traffic determination method may include the following steps:

[0069] Step S101: Obtain and decode the traffic to be detected, and divide the data packets obtained after decoding according to the different sessions they belong to.

[0070] After traffic access is performed, traffic collection can be performed to obtain the traffic to be detected and decode it. In order to effectively perform feature extraction at the data packet level later, in the present application scheme, each data packet obtained after decoding needs to be divided according to the different sessions to which it belongs.

[0071] In a specific implementation of the present invention, step S101 may specifically include:

[0072] Obtain and decode the traffic to be detected by mirroring the traffic;

[0073] For each data packet obtained after decoding, determining the source Internet Protocol address, destination Internet Protocol address, source port number, destination port number and protocol type used by the data packet as data packet division information;

[0074] Based on the division information of each data packet and according to the division rule that data packets with the same division information belong to the same session, each data packet obtained after decoding is divided according to the different sessions to which it belongs.

[0075] This implementation method takes into account that the traffic to be detected can be obtained by mirroring the traffic, which is simple and convenient to implement and will not affect the original transmission of the traffic. After obtaining the traffic to be detected and decoding it, the decoded data packets can be obtained. For each data packet, the source IP of the data packet, that is, the source Internet Protocol address, the destination IP, that is, the destination Internet Protocol address, the source port number, the destination port number and the protocol type used by the data packet can be determined from the packet header of the data packet as the data packet division information. It can be seen that the data packet division information in this implementation method includes 5 parameters. In addition, for data packets of different protocol types, different decoders can be used to complete the decoding.

[0076] When dividing the sessions, it is necessary to divide the packets obtained after decoding according to the different sessions they belong to according to the division rule that packets with the same division information belong to the same session. For example, the source IP of packet 1 is represented as IP-A, the destination IP is represented as IP-B, the source port number is represented as 001, the destination port number is represented as 002, and the protocol type is represented as X. Then the division information of packet 1 can be represented as (IP-A, IP-B, 001, 002, X). This means that packet 1 is sent from port 001 of the device with IP A to port 002 of the device with IP B, and the protocol type used is X. For example, the source IP of packet 2 is also IP-A, the destination IP is also IP-B, the source port number is also 001, the destination port number is also 002, and the protocol type is also X. Then the division information of packet 2 can be represented as (IP-A, IP-B, 001, 002, X). Therefore, it can be clearly seen that the division information of packet 1 and packet 2 is the same, so that packet 1 and packet 2 will be classified into the same session.

[0077] For another example, the source IP of data packet 3 is IP-B, the destination IP is IP-A, the source port number is 002, the destination port number is 001, and the protocol type is X. Then the partition information of data packet 3 can be expressed as (IP-B, IP-A, 002, 001, X). This means that data packet 3 is sent from port 002 of the device with IP B to port 001 of the device with IP A, and the protocol type used is X. It can be seen that compared with the source IP and destination IP of data packet 1, data packet 3 also uses the same set of source IP and destination IP, but due to the different data flow directions, the source IP and destination IP are interchanged. Similarly, the source port number and destination port number are also interchanged. However, the partition information of data packet 1 and data packet 3 can still be considered to be consistent. In other words, when comparing the two partition information, it is sufficient to compare whether the two partition information have the same five parameters mentioned above, and the order of the five parameters in the partition information is not limited. For example, in the above example, the partition information of data packet 1 is expressed as (IP-A, IP-B, 001, 002, X), and the partition information of data packet 3 is expressed as (IP-B, IP-A, 002, 001, X). The two are considered to be the same partition information.

[0078] Step S102: Whenever all data packets belonging to the same conversation are obtained, feature extraction is performed based on all the data packets of the conversation according to the first extraction rule to obtain a first feature extraction result reflecting the characteristics of the conversation at the data packet level, and feature extraction is performed according to the second extraction rule to obtain a second feature extraction result reflecting the characteristics of the conversation at the conversation level.

[0079] Whenever all the data packets belonging to the same session are obtained, all the traffic of the session can be saved locally. For example, all the traffic of the session can be saved locally in the form of PCAP (Packet Capture) packets, so that feature extraction can be performed based on the session information of the session later, that is, feature extraction can be performed based on all the data packets of the session.

[0080] When extracting features, the first extraction rule can be used to extract features, and a first feature extraction result can be obtained to reflect the features of the session at the data packet level. Of course, when extracting features according to the first extraction rule, the specific extracted characteristic items can be set and adjusted according to actual needs, so that the extracted features at the data packet level can effectively reflect the difference between malicious traffic and normal traffic. For example, features such as data packet length and time interval can be extracted.

[0081] In a specific implementation of the present invention, based on all data packets of a session, feature extraction is performed according to a first extraction rule to obtain a first feature extraction result for reflecting the features of the session at the data packet level, which may specifically include:

[0082] Based on all the data packets of the session, a packet length sequence for reflecting the length of each data packet and a time interval sequence for reflecting the time interval at which each data packet arrives are obtained;

[0083] The packet length sequence and the time interval sequence are taken as the first feature extraction result.

[0084] This implementation method takes into account that in some cases, there are differences between the data packets of malicious traffic and the data packets of normal traffic in terms of data packet length, changes in data packet length, time intervals, and changes in time intervals. In other words, the first feature extraction result of this implementation method is an important basis for identifying malicious traffic. Therefore, in this implementation method, based on all data packets of the session, a packet length sequence reflecting the length of each data packet will be extracted, that is, a vector will be obtained, and the values ​​of each element in the vector are the lengths of each data packet in turn. At the same time, in this implementation method, a time interval sequence reflecting the time intervals of the arrival of each data packet will also be extracted. The time interval sequence can also be embodied in the form of a vector, and the values ​​of each element in the vector represent the time intervals of the arrival of adjacent data packets in each data packet in turn.

[0085] After the packet length sequence and the time interval sequence of this implementation method are obtained, they can be used as the first feature extraction result. Subsequently, malicious traffic can be effectively identified based on the first feature extraction result.

[0086] Furthermore, in a specific embodiment of the present invention, it may also include:

[0087] Based on all data packets of the session, obtain the minimum data packet length, the maximum data packet length, the average data packet length, and the length standard deviation of all data packets, and add one or more of them to the first feature extraction result;

[0088] Based on all data packets of the session, the minimum time interval, maximum time interval, average time interval, and time interval standard deviation of the time intervals of arrival of all data packets are obtained, and one or more of them are added to the first feature extraction result.

[0089] This implementation takes into account that the packet length sequence and time interval sequence described above are helpful to effectively identify malicious traffic, but on this basis, the first feature extraction result can still be further expanded to further improve the accuracy of subsequent determinations.

[0090] Specifically, the packet length can be recorded in bytes, and for all packets of the same session, the minimum packet length, maximum packet length, average packet length, and length standard deviation are recorded. In addition, it should be noted that when the first feature extraction result contains more content, the difficulty of subsequent analysis will be increased to a certain extent. Therefore, in this implementation, it is supported to add one or more of the minimum packet length, maximum packet length, average packet length, and length standard deviation into the first feature extraction result according to actual needs. For example, after the experiment, it can be determined which feature items are more important, that is, more conducive to obtaining accurate judgment results later, then it can be selected to add important feature items into the first feature extraction result, and unimportant feature items are not added into the first feature extraction result.

[0091] Similarly, for all data packets in the session, after determining the time interval between the arrival of each adjacent data packet, one or more of the minimum time interval, maximum time interval, average time interval, and time interval standard deviation can be selected and added to the first feature extraction result according to actual needs.

[0092] In addition, in some embodiments, the detection model used in subsequent steps is a machine learning detection model that can support multi-dimensional input. Therefore, it is also possible to choose to add all the feature items described in this embodiment into the first feature extraction result.

[0093] Furthermore, in a specific embodiment of the present invention, it may also include:

[0094] Divide all data packets of the session according to the sending and receiving directions, determine the number of data packets under each data packet length in each data packet in the sending direction, obtain a sending data packet length probability distribution vector for reflecting the length distribution of each data packet in the sending direction, and add it to the first feature extraction result;

[0095] The number of packets of each packet length in each packet in the receiving direction is determined, and a received packet reception probability distribution vector reflecting the length distribution of each packet in the receiving direction is obtained, and added to the first feature extraction result.

[0096] In this implementation, the data packets under the same session are also divided according to the receiving and sending directions, the receiving direction is the inbound direction, and the sending direction is the outbound direction. After the division, it is necessary to determine the number of data packets under each data packet length in each data packet in the sending direction, so as to obtain a probability distribution vector, which is called the sending data packet length probability distribution vector. The sending data packet length probability distribution vector can effectively reflect the length distribution of each data packet in the sending direction. In some cases, the sending data packet length probability distribution vector can effectively reflect the difference between malicious traffic and normal traffic.

[0097] Similarly, it is necessary to determine the number of packets under each packet length in each packet in the receiving direction, and then obtain the received packet receiving probability distribution vector used to reflect the length distribution of each packet in the receiving direction. In some cases, the received packet length probability distribution vector can effectively reflect the difference between malicious traffic and normal traffic.

[0098] The probability distribution vector of the length of the sent data packet and the probability distribution vector of the received data packet need to be added to the first feature extraction result to improve the accuracy of the subsequent malicious traffic determination results and reduce the probability of false detection and missed detection.

[0099] Similarly, after all the traffic of the session is saved locally, when extracting features based on the session information of the session, feature extraction can also be performed according to the second extraction rule to obtain a second feature extraction result that reflects the features of the session at the session level. When extracting features according to the second extraction rule, the specific extracted feature items can also be set and adjusted according to actual needs, so that the extracted session-level features can effectively reflect the difference between malicious traffic and normal traffic.

[0100] For example, in a specific implementation of the present invention, based on all data packets of the session, feature extraction is performed according to the second extraction rule to obtain a second feature extraction result for reflecting the features of the session at the session level, which may specifically include:

[0101] Based on all data packets of the session, basic session statistics, handshake features and certificate features are obtained as the second feature extraction result.

[0102] This implementation method takes into account that the basic statistics data of the session, the handshake features and the certificate features more comprehensively and accurately reflect the characteristics of the session level, and are also conducive to the subsequent effective determination of whether the session belongs to malicious traffic. Therefore, the basic statistics data of the session, the handshake features and the certificate features are selected as the second feature extraction results.

[0103] Further, in a specific implementation of the present invention, the basic statistical data of the session includes: one or more of the total number of data packets in the session, the duration of the session, the total number of bytes flowing into the session, and the total number of bytes flowing out of the session;

[0104] The handshake characteristics include: one or more of the following: protocol version, cipher suite, supported extensions, connection status, and public key length;

[0105] Certificate characteristics include: whether the certificate is self-signed, whether the certificate is expired, certificate version number, certificate validity period, certificate chain length, and one or more of the normality of the certificate user.

[0106] This implementation method takes into account that the basic statistics of the session, the handshake features, and the certificate features usually include multiple feature items. Therefore, in order to ensure the flexibility of the implementation of the solution, one or more of them can be selected as needed. Of course, in some implementation methods, when the detection model used in the subsequent steps is a machine learning detection model that can support multi-dimensional input, all the feature items described in this implementation method can also be added to the second feature extraction result.

[0107] The session duration, total number of packets, and total inflow / outflow bytes in the basic statistics of the session effectively reflect the basic situation of the session. The handshake characteristics include the handshake characteristics related to the transport layer security protocol and the secure socket layer, which can effectively reflect the traffic situation of the session during the handshake phase. The certificate characteristics can effectively reflect the relevant situation of the session.

[0108] In addition, it should be noted that since the number and types of feature items in this implementation are large, in order to facilitate subsequent processing, these feature items in the second feature extraction result can usually be numerically standardized and encoded, for example, through One-Hot encoding, to form a feature data set as the required second feature extraction result.

[0109] Furthermore, in a specific embodiment of the present invention, it may also include:

[0110] Based on all data packets of the session, the statistical features of the session window sequence are obtained and added to the second feature extraction result.

[0111] In the above implementation, the basic statistics of the session, the handshake features and the certificate features can more comprehensively and accurately reflect the characteristics of the session level. However, this implementation further considers that the session window sequence statistics feature can be further added to the second feature extraction result. The session window sequence statistics feature can reflect the transmission of the data packets in the session and the situation of the data packets themselves to a certain extent, that is, the session window sequence statistics feature is a reflection of the characteristics of the data packet level to a certain extent.

[0112] After adding the session window sequence statistical features to the second feature extraction results, the subsequent second detection model can analyze and process the session window sequence statistical features and the session-level features described in the aforementioned implementation method to obtain a more reliable second detection result. In other words, in this implementation method, the session window sequence statistical features are obtained and added to the second feature extraction results, which is conducive to further improving the accuracy of the subsequent determination results.

[0113] The specific content of the session window sequence statistical feature can be set and adjusted according to actual needs. For example, in a specific embodiment of the present invention, the session window sequence statistical feature includes: a receiving time interval subsequence for reflecting the time interval of arrival of each received data packet, a sending time interval subsequence for reflecting the time interval of arrival of each sent data packet, the minimum time interval in the received data packet, the maximum time interval in the received data packet, the average time interval in the received data packet, the standard deviation of the time interval in the received data packet, the minimum time interval in the sent data packet, the maximum time interval in the sent data packet, the average time interval in the sent data packet, and the standard deviation of the time interval in the sent data packet.

[0114] In this implementation, statistics are collected according to the situation of receiving data packets and sending data packets, and characteristic items related to sending and receiving are obtained, which effectively reflects the receiving and sending of the session window sequence. And because it includes multiple characteristic items, in order to ensure the flexibility of the implementation of the solution, one or more of them can be selected as needed.

[0115] Step S103: input the first feature extraction result into the first detection model to obtain a first detection result for reflecting the maliciousness of the session, and input the second feature extraction result into the second detection model to obtain a second detection result for reflecting the maliciousness of the session.

[0116] After obtaining the first feature extraction result, the first feature extraction result needs to be input into the first detection model, and the first detection model will analyze the first feature extraction result and output a first detection result reflecting the maliciousness of the session. The larger the value of the first detection result, the higher the probability that the session is malicious traffic.

[0117] Accordingly, after obtaining the second feature extraction result, the second feature extraction result needs to be input into the second detection model, and the second detection model will analyze the second feature extraction result and output a second detection result reflecting the maliciousness of the session. The larger the value of the second detection result, the higher the probability that the session is malicious traffic.

[0118] The specific implementation of the first detection model and the second detection model can be selected according to actual needs. Since more feature items are obtained during feature extraction, a detection model based on machine learning is usually adopted, which can effectively realize the processing of multi-dimensional data and ensure processing efficiency to obtain more accurate results. For example, in a specific implementation, the first detection model and the second detection model can both be random forest models.

[0119] Step S104: Based on the first detection result and the second detection result, a malicious traffic determination result of the session is obtained.

[0120] After obtaining the first detection result and the second detection result, the malicious traffic determination result of the session can be obtained by combining the first detection result and the second detection result, that is, determining that the session is malicious traffic, or determining that the session is not malicious traffic.

[0121] When making a judgment based on the first detection result and the second detection result, there may be multiple specific implementation methods, such as selecting the larger value of the first detection result and the second detection result, and comparing it with the relevant threshold value to obtain the malicious traffic judgment result of the session. For another example, the first detection result and the second detection result may be superimposed, and the obtained value may be compared with the relevant threshold value to obtain the malicious traffic judgment result of the session.

[0122] In a specific embodiment of the present invention, the first detection model includes N different detection units, and the second detection model includes M different detection units, where N and M are both positive integers. Step S103 may specifically include:

[0123] Inputting the first feature extraction results into N detection units in the first detection model respectively, and obtaining detection results output by each of the N detection units to reflect the maliciousness level of the session;

[0124] Based on the weight coefficients of the N detection units in the first detection model, the detection results output by the N detection units are weighted and superimposed, and then the average value is calculated, and the obtained result is used as the first detection result;

[0125] Inputting the second feature extraction results into the M detection units in the second detection model respectively, and obtaining the detection results output by the M detection units respectively for reflecting the maliciousness degree of the session;

[0126] Based on the weight coefficients of the M detection units in the second detection model, the detection results output by the M detection units are weighted and superimposed, and then the average value is calculated, and the obtained result is used as the second detection result;

[0127] Based on the weight coefficients of the first detection result and the second detection result, the first detection result and the second detection result are weighted and superimposed, and the obtained result is used as the risk value to be determined;

[0128] It is determined whether the risk value to be determined is higher than a preset risk threshold. If so, it is determined that the session belongs to malicious traffic; otherwise, it is determined that the session does not belong to malicious traffic.

[0129] This implementation takes into account that in the first detection model, if a single model is used to analyze the first feature extraction result, since there are many types of malicious traffic, even if the model can effectively analyze some types of malicious traffic, it may not be able to deal with all types of malicious traffic well. In this regard, in this implementation, the first detection model includes N different detection units, which can be found in Figure 2 , Figure 2 In the example, N different detection units are set in the first detection model, which are denoted as detection units P1 to P N Detection unit. For example, the P1 detection unit is a detection unit using a random forest model, the P2 detection unit is a detection unit using a neural network, and so on.

[0130] Since the first detection model includes N different detection units, in this implementation, the first feature extraction result needs to be input into the N detection units in the first detection model respectively, that is, the N detection units respectively perform analysis and processing on the first feature extraction result, and each detection unit will obtain a detection result reflecting the maliciousness of the session. For these detection results, one processing method is to directly sum them, or to take the average value after summing them, which can be set according to actual needs, and the implementation is relatively simple and easy to implement. In this implementation, based on the weight coefficients of the N detection units in the first detection model, the detection results output by the N detection units are weighted and superimposed, and then the average value is calculated, and the result obtained is used as the first detection result. Compared with the method of directly taking the average value, this method can easily adjust the degree of influence of different detection units on the first detection result, and it can be understood that for the detection unit whose output detection result is more accurate, a higher weight coefficient should be set for it. For example, in practical applications, considering that the random forest model has a higher accuracy, the weight coefficient of the detection unit using the random forest model can be set higher.

[0131] Based on the same principle, the second detection model may include M different detection units. Figure 2 , Figure 2 In the example, M different detection units are set in the second detection model, which are denoted as Q1 detection unit to Q M Detection unit. For example, the Q1 detection unit is a detection unit using a random forest model.

[0132] Similar to the above, since the second detection model includes M different detection units, in this implementation, the second feature extraction results need to be input into the M detection units in the second detection model respectively, that is, the second feature extraction results are analyzed and processed by the M detection units respectively, and each detection unit will obtain a detection result that reflects the maliciousness of the session. For these detection results, it is also necessary to calculate the average value after weighted superposition of the detection results output by each of the M detection units based on the weight coefficients of each of the M detection units in the second detection model, and the obtained result is used as the second detection result, so as to adjust the degree of influence of each of the different detection units on the second detection result. And it can be understood that for the detection unit whose output detection result is more accurate among the M detection units, a higher weight coefficient should be set for it. In practical applications, among the M detection units, the weight coefficient of the detection unit using the random forest model is usually set higher, with higher accuracy.

[0133] After obtaining the first detection result and the second detection result, the malicious traffic determination result of the session can be obtained by combining the first detection result and the second detection result. In this implementation, the first detection result and the second detection result are weighted and superimposed based on their respective weight coefficients, and the obtained result is used as the risk value to be determined. In other words, in this implementation, it is allowed to adjust the degree of influence of the first detection result and the second detection result on the final risk value to be determined. For example, in some occasions, the staff finds that the difference between the current malicious traffic and normal traffic is mainly reflected in the session level. Therefore, the weight coefficient of the second detection result can be increased, that is, the influence of the second detection result on the final risk value to be determined can be increased to improve the accuracy of the solution.

[0134] After obtaining the risk value to be determined, it can be determined whether the risk value to be determined is higher than the preset risk threshold. If so, it means that the values ​​of the first detection result and / or the second detection result are high, indicating that the maliciousness of the session is relatively high, that is, the probability that the session is malicious traffic is high. Therefore, it can be determined that the session belongs to malicious traffic, otherwise it can be determined that the session does not belong to malicious traffic.

[0135] In a specific embodiment of the present invention, it may also include:

[0136] Determine the sessions with the same address group as the same session set; wherein the address group represents an address group consisting of a source Internet Protocol address and a destination source Internet Protocol address corresponding to the session;

[0137] Based on all sessions in the same session set, feature extraction is performed according to a third extraction rule to obtain a third feature extraction result for reflecting the features of the session at the Internet protocol layer;

[0138] Inputting the third feature extraction result into the third detection model to obtain a third detection result reflecting the maliciousness level of the session set, and using the third detection result as the third detection result of each session in the session set;

[0139] Correspondingly, based on the first detection result and the second detection result, a malicious traffic determination result of the session is obtained, including:

[0140] Based on the first detection result, the second detection result and the third detection result, a malicious traffic determination result of the session is obtained.

[0141] In the above implementation, feature extraction is performed at the packet level and the session level. This implementation further takes into account that for some malicious traffic, it is very similar to normal traffic at the packet level and the session level, but can be effectively distinguished at the IP level. The features at the IP level need to be extracted by integrating multiple sessions. Therefore, in this implementation, sessions with the same address group will be determined as the same session set. The address group here refers to the address group composed of the source Internet Protocol address and the destination source Internet Protocol address corresponding to the session.

[0142] For example, the data packets in a certain session involve the communication between IP-A and IP-B, and the one who initiated the session is IP-A, so the source Internet Protocol address corresponding to the session is IP-A, and the destination source Internet Protocol address corresponding to the session is IP-B. The address group of the session can be expressed as (IP-A and IP-B). For another example, the data packets in a certain session involve the communication between IP-A and IP-B, and the one who initiated the session is IP-B, so the source Internet Protocol address corresponding to the session is IP-B, and the destination source Internet Protocol address corresponding to the session is IP-A. The address group of the session can be expressed as (IP-B and IP-A). The two sessions illustrated here have the same address group and can be placed in the same session set. In other words, (IP-A and IP-B) and (IP-B and IP-A) in this example are considered to be the same address group.

[0143] Based on all sessions in the same session set, it is necessary to perform feature extraction according to the third extraction rule to obtain a third feature extraction result that reflects the characteristics of the session at the Internet Protocol layer, that is, to obtain the characteristics of the sessions in the session set at the IP layer as the third feature extraction result of each session in the session set.

[0144] Therefore, after the third feature extraction result is input into the third detection model, a third detection result reflecting the maliciousness of the session set can be obtained, and the third detection result can be regarded as the third detection result of each session in the session set. Therefore, when this implementation is adopted, when step S104 is subsequently executed, the malicious traffic determination result of the session can be obtained based on the first detection result, the second detection result and the third detection result.

[0145] When obtaining the malicious traffic determination result of the session based on the first detection result, the second detection result and the third detection result, the determination principle can be the same as above. For example, according to the above principle, the larger value among the first detection result, the second detection result and the third detection result can be selected and compared with the relevant threshold to obtain the malicious traffic determination result of the session. For another example, the first detection result, the second detection result and the third detection result can be superimposed or weighted, and the obtained value can be used as the risk value to be determined, and compared with the preset risk threshold to obtain the malicious traffic determination result of the session.

[0146] In addition, it can be understood that the third detection model in this embodiment can also be composed of a plurality of different detection units, similar to the above. Figure 2 In the example, K different detection units are set in the third detection model, which are denoted as S1 detection unit to S k Detection unit. For example, the S1 detection unit can also be a detection unit using a random forest model and a higher weight coefficient is set for it. Since the principle is the same as above, it will not be repeated here.

[0147] When feature extraction is performed according to the third extraction rule based on all sessions in the same session set, specific extracted feature items can be set and adjusted according to actual needs, as long as they can effectively reflect the features of the sessions in the session set at the IP level.

[0148] For example, in a specific implementation of the present invention, based on all sessions in the same session set, feature extraction is performed according to the third extraction rule to obtain a third feature extraction result for reflecting the features of the session at the Internet protocol layer, which may include:

[0149] Based on all sessions in the same session set, one or more of the total number of data packets in the session set, the average time interval for the arrival of all data packets, the average length of all data packets, the average number of data packets per session, the number of self-signed flows, the number of expired flows, and the number of flows with too long a validity period are obtained as the third feature extraction result.

[0150] The feature items in this implementation can accurately and effectively reflect the characteristics of the sessions in the session set at the IP level, and in order to ensure the flexibility of implementation, one or more of them can be used as the third feature extraction result. For example, after experiments, feature items with higher importance are retained and feature items with lower importance are discarded to reduce the complexity of subsequent operations and save computing resources.

[0151] In one embodiment of the present invention, it may also include: after obtaining the malicious traffic determination result of the session, if the session is malicious traffic, the source IP that initiated the session may be recorded and the source IP may be placed in the first global IP reputation table. After obtaining all the data packets belonging to a certain session, if the source IP that initiated the session matches any IP in the first global IP reputation table, the session may be directly regarded as malicious traffic, and there is no need to continue the subsequent analysis, which can effectively save computing resources. In addition, in some occasions, whenever the first global IP reputation table is updated, security devices such as firewalls may be notified to facilitate the work of related security devices.

[0152] Furthermore, after obtaining the malicious traffic determination result of the session, if the session is malicious traffic, the destination IP when the session was initiated can be recorded and the destination IP can be placed in the second global IP reputation table. After obtaining all the data packets belonging to a certain session, if the destination IP when the session was initiated matches any IP in the second global IP reputation table, an event record can be performed. When the number of such events within a certain period of time exceeds a set threshold, a prompt message can be output to the staff, for example, a large amount of malicious traffic for the same destination IP may have occurred in a short period of time, so that in some occasions, the staff can intervene and handle it in time.

[0153] By applying the technical solution provided by the embodiment of the present invention, there is no need to perform decryption, and the feasibility can be effectively guaranteed. Specifically, after obtaining the traffic to be detected and decoding it, each data packet obtained after decoding will be divided according to the different sessions to which it belongs. Whenever all the data packets belonging to the same session are obtained, considering that the detection accuracy of a single method is not high, it is easy to have false detection or missed detection. Therefore, in the solution of the present application, based on all the data packets of the session, feature extraction is performed according to the first extraction rule to obtain a first feature extraction result for reflecting the characteristics of the session at the data packet level, and feature extraction is performed according to the second extraction rule to obtain a second feature extraction result for reflecting the characteristics of the session at the session level. After obtaining the feature extraction results of these two levels, they are respectively input into the first detection model and the second detection model, and the first detection result for reflecting the malicious degree of the session and the second detection result for reflecting the malicious degree of the session can be obtained. Finally, the first detection result and the second detection result are combined to obtain the malicious traffic determination result of the session. It can be seen that the solution of the present application is based on the characteristics of the session at the data packet level and the characteristics at the session level. The analysis and processing are performed separately. Compared with the detection of a single method, this method can effectively improve the accuracy of the determination result.

[0154] In summary, the present application scheme can effectively implement malicious traffic determination, ensure feasibility, and improve detection accuracy.

[0155] Corresponding to the above method embodiment, the embodiment of the present invention further provides a malicious traffic determination system, which can be referred to in correspondence with the above.

[0156] See also Figure 3 FIG. 1 is a schematic diagram of a malicious traffic determination system in the present invention, comprising:

[0157] The acquisition and decoding module 301 is used to acquire and decode the traffic to be detected, and divide the data packets obtained after decoding into different sessions;

[0158] The feature extraction module 302 is used for, after obtaining all the data packets belonging to the same session, performing feature extraction according to a first extraction rule based on all the data packets of the session to obtain a first feature extraction result reflecting the features of the session at the data packet level, and performing feature extraction according to a second extraction rule to obtain a second feature extraction result reflecting the features of the session at the session level;

[0159] The classification detection module 303 is used to input the first feature extraction result into the first detection model to obtain a first detection result used to reflect the maliciousness of the session, and input the second feature extraction result into the second detection model to obtain a second detection result used to reflect the maliciousness of the session;

[0160] The result determination module 304 is used to obtain a malicious traffic determination result of the session based on the first detection result and the second detection result.

[0161] In a specific implementation of the present invention, the acquisition and decoding module 301 is specifically used for:

[0162] Obtain and decode the traffic to be detected by mirroring the traffic;

[0163] For each data packet obtained after decoding, determining the source Internet Protocol address, destination Internet Protocol address, source port number, destination port number and protocol type used by the data packet as data packet division information;

[0164] Based on the division information of each data packet and according to the division rule that data packets with the same division information belong to the same session, each data packet obtained after decoding is divided according to the different sessions to which it belongs.

[0165] In a specific implementation of the present invention, the feature extraction module 302 includes a first feature extraction unit and a second feature extraction unit.

[0166] The first feature extraction unit is used to:

[0167] Based on all the data packets of the session, a packet length sequence for reflecting the length of each data packet and a time interval sequence for reflecting the time interval at which each data packet arrives are obtained;

[0168] The packet length sequence and the time interval sequence are taken as the first feature extraction result.

[0169] In a specific embodiment of the present invention, the first feature extraction unit is further used for:

[0170] Based on all data packets of the session, obtain the minimum data packet length, the maximum data packet length, the average data packet length, and the length standard deviation of all data packets, and add one or more of them to the first feature extraction result;

[0171] Based on all data packets of the session, the minimum time interval, maximum time interval, average time interval, and time interval standard deviation of the time intervals of arrival of all data packets are obtained, and one or more of them are added to the first feature extraction result.

[0172] In a specific embodiment of the present invention, the first feature extraction unit is further used for:

[0173] Divide all data packets of the session according to the sending and receiving directions, determine the number of data packets under each data packet length in each data packet in the sending direction, obtain a sending data packet length probability distribution vector for reflecting the length distribution of each data packet in the sending direction, and add it to the first feature extraction result;

[0174] The number of packets of each packet length in each packet in the receiving direction is determined, and a received packet reception probability distribution vector reflecting the length distribution of each packet in the receiving direction is obtained, and added to the first feature extraction result.

[0175] In a specific embodiment of the present invention, the second feature extraction unit is specifically used for:

[0176] Based on all data packets of the session, basic session statistics, handshake features and certificate features are obtained as the second feature extraction result.

[0177] In a specific implementation of the present invention, the basic statistics of the session include: one or more of the total number of data packets in the session, the duration of the session, the total number of bytes flowing into the session, and the total number of bytes flowing out of the session;

[0178] The handshake characteristics include: one or more of the following: protocol version, cipher suite, supported extensions, connection status, and public key length;

[0179] Certificate characteristics include: whether the certificate is self-signed, whether the certificate is expired, certificate version number, certificate validity period, certificate chain length, and one or more of the normality of the certificate user.

[0180] In a specific implementation of the present invention, the second feature extraction unit is further used to obtain session window sequence statistical features based on all data packets of the session, and add the statistical features into the second feature extraction results.

[0181] In a specific embodiment of the present invention, the statistical features of the session window sequence include: a receiving time interval subsequence for reflecting the time intervals at which each received data packet arrives, a sending time interval subsequence for reflecting the time intervals at which each sent data packet arrives, a minimum time interval in received data packets, a maximum time interval in received data packets, an average time interval in received data packets, a standard deviation of the time interval in received data packets, a minimum time interval in sent data packets, a maximum time interval in sent data packets, an average time interval in sent data packets, and a standard deviation of the time interval in sent data packets.

[0182] In a specific embodiment of the present invention, a third feature extraction unit is further included, which is used to:

[0183] Determine the sessions with the same address group as the same session set; wherein the address group represents an address group consisting of a source Internet Protocol address and a destination source Internet Protocol address corresponding to the session;

[0184] Based on all sessions in the same session set, feature extraction is performed according to a third extraction rule to obtain a third feature extraction result for reflecting the features of the session at the Internet protocol layer;

[0185] Inputting the third feature extraction result into the third detection model to obtain a third detection result reflecting the maliciousness level of the session set, and using the third detection result as the third detection result of each session in the session set;

[0186] Accordingly, the result determination module 304 is specifically used for:

[0187] Based on the first detection result, the second detection result and the third detection result, a malicious traffic determination result of the session is obtained.

[0188] In a specific implementation of the present invention, the third feature extraction unit is specifically used for:

[0189] Based on all sessions in the same session set, one or more of the total number of data packets in the session set, the average time interval for the arrival of all data packets, the average length of all data packets, the average number of data packets per session, the number of self-signed flows, the number of expired flows, and the number of flows with too long a validity period are obtained as the third feature extraction result.

[0190] In a specific embodiment of the present invention, the first detection model includes N detection units that are different from each other, and the second detection model includes M detection units that are different from each other, and N and M are both positive integers;

[0191] The classification detection module 303 is specifically used for:

[0192] Inputting the first feature extraction results into N detection units in the first detection model respectively, and obtaining detection results output by each of the N detection units to reflect the maliciousness level of the session;

[0193] Based on the weight coefficients of the N detection units in the first detection model, the detection results output by the N detection units are weighted and superimposed, and then the average value is calculated, and the obtained result is used as the first detection result;

[0194] Inputting the second feature extraction results into the M detection units in the second detection model respectively, and obtaining the detection results output by the M detection units respectively for reflecting the maliciousness degree of the session;

[0195] Based on the weight coefficients of the M detection units in the second detection model, the detection results output by the M detection units are weighted and superimposed, and then the average value is calculated, and the obtained result is used as the second detection result;

[0196] Based on the weight coefficients of the first detection result and the second detection result, the first detection result and the second detection result are weighted and superimposed, and the obtained result is used as the risk value to be determined;

[0197] It is determined whether the risk value to be determined is higher than a preset risk threshold. If so, it is determined that the session belongs to malicious traffic; otherwise, it is determined that the session does not belong to malicious traffic.

[0198] Corresponding to the above method and system embodiments, embodiments of the present invention further provide a malicious traffic determination device, a computer-readable storage medium, and a computer program product, which can be referred to in correspondence with the above.

[0199] See also Figure 4 As shown, the device may include:

[0200] Memory 401, used for storing computer programs;

[0201] The processor 402 is used to execute a computer program to implement the steps of the malicious traffic determination method in any of the above embodiments.

[0202] The computer program product includes a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps of the malicious traffic determination method in any of the above embodiments are implemented.

[0203] See also Figure 5 The computer readable storage medium 50 stores a computer program 51, and when the computer program 51 is executed by the processor, the steps of the malicious traffic determination method in any of the above embodiments are implemented. The computer readable storage medium 50 mentioned here includes RAM (Random Access Memory), memory, ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read Only Memory), register, hard disk, removable disk, or any other form of storage medium known in the technical field.

[0204] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0205] Professionals may further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention, and the description of the above embodiments is only used to help understand the technical solution and its core idea of ​​the present invention. It should be pointed out that for ordinary technicians in the technical field, without departing from the principle of the present invention, the present invention can also be improved and modified in a number of ways, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A method for determining malicious traffic, characterized in that: include: Obtain and decode the traffic to be detected, and divide the decoded data packets into different sessions; Whenever all data packets belonging to the same session are obtained, feature extraction is performed based on all data packets of the session according to a first extraction rule to obtain a first feature extraction result reflecting the features of the session at a data packet level, and feature extraction is performed according to a second extraction rule to obtain a second feature extraction result reflecting the features of the session at a session level; Inputting the first feature extraction result into a first detection model to obtain a first detection result used to reflect the maliciousness level of the session, and inputting the second feature extraction result into a second detection model to obtain a second detection result used to reflect the maliciousness level of the session; A malicious traffic determination result of the session is obtained based on the first detection result and the second detection result.

2. The malicious traffic determination method according to claim 1, characterized in that: Obtain the traffic to be detected and decode it, and divide the decoded data packets according to the different sessions they belong to, including: Obtain and decode the traffic to be detected by mirroring the traffic; For each data packet obtained after decoding, determining the source Internet Protocol address, destination Internet Protocol address, source port number, destination port number and protocol type used by the data packet as the data packet division information; Based on the division information of each of the data packets, and according to the division rule that data packets with the same division information belong to the same session, the data packets obtained after decoding are divided according to the sessions to which they belong.

3. The malicious traffic determination method according to claim 1, characterized in that: Based on all the data packets of the session, feature extraction is performed according to a first extraction rule to obtain a first feature extraction result reflecting the features of the session at the data packet level, including: Based on all the data packets of the session, a packet length sequence is obtained to reflect the length of each data packet, and a time interval sequence is obtained to reflect the time interval between the arrival of each data packet. The packet length sequence and the time interval sequence are taken as the first feature extraction result.

4. The malicious traffic determination method according to claim 3 is characterized in that: Also includes: Based on all the data packets of the session, obtain the minimum data packet length, the maximum data packet length, the average data packet length, and the length standard deviation of all the data packets, and add one or more of them to the first feature extraction result; Based on all the data packets of the session, the minimum time interval, maximum time interval, average time interval, and time interval standard deviation of the time intervals of arrival of all the data packets are obtained, and one or more of them are added to the first feature extraction result.

5. The malicious traffic determination method according to claim 3 is characterized in that: Also includes: Dividing all the data packets of the session according to the sending and receiving directions, determining the number of data packets of each type of data packet length in the data packets in the sending direction, obtaining a sending data packet length probability distribution vector reflecting the length distribution of each data packet in the sending direction, and adding the vector to the first feature extraction result; The number of packets of each packet length in each packet in the receiving direction is determined, and a received packet reception probability distribution vector reflecting the length distribution of each packet in the receiving direction is obtained, and added to the first feature extraction result.

6. The malicious traffic determination method according to claim 1, characterized in that: Based on all data packets of the session, feature extraction is performed according to a second extraction rule to obtain a second feature extraction result reflecting the features of the session at the session level, including: Based on all data packets of the session, basic session statistics, handshake features and certificate features are obtained as the second feature extraction result.

7. The malicious traffic determination method according to claim 6, characterized in that: The basic statistics of the session include: one or more of the total number of data packets in the session, the duration of the session, the total number of bytes flowing into the session, and the total number of bytes flowing out of the session; The handshake features include: one or more of: protocol version, cipher suite, supported extensions, connection status, and public key length; The certificate characteristics include: whether the certificate is self-signed, whether the certificate is expired, the certificate version number, the certificate validity period, the certificate chain length, and one or more of the normality of the certificate user.

8. The malicious traffic determination method according to claim 6, characterized in that: Also includes: Based on all the data packets of the session, the statistical features of the session window sequence are obtained and added to the second feature extraction result.

9. The malicious traffic determination method according to claim 8, characterized in that: The session window sequence statistical features include: a receiving time interval subsequence for reflecting the time intervals at which each received data packet arrives, a sending time interval subsequence for reflecting the time intervals at which each sent data packet arrives, a minimum time interval in received data packets, a maximum time interval in received data packets, an average time interval in received data packets, a standard deviation of time intervals in received data packets, a minimum time interval in sent data packets, a maximum time interval in sent data packets, an average time interval in sent data packets, and a standard deviation of time intervals in sent data packets.

10. The malicious traffic determination method according to claim 1, characterized in that: Also includes: Determine the sessions with the same address group as the same session set; wherein the address group represents an address group consisting of a source Internet Protocol address and a destination source Internet Protocol address corresponding to the session; Based on all sessions in the same session set, feature extraction is performed according to a third extraction rule to obtain a third feature extraction result reflecting the features of the session at the Internet protocol layer; Inputting the third feature extraction result into a third detection model to obtain a third detection result reflecting the maliciousness level of the session set, and using the third detection result as the third detection result of each session in the session set; Correspondingly, based on the first detection result and the second detection result, a malicious traffic determination result of the session is obtained, including: A malicious traffic determination result of the session is obtained based on the first detection result, the second detection result and the third detection result.

11. The malicious traffic determination method according to claim 10, characterized in that: Based on all sessions in the same session set, feature extraction is performed according to the third extraction rule to obtain a third feature extraction result reflecting the features of the session at the Internet protocol layer, including: Based on all sessions in the same session set, one or more of the total number of data packets in the session set, the average time interval for the arrival of all data packets, the average length of all data packets, the average number of data packets per session, the number of self-signed flows, the number of expired flows, and the number of flows with too long a validity period are obtained as the third feature extraction result.

12. The malicious traffic determination method according to any one of claims 1 to 11, characterized in that: The first detection model includes N detection units that are different from each other, and the second detection model includes M detection units that are different from each other, where N and M are both positive integers; Inputting the first feature extraction result into a first detection model to obtain a first detection result used to reflect the maliciousness of the session, and inputting the second feature extraction result into a second detection model to obtain a second detection result used to reflect the maliciousness of the session, including: Inputting the first feature extraction results into N detection units in a first detection model respectively, to obtain detection results output by each of the N detection units and used to reflect the maliciousness level of the session; Based on the weight coefficients of the N detection units in the first detection model, the detection results output by the N detection units are weighted and superimposed, and then the average value is calculated, and the obtained result is used as the first detection result; Inputting the second feature extraction results into M detection units in a second detection model respectively, to obtain detection results output by each of the M detection units and used to reflect the maliciousness level of the session; Based on the weight coefficients of the M detection units in the second detection model, the detection results output by the M detection units are weighted and superimposed, and then the average value is calculated, and the obtained result is used as the second detection result; Based on the weight coefficients of the first detection result and the second detection result, the first detection result and the second detection result are weighted and superimposed, and the obtained result is used as the risk value to be determined; It is determined whether the risk value to be determined is higher than a preset risk threshold; if so, it is determined that the session belongs to malicious traffic; otherwise, it is determined that the session does not belong to malicious traffic.

13. A malicious traffic determination system, characterized in that: include: The acquisition and decoding module is used to obtain and decode the traffic to be detected, and divide the data packets obtained after decoding according to the different sessions they belong to; a feature extraction module configured to, after obtaining all data packets belonging to the same session, perform feature extraction according to a first extraction rule based on all data packets of the session to obtain a first feature extraction result reflecting the features of the session at a data packet level, and perform feature extraction according to a second extraction rule to obtain a second feature extraction result reflecting the features of the session at a session level; a classification detection module, configured to input the first feature extraction result into a first detection model to obtain a first detection result used to reflect the maliciousness of the session, and input the second feature extraction result into a second detection model to obtain a second detection result used to reflect the maliciousness of the session; The result determination module is used to obtain a malicious traffic determination result of the session based on the first detection result and the second detection result.

14. A malicious traffic determination device, characterized in that: include: Memory for storing computer programs; A processor is used to execute the computer program to implement the steps of the malicious traffic determination method as described in any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the malicious traffic determination method according to any one of claims 1 to 12 are implemented.

Images