Attack detection method based on trusted buffer area

Abstract

The invention relates to the technical field of attack detection, and discloses an attack detection method based on a trusted buffer, which comprises steps S1 to S4. The to-be-detected data flowing into the credible buffer area can be quickly and timely subjected to clustering analysis by adopting a DBSCAN algorithm, so that abnormal data can be quickly and accurately found out; and the abnormal data characteristics are compared with the attack data characteristics of the preset value, so that the attack behavior can be accurately judged.

Description

Technical Field

[0001] The present invention relates to the technical field of attack detection, and in particular to an attack detection method based on a trusted buffer. Background Art

[0002] With the rapid development of information technology, the Internet has become an indispensable part of people's lives and work. However, the openness and complexity of cyberspace have also made network attacks increasingly rampant. In addition, with the widespread application of emerging technologies such as cloud computing and the Internet of Things, the scale of the network continues to expand, and data traffic has increased dramatically. Traditional attack detection methods face performance bottlenecks when processing massive data and cannot meet the needs of real-time detection. In this severe network security situation, there is an urgent need for a more efficient, accurate, and flexible attack detection method that can detect various potential attack behaviors in a timely manner and ensure the safe and stable operation of the network system. Summary of the invention

[0003] The present invention mainly provides an attack detection method based on a trusted buffer, which solves the problem that as the network scale continues to expand and the data traffic increases sharply, the traditional attack detection method has low efficiency in processing massive data.

[0004] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0005] The attack detection method based on the trusted buffer includes:

[0006] Based on the trusted buffer, pre-process the data to be detected flowing into it;

[0007] Use the DBSCAN algorithm to perform cluster analysis on the preprocessed data to be detected and obtain abnormal data in the data to be detected;

[0008] Obtain abnormal features of abnormal data, and compare the abnormal features with corresponding attack data features;

[0009] Based on the comparison results, if the similarity value exceeds the preset threshold, it is determined to be an attack behavior.

[0010] Furthermore, the method of preprocessing the data to be detected flowing into the trusted buffer based on the trusted buffer includes:

[0011] Clean the data to be detected that flows into the trusted buffer;

[0012] Standardize and normalize the cleaned data to be tested;

[0013] Extract contrast features for attack detection and vectorize them.

[0014] Further, the DBSCAN algorithm is used to perform cluster analysis on the preprocessed data to be detected to obtain abnormal data in the data to be detected, including:

[0015] Use DBSCAN algorithm to perform cluster analysis on the vectorized contrast features;

[0016] The data to be detected that are identified as noise points are determined as abnormal data.

[0017] Further, obtaining abnormal features of abnormal data and comparing the abnormal features with corresponding attack data features includes:

[0018] Obtain abnormal features of abnormal data and extract abnormal feature vectors;

[0019] Determine the attack data feature corresponding to the abnormal feature, and compare the similarity of each attack vector in the attack data feature with the extracted abnormal feature vector.

[0020] Furthermore, based on the comparison result, if the similarity value exceeds a preset threshold, it is determined to be an attack behavior, including:

[0021] If the abnormal data has multiple abnormal features, the average similarity of the multiple abnormal features is calculated, and then the calculation result is compared with the preset threshold for judgment; if it exceeds the preset threshold, it is determined to be an attack behavior;

[0022] If the abnormal data has only one abnormal feature, its similarity value is directly compared with the preset threshold; if it exceeds the preset threshold, it is determined to be an attack behavior.

[0023] Beneficial effects: The DBSCAN algorithm can quickly and timely perform cluster analysis on the data to be detected that flows into the trusted buffer, so as to quickly and accurately find out the abnormal data; and compare the abnormal data characteristics with the attack data characteristics of the preset values, so as to accurately judge the attack behavior. DETAILED DESCRIPTION

[0024] The following will further describe in detail the technical solution of the attack detection method based on the trusted buffer according to the present invention in conjunction with the embodiments.

[0025] The attack detection method based on the trusted buffer of this embodiment includes steps S1 to S4:

[0026] S1. Based on the trusted buffer, pre-process the data to be detected flowing into it;

[0027] S2. Use the DBSCAN algorithm to perform cluster analysis on the preprocessed data to be detected, and obtain abnormal data in the data to be detected;

[0028] S3, obtaining abnormal features of abnormal data, and comparing the abnormal features with corresponding attack data features;

[0029] S4. Based on the comparison result, if the similarity value exceeds a preset threshold, it is determined to be an attack behavior.

[0030] Furthermore, in step S1, based on the trusted buffer, preprocessing the data to be detected flowing into the trusted buffer includes:

[0031] S11, cleaning the data to be detected that flows into the trusted buffer;

[0032] The data to be tested includes network equipment data, host system data, application server data, etc. Cleaning the above data includes removing malformed data packets, such as incomplete IP headers, invalid protocol fields, etc.; filtering out duplicate log records to avoid repeated analysis. For obviously abnormal data, such as oversized or undersized data packet sizes, unreasonable request frequencies, etc., they can be marked as suspicious data, but not deleted for the time being, for subsequent analysis.

[0033] S12, standardizing and normalizing the cleaned data to be detected;

[0034] For example, IP addresses are converted into integer form for standardization, which is convenient for calculation and comparison. Numerical data such as packet size and request time interval are normalized to fall within a specific interval, such as [0,1], to eliminate the influence of different data dimensions. Categorical data, such as protocol type and operation type, can be encoded and converted into numerical or vector form for subsequent feature extraction and analysis.

[0035] S13. Extract comparative features for detecting attacks and vectorize them.

[0036] Among them, the comparative features include statistical features, behavioral features and network features; Statistical features: Calculate the mean, variance, standard deviation and other statistical quantities of the data. For example, for network traffic data, the mean and variance of the packet size in different time periods can be calculated to reflect the stability of network traffic; for user behavior data, the standard deviation of user login time can be calculated to measure the dispersion of user login time. Behavioral features: Analyze the access frequency, access pattern and other behavioral features of the data. For example, for network traffic data, the access frequency of different source IP addresses to specific target IP addresses and the distribution of access time can be counted; for application server data, the URL sequence requested by the user can be analyzed to extract the user's access pattern. Network features: Consider the connection relationship of the data, traffic distribution and other network features. For example, for network traffic data, a network connection diagram can be constructed to analyze the node degree distribution, clustering coefficient and other features to reflect the topological structure of the network; for distributed systems, the communication traffic distribution between different nodes can be analyzed to detect abnormal traffic patterns. Each internal data sample that meets the above-mentioned contrast feature conditions is converted into a vector form. Each data sample corresponds to a contrast feature vector, which is convenient for subsequent contrast calculations; and each contrast feature corresponds to an abnormal feature, such as: abnormal features are also classified into the above three categories, each category contains multiple data samples, and each data sample corresponds to an abnormal feature vector.

[0037] For example, in statistical feature vectorization, counting the inflow and outflow of data in a trusted buffer is a very basic operation. For example, the number of data bytes entering the trusted buffer at a fixed time interval (such as every second) is counted. n and the number of bytes of data flowing out O n , after a period of time (such as (m) seconds), we can get a vector [I 1 , O 1 , I 2 , O 2 , ..., I m , O m ] to represent the dynamic changes in data traffic. This is very helpful for monitoring the data throughput of the buffer, just like in the buffer of a network server, such a vector can be used to understand the data transmission load.

[0038] Furthermore, in step S2, cluster analysis is performed on the preprocessed data to be detected using the DBSCAN algorithm to obtain abnormal data in the data to be detected, including:

[0039] S21. Use DBSCAN algorithm to perform cluster analysis on the vectorized contrast features;

[0040] Among them, for the neighborhood radius (ε) and minimum number of points (MinPts) of the DBSCAN algorithm. Analyze the historical normal data, observe the distance distribution between the data points of each normal data sample after vectorization, and then set the neighborhood radius (ε) and minimum number of points (MinPts) according to the specific situation of each normal sample data. For example, in the above statistical feature vectorization, the vector of the data inflow and outflow in the trusted buffer [I 1 , O 1 , I 2 , O 2 ,…,I m , O m ] as an example. First, the distance metric (such as Euclidean distance) between data points in the vector is calculated. The data inflow and outflow at each time point can be regarded as a two-dimensional data point (I n , O n ). Observe the distribution density of data points. If the data points are dense in certain areas, this may imply a pattern of data traffic. For example, in the data traffic vector of a network server buffer, it may be found that most of the data points are concentrated in one area, and the density of data points in this area is relatively high. The neighborhood radius (ε) and the minimum number of points (MinPts) can be preliminarily estimated by drawing a scatter plot of the data points and observing the density changes. For, the distance at which the data points begin to form clusters can be observed from the scatter plot. For example, when the distance is less than a certain value, the data points begin to cluster together, and this distance can be used as a preliminary estimate of (ε). For (MinPts), it can be determined based on the expected size of the cluster. If you want to find relatively large traffic pattern clusters, (MinPts) can be set larger; conversely, if you want to capture smaller fluctuation clusters, (MinPts) can be set smaller. The parameters can be optimized by continuously adjusting the neighborhood radius (ε) and the minimum number of points (MinPts) and observing the clustering results (such as the number of clusters, the size and shape of each cluster).

[0041] S22, determining the data to be detected that are identified as noise points as abnormal data.

[0042] Further, in step S3, the abnormal features of the abnormal data are obtained, and the abnormal features are compared with the corresponding attack data features, including:

[0043] S31, obtaining abnormal features of abnormal data and extracting abnormal feature vectors;

[0044] Among them, by extracting the abnormal features of the abnormal data, we check how many of the three major categories of features it contains, so as to facilitate the subsequent correspondence with the three major categories of features of the same type of attack data features, and then extract the vector of the specific abnormal data sample of the abnormal features.

[0045] S32: Determine the attack data feature corresponding to the abnormal feature, and compare the similarity between each attack vector in the attack data feature and the extracted abnormal feature vector.

[0046] The vectors of specific attack data samples of the attack data features are preset in advance, so as to be directly compared with the vectors of the abnormal data samples using the Euclidean distance or cosine similarity formula.

[0047] Furthermore, in step S4, based on the comparison result, if the similarity value exceeds a preset threshold, it is determined to be an attack behavior, including:

[0048] S41. If the abnormal data has multiple abnormal features, the average similarity of the multiple abnormal features is calculated, and then the calculation result is compared with a preset threshold for judgment; if it exceeds the preset threshold, it is determined to be an attack behavior;

[0049] Multiple abnormal features refer to, for example, the mean and variance of the packet size of network traffic data in the statistical features. After the similarity values ​​of two features are calculated, the similarity values ​​should be added and then the number of abnormal features should be calculated so that they can be accurately compared with the preset threshold.

[0050] The preset threshold is set according to actual needs, such as: 40%.

[0051] S42. If the abnormal data has only one abnormal feature, directly compare its similarity value with the preset threshold value; if it exceeds the preset threshold value, it is determined to be an attack behavior.

[0052] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. The attack detection method based on the trusted buffer is characterized in that: include: Based on the trusted buffer, pre-process the data to be detected flowing into it; Use the DBSCAN algorithm to perform cluster analysis on the preprocessed data to be detected and obtain abnormal data in the data to be detected; Obtain abnormal features of abnormal data, and compare the abnormal features with corresponding attack data features; Based on the comparison results, if the similarity value exceeds the preset threshold, it is determined to be an attack behavior.

2. The method according to claim 1, characterized in that The method of preprocessing the data to be detected flowing into the trusted buffer based on the trusted buffer includes: Clean the data to be detected that flows into the trusted buffer; Standardize and normalize the cleaned data to be tested; Extract contrast features for attack detection and vectorize them.

3. The method according to claim 2, characterized in that The DBSCAN algorithm is used to perform cluster analysis on the preprocessed data to be detected to obtain abnormal data in the data to be detected, including: Use DBSCAN algorithm to perform cluster analysis on the vectorized contrast features; The data to be detected that are identified as noise points are determined as abnormal data.

4. The method according to claim 3, characterized in that The step of obtaining abnormal features of abnormal data and comparing the abnormal features with corresponding attack data features includes: Obtain abnormal features of abnormal data and extract abnormal feature vectors; Determine the attack data feature corresponding to the abnormal feature, and compare the similarity of each attack vector in the attack data feature with the extracted abnormal feature vector.

5. The method according to claim 4, characterized in that Based on the comparison result, if the similarity value exceeds a preset threshold, it is determined to be an attack behavior, including: If the abnormal data has multiple abnormal features, the average similarity of the multiple abnormal features is calculated, and then the calculation result is compared with the preset threshold for judgment; if it exceeds the preset threshold, it is determined to be an attack behavior; If the abnormal data has only one abnormal feature, its similarity value is directly compared with the preset threshold; if it exceeds the preset threshold, it is determined to be an attack behavior.