Channel detection method and device, computer program product and electronic equipment

Abstract

The invention relates to a channel detection method and device, a computer program product and electronic equipment, and relates to the technical field of network and information security, the method comprises the following steps: obtaining session metadata and network flow data, and aggregating the session metadata to obtain grouped metadata; screening the grouped metadata to obtain target grouped metadata, and determining a first vector corresponding to session metadata included in the target grouped metadata; retrieving in the network traffic data according to the target packet metadata to obtain target network traffic data, and generating a second vector corresponding to the target network traffic data; and generating a splicing vector according to the first vector and the second vector, obtaining a central point of the splicing vector and a standard deviation of a distance to the central point, and obtaining a detection result of the network channel corresponding to the network request based on the standard deviation. According to the invention, the problems that the HTTP covert channel detection method is easy to bypass and the training sample is difficult to construct are solved.

Description

Background Art

[0002] As a covert communication method, stored HTTP covert channels are commonly found in various APT and advanced network attack cases. They are usually hidden in normal HTTP traffic and transmit malicious data or control instructions by disguising as legitimate network requests and responses.

[0003] In the related art, there are two main methods for detecting storage-type HTTP covert channels: protocol-based detection and traditional machine learning-based detection technology. In protocol-based detection, the HTTP protocol itself is a stateless protocol. HTTP covert channels can use the redundancy and flexibility of the HTTP protocol to communicate, thereby bypassing detection based on protocol header identifiers. In traditional machine learning-based detection technology, it is very difficult to collect covert channel samples, resulting in problems such as insufficient model training or overfitting.

[0004] Therefore, it is necessary to provide a new channel detection method.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0006] The purpose of the present disclosure is to provide a channel detection method, a channel detection device, a computer program product and an electronic device, thereby overcoming the problems that the HTTP covert channel detection method is easily bypassed and difficult to construct training samples due to the limitations and defects of related technologies, at least to a certain extent.

[0007] According to one aspect of the present disclosure, a channel detection method is provided, including:

[0008] Acquire session metadata and network traffic data corresponding to the network request within a preset time period, aggregate the session metadata, and obtain group metadata;

[0009] Screening the group metadata to obtain target group metadata, and determining a first vector corresponding to the session metadata included in the target group metadata;

[0010] Searching the network traffic data according to the target group metadata to obtain target network traffic data, and generating a second vector corresponding to the target network traffic data;

[0011] A splicing vector is generated according to the first vector and the second vector, a center point vector of the splicing vector and a standard deviation of a distance to the center point vector are obtained, and a detection result of a network channel corresponding to the network request is obtained based on the standard deviation.

[0012] In an exemplary embodiment of the present disclosure, aggregating the session metadata to obtain group metadata includes:

[0013] Acquire the public information of the session metadata and the network traffic data; wherein the public information includes a timestamp, a source IP address, a destination IP address, a source port number, and a destination port number;

[0014] The session metadata of different timestamps are aggregated according to the source IP address, the destination IP address and the destination port number in the public information to obtain the group metadata.

[0015] In an exemplary embodiment of the present disclosure, the screening of the group metadata to obtain target group metadata, and determining a first vector corresponding to the session metadata included in the target group metadata includes:

[0016] Acquire a preset threshold parameter and a length of the grouping metadata, and acquire first grouping metadata whose length is not less than the preset threshold parameter;

[0017] Randomly sampling the session metadata included in the first group metadata to obtain the target group metadata;

[0018] The session metadata in the target group metadata is input into a preset model to obtain a first vector corresponding to the session metadata.

[0019] In an exemplary embodiment of the present disclosure, searching the network traffic data according to the target packet metadata to obtain the target network traffic data and generating a second vector corresponding to the target network traffic data includes:

[0020] Retrieve the network traffic data according to each session metadata included in the target group metadata, and obtain target network traffic data corresponding to each session metadata;

[0021] A second vector corresponding to each piece of the target network traffic data is obtained based on the duration, the number of request messages, the number of request bytes, the number of response messages, and the number of response bytes included in the target network traffic data.

[0022] In an exemplary embodiment of the present disclosure, the acquiring and obtaining a second vector corresponding to each piece of the target network traffic data according to the duration, the number of request messages, the number of request bytes, the number of response messages, and the number of response bytes included in the target network traffic data, includes:

[0023] Obtaining a time slice feature of each piece of the session metadata according to the duration;

[0024] Obtaining a request message number feature of each session metadata according to the request message number;

[0025] Obtaining a request message length feature of each session metadata according to the request byte count;

[0026] Obtaining a response message number feature of each of the session metadata according to the response message number;

[0027] Obtaining a response message length feature of each piece of the session metadata according to the number of response bytes;

[0028] A second vector corresponding to each piece of the target network traffic data is obtained according to the time slice feature, the request message number feature, the request message length feature, the response message number feature, and the response message length feature.

[0029] In an exemplary embodiment of the present disclosure, generating a splicing vector according to the first vector and the second vector, and obtaining a center point vector of the splicing vector and a standard deviation of a distance to the center point vector include:

[0030] splicing a first vector of each of the session metadata in the target group metadata and a second vector corresponding to the target network traffic data corresponding to the session metadata to obtain a splicing vector of each of the session metadata in the target group metadata;

[0031] Performing dimension reduction on the concatenated vector to obtain a reduced dimension vector, obtaining a center point vector of the reduced dimension vector, and a distance from each of the reduced dimension vectors to the center point vector;

[0032] The standard deviation is obtained according to the distance from each of the reduced-dimensional vectors to the center point vector.

[0033] In an exemplary embodiment of the present disclosure, obtaining a detection result of a network channel corresponding to the network request based on the standard deviation includes:

[0034] Acquire an anomaly detection threshold, and when the standard deviation is not less than the anomaly detection threshold, the detection result of the network channel corresponding to the network request is abnormal;

[0035] When the standard deviation is smaller than the abnormality detection threshold, the detection result of the network channel corresponding to the network request is normal.

[0036] According to one aspect of the present disclosure, there is provided a channel detection device, including:

[0037] A data aggregation module, used to obtain session metadata and network traffic data corresponding to network requests within a preset time period, and aggregate the session metadata to obtain group metadata;

[0038] A data screening module, configured to screen the group metadata to obtain target group metadata, and determine a first vector corresponding to the session metadata included in the target group metadata;

[0039] A data retrieval module, configured to retrieve the network traffic data according to the target group metadata, obtain target network traffic data, and generate a second vector corresponding to the target network traffic data;

[0040] An anomaly detection module is used to generate a splicing vector according to the first vector and the second vector, obtain a center point vector of the splicing vector and a standard deviation of a distance to the center point vector, and obtain a detection result of a network channel corresponding to the network request based on the standard deviation.

[0041] According to one aspect of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the channel detection method described in any one of the above exemplary embodiments is implemented.

[0042] According to one aspect of the present disclosure, there is provided an electronic device, including:

[0043] A processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the channel detection method described in any of the above exemplary embodiments by executing the executable instructions.

[0044] A channel detection method provided by an embodiment of the present disclosure obtains session metadata and network traffic data corresponding to a network request within a preset time period, aggregates the session metadata to obtain group metadata; screens the group metadata to obtain target group metadata, and determines a first vector corresponding to the session metadata included in the target group metadata; searches the network traffic data according to the target group metadata to obtain target network traffic data, and generates a second vector corresponding to the target network traffic data; generates a splicing vector according to the first vector and the second vector, obtains a center point vector of the splicing vector and a standard deviation of the distance to the center point vector, and obtains a detection result of a network channel corresponding to the network request based on the standard deviation. On the one hand, the acquired session metadata corresponding to the network request is aggregated to obtain group metadata, the group metadata is screened to obtain target group metadata, and the first vector corresponding to the session metadata included in the group metadata is determined. After obtaining the first vector, the network traffic data is searched according to the target group metadata to obtain the target network traffic data, and a second vector corresponding to the target network traffic data is generated. The first vector and the second vector are spliced, and the anomaly detection of the HTTP channel is realized through self-similarity calculation, without the need to construct an additional training sample set, thereby improving the practicality and efficiency of channel detection. On the other hand, after obtaining the first vector and the second vector, the first vector and the second vector are spliced ​​to obtain a spliced ​​vector, the center point vector of the spliced ​​vector and the standard deviation of the distance to the center point vector are obtained, and the detection result is obtained according to the standard deviation, without the need for offline training models, thereby solving the "cold start" problem faced by the detection algorithm in the related technology.

[0045] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0047] Figure 1 The following schematically shows a flow chart of a channel detection method according to an exemplary embodiment of the present disclosure.

[0048] Figure 2 A flowchart of a method for aggregating the session metadata to obtain group metadata according to an exemplary embodiment of the present disclosure is schematically shown.

[0049] Figure 3 A flowchart of a method for screening the group metadata, obtaining target group metadata, and determining a first vector corresponding to session metadata included in the target group metadata according to an exemplary embodiment of the present disclosure is schematically shown.

[0050] Figure 4 A flowchart of a method for searching the network traffic data according to the target packet metadata, obtaining the target network traffic data, and generating a second vector corresponding to the target network traffic data according to an exemplary embodiment of the present disclosure is schematically shown.

[0051] Figure 5 A flowchart of a method for generating a stitching vector according to the first vector and the second vector, and obtaining a center point vector of the stitching vector and a standard deviation of a distance to the center point vector according to an exemplary embodiment of the present disclosure is schematically shown.

[0052] Figure 6 A flowchart of a method for obtaining a detection result of a network channel corresponding to the network request based on the standard deviation according to an exemplary embodiment of the present disclosure is schematically shown.

[0053] Figure 7 A block diagram schematically shows a channel detection device according to an exemplary embodiment of the present disclosure.

[0054] Figure 8 An electronic device for implementing the above-mentioned channel detection method according to an exemplary embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0055] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0056] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0057] As a covert communication method, stored HTTP covert channels are commonly found in various APT (Advanced Persistent Threat) and advanced network attack cases. They are usually hidden in normal HTTP traffic and silently transmit malicious data or control instructions by disguising as legitimate network requests and responses. Due to the widespread use and complexity of the HTTP protocol itself, such covert channels are difficult to detect and block easily.

[0058] Therefore, storage-based HTTP covert channel detection has become an urgent need in the security industry. However, it is difficult to implement in practice, and faces two major challenges:

[0059] 1) The HTTP protocol syntax is loosely defined and contains many redundant parts, which can be used to embed hidden information. Traditional rule detection methods often rely on strict matching of protocol features, but covert channels can cleverly use these redundant parts for communication, thereby bypassing rule detection.

[0060] 2) In HTTP covert channel detection, it is relatively easy to collect enough normal HTTP request samples, but it is very difficult to collect covert channel samples. Even if some covert channel samples can be collected, the ratio between these samples and normal samples may be extremely unbalanced. This imbalance will seriously affect the training effect of machine learning algorithms such as SVM and random forest, resulting in a decrease in the model's ability to identify covert channels.

[0061] Currently, there are two common methods for detecting storage-based HTTP covert channels:

[0062] 1) Protocol-based detection: Identify anomalies by detecting whether the state of the HTTP protocol is within the agreed normal range. However, the HTTP protocol itself is a stateless protocol, and HTTP covert channels can often cleverly use the redundant parts and flexibility of the HTTP protocol to communicate, thereby bypassing detection based on protocol header identifiers.

[0063] 2) Detection technology based on traditional machine learning: such as classification algorithms based on SVM, random forest, etc. The construction of training sample sets is a difficult problem. In particular, the collection of covert channel samples is very difficult, which may lead to problems such as insufficient model training or overfitting, and poor practicality.

[0064] Based on one or more of the above problems, this exemplary embodiment first provides a channel detection method, which can be run on a terminal device; of course, those skilled in the art can also run the method of the present invention on other platforms as required, and this exemplary embodiment does not specifically limit this. Figure 1 As shown, the channel detection method may include steps S110 to S140:

[0065] Step S110. Acquire session metadata and network traffic data corresponding to the network request within a preset time period, aggregate the session metadata, and obtain group metadata;

[0066] Step S120: Screen the group metadata to obtain target group metadata, and determine a first vector corresponding to the session metadata included in the target group metadata;

[0067] Step S130: searching the network traffic data according to the target group metadata to obtain target network traffic data, and generating a second vector corresponding to the target network traffic data;

[0068] Step S140: Generate a splicing vector according to the first vector and the second vector, obtain a center point vector of the splicing vector and a standard deviation of a distance to the center point vector, and obtain a detection result of a network channel corresponding to the network request based on the standard deviation.

[0069] The above-mentioned channel detection method obtains session metadata and network traffic data corresponding to a network request within a preset time period, aggregates the session metadata to obtain group metadata; screens the group metadata to obtain target group metadata, and determines a first vector corresponding to the session metadata included in the target group metadata; searches the network traffic data according to the target group metadata to obtain target network traffic data, and generates a second vector corresponding to the target network traffic data; generates a splicing vector according to the first vector and the second vector, obtains the center point vector of the splicing vector and the standard deviation of the distance to the center point vector, and obtains the detection result of the network channel corresponding to the network request based on the standard deviation. On the one hand, the acquired session metadata corresponding to the network request is aggregated to obtain group metadata, the group metadata is screened to obtain target group metadata, and the first vector corresponding to the session metadata included in the group metadata is determined. After obtaining the first vector, the network traffic data is searched according to the target group metadata to obtain the target network traffic data, and a second vector corresponding to the target network traffic data is generated. The first vector and the second vector are spliced, and the anomaly detection of the HTTP channel is realized through self-similarity calculation, without the need to construct an additional training sample set, thereby improving the practicality and efficiency of channel detection. On the other hand, after obtaining the first vector and the second vector, the first vector and the second vector are spliced ​​to obtain a spliced ​​vector, the center point vector of the spliced ​​vector and the standard deviation of the distance to the center point vector are obtained, and the detection result is obtained according to the standard deviation, without the need for offline training models, thereby solving the "cold start" problem faced by the detection algorithm in the related technology.

[0070] In the following, each step involved in the channel detection method according to the exemplary embodiment of the present disclosure is explained and illustrated in detail.

[0071] In step S110, session metadata and network traffic data corresponding to the network request within a preset time period are obtained, and the session metadata are aggregated to obtain group metadata.

[0072] Among them, the preset time period is a fixed time window, and the preset time period is not specifically limited in this example embodiment. Common network monitoring modes can be divided into two types: bypass mirroring mode and series monitoring mode. Based on the bypass mirroring of the network, the network full-flow probe detection system can provide session metadata and network traffic data corresponding to each HTTP request. Among them, the bypass mirroring mode is to send all network data packets accessing the database to the database gateway for analysis through traffic mirroring technology. In this example embodiment, the session metadata and network traffic data corresponding to the network request can be obtained based on the bypass mirroring mode. The acquired session metadata and network traffic data have the same public information such as timestamp, source IP address, destination IP address, source port number, destination port number, protocol number, etc. Table 1 shows some fields in the session metadata, and Table 2 shows some fields in the network traffic data.

[0073] Table 1 Session metadata

[0074]

[0075] Table 2 Network traffic data

[0076]

[0077] In this example embodiment, after obtaining the session metadata and network traffic data, the session metadata can be aggregated to obtain the group metadata. Figure 2 As shown, the session metadata is aggregated to obtain group metadata, including:

[0078] Step S210. Acquire the public information of the session metadata and the network traffic data; wherein the public information includes a timestamp, a source IP address, a destination IP address, a source port number, and a destination port number;

[0079] Step S220: Aggregate the session metadata of different timestamps according to the source IP address, destination IP address and destination port number in the public information to obtain the group metadata.

[0080] In the following, step S210 and step S220 will be further explained and illustrated. Specifically, the acquired session metadata is compared with the fields included in the network traffic data to obtain the common information of the session metadata and the network traffic data, wherein the common information is the fields included in both the session metadata and the network traffic data, and may include: timestamp, source IP address, destination IP address, source port number, destination port number, which is not specifically limited in this example embodiment. After obtaining the common information, the source IP address, destination IP address and destination port number in the common information can be used as the key of the key-value pair to aggregate the session metadata of different timestamps to obtain the packet source data.

[0081] Taking the session metadata shown in Table 1 as an example, when the session metadata is aggregated based on the source IP address 192.168.1.1, the destination IP address 203.0.113.5, and the destination port 80, the obtained group metadata is: {192.168.1.1, 203.0.113.5, 80: session metadata 1, session metadata 2, session metadata 4}.

[0082] In step S120, the group metadata is screened to obtain target group metadata, and a first vector corresponding to the session metadata included in the target group metadata is determined.

[0083] After obtaining the group metadata, the session metadata included in the group metadata may be screened to obtain the target group metadata. When screening the session metadata included in the group metadata, a threshold parameter may be set and the screening may be performed according to the threshold parameter. In this exemplary embodiment, the threshold parameter is not specifically limited. After obtaining the target group metadata, the session metadata included in the target group metadata may be model trained to obtain a vector representation corresponding to the session metadata included in the target group metadata.

[0084] refer to Figure 3 As shown, screening the group metadata to obtain target group metadata, and determining a first vector corresponding to the session metadata included in the target group metadata, includes:

[0085] Step S310. Obtain a preset threshold parameter and the length of the grouping metadata, and obtain first grouping metadata whose length is not less than the preset threshold parameter;

[0086] Step S320: Randomly sample the session metadata included in the first group metadata to obtain the target group metadata;

[0087] Step S330: Input the session metadata in the target group metadata into a preset model to obtain a first vector corresponding to the session metadata.

[0088] Below, step S310-step S330 will be further explained and illustrated. Specifically, first, a preset threshold parameter and the length of the grouping metadata are obtained, wherein the length of the grouping metadata can be the number of records of the session metadata included in the grouping metadata, and when the length of the grouping metadata is less than the preset threshold parameter, the analysis is stopped. When the length of the grouping metadata is not less than the preset threshold parameter, the session metadata included in the first grouping metadata is randomly sampled, and the target grouping metadata is obtained based on the sampled session metadata. After obtaining the target grouping metadata, the session metadata included in the target grouping metadata can be input into a preset model to obtain a high-dimensional first vector corresponding to the session metadata. Among them, the preset model can be a pre-trained model based on GPT, or it can be a pre-trained BERT model. In this example embodiment, the preset model is not specifically limited.

[0089] In step S130, the network traffic data is searched according to the target group metadata to obtain target network traffic data, and a second vector corresponding to the target network traffic data is generated.

[0090] In this example embodiment, each session metadata in the target group metadata can be used as a search condition to search in the network traffic data to obtain the target network traffic data corresponding to the session metadata. After obtaining the target network traffic data corresponding to the session metadata in the network traffic data, a second vector corresponding to the target network traffic data is obtained.

[0091] refer to Figure 4 As shown, searching the network traffic data according to the target group metadata to obtain the target network traffic data, and generating a second vector corresponding to the target network traffic data, including:

[0092] Step S410. Search the network traffic data according to each session metadata included in the target group metadata to obtain target network traffic data corresponding to each session metadata;

[0093] Step S420. Obtain and obtain a second vector corresponding to each piece of the target network traffic data according to the duration, the number of request messages, the number of request bytes, the number of response messages and the number of response bytes included in the target network traffic data.

[0094] In the following, step S410 and step S420 will be further explained and illustrated. Specifically, the timestamp, source IP address, destination IP address and destination port of each session metadata included in the target packet metadata are obtained, and the timestamp, source IP address, destination IP address and destination port of each session metadata obtained are used as search conditions for searching in the network traffic data, and the network traffic data is searched using the search conditions to obtain the target network traffic data corresponding to each session metadata. After obtaining the target network traffic data corresponding to each session metadata, a second vector identifying each target network traffic data can be obtained based on the values ​​of the fields included in all the target network traffic data. Among them, the fields included in the target network traffic data can be duration, number of request messages, number of request bytes, number of response messages and number of response bytes.

[0095] Further, the acquiring and obtaining a second vector corresponding to each piece of the target network traffic data according to the duration, the number of request messages, the number of request bytes, the number of response messages, and the number of response bytes included in the target network traffic data, includes:

[0096] Obtaining a time slice feature of each piece of the session metadata according to the duration;

[0097] Obtaining a request message number feature of each session metadata according to the request message number;

[0098] Obtaining a request message length feature of each session metadata according to the request byte count;

[0099] Obtaining a response message number feature of each of the session metadata according to the response message number;

[0100] Obtaining a response message length feature of each piece of the session metadata according to the number of response bytes;

[0101] A second vector corresponding to each piece of the target network traffic data is obtained according to the time slice feature, the request message number feature, the request message length feature, the response message number feature, and the response message length feature.

[0102] Specifically, the duration included in the target network traffic data is obtained, and the time slice feature is obtained according to the duration included in the target network traffic data. Among them, T i is the duration in the target network traffic data corresponding to each session metadata in the target packet data, and k is the number of session metadata included in the target packet data. According to the number of request messages included in the target network data, the request message length feature of each session metadata is obtained. Among them, Req_P i is the number of request messages in the target network traffic data corresponding to each session metadata in the target packet data, and k is the number of session metadata included in the target packet data. According to the number of request bytes included in the target network data, the request message length feature is obtained. Among them, Req_L i is the number of request bytes in the target network traffic data corresponding to each session metadata in the target packet data, and k is the number of session metadata included in the target packet data. According to the number of response messages in the target network data, the response message number feature is obtained. Among them, Res_P i is the number of response messages in the target network traffic data corresponding to each session metadata in the target packet data, and k is the number of session metadata included in the target packet data. According to the number of response bytes included in the target network data, the response message length feature is obtained. Among them, Res_L i is the number of response bytes in the target network traffic data corresponding to each session metadata in the target packet data, and k is the number of session metadata included in the target packet data.

[0103] After obtaining the request message number feature, the request message length feature, the response message number feature, and the response message length feature, a second vector may be generated according to the request message number feature, the request message length feature, the response message number feature, and the response message length feature.

[0104] In step S140, a splicing vector is generated according to the first vector and the second vector, a center point vector of the splicing vector and a standard deviation of a distance to the center point vector are obtained, and a detection result of a network channel corresponding to the network request is obtained based on the standard deviation.

[0105] After obtaining the first vector corresponding to the session metadata included in the target group metadata and the second vector of the target network flow data corresponding to the session metadata in the network flow data, the first vector and the second vector can be spliced ​​to obtain the splicing vector of each session metadata in the target group metadata. After obtaining the splicing vector of each session metadata, the center point vector of the target group metadata and the standard deviation of the distance from each point to the center point vector can be determined, and the channel detection result can be obtained based on the standard deviation.

[0106] refer to Figure 5 As shown, generating a splicing vector according to the first vector and the second vector, and obtaining a center point vector of the splicing vector and a standard deviation of a distance to the center point vector include:

[0107] Step S510. Concatenate the first vector of each session metadata in the target group metadata and the second vector corresponding to the target network traffic data corresponding to the session metadata to obtain a concatenated vector of each session metadata in the target group metadata;

[0108] Step S520: Reduce the dimension of the concatenated vector to obtain a reduced dimension vector, obtain the center point vector of the reduced dimension vector, and the distance from each reduced dimension vector to the center point vector;

[0109] Step S530. Obtain the standard deviation according to the distance from each of the reduced-dimensional vectors to the center point vector.

[0110] In the following, step S510-step S530 will be further explained and illustrated. Specifically, the first vector corresponding to each session metadata in the target group metadata and the second vector corresponding to the target network traffic data corresponding to the session metadata in the network traffic data are spliced ​​to obtain a spliced ​​vector for each session metadata. After obtaining the spliced ​​vector, the spliced ​​vector can be dimensionally reduced to obtain a reduced-dimensional vector, wherein the spliced ​​vector is a 105-dimensional multidimensional vector, and the multidimensional vector can be simplified to a 9-dimensional vector. In this example embodiment, the simplified dimension is not specifically limited. After obtaining the reduced-dimensional vector corresponding to each session metadata, the center point vector is determined according to the reduced-dimensional vector of each session metadata in the target group metadata. Wherein, vi is the dimension reduction vector corresponding to each session metadata, and k is the number of session metadata included in the target group metadata. After obtaining the center point vector, the distance between the dimension reduction vector of each session metadata in the target group metadata and the center point vector can be calculated. After obtaining the distance between each dimension reduction vector and the center point vector, the distance between the dimension reduction vector and the center point vector can be calculated according to The distance standard deviation is calculated, where v* is the center point vector, vi is the dimension reduction vector corresponding to each session metadata, and k is the number of session metadata included in the target group metadata.

[0111] After obtaining the standard deviation, refer to Figure 6 As shown, based on the standard deviation, obtaining a detection result of a network channel corresponding to the network request includes:

[0112] Step S610. Obtain an abnormality detection threshold. When the standard deviation is not less than the abnormality detection threshold, the detection result of the network channel corresponding to the network request is abnormal.

[0113] Step S620: When the standard deviation is less than the abnormality detection threshold, the detection result of the network channel corresponding to the network request is normal.

[0114] In the following, step S610 and step S620 will be further explained and illustrated. Specifically, an anomaly detection threshold is obtained, and the anomaly detection threshold can be 0.05 or other values. In this example embodiment, the anomaly detection threshold is not specifically limited. After obtaining the anomaly detection threshold, the anomaly detection threshold can be compared with the standard deviation. When the standard deviation is not less than the anomaly detection threshold, the detection result of the network channel corresponding to the network request is abnormal. However, when the standard deviation is less than the anomaly detection threshold, the detection result of the network channel corresponding to the network request is normal.

[0115] The channel detection device provided by the example embodiment of the present disclosure has at least the following advantages: on the one hand, the acquired session metadata corresponding to the network request is aggregated to obtain the group metadata, the group metadata is screened to obtain the target group metadata, and the first vector corresponding to the session metadata included in the group metadata is determined. After obtaining the first vector, the network traffic data is searched according to the target group metadata to obtain the target network traffic data, and a second vector corresponding to the target network traffic data is generated, the first vector and the second vector are spliced, and the anomaly detection of the HTTP channel is realized through self-similarity calculation, and no additional training sample set needs to be constructed, thereby improving the practicality and efficiency of channel detection. On the other hand, after obtaining the first vector and the second vector, the first vector and the second vector are spliced ​​to obtain the spliced ​​vector, the center point vector of the spliced ​​vector and the standard deviation of the distance to the center point vector are obtained, and the detection result is obtained according to the standard deviation, and no offline training model is required, which solves the "cold start" problem faced by the detection algorithm in the related art.

[0116] The exemplary embodiment of the present disclosure also provides a channel detection device, referring to Figure 7 As shown, it may include: a data aggregation module 710, a data screening module 720, a data retrieval module 730 and an anomaly detection module 740. Among them:

[0117] The data aggregation module 710 is used to obtain session metadata and network traffic data corresponding to the network request within a preset time period, and aggregate the session metadata to obtain group metadata;

[0118] A data screening module 720, configured to screen the group metadata to obtain target group metadata, and determine a first vector corresponding to the session metadata included in the target group metadata;

[0119] A data retrieval module 730, configured to search the network traffic data according to the target group metadata, obtain target network traffic data, and generate a second vector corresponding to the target network traffic data;

[0120] The anomaly detection module 740 is used to generate a splicing vector according to the first vector and the second vector, obtain a center point vector of the splicing vector and a standard deviation of the distance to the center point vector, and obtain a detection result of a network channel corresponding to the network request based on the standard deviation.

[0121] The specific details of each module in the above-mentioned channel detection device have been described in detail in the corresponding channel detection method, so they will not be repeated here.

[0122] In an exemplary embodiment of the present disclosure, the data aggregation module includes:

[0123] A public information determination module, used to obtain the public information of the session metadata and the network traffic data; wherein the public information includes a timestamp, a source IP address, a destination IP address, a source port number, and a destination port number;

[0124] The group metadata acquisition module is used to aggregate the session metadata of different timestamps according to the source IP address, destination IP address and destination port number in the public information to obtain the group metadata.

[0125] In an exemplary embodiment of the present disclosure, the data screening module includes:

[0126] A first grouping metadata determining module is configured to obtain a preset threshold parameter and a length of the grouping metadata, and obtain first grouping metadata whose length is not less than the preset threshold parameter;

[0127] a target group metadata determination module, configured to randomly sample the session metadata included in the first group metadata to obtain the target group metadata;

[0128] The first vector acquisition module is used to input the session metadata in the target group metadata into a preset model to obtain a first vector corresponding to the session metadata.

[0129] In an exemplary embodiment of the present disclosure, the data retrieval module includes:

[0130] A network traffic data matching module, configured to search the network traffic data according to each session metadata included in the target group metadata, and obtain target network traffic data corresponding to each session metadata;

[0131] The second vector generation module is used to obtain and obtain a second vector corresponding to each target network traffic data according to the duration, number of request messages, number of request bytes, number of response messages and number of response bytes included in the target network traffic data.

[0132] In an exemplary embodiment of the present disclosure, the second vector generating module includes:

[0133] A time slice feature determination module, used for obtaining a time slice feature of each of the session metadata according to the duration;

[0134] A request message number feature determination module, used to obtain a request message number feature of each session metadata according to the request message number;

[0135] A request message length feature determination module, used to obtain a request message length feature of each session metadata according to the request byte number;

[0136] A response message number feature determination module, used to obtain a response message number feature of each of the session metadata according to the response message number;

[0137] A response message length feature determination module, used to obtain a response message length feature of each of the session metadata according to the number of response bytes;

[0138] The second vector determination module is used to obtain a second vector corresponding to each target network traffic data according to the time slice characteristics, the request message number characteristics, the request message length characteristics, the response message number characteristics, and the response message length characteristics.

[0139] In an exemplary embodiment of the present disclosure, the anomaly detection module includes:

[0140] A vector splicing module, used for splicing a first vector of each session metadata in the target group metadata and a second vector corresponding to the target network traffic data corresponding to the session metadata, to obtain a splicing vector of each session metadata in the target group metadata;

[0141] A vector distance calculation module, used to reduce the dimension of the concatenated vector to obtain a reduced-dimensional vector, obtain a center point vector of the reduced-dimensional vector, and a distance from each of the reduced-dimensional vectors to the center point vector;

[0142] A standard deviation determination module is used to obtain the standard deviation according to the distance from each of the reduced-dimensional vectors to the center point vector.

[0143] In an exemplary embodiment of the present disclosure, the anomaly detection module includes:

[0144] A first detection module, configured to obtain an abnormality detection threshold, wherein when the standard deviation is not less than the abnormality detection threshold, a detection result of the network channel corresponding to the network request is abnormal;

[0145] The second detection module is used to determine that the detection result of the network channel corresponding to the network request is normal when the standard deviation is less than the abnormality detection threshold.

[0146] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0147] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0148] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0149] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0150] Refer to the following Figure 8 The electronic device 800 according to this embodiment of the present disclosure is described. Figure 8 The electronic device 800 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0151] like Figure 8 As shown, the electronic device 800 is in the form of a general computing device. The components of the electronic device 800 may include, but are not limited to: the at least one processing unit 810, the at least one storage unit 820, a bus 830 connecting different system components (including the storage unit 820 and the processing unit 810), and a display unit 840.

[0152] The storage unit stores program codes, which can be executed by the processing unit 810, so that the processing unit 810 performs the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 810 can perform the following steps: Figure 1 The steps S110 shown in the figure are as follows: obtaining session metadata and network traffic data corresponding to a network request within a preset time period, aggregating the session metadata, and obtaining group metadata; S120: screening the group metadata, obtaining target group metadata, and determining a first vector corresponding to the session metadata included in the target group metadata; S130: searching the network traffic data according to the target group metadata, obtaining target network traffic data, and generating a second vector corresponding to the target network traffic data; S140: generating a splicing vector according to the first vector and the second vector, obtaining a center point vector of the splicing vector and a standard deviation of the distance to the center point vector, and obtaining a detection result of a network channel corresponding to the network request based on the standard deviation.

[0153] The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 8201 and / or a cache memory unit 8202 , and may further include a read-only memory unit (ROM) 8203 .

[0154] The storage unit 820 may also include a program / utility 8204 having a set (at least one) of program modules 8205, such program modules 8205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0155] Bus 830 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0156] The electronic device 800 may also communicate with one or more external devices 900 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 800, and / or communicate with any device that enables the electronic device 800 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 850. Furthermore, the electronic device 800 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 860. As shown, the network adapter 860 communicates with other modules of the electronic device 800 via a bus 830. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0157] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0158] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary implementations of the present disclosure described in the above "Exemplary Method" section of the present specification.

[0159] According to the program product for implementing the above method in the embodiment of the present disclosure, it can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0160] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0161] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0162] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0163] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0164] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0165] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are to be considered as exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

Claims

1. A channel detection method, characterized in that: include: Acquire session metadata and network traffic data corresponding to the network request within a preset time period, aggregate the session metadata, and obtain group metadata; Screening the group metadata to obtain target group metadata, and determining a first vector corresponding to the session metadata included in the target group metadata; Searching the network traffic data according to the target group metadata to obtain target network traffic data, and generating a second vector corresponding to the target network traffic data; A splicing vector is generated according to the first vector and the second vector, a center point vector of the splicing vector and a standard deviation of a distance to the center point vector are obtained, and a detection result of a network channel corresponding to the network request is obtained based on the standard deviation.

2. The method according to claim 1, characterized in that The aggregating the session metadata to obtain group metadata includes: Acquire the public information of the session metadata and the network traffic data; wherein the public information includes a timestamp, a source IP address, a destination IP address, a source port number, and a destination port number; The session metadata of different timestamps are aggregated according to the source IP address, the destination IP address and the destination port number in the public information to obtain the group metadata.

3. The method according to claim 1, characterized in that The screening of the group metadata to obtain target group metadata, and determining a first vector corresponding to the session metadata included in the target group metadata, includes: Acquire a preset threshold parameter and a length of the grouping metadata, and acquire first grouping metadata whose length is not less than the preset threshold parameter; Randomly sampling the session metadata included in the first group metadata to obtain the target group metadata; The session metadata in the target group metadata is input into a preset model to obtain a first vector corresponding to the session metadata.

4. The method according to claim 1, characterized in that: The step of searching the network traffic data according to the target group metadata to obtain the target network traffic data and generating a second vector corresponding to the target network traffic data includes: Retrieve the network traffic data according to each session metadata included in the target group metadata, and obtain target network traffic data corresponding to each session metadata; A second vector corresponding to each piece of the target network traffic data is obtained based on the duration, the number of request messages, the number of request bytes, the number of response messages, and the number of response bytes included in the target network traffic data.

5. The method according to claim 4, characterized in that The acquiring and obtaining a second vector corresponding to each piece of the target network traffic data according to the duration, the number of request messages, the number of request bytes, the number of response messages, and the number of response bytes included in the target network traffic data, comprises: Obtaining a time slice feature of each piece of the session metadata according to the duration; Obtaining a request message number feature of each session metadata according to the request message number; Obtaining a request message length feature of each session metadata according to the request byte count; Obtaining a response message number feature of each of the session metadata according to the response message number; Obtaining a response message length feature of each piece of the session metadata according to the number of response bytes; A second vector corresponding to each piece of the target network traffic data is obtained according to the time slice feature, the request message number feature, the request message length feature, the response message number feature, and the response message length feature.

6. The method according to claim 1, characterized in that The step of generating a splicing vector according to the first vector and the second vector, and obtaining a center point vector of the splicing vector and a standard deviation of a distance to the center point vector includes: splicing a first vector of each of the session metadata in the target group metadata and a second vector corresponding to the target network traffic data corresponding to the session metadata to obtain a splicing vector of each of the session metadata in the target group metadata; Performing dimension reduction on the concatenated vector to obtain a reduced dimension vector, obtaining a center point vector of the reduced dimension vector, and a distance from each of the reduced dimension vectors to the center point vector; The standard deviation is obtained according to the distance from each of the reduced-dimensional vectors to the center point vector.

7. The method according to claim 6, characterized in that The obtaining, based on the standard deviation, a detection result of a network channel corresponding to the network request includes: Acquire an anomaly detection threshold, and when the standard deviation is not less than the anomaly detection threshold, the detection result of the network channel corresponding to the network request is abnormal; When the standard deviation is smaller than the abnormality detection threshold, the detection result of the network channel corresponding to the network request is normal.

8. A channel detection device, characterized in that: include: A data aggregation module, used to obtain session metadata and network traffic data corresponding to network requests within a preset time period, and aggregate the session metadata to obtain group metadata; A data screening module, configured to screen the group metadata to obtain target group metadata, and determine a first vector corresponding to the session metadata included in the target group metadata; A data retrieval module, configured to retrieve the network traffic data according to the target group metadata, obtain target network traffic data, and generate a second vector corresponding to the target network traffic data; An anomaly detection module is used to generate a splicing vector according to the first vector and the second vector, obtain a center point vector of the splicing vector and a standard deviation of a distance to the center point vector, and obtain a detection result of a network channel corresponding to the network request based on the standard deviation.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to perform the method of any one of claims 1 to 7 by executing the executable instructions.

Images