Channel detection method and apparatus, computer program product, and electronic device

Abstract

The present disclosure relates to a channel detection method and device, a computer program product and an electronic device, and relates to the technical field of network and information security. The method comprises: obtaining session metadata and network traffic data, aggregating the session metadata to obtain grouping metadata; filtering the grouping metadata to obtain target grouping metadata, and determining a first vector corresponding to the session metadata included in the target grouping metadata; searching the target grouping metadata in the network traffic data to obtain target network traffic data, and generating a second vector corresponding to the target network traffic data; generating a splicing vector according to the first vector and the second vector, obtaining a center point of the splicing vector and a standard deviation of the distance to the center point, and obtaining a detection result of a network channel corresponding to a network request based on the standard deviation. The present disclosure solves the problems that the HTTP covert channel detection method is easy to be bypassed and it is difficult to construct training samples.

Description

Technical Field

[0001] This disclosure relates to the field of network and information security technology, and more specifically, to a channel detection method and apparatus, a computer program product, and an electronic device. Background Technology

[0002] Stored HTTP covert channels, as a form of covert communication, are commonly found in various APT and advanced network attack cases. They are typically hidden within normal HTTP traffic, transmitting malicious data or control commands by disguising themselves as legitimate network requests and responses.

[0003] In related technologies, there are two main methods for detecting stored HTTP covert channels: protocol-based detection and detection techniques based on traditional machine learning. In protocol-based detection, the HTTP protocol itself is stateless, and HTTP covert channels can utilize the redundancy and flexibility of the HTTP protocol to communicate, thereby bypassing detection based on protocol header identifiers. In traditional machine learning-based detection techniques, collecting covert channel samples is very difficult, leading to problems such as insufficient model training or overfitting.

[0004] Therefore, a new channel detection method is needed.

[0005] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] The purpose of this disclosure is to provide a channel detection method, channel detection device, computer program product, and electronic device, thereby overcoming, to at least a certain extent, the problems of HTTP covert channel detection methods being easily bypassed and difficult to construct training samples due to the limitations and defects of related technologies.

[0007] According to one aspect of this disclosure, a channel detection method is provided, comprising:

[0008] Obtain session metadata and network traffic data corresponding to network requests within a preset time period, and aggregate the session metadata to obtain group metadata;

[0009] The packet metadata is filtered to obtain the target packet metadata, and a first vector corresponding to the session metadata included in the target packet metadata is determined.

[0010] The target network traffic data is retrieved from the network traffic data based on the target packet metadata, and a second vector corresponding to the target network traffic data is generated.

[0011] A spliced ​​vector is generated based on the first vector and the second vector. The center point vector of the spliced ​​vector and the standard deviation of the distance to the center point vector are obtained. Based on the standard deviation, the detection result of the network channel corresponding to the network request is obtained.

[0012] In one exemplary embodiment of this disclosure, the aggregation of the session metadata to obtain group metadata includes:

[0013] Obtain common information of the session metadata and the network traffic data; wherein, the common information includes timestamp, source IP address, destination IP address, source port number, and destination port number;

[0014] The session metadata with different timestamps is aggregated based on the source IP address, destination IP address, and destination port number in the public information to obtain the packet metadata.

[0015] In one exemplary embodiment of this disclosure, the step of filtering the packet metadata to obtain target packet metadata and determining a first vector corresponding to the session metadata included in the target packet metadata includes:

[0016] Obtain a preset threshold parameter and the length of the group metadata; obtain the first group metadata whose length is not less than the preset threshold parameter.

[0017] The target packet metadata is obtained by randomly sampling the session metadata included in the first packet metadata.

[0018] The session metadata in the target group metadata is input into a preset model to obtain a first vector corresponding to the session metadata.

[0019] In one exemplary embodiment of this disclosure, the step of retrieving target network traffic data from the network traffic data based on the target packet metadata and generating a second vector corresponding to the target network traffic data includes:

[0020] Based on each piece of session metadata included in the target packet metadata, the network traffic data is retrieved to obtain the target network traffic data corresponding to each piece of session metadata;

[0021] A second vector corresponding to each piece of target network traffic data is obtained based on the duration, number of request messages, number of request bytes, number of response messages, and number of response bytes included in the target network traffic data.

[0022] In one exemplary embodiment of this disclosure, the step of acquiring and obtaining a second vector corresponding to each piece of target network traffic data based on the duration, number of request packets, number of request bytes, number of response packets, and number of response bytes included in the target network traffic data includes:

[0023] The temporal fragmentation characteristics of each session metadata entry are obtained based on the duration.

[0024] The number of request messages for each session metadata is determined based on the number of request messages.

[0025] The request message length characteristic of each session metadata is obtained based on the number of requested bytes;

[0026] The number of response messages for each session metadata is determined based on the number of response messages.

[0027] The response message length characteristic of each session metadata is obtained based on the number of response bytes;

[0028] Based on the time slicing feature, the number of request packets, the length of request packets, the number of response packets, and the length of response packets, a second vector corresponding to each of the target network traffic data is obtained.

[0029] In one exemplary embodiment of this disclosure, the step of generating a concatenated vector based on the first vector and the second vector, and obtaining the center vector of the concatenated vector and the standard deviation of the distance to the center vector, includes:

[0030] The first vector of each session metadata in the target packet metadata and the second vector corresponding to the target network traffic data of the session metadata are concatenated to obtain the concatenated vector of each session metadata in the target packet metadata.

[0031] The concatenated vector is dimensionality reduced to obtain a dimensionality-reduced vector. The center point vector of the dimensionality-reduced vector and the distance from each dimensionality-reduced vector to the center point vector are obtained.

[0032] The standard deviation is obtained based on the distance from each of the reduced-dimensional vectors to the center point vector.

[0033] In one exemplary embodiment of this disclosure, obtaining the detection result of the network channel corresponding to the network request based on the standard deviation includes:

[0034] Obtain an anomaly detection threshold; when the standard deviation is not less than the anomaly detection threshold, the detection result of the network channel corresponding to the network request is anomaly.

[0035] When the standard deviation is less than the anomaly detection threshold, the detection result of the network channel corresponding to the network request is normal.

[0036] According to one aspect of this disclosure, a channel detection apparatus is provided, comprising:

[0037] The data aggregation module is used to acquire session metadata and network traffic data corresponding to network requests within a preset time period, and aggregate the session metadata to obtain group metadata.

[0038] The data filtering module is used to filter the group metadata to obtain target group metadata and determine a first vector corresponding to the session metadata included in the target group metadata.

[0039] The data retrieval module is used to retrieve the target network traffic data based on the target packet metadata, obtain the target network traffic data, and generate a second vector corresponding to the target network traffic data.

[0040] An anomaly detection module is used to generate a spliced ​​vector based on the first vector and the second vector, obtain the center point vector of the spliced ​​vector and the standard deviation of the distance to the center point vector, and obtain the detection result of the network channel corresponding to the network request based on the standard deviation.

[0041] According to one aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the channel detection method described in any of the exemplary embodiments above.

[0042] According to one aspect of this disclosure, an electronic device is provided, comprising:

[0043] A processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the channel detection method according to any of the exemplary embodiments described above by executing the executable instructions.

[0044] This disclosure provides a channel detection method that acquires session metadata and network traffic data corresponding to a network request within a preset time period; aggregates the session metadata to obtain packet metadata; filters the packet metadata to obtain target packet metadata; determines a first vector corresponding to the session metadata included in the target packet metadata; retrieves target network traffic data based on the target packet metadata in the network traffic data; generates a second vector corresponding to the target network traffic data; generates a concatenated vector based on the first vector and the second vector; obtains the center vector of the concatenated vector and the standard deviation of the distance to the center vector; and obtains the detection result of the network channel corresponding to the network request based on the standard deviation. On one hand, the acquired session metadata corresponding to the network request is aggregated to obtain packet metadata. This packet metadata is then filtered to obtain target packet metadata, and a first vector corresponding to the session metadata included in the packet metadata is determined. After obtaining the first vector, network traffic data is retrieved based on the target packet metadata to obtain target network traffic data, and a second vector corresponding to the target network traffic data is generated. The first and second vectors are concatenated, and self-similarity calculation is used to achieve anomaly detection of the HTTP channel. This eliminates the need to construct an additional training sample set, improving the practicality and efficiency of channel detection. On the other hand, after obtaining the first and second vectors, they are concatenated to obtain a concatenated vector. The center vector of the concatenated vector and the standard deviation of the distance to the center vector are obtained. Based on the standard deviation, the detection result is obtained. This eliminates the need for offline model training, solving the "cold start" problem faced by detection algorithms in related technologies.

[0045] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0046] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0047] Figure 1 A flowchart illustrating a channel detection method according to an example embodiment of the present disclosure is shown schematically.

[0048] Figure 2 The flowchart illustrates a method for aggregating session metadata to obtain group metadata according to an example embodiment of the present disclosure.

[0049] Figure 3 The flowchart illustrates a method for filtering the packet metadata to obtain target packet metadata and determining a first vector corresponding to the session metadata included in the target packet metadata, according to an example embodiment of the present disclosure.

[0050] Figure 4 The flowchart illustrates a method for retrieving target network traffic data from network traffic data based on target packet metadata, according to an example embodiment of the present disclosure, and generating a second vector corresponding to the target network traffic data.

[0051] Figure 5 The flowchart illustrates a method for generating a spliced ​​vector based on a first vector and a second vector, and obtaining the center vector of the spliced ​​vector and the standard deviation of the distance to the center vector, according to an example embodiment of the present disclosure.

[0052] Figure 6 The flowchart illustrates a method for obtaining a detection result of a network channel corresponding to a network request based on the standard deviation, according to an example embodiment of the present disclosure.

[0053] Figure 7 A block diagram of a channel detection apparatus according to an exemplary embodiment of the present disclosure is shown schematically.

[0054] Figure 8 An electronic device for implementing the channel detection method described above is illustrated according to an example embodiment of the present disclosure. Detailed Implementation

[0055] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this disclosure more comprehensive and complete, and to fully convey the concept of the example embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more of the specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0056] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0057] Stored HTTP covert channels, as a form of covert communication, are commonly found in various APT (Advanced Persistent Threat) and advanced cyberattack cases. They are typically hidden within normal HTTP traffic, silently transmitting malicious data or control commands by disguising themselves as legitimate network requests and responses. Due to the widespread use and complexity of the HTTP protocol itself, these covert channels are difficult to detect and block easily.

[0058] Therefore, the detection of stored HTTP covert channels has become an urgent need in the security industry, but in practice, it is fraught with difficulties and faces two major challenges:

[0059] 1) The HTTP protocol syntax is relatively loose, containing many redundant parts. These redundant parts can be used to embed covert information. Traditional rule detection methods often rely on strict matching of protocol features, but covert channels can cleverly utilize these redundant parts to communicate, thereby bypassing rule detection.

[0060] 2) In HTTP covert channel detection, collecting enough normal HTTP request samples is relatively easy, but collecting covert channel samples is extremely difficult. Even if some covert channel samples can be collected, the ratio between these samples and normal samples may be highly imbalanced. This imbalance will seriously affect the training effect of machine learning algorithms such as SVM and random forest, leading to a decrease in the model's ability to identify covert channels.

[0061] Currently, there are two main common methods for detecting stored HTTP covert channels:

[0062] 1) Protocol-based detection: This method identifies anomalies by detecting whether the HTTP protocol state is within the agreed-upon normal range. However, the HTTP protocol itself is stateless, and HTTP covert channels can often cleverly utilize the redundancy and flexibility of the HTTP protocol to communicate, thereby bypassing detection based on protocol header identifiers.

[0063] 2) Detection techniques based on traditional machine learning: such as classification algorithms based on SVM and random forest. Constructing a training sample set is a challenge. In particular, collecting samples from hidden channels is very difficult, which may lead to undertraining or overfitting of the model, resulting in poor practicality.

[0064] To address one or more of the aforementioned issues, this exemplary embodiment first provides a channel detection method that can run on a terminal device. Of course, those skilled in the art can also run the method of this invention on other platforms as needed, and this exemplary embodiment does not impose any special limitations on this. (Reference) Figure 1 As shown, the channel detection method may include steps S110-S140:

[0065] Step S110. Obtain session metadata and network traffic data corresponding to network requests within a preset time period, and aggregate the session metadata to obtain group metadata;

[0066] Step S120. Filter the packet metadata to obtain target packet metadata, and determine the first vector corresponding to the session metadata included in the target packet metadata;

[0067] Step S130. Retrieve from the network traffic data according to the target packet metadata to obtain the target network traffic data, and generate a second vector corresponding to the target network traffic data;

[0068] Step S140. Generate a spliced ​​vector based on the first vector and the second vector, obtain the center point vector of the spliced ​​vector and the standard deviation of the distance to the center point vector, and obtain the detection result of the network channel corresponding to the network request based on the standard deviation.

[0069] The aforementioned channel detection method acquires session metadata and network traffic data corresponding to a network request within a preset time period; aggregates the session metadata to obtain packet metadata; filters the packet metadata to obtain target packet metadata; determines a first vector corresponding to the session metadata included in the target packet metadata; retrieves target network traffic data based on the target packet metadata, and generates a second vector corresponding to the target network traffic data; generates a concatenated vector based on the first vector and the second vector; obtains the center vector of the concatenated vector and the standard deviation of the distance to the center vector; and obtains the detection result of the network channel corresponding to the network request based on the standard deviation. On one hand, the acquired session metadata corresponding to the network request is aggregated to obtain packet metadata. This packet metadata is then filtered to obtain target packet metadata, and a first vector corresponding to the session metadata included in the packet metadata is determined. After obtaining the first vector, network traffic data is retrieved based on the target packet metadata to obtain target network traffic data, and a second vector corresponding to the target network traffic data is generated. The first and second vectors are concatenated, and self-similarity calculation is used to achieve anomaly detection of the HTTP channel. This eliminates the need to construct an additional training sample set, improving the practicality and efficiency of channel detection. On the other hand, after obtaining the first and second vectors, they are concatenated to obtain a concatenated vector. The center vector of the concatenated vector and the standard deviation of the distance to the center vector are obtained. Based on the standard deviation, the detection result is obtained. This eliminates the need for offline model training, solving the "cold start" problem faced by detection algorithms in related technologies.

[0070] The following provides a detailed explanation and description of each step involved in the channel detection method of the exemplary embodiments of this disclosure.

[0071] In step S110, session metadata and network traffic data corresponding to network requests within a preset time period are obtained, and the session metadata is aggregated to obtain group metadata.

[0072] The preset time period is a fixed time window, and this example embodiment does not specify a particular time period. Common network monitoring modes can be divided into two types: bypass mirroring mode and in-line monitoring mode. Based on bypass mirroring of the network, the network full-traffic probe detection system can provide session metadata and network traffic data corresponding to each HTTP request. In bypass mirroring mode, all network packets accessing the database are sent to the database gateway for analysis using traffic mirroring technology. In this example embodiment, session metadata and network traffic data corresponding to network requests can be obtained based on bypass mirroring mode. The obtained session metadata and network traffic data share common information such as timestamps, source IP addresses, destination IP addresses, source port numbers, destination port numbers, and protocol numbers. Table 1 shows some fields in the session metadata, and Table 2 shows some fields in the network traffic data.

[0073] Table 1 Session metadata

[0074]

[0075] Table 2 Network Traffic Data

[0076]

[0077] In this example embodiment, after obtaining session metadata and network traffic data, the session metadata can be aggregated to obtain packet metadata, which can be referenced. Figure 2 As shown, the session metadata is aggregated to obtain group metadata, including:

[0078] Step S210. Obtain common information of the session metadata and the network traffic data; wherein, the common information includes timestamp, source IP address, destination IP address, source port number, and destination port number;

[0079] Step S220. Aggregate the session metadata with different timestamps according to the source IP address, destination IP address and destination port number in the public information to obtain the packet metadata.

[0080] The following will further explain and illustrate steps S210 and S220. Specifically, the fields included in the obtained session metadata and network traffic data are compared to obtain common information between the session metadata and network traffic data. This common information consists of fields included in both the session metadata and network traffic data, which may include: timestamp, source IP address, destination IP address, source port number, and destination port number. In this example embodiment, no specific limitations are imposed on these fields. After obtaining the common information, the session metadata with different timestamps can be aggregated using the source IP address, destination IP address, and destination port number in the common information as the keys of key-value pairs to obtain grouped source data.

[0081] Taking the session metadata shown in Table 1 as an example, when the session metadata is aggregated with source IP address 192.168.1.1, destination IP address 203.0.113.5, and destination port 80, the resulting packet metadata is: {192.168.1.1, 203.0.113.5, 80: Session metadata 1, Session metadata 2, Session metadata 4}.

[0082] In step S120, the packet metadata is filtered to obtain target packet metadata, and a first vector corresponding to the session metadata included in the target packet metadata is determined.

[0083] After obtaining the group metadata, the session metadata included in the group metadata can be filtered to obtain the target group metadata. When filtering the session metadata included in the group metadata, a threshold parameter can be set, and filtering can be performed based on the threshold parameter. In this example embodiment, the threshold parameter is not specifically limited. After obtaining the target group metadata, a model can be trained on the session metadata included in the target group metadata to obtain a vector representation corresponding to the session metadata included in the target group metadata.

[0084] refer to Figure 3 As shown, the packet metadata is filtered to obtain target packet metadata, and a first vector corresponding to the session metadata included in the target packet metadata is determined, including:

[0085] Step S310. Obtain a preset threshold parameter and the length of the group metadata, and obtain the first group metadata whose length is not less than the preset threshold parameter;

[0086] Step S320. Randomly sample the session metadata included in the first packet metadata to obtain the target packet metadata;

[0087] Step S330. Input the session metadata in the target group metadata into the preset model to obtain the first vector corresponding to the session metadata.

[0088] The following will further explain and illustrate steps S310-S330. Specifically, firstly, a preset threshold parameter and the length of the group metadata are obtained. The length of the group metadata can be the number of session metadata records included in the group metadata. When the length of the group metadata is less than the preset threshold parameter, the analysis stops. When the length of the group metadata is not less than the preset threshold parameter, the session metadata included in the first group metadata is randomly sampled, and the target group metadata is obtained based on the sampled session metadata. After obtaining the target group metadata, the session metadata included in the target group metadata can be input into a preset model to obtain a high-dimensional first vector corresponding to the session metadata. The preset model can be a pre-trained model based on GPT or a pre-trained BERT model. In this example embodiment, the preset model is not specifically limited.

[0089] In step S130, the target network traffic data is obtained by retrieving the target packet metadata from the network traffic data, and a second vector corresponding to the target network traffic data is generated.

[0090] In this example embodiment, network traffic data can be searched using each session metadata record in the target group metadata as a search condition to obtain the target network traffic data corresponding to the session metadata. After obtaining the target network traffic data corresponding to the session metadata in the network traffic data, a second vector corresponding to the target network traffic data is obtained.

[0091] refer to Figure 4 As shown, the target network traffic data is obtained by retrieving the target packet metadata from the network traffic data, and a second vector corresponding to the target network traffic data is generated, including:

[0092] Step S410. Retrieve from the network traffic data according to each piece of session metadata included in the target packet metadata to obtain the target network traffic data corresponding to each piece of session metadata;

[0093] Step S420. Obtain and, based on the duration, number of request packets, number of request bytes, number of response packets, and number of response bytes included in the target network traffic data, obtain a second vector corresponding to each piece of the target network traffic data.

[0094] The following will further explain and illustrate steps S410 and S420. Specifically, the timestamp, source IP address, destination IP address, and destination port of each session metadata entry included in the target packet metadata are obtained. These timestamps, source IP addresses, destination IP addresses, and destination ports are used as search criteria in the network traffic data. The search is conducted using these search criteria to obtain the target network traffic data corresponding to each session metadata entry. After obtaining the target network traffic data corresponding to each session metadata entry, a second vector identifying each target network traffic data entry can be obtained based on the values ​​of the fields included in all the target network traffic data entries. The fields included in the target network traffic data can include duration, number of request packets, number of request bytes, number of response packets, and number of response bytes.

[0095] Furthermore, the step of acquiring and obtaining a second vector corresponding to each piece of target network traffic data based on the duration, number of request packets, number of request bytes, number of response packets, and number of response bytes included in the target network traffic data includes:

[0096] The temporal fragmentation characteristics of each session metadata entry are obtained based on the duration.

[0097] The number of request messages for each session metadata is determined based on the number of request messages.

[0098] The request message length characteristic of each session metadata is obtained based on the number of requested bytes;

[0099] The number of response messages for each session metadata is determined based on the number of response messages.

[0100] The response message length characteristic of each session metadata is obtained based on the number of response bytes;

[0101] Based on the time slicing feature, the number of request packets, the length of request packets, the number of response packets, and the length of response packets, a second vector corresponding to each of the target network traffic data is obtained.

[0102] Specifically, the duration included in the target network traffic data is obtained, and time-slicing features are derived based on the duration included in the target network traffic data. Among them, T i Let k be the duration in the target network traffic data corresponding to each session metadata in the target packet data, and k be the number of session metadata included in the target packet data. Based on the number of request packets included in the target network data, the request packet length characteristic of each session metadata is obtained. Among them, Req_P i Let k be the number of request packets in the target network traffic data corresponding to each session metadata in the target packet data, and k be the number of session metadata included in the target packet data. The request packet length characteristic is obtained based on the number of request bytes included in the target network data. Among them, Req_L i Let k be the number of request bytes in the target network traffic data corresponding to each session metadata in the target packet data, and k be the number of session metadata included in the target packet data. The response packet count characteristic is obtained based on the number of response packets in the target network data. Among them, Res_P i Let k be the number of response packets in the target network traffic data corresponding to each session metadata in the target packet data, and k be the number of session metadata included in the target packet data. The response packet length characteristic is obtained based on the number of response bytes included in the target network data. Among them, Res_L i is the number of response bytes in the target network traffic data corresponding to each session metadata in the target packet data, and k is the number of session metadata included in the target packet data.

[0103] After obtaining the characteristics of the number of request messages, the length of request messages, the number of response messages, and the length of response messages, a second vector can be generated based on these characteristics.

[0104] In step S140, a spliced ​​vector is generated based on the first vector and the second vector. The center point vector of the spliced ​​vector and the standard deviation of the distance to the center point vector are obtained. Based on the standard deviation, the detection result of the network channel corresponding to the network request is obtained.

[0105] After obtaining the first vector corresponding to the session metadata included in the target packet metadata and the second vector of the target network traffic data corresponding to the session metadata in the network traffic data, the first and second vectors can be concatenated to obtain the concatenated vector for each session metadata entry in the target packet metadata. After obtaining the concatenated vector for each session metadata entry, the center point vector of the target packet metadata and the standard deviation of the distance from each point to the center point vector can be determined. The channel detection result is obtained based on the standard deviation.

[0106] refer to Figure 5 As shown, a concatenated vector is generated based on the first vector and the second vector, and the center vector of the concatenated vector and the standard deviation of the distance to the center vector are obtained, including:

[0107] Step S510. Concatenate the first vector of each session metadata in the target packet metadata with the second vector corresponding to the target network traffic data corresponding to the session metadata to obtain the concatenated vector of each session metadata in the target packet metadata;

[0108] Step S520. Reduce the dimension of the spliced ​​vector to obtain a dimension-reduced vector, obtain the center point vector of the dimension-reduced vector, and the distance from each dimension-reduced vector to the center point vector;

[0109] Step S530. Obtain the standard deviation based on the distance from each of the dimension-reduced vectors to the center point vector.

[0110] The following will further explain and illustrate steps S510-S530. Specifically, the first vector corresponding to each session metadata in the target packet metadata and the second vector corresponding to the target network traffic data corresponding to the session metadata in the network traffic data are concatenated to obtain the concatenated vector for each session metadata. After obtaining the concatenated vector, the dimensionality of the concatenated vector can be reduced to obtain a dimensionality-reduced vector. This concatenated vector is a 105-dimensional multidimensional vector, which can be simplified to a 9-dimensional vector. In this example embodiment, the simplified dimension is not specifically limited. After obtaining the dimensionality-reduced vector corresponding to each session metadata, the center point vector is determined based on the dimensionality-reduced vector of each session metadata in the target packet metadata. Where vi is the dimensionality-reduced vector corresponding to each session metadata record, and k is the number of session metadata records included in the target group metadata. After obtaining the centroid vector, the distance between the dimensionality-reduced vector of each session metadata record in the target group metadata and the centroid vector can be calculated. After obtaining the distance between each dimensionality-reduced vector and the centroid vector, it is possible to... The distance standard deviation is calculated, where v* is the centroid vector, vi is the dimensionality-reduced vector corresponding to each session metadata, and k is the number of session metadata included in the target group metadata.

[0111] After obtaining the standard deviation, refer to Figure 6 As shown, based on the standard deviation, the detection result of the network channel corresponding to the network request is obtained, including:

[0112] Step S610. Obtain the anomaly detection threshold. When the standard deviation is not less than the anomaly detection threshold, the detection result of the network channel corresponding to the network request is anomaly.

[0113] Step S620. When the standard deviation is less than the anomaly detection threshold, the detection result of the network channel corresponding to the network request is normal.

[0114] The following will further explain and illustrate steps S610 and S620. Specifically, an anomaly detection threshold is obtained. This threshold can be 0.05 or other values; in this example embodiment, the anomaly detection threshold is not specifically limited. After obtaining the anomaly detection threshold, it can be compared with the standard deviation. When the standard deviation is not less than the anomaly detection threshold, the detection result of the network channel corresponding to the network request is abnormal. However, when the standard deviation is less than the anomaly detection threshold, the detection result of the network channel corresponding to the network request is normal.

[0115] The channel detection device provided in this disclosure has at least the following advantages: On the one hand, it aggregates the acquired session metadata corresponding to the network request to obtain packet metadata, filters the packet metadata to obtain target packet metadata, and determines a first vector corresponding to the session metadata included in the packet metadata. After obtaining the first vector, it searches the network traffic data according to the target packet metadata to obtain target network traffic data, and generates a second vector corresponding to the target network traffic data. It concatenates the first vector and the second vector, and realizes anomaly detection of the HTTP channel through self-similarity calculation. It does not require the construction of an additional training sample set, thus improving the practicality and efficiency of channel detection. On the other hand, after obtaining the first vector and the second vector, it concatenates the first vector and the second vector to obtain a concatenated vector. It obtains the center vector of the concatenated vector and the standard deviation of the distance to the center vector. Based on the standard deviation, it obtains the detection result. It does not require offline model training, thus solving the "cold start" problem faced by detection algorithms in related technologies.

[0116] This disclosure also provides a channel detection apparatus, with reference to exemplary embodiments thereof. Figure 7 As shown, it may include: a data aggregation module 710, a data filtering module 720, a data retrieval module 730, and an anomaly detection module 740. Wherein:

[0117] Data aggregation module 710 is used to acquire session metadata and network traffic data corresponding to network requests within a preset time period, and aggregate the session metadata to obtain group metadata;

[0118] The data filtering module 720 is used to filter the group metadata to obtain target group metadata and determine a first vector corresponding to the session metadata included in the target group metadata.

[0119] The data retrieval module 730 is used to retrieve the target network traffic data based on the target packet metadata, obtain the target network traffic data, and generate a second vector corresponding to the target network traffic data.

[0120] The anomaly detection module 740 is used to generate a spliced ​​vector based on the first vector and the second vector, obtain the center point vector of the spliced ​​vector and the standard deviation of the distance to the center point vector, and obtain the detection result of the network channel corresponding to the network request based on the standard deviation.

[0121] The specific details of each module in the aforementioned channel detection device have been described in detail in the corresponding channel detection methods, so they will not be repeated here.

[0122] In one exemplary embodiment of this disclosure, the data aggregation module includes:

[0123] The public information determination module is used to obtain public information of the session metadata and the network traffic data; wherein, the public information includes timestamp, source IP address, destination IP address, source port number, and destination port number;

[0124] The packet metadata acquisition module is used to aggregate the session metadata with different timestamps based on the source IP address, destination IP address and destination port number in the public information to obtain the packet metadata.

[0125] In one exemplary embodiment of this disclosure, the data filtering module includes:

[0126] The first group metadata determination module is used to obtain a preset threshold parameter and the length of the group metadata, and to obtain the first group metadata whose length is not less than the preset threshold parameter;

[0127] The target packet metadata determination module is used to randomly sample the session metadata included in the first packet metadata to obtain the target packet metadata;

[0128] The first vector acquisition module is used to input the session metadata in the target group metadata into a preset model to obtain a first vector corresponding to the session metadata.

[0129] In one exemplary embodiment of this disclosure, the data retrieval module includes:

[0130] The network traffic data matching module is used to retrieve target network traffic data corresponding to each piece of session metadata included in the target packet metadata.

[0131] The second vector generation module is used to obtain and, based on the duration, number of request packets, number of request bytes, number of response packets, and number of response bytes included in the target network traffic data, obtain a second vector corresponding to each piece of the target network traffic data.

[0132] In one exemplary embodiment of this disclosure, the second vector generation module includes:

[0133] A time-slicing feature determination module is used to obtain the time-slicing feature of each session metadata item based on the duration.

[0134] The request message count feature determination module is used to obtain the request message count feature of each session metadata based on the number of request messages;

[0135] The request message length feature determination module is used to obtain the request message length feature of each session metadata based on the number of request bytes;

[0136] The response message count feature determination module is used to obtain the response message count feature of each session metadata based on the response message count;

[0137] The response message length feature determination module is used to obtain the response message length feature of each session metadata based on the number of response bytes;

[0138] The second vector determination module is used to obtain a second vector corresponding to each of the target network traffic data based on the time slicing characteristics, the number of request packets, the length of request packets, the number of response packets, and the length of response packets.

[0139] In one exemplary embodiment of this disclosure, the anomaly detection module includes:

[0140] The vector concatenation module is used to concatenate the first vector of each session metadata in the target packet metadata with the second vector corresponding to the target network traffic data of the session metadata, so as to obtain the concatenated vector of each session metadata in the target packet metadata.

[0141] The vector distance calculation module is used to reduce the dimensionality of the concatenated vectors to obtain a dimensionality-reduced vector, obtain the center point vector of the dimensionality-reduced vector, and the distance from each dimensionality-reduced vector to the center point vector;

[0142] The standard deviation determination module is used to obtain the standard deviation based on the distance from each of the dimension-reduced vectors to the center point vector.

[0143] In one exemplary embodiment of this disclosure, the anomaly detection module includes:

[0144] The first detection module is used to obtain an anomaly detection threshold. When the standard deviation is not less than the anomaly detection threshold, the detection result of the network channel corresponding to the network request is anomaly.

[0145] The second detection module is used to determine that the detection result of the network channel corresponding to the network request is normal when the standard deviation is less than the anomaly detection threshold.

[0146] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0147] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0148] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0149] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0150] The following reference Figure 8 To describe an electronic device 800 according to such an embodiment of the present disclosure. Figure 8 The electronic device 800 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0151] like Figure 8 As shown, the electronic device 800 is manifested in the form of a general-purpose computing device. The components of the electronic device 800 may include, but are not limited to: at least one processing unit 810, at least one storage unit 820, a bus 830 connecting different system components (including storage unit 820 and processing unit 810), and a display unit 840.

[0152] The storage unit stores program code that can be executed by the processing unit 810, causing the processing unit 810 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processing unit 810 can perform actions such as... Figure 1 The steps shown are as follows: S110: Obtain session metadata and network traffic data corresponding to the network request within a preset time period, aggregate the session metadata to obtain packet metadata; S120: Filter the packet metadata to obtain target packet metadata, and determine a first vector corresponding to the session metadata included in the target packet metadata; S130: Search the network traffic data according to the target packet metadata to obtain target network traffic data, and generate a second vector corresponding to the target network traffic data; S140: Generate a spliced ​​vector according to the first vector and the second vector, obtain the center point vector of the spliced ​​vector and the standard deviation of the distance to the center point vector, and obtain the detection result of the network channel corresponding to the network request based on the standard deviation.

[0153] Storage unit 820 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 8201 and / or cache memory 8202, and may further include a read-only memory (ROM) 8203.

[0154] The storage unit 820 may also include a program / utility 8204 having a set (at least one) of program modules 8205, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0155] Bus 830 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0156] Electronic device 800 can also communicate with one or more external devices 900 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 800, and / or with any device that enables electronic device 800 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 850. Furthermore, electronic device 800 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 860. As shown, network adapter 860 communicates with other modules of electronic device 800 via bus 830. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0157] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0158] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible implementations, various aspects of this disclosure may also be implemented as a program product including program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of this disclosure described in the "Exemplary Methods" section above.

[0159] The program product for implementing the above-described method according to embodiments of the present disclosure may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0160] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0161] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0162] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0163] Program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0164] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this disclosure and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0165] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

Claims

1. A channel detection method, characterized in that, include: Obtain session metadata and network traffic data corresponding to network requests within a preset time period, and obtain common information of the session metadata and network traffic data; wherein, the common information includes timestamp, source IP address, destination IP address, source port number, and destination port number; aggregate the session metadata of different timestamps according to the source IP address, destination IP address, and destination port number in the common information to obtain group metadata; Obtain a preset threshold parameter and the length of the group metadata; obtain a first group metadata whose length is not less than the preset threshold parameter; randomly sample the session metadata included in the first group metadata to obtain target group metadata; input the session metadata in the target group metadata into a preset model to obtain a first vector corresponding to the session metadata; The network traffic data is retrieved based on each session metadata entry included in the target packet metadata to obtain target network traffic data corresponding to each session metadata entry; a second vector corresponding to each target network traffic data entry is obtained based on the duration, number of request packets, number of request bytes, number of response packets, and number of response bytes included in the target network traffic data. A spliced ​​vector is generated based on the first vector and the second vector. The center point vector of the spliced ​​vector and the standard deviation of the distance from the spliced ​​vector to the center point vector are obtained. Based on the standard deviation, the detection result of the network channel corresponding to the network request is obtained.

2. The method according to claim 1, characterized in that, The step of acquiring and obtaining a second vector corresponding to each piece of target network traffic data based on the duration, number of request packets, number of request bytes, number of response packets, and number of response bytes included in the target network traffic data includes: The temporal fragmentation characteristics of each session metadata entry are obtained based on the duration. The number of request messages for each session metadata is determined based on the number of request messages. The request message length characteristic of each session metadata is obtained based on the number of requested bytes; The number of response messages for each session metadata is determined based on the number of response messages. The response message length characteristic of each session metadata is obtained based on the number of response bytes; Based on the time slicing feature, the number of request packets, the length of request packets, the number of response packets, and the length of response packets, a second vector corresponding to each of the target network traffic data is obtained.

3. The method according to claim 1, characterized in that, The step of generating a concatenated vector based on the first vector and the second vector, and obtaining the center vector of the concatenated vector and the standard deviation of the distance to the center vector, includes: The first vector of each session metadata in the target packet metadata and the second vector corresponding to the target network traffic data of the session metadata are concatenated to obtain the concatenated vector of each session metadata in the target packet metadata. The concatenated vector is dimensionality reduced to obtain a dimensionality-reduced vector. The center point vector of the dimensionality-reduced vector and the distance from each dimensionality-reduced vector to the center point vector are obtained. The standard deviation is obtained based on the distance from each of the reduced-dimensional vectors to the center point vector.

4. The method according to claim 3, characterized in that, The step of obtaining the detection result of the network channel corresponding to the network request based on the standard deviation includes: Obtain an anomaly detection threshold; when the standard deviation is not less than the anomaly detection threshold, the detection result of the network channel corresponding to the network request is anomaly. When the standard deviation is less than the anomaly detection threshold, the detection result of the network channel corresponding to the network request is normal.

5. A channel detection device, characterized in that, include: The data aggregation module is used to obtain session metadata and network traffic data corresponding to network requests within a preset time period, and to obtain common information of the session metadata and the network traffic data; wherein, the common information includes timestamp, source IP address, destination IP address, source port number, and destination port number; and to aggregate the session metadata of different timestamps according to the source IP address, destination IP address, and destination port number in the common information to obtain group metadata; A data filtering module is used to obtain a preset threshold parameter and the length of the group metadata; obtain a first group metadata whose length is not less than the preset threshold parameter; randomly sample the session metadata included in the first group metadata to obtain target group metadata; and input the session metadata in the target group metadata into a preset model to obtain a first vector corresponding to the session metadata. The data retrieval module is used to retrieve network traffic data based on each piece of session metadata included in the target group metadata, to obtain target network traffic data corresponding to each piece of session metadata; and to obtain a second vector corresponding to each piece of target network traffic data based on the duration, number of request packets, number of request bytes, number of response packets, and number of response bytes included in the target network traffic data. An anomaly detection module is used to generate a spliced ​​vector based on the first vector and the second vector, obtain the center point vector of the spliced ​​vector and the standard deviation of the distance from the spliced ​​vector to the center point vector, and obtain the detection result of the network channel corresponding to the network request based on the standard deviation.

6. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 4.

7. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the method of any one of claims 1-4 by executing the executable instructions.

Images