Remote desktop protocol bearer service type identification method based on full load mark sequence

Abstract

The invention discloses a remote desktop protocol bearer service type identification method based on a full-load marking sequence. The method comprises the following steps: step 1, performing full-load marking on each data packet in remote desktop protocol traffic; step 2, alternately dividing the data stream into a full-load continuous packet group and a non-full-load continuous packet group; step 3, forming a load identification packet cluster by each non-full-load continuous packet group and a subsequent full-load continuous packet group; step 4, extracting intra-cluster spatial features and time features of each packet cluster; 5, representing each data stream as a load identification packet cluster feature sequence; step 6, discrete wavelet transform is carried out on the multi-dimensional load identification packet cluster feature sequence, and robust feature vectors are extracted; 7, training a Gaussian mixture model; and step 8, realizing service type identification for the to-be-identified data stream. Through the method, different service types in the remote desktop protocol flow can be accurately identified, and technical support is provided for network behavior supervision and communication governance.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic analysis, and in particular to a remote desktop protocol bearer service type identification method based on a full-load mark sequence. Background Art

[0002] Remote Desktop Protocol (RDP) is a common protocol used to provide remote display and input capabilities, allowing users to connect to remote computers through the network to achieve remote control and resource sharing. RDP supports a variety of functions, including remote desktop display and interaction, file transfer, printing, audio redirection, device redirection, etc., and is widely used in remote office, remote education and remote maintenance in industries such as power and municipal administration.

[0003] With the development of network technology, RDP faces increasingly severe security challenges during its use. In order to protect data security, RDP communications are usually encrypted, which makes it difficult for traditional content-based traffic analysis methods to identify the specific service types it carries. Existing protocol identification methods mainly rely on signature matching, deep packet inspection and other means, but when faced with encrypted traffic, the effectiveness of these methods is greatly reduced and they cannot accurately identify the service types carried in RDP traffic.

[0004] In addition, RDP traffic features are complex, and traffic patterns of multiple service types differ, but due to encryption, traditional methods cannot effectively use these differences for identification. This poses a challenge to network behavior supervision and communication governance, and there is an urgent need for a method that does not rely on decryption and can identify service types based on the statistical characteristics of encrypted traffic. Summary of the invention

[0005] In view of the problem that the existing technology cannot effectively identify the service type carried by the remote desktop protocol, which leads to challenges in network behavior supervision and communication management, the present invention provides a remote desktop protocol carried service type identification method based on a full-load tag sequence, which can accurately identify different service types in remote desktop protocol traffic and provide technical support for network behavior supervision and communication management.

[0006] The method of the present invention comprises the following steps:

[0007] Step 1: During the Remote Desktop Protocol communication process, capture the RDP traffic data in the target network. i Perform full load marking to form a binary full load marking sequence C = {C1, C2, ..., C n},in:

[0008]

[0009] Among them, len(P i ) indicates the length of the data packet, L MTU The preset full-load packet length is usually the maximum transmission unit (MTU) of the link, such as 1500 bytes.

[0010] Step 2: Starting from the first data packet, according to the full load mark sequence C, the data stream F is alternately divided into full load continuous packet groups and non-full load continuous packet groups.

[0011] Step 3: Take each non-full-load continuous packet group N i and the subsequent full load continuous package group A i Composition payload identification packet cluster G i = {N i , A i}.

[0012] Step 4: Identify the packet cluster G for each payload i Extract the spatial and temporal features within the cluster, and form the feature vector v i , features include:

[0013] (1) Intra-cluster spatial characteristics:

[0014] ①Total number of packets in the cluster T i =|N i |+|A i |;

[0015] ② Full load package ratio

[0016] ③Mean value of non-full-load package length μ L and variance

[0017] ④ The first-order entropy H1 and second-order entropy H2 of the non-full-load packet length quantization sequence:

[0018] The quantization step size Quantization formula First-order entropy: H1 = -∑ j p j log2p j Among them, p j is the probability of quantization length j; second-order entropy: H2 = -∑ j，k p jk log2p jk Among them, p jk is the joint probability of adjacent quantization lengths j and k.

[0019] (2) Intra-cluster temporal characteristics:

[0020] ① Mean delay between packets μT and variance The inter-packet delay Δt k =t k -t k-1 ;

[0021] ② The time entropy H of the binary packet delay sequence T :

[0022] Binarized sequence:

[0023] Time Entropy: Among them, p b is the probability that the value in the binary sequence is b.

[0024] ③ Statistical characteristics of the binary inter-packet delay sequence run: including the average run length L run and the number of runs N run .

[0025] Step 5: Extract the multidimensional features in step 4 from each data stream in accordance with the divided payload identification packet clusters, and represent them as a payload identification packet cluster feature sequence; represent each data stream as a payload identification packet cluster feature sequence of length N (e.g., N=20), and perform zero padding on data streams with less than N packet clusters to form a feature sequence of uniform length.

[0026] Step 6: Perform discrete wavelet transform on the multidimensional feature sequence to extract robust feature vectors. Discrete wavelet transform uses Daubechies wavelet basis function to perform multi-scale decomposition on the feature sequence, extract time-frequency domain features, and improve the robustness of the feature vector.

[0027] Step 7: Based on the sample data with service type labels, Gaussian mixture model (GMM) is used for unsupervised clustering training to obtain the cluster center of each service type. The GMM training process is: first, initialize the parameters, set the number of Gaussian components K as the number of service types, and use the K-means clustering results to initialize the mean, covariance and mixing coefficient; then perform EM algorithm iterative optimization, iteratively calculate the posterior probability of the sample data through the expectation maximization (EM) algorithm, and update the model parameters until convergence.

[0028] Step 8: For the data stream to be identified, extract the feature vector according to the above steps, calculate its similarity with each cluster center, and realize the identification of the bearer service type. The similarity calculation uses the Mahalanobis distance to calculate the distance between the feature vector of the data stream to be identified and each cluster center, and selects the service type corresponding to the cluster center with the smallest distance as the identification result.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] First, it does not require decryption and has strong applicability. This method does not rely on decryption of the data packet content and is suitable for encrypted RDP traffic, which has wide applicability. Secondly, it has rich features and accurate recognition. By extracting rich spatial and temporal features, it captures the differences in traffic patterns of different service types and improves recognition accuracy. Thirdly, it has strong robustness. Discrete wavelet transform and unsupervised clustering algorithms are used to improve the robustness of features and the generalization ability of the model. In addition, the implementation cost is low. The unsupervised clustering method does not require a large amount of manually labeled data, which reduces the implementation cost and is easy to deploy and apply.

[0031] The method of the present invention can accurately identify different service types in remote desktop protocol traffic, provides technical support for network behavior supervision and communication management, and has important practical application value. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 The present invention is a flow chart of a method for identifying a remote desktop protocol bearer service type based on a full-load mark sequence. DETAILED DESCRIPTION

[0033] The method of the present invention is described in detail below in conjunction with the accompanying drawings.

[0034] like Figure 1 As shown, a method for identifying a remote desktop protocol bearer service type based on a full-load tag sequence of the present invention comprises the following steps:

[0035] Step 1: Packet full mark

[0036] For each packet P in the RDP traffic i Perform full load marking to form a binary full load marking sequence C = {C1, C2, ..., C n},in:

[0037]

[0038] len(P i ) indicates data packet P i Length;

[0039] L MTU is the preset full-load packet length, which is usually the maximum transmission unit (MTU) of the link, such as 1500 bytes;

[0040] n is the total number of packets.

[0041] Step 2: Data flow division

[0042] Starting from the first data packet, the data stream F is divided alternately into full-load continuous packet groups and non-full-load continuous packet groups according to the full-load mark sequence C.

[0043] Full-load continuous packet group: a sequence of continuous data packets with the full-load mark 1;

[0044] Non-full continuous packet group: a sequence of continuous data packets whose full mark is 0.

[0045] Step 3: Formation of payload identification packet cluster

[0046] Each non-full load continuous packet group N i and the subsequent full load continuous package group A i Composition payload identification packet cluster G i = {N i , A i}.

[0047] In order to ensure the correctness of the packet cluster, it should be noted that if the first packet group of the data stream is a full continuous packet group, the full continuous packet group is skipped until the first non-full continuous packet group is found to start forming a packet cluster.

[0048] Step 4: Feature extraction

[0049] For each payload identification packet cluster G i Extract the spatial and temporal features within the cluster to form the feature vector v i

[0050] (1) Intra-cluster spatial characteristics include:

[0051] Total number of packets in the cluster T i :

[0052] T i =|N i |+|A i |

[0053] Among them, |N i | and |A i | respectively represent N i and A i The number of packets in .

[0054] Full load package ratio R i :

[0055]

[0056] Mean length of non-full-load package μ L :

[0057]

[0058] Partially loaded packet length variance

[0059]

[0060] The first-order entropy H1 and second-order entropy H2 of the non-full packet length quantization sequence are:

[0061] Quantization step size q:

[0062]

[0063] Quantization length sequence Q = {Q k}:

[0064]

[0065] First-order entropy H1:

[0066]

[0067] Among them, p j is the probability of quantization length j, that is:

[0068]

[0069] Second order entropy H2:

[0070]

[0071] Among them, p jk is the joint probability of adjacent quantization lengths j and k, that is:

[0072]

[0073] (2) Intra-cluster temporal characteristics

[0074] Mean inter-packet delay μT:

[0075]

[0076] Inter-packet delay sequence

[0077] Δt k =t k -t k-1 , k = 2, 3, ..., T i

[0078] Among them, t k is the timestamp of the kth data packet.

[0079] Inter-packet delay variance

[0080]

[0081] Time entropy H T :

[0082]

[0083] Binarized Inter-Packet Delay Sequence

[0084]

[0085] Among them, p b is the probability that the value in the binary sequence S is b.

[0086] Binarized inter-packet delay sequence run statistics characteristics:

[0087] Average run length L run :Assume that there are N binary sequences S run The sum of the lengths of all runs is L total ,but:

[0088]

[0089] Number of runs N run : The total number of runs in the binary sequence S; a run refers to the number of consecutive subsequences of the same value in a binary sequence.

[0090] Step 5: Feature sequence construction

[0091] Extract the multi-dimensional features in step 4 from each data stream in sequence according to the segmented payload identification packet clusters, and express them as a payload identification packet cluster feature sequence;

[0092] The feature vector v of each packet cluster i Arrange them in the order of the data stream to form a feature sequence:

[0093] Feature = [v1, v2, ..., v m ]

[0094] m is the number of payload identification packet clusters. For uniform processing, if m<20, the feature sequence is padded with zeros to make its length reach 20.

[0095] Step 6: Discrete Wavelet Transform

[0096] Discrete wavelet transform (DWT) is used to extract robust feature vectors from multi-dimensional payload identification packet cluster feature sequences.

[0097] Wavelet basis function: You can choose Daubechies (db4) wavelet basis function.

[0098] Number of decomposition levels: The number of decomposition levels is determined based on the length and characteristics of the feature sequence.

[0099] Through DWT, the feature sequence can be decomposed into low-frequency approximate coefficients and high-frequency detail coefficients, retaining effective information, removing noise, and enhancing the robustness of the feature.

[0100] Step 7: Gaussian mixture model training

[0101] Based on the sample data with labeled service type labels, Gaussian mixture model (GMM) is used for unsupervised clustering training.

[0102] (1) Model initialization

[0103] Number of Gaussian components K: set to the number of service types, for example 5.

[0104] Initial parameters: The result of K-means clustering can be used to initialize the mean vector μ of GMM k , covariance matrix∑ k and the mixing coefficient π k .

[0105] (2) Expectation-Maximization (EM) Algorithm

[0106] Repeat the following steps until the model converges:

[0107] Step E (Expectation): Calculate the posterior probability γ of the sample belonging to each Gaussian component ik , that is, the degree of responsibility:

[0108]

[0109] where x i is the sample feature vector; is the probability density function of the kth Gaussian component.

[0110] M step (Maximization):

[0111] Update the following model parameters:

[0112] Mixing coefficient:

[0113]

[0114] in, N is the total number of samples.

[0115] Mean vector:

[0116]

[0117] Covariance matrix:

[0118]

[0119] (3) Clustering results

[0120] After the training is completed, the parameters of the Gaussian components corresponding to each service type are obtained.

[0121] Step 8: Service type identification

[0122] For the data stream to be identified, the feature vector is extracted according to the above steps, and discrete wavelet transform processing is performed to obtain the feature representation x.

[0123] Calculate the Mahalanobis distance between the feature vector x and each Gaussian component, that is, the following posterior probability:

[0124]

[0125] Select the k with the largest posterior probability * The corresponding service type is used as the identification result:

[0126]

[0127] The present invention provides a method for identifying the type of remote desktop protocol bearer service based on full load mark sequence analysis. By marking the full load of RDP traffic, a binary full load mark sequence is constructed, and each service type is accurately identified by combining feature extraction and discrete wavelet transform. This method effectively overcomes the limitation that encrypted traffic cannot be unpacked and analyzed, and provides technical support for network security and communication management. The above is only a specific implementation method of the present application, but the scope of protection of the present application is not limited to this. Any technician familiar with the technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be covered within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be based on the scope of protection of the claims.

[0128] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not intended to limit the present invention. A person skilled in the art should understand that the specific implementation of the present invention can be modified or replaced by equivalents, but these modifications or changes are within the scope of protection of the pending claims.

Claims

1. A method for identifying the type of remote desktop protocol bearer service based on a full-load tag sequence, characterized in that: The method comprises the following steps: Step 1: For each packet P in the Remote Desktop Protocol (RDP) traffic i Full load mark is performed. If the data packet length is equal to the preset full load packet length L MTU , then mark C i =1; otherwise C i = 0; forming a binary full load mark sequence C = {C1, C2, ..., C n },in: len(P i ) indicates data packet P i The length of n is the total number of data packets; Step 2: Starting from the first data packet, the data stream F is alternately divided into full-load continuous packet groups and non-full-load continuous packet groups according to the full-load mark sequence C; Step 3: Take each non-full-load continuous packet group N i and the subsequent full load continuous package group A i Composition payload identification packet cluster G i = {N i ,A i }; Step 4: Identify the packet cluster G for each payload i Extract the spatial and temporal features within the cluster to form the feature vector v i ; Step 5: extract the multi-dimensional features in step 4 from each data stream in sequence according to the segmented payload identification packet clusters, and express them as a payload identification packet cluster feature sequence; Step 6: Perform discrete wavelet transform on the multi-dimensional characteristic sequence of the payload identification packet cluster to extract a robust characteristic vector; Step 7: Based on the sample data with service type labels, Gaussian mixture model (GMM) is used for unsupervised clustering training to obtain the cluster center of each service type; Step 8: For the data stream to be identified, extract the feature vector according to the above steps, calculate its similarity with each cluster center, and realize the identification of the bearer service type.

2. According to the method for identifying the type of remote desktop protocol bearer service based on a full load mark sequence according to claim 1, it is characterized in that: The preset full load package length L MTU is the maximum transmission unit of the link.

3. According to claim 1, a method for identifying a remote desktop protocol bearer service type based on a full-load tag sequence, characterized in that: The intra-cluster spatial features include: ①Total number of packets in the cluster T i : T i =|N i |+|A i | ②Full load package ratio R i : ③Mean value of non-full-load package length μ L and variance ④ The first-order entropy H1 and second-order entropy H2 of the non-full-load packet length quantization sequence, where the quantization step length of the non-full-load packet length quantization sequence The quantification formula is: Among them, P k ∈N i , Q k is the quantized length of the non-full-loaded packet; The calculation formula of first-order entropy H1 is: The calculation formula of second-order entropy H2 is: Among them, p j is the probability of quantizing length j, p jk is the joint probability of adjacent quantization lengths j and k.

4. The method for identifying the type of remote desktop protocol bearer service based on a full-load tag sequence according to claim 3, characterized in that: The intra-cluster time features include: ① Mean delay between packets μ T and variance Inter-packet delay Δt k : Δt k =t k -t k-1 Among them, t k is the arrival time of the kth data packet, k = 2, 3, ..., T i ; ② The time entropy H of the binary packet delay sequence T : Note the binary packet delay sequence Time entropy H T Calculation formula: Among them, p b is the probability that the value in the binary sequence is b; ③Statistical characteristics of the binary inter-packet delay sequence run length, average run length L run and the number of runs N run : Average run length L run : The average length of consecutive subsequences of the same value in the binary sequence S; Number of runs N run : The total number of runs in the binary sequence S.

5. A method for identifying the type of remote desktop protocol bearer service based on a full load mark sequence according to claim 4, characterized in that: The quantization step length q of the non-full packet length quantization sequence is equal to the full packet length L MTU One quarter of Where P k This is a non-fully loaded package.

6. A method for identifying a remote desktop protocol bearer service type based on a full-load tag sequence according to claim 4, characterized in that: The binary inter-packet delay sequence S k For the inter-packet delay Δt k , when Δt k >μ T It is recorded as 1 when it is, otherwise it is recorded as 0.

7. The method for identifying the type of remote desktop protocol bearer service based on a full-load tag sequence according to claim 1, characterized in that: The discrete wavelet transform adopts Daubechies wavelet (db4) basis function, performs multi-scale decomposition on the multi-dimensional feature sequence, and extracts time-frequency domain features to improve the robustness of the feature vector.

8. The method for identifying the type of remote desktop protocol bearer service based on a full-load tag sequence according to claim 1, characterized in that: The Gaussian mixture model (GMM) is iteratively optimized through an expectation maximization (EM) algorithm to estimate the mixing coefficient, mean vector and covariance matrix of the model, and obtain the cluster center of each service type.

9. The method for identifying the type of remote desktop protocol bearer service based on a full-load tag sequence according to claim 1, characterized in that: The similarity calculation uses Mahalanobis distance to calculate the distance between the feature vector of the data stream to be identified and each cluster center, and selects the service type corresponding to the cluster center with the smallest distance as the identification result.

10. The method for identifying the type of remote desktop protocol bearer service based on a full-load tag sequence according to claim 1, characterized in that: The remote desktop protocol bearer service types that can be identified by the method include remote desktop display and interaction services, file transfer services, printing services, audio redirection services, device redirection services and other service types.

Images