Encrypted malicious traffic detection method and device and electronic equipment

Abstract

The embodiment of the invention provides an encrypted malicious traffic detection method and device and electronic equipment, and the method comprises the steps: collecting to-be-detected service traffic, extracting a feature vector of each TCP stream in the service traffic, inputting the extracted feature vectors into a trained detection model, and obtaining a detection result; obtaining a detection result of whether the traffic output by the detection model belongs to malicious encrypted traffic; the trained detection model comprises a detection model obtained by training a support vector machine model by adopting known malicious encrypted traffic and normal service traffic; in the training process, feature vectors of multiple dimensions of each TCP stream are extracted from malicious encrypted traffic and normal service traffic and input into the support vector machine model, wherein the feature vectors comprise a first feature vector associated with adjacent frame request packet time difference and adjacent frame return packet time difference, a second feature vector associated with the number of request packets and the number of return packets and the like. According to the method, the problem that the detection effect of a traditional firewall on malicious encrypted traffic is poor in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of traffic detection, and in particular to an encrypted malicious traffic detection method, an encrypted malicious traffic detection device, and an electronic device. Background Art

[0002] With the development of computer networks, more and more companies have begun to pay attention to information construction, which has also led to increasingly severe network security issues. Common security risks include endless zero-day vulnerabilities, APT (Advanced Persistent Threat), encrypted malicious traffic, worm viruses, etc. After the attacker gains control of the host through certain means, he usually uses encryption algorithms to encrypt subsequent communication traffic to achieve continuous control of the target host and evade detection by security products. In order to deal with these security risks, companies usually deploy firewall devices for detection and defense. Traditional firewall devices usually use regular expressions to detect network communication traffic. The security operators of traditional firewalls will continuously analyze the attack characteristics of various attack traffic and write corresponding detection rules according to the attack to detect and intercept the attack traffic. However, since the encrypted traffic encrypts the malicious features through the encryption algorithm, there is no obvious attack feature, so it is impossible to write regular expressions for the encrypted traffic. Therefore, the detection effect of traditional firewalls on malicious encrypted traffic is usually poor. Summary of the invention

[0003] The embodiment of the present invention provides a method, device and electronic device for detecting encrypted malicious traffic to solve the problem that the traditional firewall in the prior art has poor detection effect on malicious encrypted traffic.

[0004] The embodiment of the present invention discloses a method for detecting encrypted malicious traffic, comprising:

[0005] Collecting the service traffic to be detected, extracting the feature vector of each TCP flow in the service traffic to be detected, inputting the extracted feature vector into the trained detection model, and obtaining the detection result output by the detection model as to whether the traffic belongs to malicious encrypted traffic;

[0006] The trained detection model includes: a detection model obtained by training a support vector machine model using known malicious encrypted traffic and normal business traffic;

[0007] During the training process, it is necessary to extract feature vectors of multiple dimensions of each TCP flow from malicious encrypted traffic and normal business traffic and input them into the support vector machine model.

[0008] The feature vector includes one or more of the following:

[0009] Feature vectors associated with the time difference between request packets of adjacent frames and the time difference between return packets of adjacent frames, feature vectors associated with the number of request packets and the number of return packets, feature vectors associated with the number of bytes in request packets and the number of bytes in return packets, feature vectors related to the payload in request packets and the payload in return packets, feature vectors related to the number of source IP addresses and the number of destination IP addresses.

[0010] Optionally, the method further comprises:

[0011] Acquire a training data set for training a detection model, wherein the training data set includes: malicious encrypted traffic and normal business traffic;

[0012] Extract feature vectors of multiple dimensions for each TCP flow from malicious encrypted traffic and normal business traffic in the training data set;

[0013] All extracted feature vectors are input into the support vector machine model to train the parameters of the support vector machine model and obtain the trained detection model.

[0014] Optionally, feature vectors of multiple dimensions of each TCP flow are extracted for malicious encrypted traffic and normal business traffic in the training data set, including:

[0015] Get the source IP address of each TCP flow in the traffic s and destination IP address r , the number of request packets from the source IP address to the destination IP address, the number of reply packets from the destination IP address to the source IP address, the information of the TCP data segment and the TCP message segment in each request packet / reply packet; and the time difference between adjacent frame request packets and adjacent reply packets in each TCP stream;

[0016] According to the source IP address IP s and destination IP address r , the number of request packets from the source IP address to the destination IP address, the number of return packets from the destination IP address to the source IP address, the information of the TCP data segment and the TCP message segment in each request packet / reply packet; and the time difference between adjacent frame request packets and adjacent return packets in each TCP stream, to generate feature vectors of multiple dimensions.

[0017] Optionally, feature vectors of multiple dimensions of each TCP flow are extracted for malicious encrypted traffic and normal business traffic in the training data set, including:

[0018] Generate a feature vector t1 of the first dimension according to the time difference between the adjacent frame request packets and the time difference between the adjacent return packets. D s is the sum of the time differences of the request packets, D r The sum of the time differences of the return packets;

[0019] and / or,

[0020] According to the source IP address s and destination IP address r The number of request packets and return packets between them is used to generate the feature vector of the second dimension, for example t2. N s IP s Send to IP r The number of request packets, N d IP r Send to IP s The number of return packets;

[0021] and / or,

[0022] According to the source IP address s and destination IP address r The length of each TCP data segment in the request packet and the response packet is used to generate the feature vector t3 of the third dimension. L s L is the sum of the number of bytes in the request packet in the sum of the TCP data segment lengths. r It is the sum of the bytes in the returned packets in the sum of the lengths of the TCP data segments;

[0023] and / or,

[0024] According to the source IP address s and destination IP address r The payload information of the TCP segments in the request packet and the reply packet is used to generate the feature vector t4 of the fourth dimension. R s is the number of repeated letters in the request packet obtained based on the TCP segment payload, R r The number of repeated letters in the reply packet obtained based on the payload of the TCP segment;

[0025] and / or,

[0026] According to the source IP address s and destination IP address r , generate the fifth dimension feature vector t5, IP s 'Convert the source IP address to a specified base value, IP r 'Convert the destination IP address to a specified base value.

[0027] Optionally, IP s 'Convert the source IP address to a decimal value, IP r 'Convert the destination IP address into a decimal value;

[0028] Alternatively, IP s 'Convert the source IP address to a hexadecimal value, IP r 'Convert the destination IP address to a hexadecimal value.

[0029] The embodiment of the present invention also discloses a training method for an encrypted malicious traffic detection model, comprising:

[0030] Acquire a training data set for training a detection model, wherein the training data set includes: malicious encrypted traffic and normal business traffic;

[0031] Extract feature vectors of multiple dimensions for each TCP flow from malicious encrypted traffic and normal business traffic in the training data set;

[0032] Input all extracted feature vectors into the support vector machine model to train the parameters of the support vector machine model and obtain a trained detection model;

[0033] The feature vectors of multiple dimensions of each TCP flow include one or more of the following:

[0034] Feature vectors associated with the time difference between request packets of adjacent frames and the time difference between return packets of adjacent frames, feature vectors associated with the number of request packets and the number of return packets, feature vectors associated with the number of bytes in request packets and the number of bytes in return packets, feature vectors related to the payload in request packets and the payload in return packets, feature vectors related to the number of source IP addresses and the number of destination IP addresses.

[0035] Optionally, feature vectors of multiple dimensions of each TCP flow are extracted for malicious encrypted traffic and normal business traffic in the training data set, including:

[0036] Get the source IP address of each TCP flow in the traffic s and destination IP address r , the number of request packets from the source IP address to the destination IP address, the number of reply packets from the destination IP address to the source IP address, the information of the TCP data segment and the TCP message segment in each request packet / reply packet; and the time difference between adjacent frame request packets and adjacent reply packets in each TCP stream;

[0037] According to the source IP address IP s and destination IP address r , the number of request packets from the source IP address to the destination IP address, the number of return packets from the destination IP address to the source IP address, the information of the TCP data segment and the TCP message segment in each request packet / reply packet; and the time difference between adjacent frame request packets and adjacent return packets in each TCP stream, to generate feature vectors of multiple dimensions.

[0038] Optionally, feature vectors of multiple dimensions of each TCP flow are extracted for malicious encrypted traffic and normal business traffic in the training data set, including:

[0039] Generate a feature vector t1 of the first dimension according to the time difference between the adjacent frame request packets and the time difference between the adjacent return packets. D s is the sum of the time differences of the request packets, D r The sum of the time differences of the return packets;

[0040] and / or,

[0041] According to the source IP address s and destination IP address r The number of request packets and return packets between them is used to generate the feature vector of the second dimension, for example t2. N s IP s Send to IP r The number of packets, N d IP r Send to IP s The number of packets;

[0042] and / or,

[0043] According to the source IP address s and destination IP address r The length of each TCP data segment in the request packet and the response packet is used to generate the feature vector t3 of the third dimension. L s L is the sum of the request packet sizes in the sum of the TCP data segment lengths. r It is the sum of the reply packet sizes in the sum of the TCP data segment lengths;

[0044] and / or,

[0045] According to the source IP address s and destination IP address r The payload information of the TCP segments in the request packet and the reply packet is used to generate the feature vector t4 of the fourth dimension. R s is the number of repeated letters in the request packet obtained based on the TCP segment payload, R r The number of repeated letters in the reply packet obtained based on the payload of the TCP segment;

[0046] and / or,

[0047] According to the source IP address s and destination IP address r , generate the fifth dimension feature vector t5, IPs 'Convert the source IP address to a specified base value, IP r 'Convert the destination IP address to a specified base value.

[0048] The embodiment of the present invention also discloses an encrypted malicious traffic detection device, including:

[0049] A collection module, used for collecting the service traffic to be detected;

[0050] The detection model detection module extracts the feature vector of each TCP flow in the service flow to be detected, inputs the extracted feature vector into the trained detection model, and obtains the detection result output by the detection model as to whether the flow belongs to malicious encrypted traffic;

[0051] The trained detection model includes: a detection model obtained by training a support vector machine model using known malicious encrypted traffic and normal business traffic;

[0052] During the training process, it is necessary to extract feature vectors of multiple dimensions of each TCP flow from malicious encrypted traffic and normal business traffic and input them into the support vector machine model.

[0053] The feature vector includes one or more of the following:

[0054] Feature vectors associated with the time difference between request packets of adjacent frames and the time difference between return packets of adjacent frames, feature vectors associated with the number of request packets and the number of return packets, feature vectors associated with the number of bytes in request packets and the number of bytes in return packets, feature vectors related to the payload in request packets and the payload in return packets, feature vectors related to the number of source IP addresses and the number of destination IP addresses.

[0055] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0056] The memory is used to store computer programs;

[0057] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0058] The embodiment of the present invention further discloses one or more computer-readable media on which instructions are stored. When executed by one or more processors, the processors are enabled to execute the method described in the embodiment of the present invention.

[0059] The embodiments of the present invention include the following advantages:

[0060] The method of the embodiment of the present invention detects the collected business traffic through a pre-trained detection model, which can quickly and effectively detect malicious encrypted traffic, solve the problem that the current traditional firewall has poor detection effect on encrypted malicious traffic, and improve the enterprise's detection ability for encrypted malicious traffic.

[0061] The training method of the encrypted malicious traffic detection model in the embodiment of the present invention obtains the feature vectors of each TCP flow from the malicious encrypted traffic and the normal business traffic. These feature vectors describe the difference between normal traffic and malicious encrypted traffic, and then train the support vector machine model to obtain the detection model. Compared with the traditional firewall, it can describe the difference between normal business traffic and malicious encrypted traffic, can cover the detection of malicious encrypted traffic, and has a wider detection range.

[0062] In the embodiment of the present invention, the feature vectors extracted from multiple dimensions can accurately describe the difference between normal traffic and malicious encrypted traffic. A large amount of normal business traffic and malicious encrypted traffic are learned by using the support vector machine algorithm to form a detection model that fits the specific situation of business traffic, and the accuracy of malicious encrypted traffic detection is higher. In the embodiment of the present invention, the most complex calculations are placed in the training stage, the amount of calculations required in the detection stage is small, and the detection efficiency is higher. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a flow chart of an encrypted malicious traffic detection method provided in an embodiment of the present invention;

[0064] Figure 2 It is a flowchart of the steps of a method for detecting encrypted malicious traffic provided in an embodiment of the present invention;

[0065] Figure 3 It is a flowchart of the steps of a training method for an encrypted malicious traffic detection model provided in an embodiment of the present invention;

[0066] Figure 4 It is a structural block diagram of an encrypted malicious traffic detection device provided in an embodiment of the present invention;

[0067] Figure 5 is a block diagram of an electronic device provided in an embodiment of the present invention;

[0068] Figure 6 is a schematic diagram of a computer-readable medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0069] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0070] Reference Figure 1 , shows a flow chart of an encrypted malicious traffic detection method provided in an embodiment of the present invention, which may specifically include the following steps:

[0071] 101. Collect the business traffic to be tested.

[0072] For example, the service traffic can be replicated by mirroring the port and then connected to the method of this embodiment. Alternatively, a network splitter can be used to losslessly replicate the network traffic, and then the method of the embodiment can be used for detection. In other embodiments, a packet capture tool can also be used to directly capture the traffic data on the network interface.

[0073] 102. Extracting a feature vector of each TCP flow in the service traffic to be detected, inputting the extracted feature vector into the trained detection model, and obtaining a detection result output by the detection model as to whether the traffic belongs to malicious encrypted traffic;

[0074] The trained detection model includes: a detection model obtained by training a support vector machine model using known malicious encrypted traffic and normal business traffic;

[0075] During the training process, it is necessary to extract feature vectors of multiple dimensions of each TCP flow from malicious encrypted traffic and normal business traffic and input them into the support vector machine model.

[0076] The feature vector includes one or more of the following:

[0077] Feature vectors associated with the time difference between request packets of adjacent frames and the time difference between return packets of adjacent frames, feature vectors associated with the number of request packets and the number of return packets, feature vectors associated with the number of bytes in request packets and the number of bytes in return packets, feature vectors related to the payload in request packets and the payload in return packets, feature vectors related to the number of source IP addresses and the number of destination IP addresses.

[0078] The method of this embodiment detects the collected business traffic through a pre-trained detection model, which can quickly and effectively detect malicious encrypted traffic, solve the problem that the current traditional firewall has poor detection effect on encrypted malicious traffic, and improve the enterprise's detection ability for encrypted malicious traffic.

[0079] Reference Figure 2 , shows a flowchart of a method for detecting encrypted malicious traffic provided in an embodiment of the present invention, which may specifically include the following steps:

[0080] 201. Obtain a training data set for training a detection model, where the training data set includes: malicious encrypted traffic and normal business traffic;

[0081] 202. Extract feature vectors of multiple dimensions of each TCP flow for malicious encrypted traffic and normal business traffic in the training data set;

[0082] 203. Input all extracted feature vectors into a support vector machine model to train the parameters of the support vector machine model and obtain a trained detection model.

[0083] 204. Obtain the service traffic to be detected.

[0084] 205. Extract the feature vector of each TCP flow in the business traffic to be detected, input the extracted feature vector into the trained detection model, and obtain the detection result output by the detection model as to whether the traffic belongs to malicious encrypted traffic.

[0085] The acquisition of the feature vector in each TCP stream / TCP session in the above-mentioned malicious encrypted traffic, normal business traffic or business traffic to be detected can be explained as follows:

[0086] A1. Get the source IP address of each TCP flow in the traffic s and destination IP address r , the number of request packets from the source IP address to the destination IP address, the number of reply packets from the destination IP address to the source IP address, the information of the TCP data segment and the TCP message segment in each request packet / reply packet; and the time difference between adjacent frame request packets and adjacent reply packets in each TCP stream;

[0087] A2. According to the source IP address IP s and destination IP address r , the number of request packets from the source IP address to the destination IP address, the number of return packets from the destination IP address to the source IP address, the information of the TCP data segment and the TCP message segment in each request packet / reply packet; and the time difference between adjacent frame request packets and adjacent return packets in each TCP stream, to generate feature vectors of multiple dimensions.

[0088] The request packets and return packets in this embodiment are collectively referred to as data packets in the traffic. Data packets are used in some embodiments, and request packets / return packets are used where specifically stated, which are determined according to the specific scenario.

[0089] Specifically, this embodiment uses feature vectors of five dimensions as an example, but is not limited to feature vectors of these five dimensions. In actual applications, feature vectors of two dimensions, three dimensions, four dimensions, five dimensions, or more dimensions may be selected.

[0090] A2-1, generating a feature vector t1 of the first dimension according to the time difference between adjacent frame request packets and the time difference between adjacent return packets, D s is the sum of the time differences of the request packets, D r The sum of the time differences of the return packets;

[0091] A2-2. Based on the source IP address s and destination IP address r The number of request packets and return packets between them is used to generate the feature vector of the second dimension, for example t2. N s IP s Send to IP r The number of request packets, N d IP r Send to IP s The number of return packets;

[0092] A2-3. Based on the source IP address s and destination IP address r The length of each TCP data segment in the data packet between them generates the feature vector t3 of the third dimension. L s L is the sum of the request packet size (i.e., the number of bytes in the request packet) in the sum of the TCP data segment lengths. r It is the sum of the reply packet sizes (i.e., the number of reply packet bytes) in the sum of the TCP data segment lengths.

[0093] A2-4. Based on the source IP address s and destination IP address r The information of the payload of the TCP segment in the data packets (i.e., the request packet and the reply packet) is used to generate the feature vector t4 of the fourth dimension. R s is the number of repeated letters in the request packet obtained based on the TCP segment payload, R r It is the number of repeated letters in the reply packet obtained based on the payload of the TCP segment.

[0094] A2-5. Based on the source IP address s and destination IP address r , generate the fifth dimension feature vector t5, IP s 'Convert the source IP address to a specified base value, IP r 'Convert the destination IP address to a specified base value.

[0095] In this embodiment, IP s 'Convert the source IP address to a decimal value, IP r'Convert the destination IP address into a decimal value;

[0096] In other embodiments, IP s 'Convert the source IP address to a hexadecimal value, IP r 'Convert the destination IP address into a hexadecimal value; or you can use a binary value for conversion. It should be noted that the conversion of the numerator and denominator is consistent.

[0097] The above shows the contents of the feature vectors of five dimensions. It should be noted here that in the training phase, the number of dimensions of the feature vector of normal business traffic is consistent with the number of dimensions of malicious encrypted traffic, and the number of dimensions in each TCP flow in the training phase is greater than or equal to the number of dimensions in each TCP flow in the normal use detection phase.

[0098] In actual applications, after capturing the PCAP packet of the traffic, you can use traffic analysis tools for analysis. Common traffic analysis tools include Wireshark, tcpdump, tshark, Zeek, and application layer protocol analysis tools. The common transport layer traffic is divided into two types: TCP flow and UDP flow. This embodiment detects and analyzes the TCP flow in the traffic.

[0099] And due to the differences between malicious encrypted traffic and normal business traffic, a feature vector with five dimensions is set.

[0100] That is, due to normal business traffic, the time ratio of request packets to response packets is usually relatively stable. For example, for a web page request, if the server responds normally, the time from request issuance to response receipt will be within a reasonable range, while malicious encrypted traffic may have an abnormal time ratio. For example, an attacker may exhaust server resources by sending a large number of request packets. The response time may be unstable because the server processes a large number of false requests, or malicious encrypted traffic communicates secretly in the background. The time interval between request and response packets does not conform to normal business logic. Therefore, the feature vector of the first dimension is set, which is the time ratio of request packets to response packets;

[0101] Since the ratio of request packets and response packets in normal business traffic also has certain rules, for example, for a file download service, one request packet may correspond to a certain number of response packets, and these response packets are used to gradually transmit the file content, or for query services, one request may correspond to one response packet or a small number of response packets may be used to provide query results. Malicious encrypted traffic may have a large number of request packets but few response packets, such as DoS attacks, or a large number of response packets corresponding to few request packets, such as returning stolen data. Therefore, the feature vector of the second dimension is set, which is the ratio of the number of request packets to response packets;

[0102] In normal business traffic, different services have different request packet and response packet size ratios, while malicious encrypted traffic may have abnormal size ratios. For example, malicious encrypted traffic may send very small request packets to trigger vulnerabilities, and then receive a large number of response packets to obtain sensitive information, or send huge request packets to break through the server's cache limit, while the response packets may be very small or non-existent. Therefore, the feature vector of the third dimension is set, which is the size ratio of the request packet to the response packet.

[0103] Since the ratio of repeated letters in the request packets and response packets of normal business traffic is usually low and random, while malicious encrypted traffic often has a specific pattern and may contain more repeated letters in the request packets or response packets. For example, some simple encryption obfuscation methods may cause the repetition frequency of certain characters to be higher than normal. Therefore, the fourth dimension of the feature vector is set, which is the ratio of the number of repeated letters in the request packet and the response.

[0104] Since the ratio of source IP address to destination IP address of normal business traffic is relatively stable, while malicious encrypted traffic may have an abnormal ratio of source IP address to destination IP address. For example, a botnet may send traffic from a large number of source IP addresses (controlled zombie hosts) to one or a few destination IP addresses, or send traffic from one source IP address to a large number of different destination IP addresses, we set the fifth dimension of the feature vector, which is the ratio of source IP to destination IP.

[0105] In order to better understand the feature vectors of the above five dimensions, the fields of each TCP flow in the business traffic, that is, the TCP session, are briefly explained below.

[0106] The feature vector of the first dimension mentioned above can be analyzed through the tcp.time_delta field in the data packet. The tcp.time_delta field (Time delta from previous frame in this TCP stream) represents the time difference between the current TCP data packet and the previous TCP data packet in the same TCP stream, that is, the tcp.time_delta field can be used in the TCP stream and only records the data packets of the same TCP stream. Therefore, in this embodiment, the feature vector of the first dimension can be analyzed through the tcp.time_delta field in the data packet, that is, the feature vector of the first dimension is analyzed by recording the time difference from the previous frame request packet to the request packet. In summary, the sum of the time difference of the request packet and the sum of the time difference of the return packet can be obtained respectively through the tcp.time_delta field, and the feature vector t1 of the first dimension is generated by the sum of the time difference of the request packet and the sum of the time difference of the return packet.

[0107] The feature vector of the second dimension can be obtained through the first SYN packet in the TCP stream according to the source IP address IP s and destination IP address r After that, by calculating the IP s Send to IP r The number of packets N s , and by IP r Send to IP s The number of packets N d Among them, the SYN packet is the first data packet in the TCP three-way handshake process. When establishing a TCP connection, the source IP address will send a data packet with the SYN flag to the target IP address and request to establish a connection. This data packet does not contain actual data, but is only used to synchronize the sequence numbers of the source IP address and the target IP address to prepare for subsequent data transmission. The SYN packet usually contains fields such as the source IP address and the target IP address. That is, by analyzing the SYN packet, the source IP address IP of the TCP flow can be obtained. s and destination IP address r , and then through the source IP address IP s and destination IP address r , get IP s Send to IP r The number of packets N s , and by IP r Send to IP s The number of packets N d , and then analyze and generate the feature vector of the second dimension. That is, according to the source IP address IP s and destination IP address r The number of request packets and return packets between them is used to generate the feature vector of the second dimension, for example t2.

[0108] The feature vector of the third dimension can be analyzed through the tcp.len field in the data packet. The tcp.len field is a 16-bit field in the TCP header. For example, in Wireshark, the value of the tcp.len field usually indicates the length of the TCP data segment, which does not include the TCP header. If the value of tcp.len is 319, it means that the length of the TCP data segment is 319 bytes, but these 319 bytes are the data part and do not include the TCP header. Therefore, in actual applications, if filtering is required based on tcp.len, it may be necessary to subtract the length of the TCP header by 1. In this embodiment, by tracing the TCP flow, the tcp.len field can be used to calculate the length of the TCP segment from the source IP address IP. s Send to destination IP address rThe sum of the fields of the data packet, that is, tcp.len records the size of the request packet, and then the sum of the request packet size L in the sum of the TCP data segment lengths can be obtained through the sum of the fields. s Similarly, we can get the sum of the reply packet size L in the sum of the TCP data segment lengths. r , and through L s and L r Get the feature vector t3 of the third dimension,

[0109] The feature vector of the fourth dimension can be analyzed through the tcp.payload field in the data packet. The tcp.payload field represents the data portion of the TCP data packet, that is, the portion after the TCP header, also called the TCP payload, which contains the actual transmitted data, such as HTTP requests, FTP file transfer data, SMTP email content, etc.; by checking the tcp.payload field, you can view the actual transmitted data, so as to better understand the content transmitted during the communication process. In this embodiment, the tcp.payload field represents the payload of the TCP segment, which can be obtained by summarizing the source IP address IP s Send to destination IP address r The tcp.payload field of the data packet is used to count the number of repeated letters R in the request packet. s and the number of repeated letters in the return packet R r , and through R s and R r Get the feature vector t4 of the fourth dimension,

[0110] The feature vector of the fifth dimension can be converted into the source IP address IP s and destination IP address s , converted to the value corresponding to the specified base for analysis. IP addresses are usually represented by 32-bit (IPv4) or 128-bit (IPv6) binary numbers, which better meet the needs of data analysis and processing and improve analysis efficiency and accuracy. That is, this embodiment converts the source IP address IP s and destination IP address s , respectively converted into the corresponding decimal IP s ' and IP r ', and by IP s ' and IP r 'Get the fifth dimension feature vector t5,

[0111] The detection model of this embodiment distinguishes malicious encrypted traffic from normal business traffic by analyzing feature vectors in five dimensions, namely, the time ratio of request packets and response packets, the number ratio of request packets and response packets, the size ratio of request packets and response packets, the ratio of the number of repeated letters in request packets and response packets, and the ratio of source IP to destination IP, and then detects encrypted malicious traffic.

[0112] In this embodiment, feature vectors are obtained from malicious encrypted traffic and normal business traffic respectively, including the time ratio of request packets and return packets, the number ratio of request packets and return packets, the size ratio of request packets and return packets, the number ratio of repeated letters in request packets and return packets, and the ratio of source IP to destination IP; these feature vectors describe the difference between normal traffic and malicious encrypted traffic and then train a support vector machine model to obtain a detection model. Compared with traditional firewalls, this model can describe the difference between normal business traffic and malicious encrypted traffic, can cover the detection of malicious encrypted traffic, and has a wider detection range.

[0113] Reference Figure 3 , shows a flowchart of a training method for an encrypted malicious traffic detection model provided in an embodiment of the present invention, which may specifically include the following steps:

[0114] 301. Obtain a training data set for training a detection model, where the training data set includes: malicious encrypted traffic and normal business traffic;

[0115] 302. Extract feature vectors of multiple dimensions of each TCP flow from malicious encrypted traffic and normal business traffic in the training data set.

[0116] For example, this step may include: obtaining a feature vector of each flow: specifically as follows, these sub-steps are not shown in the figure:

[0117] 302-1. Calculate the sum of the tcp.time_delta fields of each request packet in the traffic. The tcp.time_delta field is the time difference between the previous request packet and the current request packet. Calculate the sum to obtain the request time sum D. s ; Calculate the total packet return time D r , the time ratio t1 of the request packet and the return packet is

[0118] 302-2. Track the TCP flow, find the first SYN packet in the TCP flow, and get the source IP address IP s and destination IP address r , calculated by IP s Send to IP r The number of packets N s , calculated by IP r Send to IPs The number of packets N d , calculate the ratio of request packets to return packets t2 as

[0119] 302-3. Track TCP flow and calculate source IP address s Send to destination IP address r The sum of the tcp.len fields of the data packets is calculated to obtain the total size of the request packets L s , calculate the total size of the returned packets L r , calculate the size ratio t3 of the request packet and the return packet as

[0120] 302-4. Summarize the source IP address IP according to the TCP flow s Send to destination IP address r The payload of the TCP segment of the data packet, and the number of repeated letters R in the statistical data packet s , calculated by IP r Send to IP s The number of repeated letters R r , calculate the ratio of the number of repeated letters in the request packet and the return packet t4 as

[0121]

[0122] 302-5, IP s 、IP r Converted to decimal, the ratio t5 of source IP to destination IP is:

[0123] 303. Input all extracted feature vectors into a support vector machine model to train the parameters of the support vector machine model and obtain a trained detection model.

[0124] In this embodiment, based on machine learning technology, the support vector machine is used to calculate the optimal boundary in N-dimensional space. By extracting the communication feature vector of TCP traffic, a classification model is constructed in N-dimensional space. This can achieve the effect of distinguishing normal traffic from malicious encrypted traffic, thereby achieving the purpose of malicious encrypted traffic detection.

[0125] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0126] Reference Figure 4 , shows a structural block diagram of an encrypted malicious traffic detection device provided in an embodiment of the present invention, which may specifically include the following modules:

[0127] A collection module, used for collecting the service traffic to be detected;

[0128] The detection model detection module extracts the feature vector of each TCP flow in the service flow to be detected, inputs the extracted feature vector into the trained detection model, and obtains the detection result output by the detection model as to whether the flow belongs to malicious encrypted traffic;

[0129] The trained detection model includes: a detection model obtained by training a support vector machine model using known malicious encrypted traffic and normal business traffic;

[0130] During the training process, it is necessary to extract feature vectors of multiple dimensions of each TCP flow from malicious encrypted traffic and normal business traffic and input them into the support vector machine model.

[0131] The feature vector includes one or more of the following:

[0132] Feature vectors associated with the time difference between request packets of adjacent frames and the time difference between return packets of adjacent frames, feature vectors associated with the number of request packets and the number of return packets, feature vectors associated with the number of bytes in request packets and the number of bytes in return packets, feature vectors related to the payload in request packets and the payload in return packets, feature vectors related to the number of source IP addresses and the number of destination IP addresses.

[0133] This device can detect the collected business traffic through a pre-trained detection model, which can quickly and effectively detect malicious encrypted traffic, solve the problem that the current traditional firewall has poor detection effect on encrypted malicious traffic, and improve the company's detection ability for encrypted malicious traffic.

[0134] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0135] In addition, an embodiment of the present invention further provides an electronic device, such as Figure 5 As shown, it includes a processor 1301, a communication interface 1302, a memory 1303 and a communication bus 1304, wherein the processor 1301, the communication interface 1302, and the memory 1303 communicate with each other through the communication bus 1304.

[0136] Memory 1303, used for storing computer programs;

[0137] The processor 1301 is used to implement the following steps when executing the program stored in the memory 1303:

[0138] Collect the business traffic to be tested;

[0139] Extracting a feature vector of each TCP flow in the service traffic to be detected, inputting the extracted feature vector into a trained detection model, and obtaining a detection result output by the detection model as to whether the traffic belongs to malicious encrypted traffic;

[0140] The trained detection model includes: a detection model obtained by training a support vector machine model using known malicious encrypted traffic and normal business traffic;

[0141] During the training process, it is necessary to extract feature vectors of multiple dimensions of each TCP flow from malicious encrypted traffic and normal business traffic and input them into the support vector machine model.

[0142] The feature vector includes one or more of the following:

[0143] Feature vectors associated with the time difference between request packets of adjacent frames and the time difference between return packets of adjacent frames, feature vectors associated with the number of request packets and the number of return packets, feature vectors associated with the number of bytes in request packets and the number of bytes in return packets, feature vectors related to the payload in request packets and the payload in return packets, feature vectors related to the number of source IP addresses and the number of destination IP addresses.

[0144] Alternatively, obtaining a training data set for training a detection model, wherein the training data set includes: malicious encrypted traffic and normal business traffic;

[0145] Extract feature vectors of multiple dimensions for each TCP flow from malicious encrypted traffic and normal business traffic in the training data set;

[0146] All extracted feature vectors are input into the support vector machine model to train the parameters of the support vector machine model and obtain the trained detection model.

[0147] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0148] The communication interface is used for communication between the above terminal and other devices.

[0149] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0150] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0151] like Figure 6 As shown, in another embodiment provided by the present invention, a computer-readable storage medium 1401 is also provided, in which instructions are stored. When the computer-readable storage medium 1401 is run on a computer, the computer executes the encrypted malicious traffic detection method or the encrypted malicious traffic detection model training method described in the above embodiments.

[0152] In another embodiment provided by the present invention, a computer program product containing instructions is also provided. When the computer is run on the computer, the computer executes the encrypted malicious traffic detection method or the encrypted malicious traffic detection model training method described in the above embodiments.

[0153] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0154] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0155] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0156] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A method for detecting encrypted malicious traffic, characterized in that: include: Collecting the service traffic to be detected, extracting the feature vector of each TCP flow in the service traffic to be detected, inputting the extracted feature vector into the trained detection model, and obtaining the detection result output by the detection model as to whether the traffic belongs to malicious encrypted traffic; The trained detection model includes: a detection model obtained by training a support vector machine model using known malicious encrypted traffic and normal business traffic; During the training process, it is necessary to extract feature vectors of multiple dimensions of each TCP flow from malicious encrypted traffic and normal business traffic and input them into the support vector machine model. The feature vector includes one or more of the following: Feature vectors associated with the time difference between request packets of adjacent frames and the time difference between return packets of adjacent frames, feature vectors associated with the number of request packets and the number of return packets, feature vectors associated with the number of bytes in request packets and the number of bytes in return packets, feature vectors related to the payload in request packets and the payload in return packets, feature vectors related to the number of source IP addresses and the number of destination IP addresses.

2. The method according to claim 1, characterized in that: The method further comprises: Acquire a training data set for training a detection model, wherein the training data set includes: malicious encrypted traffic and normal business traffic; Extract feature vectors of multiple dimensions for each TCP flow from malicious encrypted traffic and normal business traffic in the training data set; All extracted feature vectors are input into the support vector machine model to train the parameters of the support vector machine model and obtain the trained detection model.

3. The method according to claim 2, characterized in that For malicious encrypted traffic and normal business traffic in the training data set, feature vectors of multiple dimensions of each TCP flow are extracted, including: Get the source IP address of each TCP flow in the traffic s and destination IP address r , the number of request packets from the source IP address to the destination IP address, the number of reply packets from the destination IP address to the source IP address, the information of the TCP data segment and the TCP message segment in each request packet / reply packet; and the time difference between adjacent frame request packets and adjacent reply packets in each TCP stream; According to the source IP address IP s and destination IP address r , the number of request packets from the source IP address to the destination IP address, the number of return packets from the destination IP address to the source IP address, the information of the TCP data segment and the TCP message segment in each request packet / reply packet; and the time difference between adjacent frame request packets and adjacent return packets in each TCP stream, to generate feature vectors of multiple dimensions.

4. The method according to claim 3, characterized in that For malicious encrypted traffic and normal business traffic in the training data set, feature vectors of multiple dimensions of each TCP flow are extracted, including: Generate a feature vector t1 of the first dimension according to the time difference between the adjacent frame request packets and the time difference between the adjacent return packets. D s is the sum of the time differences of the request packets, D r The sum of the time differences of the return packets; and / or, According to the source IP address s and destination IP address r The number of request packets and return packets between them is used to generate the feature vector of the second dimension, for example t2. N s IP s Send to IP r The number of request packets, N d IP r Send to IP s The number of return packets; and / or, According to the source IP address s and destination IP address r The length of each TCP data segment in the request packet and the response packet is used to generate the feature vector t3 of the third dimension. L s L is the sum of the number of bytes in the request packet in the sum of the TCP data segment lengths. r It is the sum of the number of bytes in the returned packets in the sum of the lengths of the TCP data segments; and / or, According to the source IP address s and destination IP address r The payload information of the TCP segments in the request packet and the reply packet is used to generate the feature vector t4 of the fourth dimension. R s is the number of repeated letters in the request packet obtained based on the TCP segment payload, R r The number of repeated letters in the reply packet obtained based on the payload of the TCP segment; and / or, According to the source IP address s and destination IP address r , generate the fifth dimension feature vector t5, IP s 'Convert the source IP address to a specified base value, IP r 'Convert the destination IP address to a specified base value.

5. The method according to claim 4, characterized in that IP s 'Convert the source IP address to a decimal value, IP r 'Convert the destination IP address into a decimal value; Alternatively, IP s 'Convert the source IP address to a hexadecimal value, IP r 'Convert the destination IP address to a hexadecimal value.

6. A training method for an encrypted malicious traffic detection model, characterized in that: include: Acquire a training data set for training a detection model, wherein the training data set includes: malicious encrypted traffic and normal business traffic; Extract feature vectors of multiple dimensions for each TCP flow from malicious encrypted traffic and normal business traffic in the training data set; Input all extracted feature vectors into the support vector machine model to train the parameters of the support vector machine model and obtain a trained detection model; The feature vectors of multiple dimensions of each TCP flow include one or more of the following: Feature vectors associated with the time difference between request packets of adjacent frames and the time difference between return packets of adjacent frames, feature vectors associated with the number of request packets and the number of return packets, feature vectors associated with the number of bytes in request packets and the number of bytes in return packets, feature vectors related to the payload in request packets and the payload in return packets, feature vectors related to the number of source IP addresses and the number of destination IP addresses.

7. The method according to claim 6, characterized in that For malicious encrypted traffic and normal business traffic in the training data set, feature vectors of multiple dimensions of each TCP flow are extracted, including: Get the source IP address of each TCP flow in the traffic s and destination IP address r , the number of request packets from the source IP address to the destination IP address, the number of reply packets from the destination IP address to the source IP address, the information of the TCP data segment and the TCP message segment in each request packet / reply packet; and the time difference between adjacent frame request packets and adjacent reply packets in each TCP stream; According to the source IP address IP s and destination IP address r , the number of request packets from the source IP address to the destination IP address, the number of return packets from the destination IP address to the source IP address, the information of the TCP data segment and the TCP message segment in each request packet / reply packet; and the time difference between adjacent frame request packets and adjacent return packets in each TCP stream, to generate feature vectors of multiple dimensions.

8. The method according to claim 7, characterized in that For malicious encrypted traffic and normal business traffic in the training data set, feature vectors of multiple dimensions of each TCP flow are extracted, including: Generate a feature vector t1 of the first dimension according to the time difference between the adjacent frame request packets and the time difference between the adjacent return packets. D s is the sum of the time differences of the request packets, D r The sum of the time differences of the return packets; and / or, According to the source IP address s and destination IP address r The number of request packets and return packets between them is used to generate the feature vector of the second dimension, for example t2. N s IP s Send to IP r The number of packets, N d IP r Send to IP s The number of packets; and / or, According to the source IP address s and destination IP address r The length of each TCP data segment in the request packet and the response packet is used to generate the feature vector t3 of the third dimension. L s L is the sum of the request packet sizes in the sum of the TCP data segment lengths. r It is the sum of the reply packet sizes in the sum of the TCP data segment lengths; and / or, According to the source IP address s and destination IP address r The payload information of the TCP segments in the request packet and the reply packet is used to generate the feature vector t4 of the fourth dimension. R s is the number of repeated letters in the request packet obtained based on the TCP segment payload, R r The number of repeated letters in the reply packet obtained based on the payload of the TCP segment; and / or, According to the source IP address s and destination IP address r , generate the fifth dimension feature vector t5, IP s 'Convert the source IP address to a specified base value, IP r 'Convert the destination IP address to a specified base value.

9. An encrypted malicious traffic detection device, characterized in that: include: A collection module, used for collecting the service traffic to be detected; The detection model detection module extracts the feature vector of each TCP flow in the service flow to be detected, inputs the extracted feature vector into the trained detection model, and obtains the detection result output by the detection model as to whether the flow belongs to malicious encrypted traffic; The trained detection model includes: a detection model obtained by training a support vector machine model using known malicious encrypted traffic and normal business traffic; During the training process, it is necessary to extract feature vectors of multiple dimensions of each TCP flow from malicious encrypted traffic and normal business traffic and input them into the support vector machine model. The feature vector includes one or more of the following: Feature vectors associated with the time difference between request packets of adjacent frames and the time difference between return packets of adjacent frames, feature vectors associated with the number of request packets and the number of return packets, feature vectors associated with the number of bytes in request packets and the number of bytes in return packets, feature vectors related to the payload in request packets and the payload in return packets, feature vectors related to the number of source IP addresses and the number of destination IP addresses.

10. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 8 when executing the program stored in the memory.

Images