Protocol structure identification method and device based on traffic learning, equipment and medium
Through a traffic learning method, the structural characteristics of network communication data packets are extracted and the message type template is constructed, which solves the problem of insufficient accuracy and timeliness of protocol identification in the prior art, and achieves more efficient protocol structure identification.
Patent Information
- Application Number
- CN202411893714.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-20
- Publication Date
- 2025-04-11
AI Technical Summary
When the existing network protocol structure identification method faces a large number of private protocols, the accuracy and timeliness are difficult to meet, and the algorithm is inefficient, so the recognition ability needs to be improved.
The protocol structure recognition method based on traffic learning is adopted, and network communication data packets with a large number of malicious samples are obtained, and the packet structure characteristics are extracted using partially ordered iterative multi-sequence comparison algorithm, and the packet type template is constructed, and protocol structure recognition is performed based on the template.
It reduces the complexity of protocol identification, improves the accuracy and timeliness of protocol structure identification, and can more effectively identify the network protocol structure.
Smart Images
Figure CN119814629A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the field of computer technology applications, and in particular to a method, device, equipment and medium for identifying a protocol structure based on traffic learning. Background Art
[0002] At present, the main methods for identifying network protocol structures are protocol structure identification methods based on instruction sequences and application layer protocol structure identification methods based on constraints. The protocol structure identification of instruction sequences is to parse the message at the instruction-level monitoring protocol entity. This method is greatly affected by the number and quality of samples, is relatively complex to implement, and has many restrictions. The application protocol structure identification method based on constraints uses the idea of sequence pattern mining algorithm to extract protocol features, and then identifies the protocol structure based on the protocol features. This method can effectively complete the application protocol identification work. However, this method requires repeated scanning of the database and generates a large number of candidate sequences during the mining process, resulting in low algorithm efficiency and its identification ability needs to be improved. With the increasing number of private protocols in network traffic, the accuracy and timeliness of protocol identification are also getting higher and higher. It is a difficult task to identify the protocol structure based on instruction sequences and constraints alone. Summary of the invention
[0003] In order to solve the above technical problems, the present disclosure provides a method, device, equipment and medium for protocol structure identification based on traffic learning.
[0004] In a first aspect, the present disclosure provides a protocol structure identification method based on traffic learning, comprising:
[0005] Obtain a large number of network communication data packets of malicious samples;
[0006] Segmenting and classifying the network communication data packets to obtain corresponding packet groups;
[0007] Performing comparative analysis on the message groups based on a partial order iterative multiple sequence alignment algorithm to obtain corresponding message structure features;
[0008] A message type template is constructed based on the message structure feature, and protocol structure identification is performed based on the message type template.
[0009] In a second aspect, the present disclosure provides a protocol structure identification device based on traffic learning, comprising:
[0010] A data acquisition module, used to acquire network communication data packets of a large number of malicious samples;
[0011] A first processing module, used for segmenting and classifying the network communication data message to obtain corresponding message groups;
[0012] A second processing module is used to perform comparative analysis on the message groups based on a partial order iterative multiple sequence alignment algorithm to obtain corresponding message structure features;
[0013] The template construction module is used to construct a message type template based on the message structure characteristics, and perform protocol structure identification based on the message type template.
[0014] In a third aspect, the present disclosure provides a protocol structure identification device based on traffic learning, including:
[0015] processor;
[0016] A memory for storing executable instructions;
[0017] The processor is used to read executable instructions from the memory and execute the executable instructions to implement the protocol structure identification method based on traffic learning of the first aspect.
[0018] In a fourth aspect, the present disclosure provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor implements the protocol structure identification method based on traffic learning of the first aspect.
[0019] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:
[0020] The protocol structure identification method, device, equipment and medium based on traffic learning of the disclosed embodiment can obtain a large number of network communication data packets of malicious samples, then segment and classify the network communication data packets to obtain corresponding message groups, then compare and analyze the message groups based on the partial order iterative multiple sequence alignment algorithm to obtain corresponding message structure features, and finally construct a message type template based on the message structure features, and perform protocol structure identification based on the message type template. Thus, a message type template is constructed through a large number of network communication data packets of malicious samples, and protocol structure identification is performed based on the message type template, thereby reducing the complexity of protocol identification and improving the accuracy and timeliness of protocol structure identification. BRIEF DESCRIPTION OF THE DRAWINGS
[0021] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.
[0022] Figure 1 A flow chart of a protocol structure identification method based on traffic learning provided in an embodiment of the present disclosure;
[0023] Figure 2 A flow chart of another protocol structure identification method based on traffic learning provided by an embodiment of the present disclosure;
[0024] Figure 3 A flowchart of another method for identifying a protocol structure based on traffic learning provided by an embodiment of the present disclosure;
[0025] Figure 4 A schematic diagram of the structure of a protocol structure identification device based on traffic learning provided by an embodiment of the present disclosure;
[0026] Figure 5 A structural diagram of a protocol structure identification device based on traffic learning provided in an embodiment of the present disclosure. DETAILED DESCRIPTION
[0027] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.
[0028] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.
[0029] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.
[0030] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.
[0031] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".
[0032] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.
[0033] In order to solve the above problems, the embodiments of the present disclosure provide a method, device, equipment and medium for identifying a protocol structure based on traffic learning. Figures 1 to 3 The protocol structure identification method based on traffic learning provided by an embodiment of the present disclosure is described in detail.
[0034] Figure 1 A flow chart of a protocol structure identification method based on traffic learning provided by an embodiment of the present disclosure is shown.
[0035] In the embodiment of the present disclosure, the protocol structure identification method based on traffic learning can be executed by an electronic device, wherein the electronic device can include but is not limited to devices such as computer devices, cloud servers or cloud server clusters.
[0036] like Figure 1 As shown, the protocol structure identification method based on traffic learning may include the following steps.
[0037] S110. Obtain a large number of network communication data packets of malicious samples.
[0038] In the disclosed embodiment, the electronic device may obtain a large number of network communication data packets of malicious samples.
[0039] Optionally, the malicious sample may be a data message containing a virus.
[0040] Optionally, the network communication data message may include a first packet online message, an online response message, a heartbeat message, a command issuing message, and a command response message.
[0041] Specifically, the electronic device can release a large number of malicious samples through the data acquisition module, so as to obtain the network communication data message corresponding to each malicious sample. Among them, the direction of the first packet online message, heartbeat message, and command response message is client-to-server, that is, from the client to the server; the direction of the online response message and the command message is server-to-client, that is, from the server to the client.
[0042] Optionally, the first packet online message is used to tell the control node that the machine has been controlled. The packet generally contains system information of the machine, usually the first data packet. The size of the first packet can be obtained based on this data packet, and the content of the first packet can be extracted.
[0043] The online response message, also called the reply packet, is used to tell the malicious code running on the machine that it is connected to the control end and waiting for instructions. The response packet is a data packet sent by the server to the client after the first data packet sent by the client to the server.
[0044] Heartbeat messages are sent at fixed intervals to maintain a long-term connection between the client and the server to ensure survivability.
[0045] The command message is a command sent from the control end to the controlled machine, telling the controlled malicious code what to do, such as the type, target, and time of attack. It is some specific behavioral characteristics of the sample family. Depending on the family, the specific content, length, and attack type of the command packet will vary.
[0046] The command response message is the response made by the controlled client after receiving the command sent by the server, telling the server that the relevant command package has been received.
[0047] S120: Segment and classify the network communication data message to obtain corresponding message groups.
[0048] In the disclosed embodiment, the electronic device may perform segmentation and classification processing on the network communication data message to obtain corresponding message groups.
[0049] Specifically, the electronic device first locates the message fields of different functions and meanings in the message and the organizational structure information of each message field through the message structure segmentation module, identifies the different fields in the message, and then classifies the message according to the type of characters in the message to obtain corresponding message groups.
[0050] S130 , performing comparative analysis on the message groups based on a partial order iterative multiple sequence alignment algorithm to obtain corresponding message structure features.
[0051] In the disclosed embodiment, the electronic device may perform comparative analysis on the message groups based on a partial-order iterative multiple sequence alignment algorithm to obtain corresponding message structure features.
[0052] Specifically, after obtaining the message grouping, the electronic device performs comparative analysis on multiple message sequences in the message grouping based on a partial order iterative multiple sequence alignment algorithm to obtain message structure features corresponding to network protocol structures of different virus families.
[0053] S140: construct a message type template based on the message structure feature, and perform protocol structure identification based on the message type template.
[0054] In the disclosed embodiment, the electronic device may construct a message type template based on the message structure feature, and perform protocol structure identification based on the message type template.
[0055] Therefore, in the disclosed embodiment, a large number of network communication data packets of malicious samples can be obtained, and then the network communication data packets are segmented and classified to obtain corresponding message groups, and then the message groups are compared and analyzed based on the partial order iterative multiple sequence alignment algorithm to obtain corresponding message structure features, and finally a message type template is constructed based on the message structure features, and the protocol structure is identified based on the message type template. Therefore, a message type template is constructed through a large number of network communication data packets of malicious samples, and the protocol structure is identified based on the message type template, thereby reducing the complexity of protocol identification and improving the accuracy and timeliness of protocol structure identification.
[0056] Figure 2 A flow chart of another method for identifying a protocol structure based on traffic learning provided by an embodiment of the present disclosure is shown.
[0057] like Figure 2 As shown, the protocol structure identification method based on traffic learning may include the following steps.
[0058] S210: Perform structure identification processing on the network communication data message to obtain a corresponding message structure.
[0059] In the disclosed embodiment, the electronic device may perform structure recognition processing on the network communication data message to obtain a corresponding message structure.
[0060] Optionally, the message structure may include a text field, a binary field, a code field, and a length field.
[0061] Specifically, the electronic device can perform structural recognition processing on the network communication data message, such as locating the message fields with different functions and meanings in the message and the organizational structure information of each message field through the message structure segmentation module, and it is necessary to identify the text field, binary field, Unicode encoding field and length field in the message.
[0062] In some embodiments, the electronic device can identify text domains and binary domains, traverse each byte in the message, and if the byte is a printable character, classify it as a text domain, otherwise classify it as a binary domain. For bytes that can be interpreted as both printable characters and binary characters, the type of the byte is determined based on the type of bytes before and after the byte. For example, the value 0x40 can not only be interpreted as a printable character "①, but also can represent a binary character. In this case, 0x40 needs to be classified as a text domain or a binary domain based on the type of the bytes before and after 0x40.
[0063] In some embodiments, the electronic device can identify the Unicode encoding domain, and the way to identify the Unicode encoding is: traverse each sequence, if there are "00"s that appear continuously and at intervals and the characters between every two "00"s are the byte range of printable characters, it can be determined that it is a Unicode encoding. This is because a notable feature of Unicode characters is that there is a printable character between every two "00", and the printable characters are all separated by "00". The Unicode encoding domain is determined after finding the "00"s that appear continuously and at intervals, and there are printable characters between every two "00", and finally these bytes are combined as a whole as a Unicode encoding domain.
[0064] In some embodiments, the electronic device can identify the length field. The length field in the message is usually used to mark the length of one or more fields. In practice, its value is the sum of the lengths of certain continuous sequence fragments in the message. Based on the characteristics of the length field, the following identification idea can be proposed: for all message sequences, first identify all text fields, binary fields, and Unicode fields, and on this basis, find all fields with continuous positions, that is, a continuous field set, and calculate their lengths to obtain a length set. Then, for the entire message sequence, find its binary field, match each byte in the binary field with the value in the length set, and if there is a match, record the relative displacement of the byte in the message sequence. Since there may be multiple matches, the final result is a displacement set. Each sequence will generate such a displacement set, and the displacement sets obtained from all sequences are intersected. This intersection is the length field that is finally identified.
[0065] S220. Based on the message structure, group the network communication data message to obtain the message grouping.
[0066] Furthermore, the electronic device may perform grouping processing on the network communication data message based on the message structure to obtain the message grouping.
[0067] Specifically, the electronic device can group the network communication data messages according to the message structure, such as classifying the messages into text messages and binary messages according to the types of characters in the messages, and further subdividing the messages according to the composition structure of the domains based on the message structure to obtain message groups.
[0068] Optionally, based on the message structure, the network communication data messages are grouped to obtain the message groups, which may specifically include: classifying the network communication data messages to obtain corresponding message types, wherein the message types include text messages and binary messages; based on the message type and the message structure, the network communication data messages are grouped to obtain the message groups.
[0069] In the disclosed embodiment, the electronic device may classify the network communication data messages to obtain corresponding message types.
[0070] Optionally, the message type may include a text message and a binary message.
[0071] Specifically, the electronic device may classify the network communication data message to obtain a corresponding message type, such as classifying the message into a text message and a binary message according to the type of characters in the message.
[0072] Among them, for each message obtained, first analyze each different byte in each message, if it is a printable character, then determine that the character is a character type; otherwise, determine it to be a binary byte. After judging each byte of each message, analyze the entire message, if all characters and 0x0D0A (0x0D0A is a separator character) appear in the message, then determine that this message is a text message; otherwise, determine it to be a binary message.
[0073] Furthermore, the electronic device may perform grouping processing on the network communication data message based on the message type and the message structure to obtain the message grouping.
[0074] Specifically, after obtaining the message type and the message structure, the electronic device can group the network communication data message. For example, after obtaining the byte type of a message, the electronic device compares the message with the previously divided message group to see whether there is a message classification that matches the message. If so, the message is directly added to the corresponding message classification, otherwise a new message classification is created. According to the message type and message direction, a binary message can only be grouped with a binary message, a text message can only be grouped with a text message, and only messages with the same direction can be classified into the same message group.
[0075] Optionally, for binary messages, the following restrictions are included: Length restriction: the length distance between two messages cannot be greater than the specified threshold, which is always on; Content restriction: the edit distance between two messages cannot be greater than the specified threshold, which is always on; Format restriction: two messages of the same type must have the same number and order of text fields, binary fields, and Unicode encoding fields.
[0076] Optionally, for text messages, the following restrictions are included: Fragment restriction: The message is divided into a combination of different fragments using 0x0D0A as a delimiter, and the number difference of the message sequence cannot be greater than a certain specified threshold; Length restriction: The length difference between the two corresponding fragments between messages cannot exceed a certain specified domain value; Content restriction: The edit distance between the two corresponding fragments of two messages of the same type cannot exceed a certain specified domain value; String restriction: For a certain fragment, a series of string sets are divided using special symbols as boundaries, and the number of common strings between the corresponding fragments of two messages of the same type needs to meet the domain value conditions.
[0077] Only when the above conditions are met at the same time can it be judged that the corresponding fragments of the two messages are similar, and then it can be judged that the two messages may be of the same type: if there are multiple messages judged as similar messages, the one with the smallest edit distance is selected as the best matching message type and added to the corresponding message type group.
[0078] Figure 3 A flow chart of another method for identifying a protocol structure based on traffic learning provided in an embodiment of the present disclosure is shown.
[0079] like Figure 3 As shown, the protocol structure identification method based on traffic learning may include the following steps.
[0080] S310 , performing comparative analysis on the message groups based on a partial order iterative multiple sequence alignment algorithm to obtain a communication packet partial order graph.
[0081] In the disclosed embodiment, the electronic device may perform comparative analysis on the message groups based on a partial-order iterative multiple sequence alignment algorithm to obtain a partial-order graph of the communication packets.
[0082] Specifically, the electronic device compares and analyzes multiple message sequences in each group based on the iterative multiple sequence alignment algorithm based on the partial order, such as comparing the first sequence with the second sequence, and saving the comparison results in a merged message partial order graph (PO-MSA), and then aligning the PO-MSA with the new sequence, adding the comparison information until the final sequence comparison is completed, and the obtained PO-MSA contains all the comparison information to form a result sequence. The merged nodes in the partial order graph represent the positions of successful comparison in different message sequences. In the process of multiple sequence comparison messages, in order to achieve the purpose of aligning the sequences to the greatest extent, it may be necessary to insert some spaces so that all messages have the same length.
[0083] S320. Identify variable domains and immutable domains based on the communication packet partial order graph, and determine the message structure characteristics.
[0084] Furthermore, the electronic device may identify the variable domain and the immutable domain based on the partial order graph of the communication packet, and determine the message structure characteristics.
[0085] Specifically, the electronic device can identify the variable domain and the immutable domain based on the partial order graph of the communication packet. For example, after the comparison is completed, according to the partial order graph of the message, the change rate of the bytes at the same position in the same group message can be calculated. If the bytes at the same position of the message are the same, the change rate is equal to 0; otherwise, the ratio of the values of different bytes to the number of messages is used as the change rate. Bytes with the same change rate form the same domain, where the change rate of 0 is judged as an immutable domain, otherwise it is judged as a variable domain. For the communication data packets of the same sample of the same family in different environments, the immutable domain of the data packets of the same type and direction is basically unchanged, and the common features are basically unchanged; and for different samples of the same family, the communication data packets in different environments, we can extract the immutable domain of the data packets of the same type and direction through message classification, so as to summarize the common features in different samples of the family, that is, the features of the family. Therefore, the message immutable domain in each message group can be extracted to form an immutable domain set of this type of message group, which is used as the feature of this type of message group, that is, the message structure feature is obtained.
[0086] Optionally, S140 may specifically include: constructing the message type template based on the information of the variable field and the immutable field and the composition order.
[0087] In the embodiment of the present disclosure, the electronic device may construct the message type template based on the information of the variable field and the immutable field and the composition order.
[0088] Specifically, after identifying the various domains and domain types of the message, the collection of all domains constitutes the basic model of the message. Combined with the previous message classification work, all messages will be divided into the message groups to which they belong. For each group, the message protocol structure identification module will construct a model with domains as a collection for each type of message. By describing the information of each domain and the composition order of the domains in detail, a standard message type template output is constructed, and then the identification of network protocol structures of different virus families can be completed according to the message type template.
[0089] Figure 4 A schematic structural diagram of a protocol structure identification device based on traffic learning provided by an embodiment of the present disclosure is shown.
[0090] like Figure 4 As shown, the protocol structure identification device 400 based on traffic learning may include a data acquisition module 410 , a first processing module 420 , a second processing module 430 and a template construction module 440 .
[0091] The data acquisition module 410 can be used to acquire a large number of network communication data packets of malicious samples.
[0092] The first processing module 420 can be used to perform segmentation and classification processing on the network communication data message to obtain corresponding message groups.
[0093] The second processing module 430 can be used to perform comparative analysis on the message groups based on a partial order iterative multiple sequence alignment algorithm to obtain corresponding message structure features.
[0094] The template construction module 440 can be used to construct a message type template based on the message structure characteristics, and perform protocol structure recognition based on the message type template.
[0095] Therefore, in the disclosed embodiment, a large number of network communication data packets of malicious samples can be obtained, and then the network communication data packets are segmented and classified to obtain corresponding message groups, and then the message groups are compared and analyzed based on the partial order iterative multiple sequence alignment algorithm to obtain corresponding message structure features, and finally a message type template is constructed based on the message structure features, and the protocol structure is identified based on the message type template. Therefore, a message type template is constructed through a large number of network communication data packets of malicious samples, and the protocol structure is identified based on the message type template, thereby reducing the complexity of protocol identification and improving the accuracy and timeliness of protocol structure identification.
[0096] In some embodiments of the present disclosure, the network communication data message includes a first-packet online message, an online response message, a heartbeat message, a command issuance message, and a command response message.
[0097] In some embodiments of the present disclosure, the first processing module 420 may specifically include a first processing unit and a second processing unit.
[0098] The first processing unit can be used to perform structure identification processing on the network communication data message to obtain a corresponding message structure.
[0099] The second processing unit may be configured to perform grouping processing on the network communication data message based on the message structure to obtain the message grouping.
[0100] In some embodiments of the present disclosure, the message structure includes a text field, a binary field, a coding field and a length field.
[0101] In some embodiments of the present disclosure, the first processing module 420 may further specifically include a third processing unit and a fourth processing unit.
[0102] The third processing unit can be used to classify the network communication data messages to obtain corresponding message types, and the message types include text messages and binary messages.
[0103] The fourth processing unit may be configured to perform grouping processing on the network communication data message based on the message type and the message structure to obtain the message grouping.
[0104] In some embodiments of the present disclosure, the second processing module 430 may specifically include a fifth processing unit and a sixth processing unit.
[0105] The fifth processing unit can be used to perform comparative analysis on the message groups based on a partial order iterative multiple sequence alignment algorithm to obtain a communication packet partial order graph.
[0106] The sixth processing unit may be configured to identify variable domains and immutable domains based on the communication packet partial order graph, and determine the message structure features.
[0107] In some embodiments of the present disclosure, the template construction module 440 may specifically include a template construction unit.
[0108] The template construction unit may be used to construct the message type template based on the information and composition order of the variable field and the immutable field.
[0109] It should be noted that Figure 4 The protocol structure identification device 400 shown in FIG. 4 can be executed based on traffic learning. Figures 1 to 3 The various steps in the method embodiment shown in the figure are implemented Figures 1 to 3 The various processes and effects in the method embodiment shown are not described in detail here.
[0110] Figure 5 A structural diagram of a protocol structure identification device based on traffic learning provided by an embodiment of the present disclosure is shown.
[0111] In some embodiments of the present disclosure, Figure 5 The protocol structure identification device based on traffic learning shown may be an electronic device. Specifically, the electronic device may include but is not limited to devices such as computer devices, cloud servers or cloud server clusters.
[0112] like Figure 5 As shown, the protocol structure identification device based on traffic learning may include a processor 501 and a memory 502 storing computer program instructions.
[0113] Specifically, the processor 501 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.
[0114] The memory 502 may include a large capacity memory for information or instructions. By way of example and not limitation, the memory 502 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a tape, or a universal serial bus (USB) drive or a combination of two or more of these. Where appropriate, the memory 502 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 502 may be inside or outside the integrated gateway device. In a particular embodiment, the memory 502 is a non-volatile solid-state memory. In a particular embodiment, the memory 502 includes a read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (Electrically Erasable Programmable ROM, EEPROM), an electrically rewritable ROM (EAROM) or a flash memory, or a combination of two or more of these.
[0115] The processor 501 reads and executes the computer program instructions stored in the memory 502 to perform the steps of the protocol structure identification method based on traffic learning provided in the embodiment of the present disclosure.
[0116] In one example, the protocol structure identification device based on traffic learning may further include a transceiver 503 and a bus 504. Figure 5 As shown, the processor 501, the memory 502 and the transceiver 503 are connected via a bus 504 and communicate with each other.
[0117] The bus 504 includes hardware, software, or both. For example, but not limitation, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industrial Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a MicroChannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, the bus 504 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.
[0118] The embodiment of the present disclosure also provides a computer-readable storage medium, which can store a computer program. When the computer program is executed by a processor, the processor implements the protocol structure identification method based on traffic learning provided by the embodiment of the present disclosure.
[0119] The above-mentioned storage medium may, for example, include a memory 502 of computer program instructions, and the above-mentioned instructions may be executed by the processor 501 of the protocol structure identification device based on traffic learning to complete the protocol structure identification method based on traffic learning provided in the embodiment of the present disclosure. Optionally, the storage medium may be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium may be a ROM, a random access memory (Random Access Memory, RAM), a compact disc read-only memory (Compact Disc ROM, CD-ROM), a magnetic tape, a floppy disk, and an optical data storage device, etc.
[0120] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the term "comprising" is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.
[0121] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A protocol structure identification method based on traffic learning, characterized in that: include: Obtain a large number of network communication data packets of malicious samples; Segmenting and classifying the network communication data packets to obtain corresponding packet groups; Performing comparative analysis on the message groups based on a partial order iterative multiple sequence alignment algorithm to obtain corresponding message structure features; A message type template is constructed based on the message structure feature, and protocol structure identification is performed based on the message type template.
2. The method according to claim 1, characterized in that The network communication data message includes a first packet online message, an online response message, a heartbeat message, a command issuing message, and a command response message.
3. The method according to claim 1, characterized in that: The segmentation and classification processing of the network communication data message to obtain corresponding message groups includes: Performing structure recognition processing on the network communication data message to obtain a corresponding message structure; Based on the message structure, the network communication data message is grouped to obtain the message grouping.
4. The method according to claim 3, characterized in that The message structure includes a text field, a binary field, a code field and a length field.
5. The method according to claim 3, characterized in that: The method of performing grouping processing on the network communication data message based on the message structure to obtain the message grouping includes: Classifying and processing the network communication data messages to obtain corresponding message types, wherein the message types include text messages and binary messages; Based on the message type and the message structure, the network communication data message is grouped to obtain the message grouping.
6. The method according to claim 1, characterized in that The partial order-based iterative multiple sequence alignment algorithm performs comparative analysis on the message groups to obtain corresponding message structure features, including: Based on the partial order iterative multiple sequence alignment algorithm, the message grouping is compared and analyzed to obtain a communication packet partial order graph; Based on the communication packet partial order graph, variable domains and immutable domains are identified, and the message structure characteristics are determined.
7. The method according to claim 6, characterized in that The constructing a message type template based on the message structure feature includes: The message type template is constructed based on the information of the variable field and the immutable field and the composition order.
8. A protocol structure identification device based on traffic learning, characterized in that: include: A data acquisition module, used to acquire network communication data packets of a large number of malicious samples; A first processing module, used for segmenting and classifying the network communication data message to obtain corresponding message groups; A second processing module is used to perform comparative analysis on the message groups based on a partial order iterative multiple sequence alignment algorithm to obtain corresponding message structure features; The template construction module is used to construct a message type template based on the message structure characteristics, and perform protocol structure identification based on the message type template.
9. A protocol structure identification device based on traffic learning, characterized in that: include: processor; A memory for storing executable instructions; The processor is used to read the executable instructions from the memory and execute the executable instructions to implement the protocol structure identification method based on traffic learning as described in any one of claims 1 to 7.
10. A non-volatile computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the processor implements the protocol structure identification method based on traffic learning described in any one of claims 1 to 7.