Internet control message hidden tunnel detection method, device and equipment

Abstract

The invention relates to the technical field of network security, and discloses an Internet control message hidden tunnel detection method, device and equipment, and the method comprises the steps: obtaining the flow data of an Internet control message, and processing the flow data to obtain message data; inputting the message data into a hidden tunnel detection model to obtain an abnormal message probability that the message data of the Internet control message is an abnormal message, and inputting the message data of the Internet control message into a normal message detection model to obtain a normal message probability that the message data of the Internet control message is a normal message; and judging whether the message data of the Internet control message is normal message data or abnormal message data according to the abnormal message probability, the normal message probability and a preset rule. The hidden tunnel detection model and the normal message detection model are used for doubly judging whether the message data are abnormal data or not, so that the manual operation and maintenance cost is reduced, and the detection efficiency and the detection accuracy of the hidden tunnel are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a detection method, device and equipment for a hidden tunnel of an Internet control message. Background Art

[0002] With the rapid development of network technology, the application of various network protocols has become more complex, and network security issues have become increasingly prominent. Among them, the Internet Control Message Protocol (ICMP) protocol is widely used in network diagnosis and security auditing. Some users may also use ICMP to build covert tunnels to transmit and hide malicious data, which poses a serious threat to network security. ICMP covert tunnel is a new type of network attack method that uses the characteristics of the ICMP protocol to hide malicious data in normal network data streams, thereby bypassing the detection of security devices such as firewalls. Therefore, developing an efficient and accurate ICMP covert tunnel detection method has become an important topic in the current field of network security.

[0003] Traditional ICMP covert tunnel detection methods are mainly based on traffic statistical characteristics or manual rule matching. Although they have certain effects, these methods often require a lot of computing resources and time, and the effects are too dependent on the accuracy of the rules. They cannot cope with the increasingly complex network environment and malicious attacks, and the detection efficiency and accuracy are low. Summary of the invention

[0004] In view of this, the present invention provides a method, device and equipment for detecting an Internet control message covert tunnel to solve the problem of low detection efficiency and accuracy of the traditional ICMP covert tunnel detection method.

[0005] In a first aspect, the present invention provides a method for detecting a hidden tunnel of an Internet control message, the method comprising:

[0006] Obtaining flow data of Internet control messages and processing the flow data to obtain message data of Internet control messages;

[0007] Inputting the message data of the Internet control message into the hidden tunnel detection model to obtain the abnormal message probability that the message data of the Internet control message is an abnormal message, and inputting the message data of the Internet control message into the normal message detection model to obtain the normal message probability that the message data of the Internet control message is a normal message;

[0008] The message data of the Internet control message is determined to be normal message data or abnormal message data according to the abnormal message probability, the normal message probability and the preset rules.

[0009] The method for detecting hidden tunnels of Internet control messages provided by the present invention utilizes a hidden tunnel detection model and a normal message detection model to dually determine whether message data is abnormal data, thereby reducing manual operation and maintenance costs and improving the detection efficiency and accuracy of hidden tunnels.

[0010] In an optional implementation manner, the flow data of the Internet control message is obtained and processed to obtain the message data of the Internet control message, including:

[0011] Collecting the flow data of the Internet control message by using a network sniffer, and determining the payload length of the Internet control message corresponding to the flow data of the Internet control message;

[0012] If the payload length of the Internet control message is less than the preset payload length, the payload length of the Internet control message is padded and aligned using a preset padding character to obtain message data of the Internet control message of the preset payload length.

[0013] The method for detecting hidden tunnels of Internet control messages provided by the present invention utilizes a network sniffer to collect traffic data, can timely discover and affect security threats in the network, ensure stable acquisition of traffic data, fill and align traffic data with insufficient payload length, ensure that the obtained message data can be directly used by the detection model, and improve the detection efficiency of the detection model.

[0014] In an optional implementation, the covert tunnel detection model includes: a plurality of attack communication detection sub-models, each attack communication detection sub-model being used to detect covert tunnels of different attack communication categories;

[0015] The training process of each attack communication sub-model includes:

[0016] Acquire transmission messages of multiple target attack communications as an abnormal sample set, and divide the abnormal sample set into abnormal training samples and abnormal test samples;

[0017] The preset neural network model is trained using abnormal training samples, and the trained model is tested using abnormal test samples to obtain an attack communication detection sub-model for detecting target attack communications.

[0018] The invention provides a method for detecting hidden tunnels of Internet control messages. Each type of attack communication corresponds to a detection sub-model. Multiple detection sub-models detect flow data in sequence. The detection types are more abundant, thereby improving the accuracy and adaptability of attack communication detection.

[0019] In an optional implementation, the training process of the normal message detection model includes:

[0020] Acquire normal communication messages of a plurality of Internet control messages as a normal sample set, and divide the normal sample set into a normal training sample and a normal test sample;

[0021] The preset neural network model is trained using normal training samples, and the trained model is tested using normal test samples to obtain a normal message detection model.

[0022] The method for detecting hidden tunnels of Internet control messages provided by the present invention also trains a neural network model for normal message data, judges the message data from both normal and abnormal aspects, improves the accuracy of message data judgment, and facilitates accurate discovery of hidden tunnels.

[0023] In an optional embodiment, the method further includes:

[0024] The message data of the Internet control message determined as abnormal message data is added to the abnormal sample data set, and the training process of the attack communication detection sub-model is repeated to optimize the covert tunnel detection model;

[0025] The message data of the Internet control message determined to be normal message data is added to the normal sample data set, and the training process of the normal message detection model is repeated to optimize the normal message detection model.

[0026] The method for detecting the covert tunnel of Internet control messages provided by the present invention optimizes the covert tunnel detection model by using the newly determined abnormal message data, and optimizes the normal message detection model by using the newly determined normal message data, thereby ensuring that unknown attack communications can also be accurately identified by the model, improving the accuracy of the model, and ensuring the accuracy of ICMP covert tunnel detection.

[0027] In an optional implementation, determining whether message data of an Internet control message is normal message data or abnormal message data according to an abnormal message probability, a normal message probability and a preset rule includes:

[0028] If the abnormal message probability is greater than the preset abnormal probability, and the normal message probability is less than the preset normal probability, the message data of the Internet control message is abnormal message data;

[0029] If the abnormal message probability is less than the preset abnormal probability, and the normal message probability is greater than the preset normal probability, the message data of the Internet control message is normal message data;

[0030] If the abnormal message probability is not greater than the preset abnormal probability, and the normal message probability is not greater than the preset normal probability, the message data of the Internet control message is determined to be normal message data or abnormal message data according to the preset rule.

[0031] The method for detecting hidden tunnels of Internet control messages provided by the present invention performs double judgment on message data by using a preset abnormal probability and a preset normal probability, and continues to use existing preset rules for judgment if judgment cannot be made, thereby ensuring complete detection of hidden tunnels, avoiding missed detections, and improving the detection accuracy of hidden tunnels.

[0032] In a second aspect, the present invention provides a device for detecting a hidden tunnel of an Internet control message, the device comprising:

[0033] A data preprocessing module, used to obtain the flow data of the Internet control message and process it to obtain the message data of the Internet control message;

[0034] A model detection module, used for inputting the message data of the Internet control message into the concealed tunnel detection model to obtain the abnormal message probability that the message data of the Internet control message is an abnormal message, and inputting the message data of the Internet control message into the normal message detection model to obtain the normal message probability that the message data of the Internet control message is a normal message;

[0035] The message data determination module is used to determine whether the message data of the Internet control message is normal message data or abnormal message data according to the abnormal message probability, the normal message probability and preset rules.

[0036] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0037] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to cause a computer to execute the method of the first aspect or any corresponding embodiment thereof.

[0038] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1It is a flow chart of a method for detecting a concealed tunnel of an Internet control message according to an embodiment of the present invention;

[0041] Figure 2 It is a flow chart of another method for detecting a concealed tunnel of an Internet control message according to an embodiment of the present invention;

[0042] Figure 3 It is a flowchart of a specific embodiment of a method for detecting a concealed tunnel of an Internet control message according to an embodiment of the present invention;

[0043] Figure 4 is a structural block diagram of a detection device for a concealed tunnel of an Internet control message according to an embodiment of the present invention;

[0044] Figure 5 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0046] The embodiments of the present invention provide a method, device and equipment for detecting a covert tunnel of an Internet control message, which achieves the effect of improving the detection efficiency and accuracy of the covert tunnel by doubly judging the message data through a covert tunnel detection model and a normal message detection model.

[0047] According to an embodiment of the present invention, an embodiment of a method for detecting a covert tunnel of an Internet control message is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0048] In this embodiment, a method for detecting a hidden tunnel of an Internet control message is provided, which can be used in the above-mentioned computer system. Figure 1 is a flow chart of a method for detecting a concealed tunnel of an Internet control message according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0049] Step S101, acquiring flow data of Internet control messages, and processing the flow data to obtain message data of Internet control messages.

[0050] Specifically, Internet Control Message Protocol (ICMP) is a protocol in the Internet Protocol Suite (TCP / IP protocol suite) used to send error report messages in IP networks. ICMP exists in the fourth layer (transport layer) of the TCP / IP protocol stack, which is the upper layer of the IP protocol. ICMP messages can be transmitted between two devices to diagnose network connection problems and report errors.

[0051] ICMP traffic data is the total amount of all data transmitted through the ICMP network within a period of time. It is raw data and includes all message data and its header information, as well as any type of network communication activities that may exist, such as control signals, management information, etc. ICMP traffic data contains multiple message data. The purpose of processing it is to unify the format of the directly obtained data so that it can be analyzed uniformly later. The traffic data is continuously processed to obtain continuous ICMP message data. The data to be detected in this embodiment is the ICMP message data in the ICMP network transmission process.

[0052] Step S102, inputting the message data of the Internet control message into the hidden tunnel detection model to obtain the abnormal message probability that the message data of the Internet control message is an abnormal message, and inputting the message data of the Internet control message into the normal message detection model to obtain the normal message probability that the message data of the Internet control message is a normal message.

[0053] Specifically, for the ICMP message data to be detected, two models need to be used for detection processing. The ICMP message data to be detected is input into the hidden tunnel detection model to obtain the abnormal message probability that the ICMP message data is an abnormal message; the ICMP message data is input into the normal message detection model to obtain the normal message probability that the ICMP message data is a normal message. It should be noted that the hidden tunnel detection model and the normal message detection model are both pre-trained models.

[0054] Step S103, determining whether the message data of the Internet control message is normal message data or abnormal message data according to the abnormal message probability, the normal message probability and a preset rule.

[0055] Specifically, for an ICMP message data, there are only two possible detection results: normal message or abnormal message, so the sum of the abnormal message probability and the normal message probability is 1. If the abnormal message probability is large (greater than the preset abnormal threshold), it is determined to be an abnormal message and an alarm is issued. If the normal message probability is large (greater than the preset normal threshold), it is determined to be a normal message. However, it may happen that for the same ICMP message data, the abnormal message probability and the normal message probability are not large, and the difference between the two is not large (for example, both are 50%, only as an example, but not limited to this), which is equivalent to the hidden tunnel detection model and the normal message detection model cannot accurately identify whether the ICMP message data is a normal message or an abnormal message. At this time, the preset rules can be further used to deeply analyze the characteristics and behaviors of the ICMP message data, so as to determine whether the ICMP message data is an abnormal message from other angles, and then determine whether there is a hidden tunnel. For example: it can be checked whether there is an abnormal ICMP packet sequence, whether the packet characteristics conform to the normal ICMP traffic mode, whether it matches the ICMP hidden tunnel rules, etc., only as an example, but not limited to this.

[0056] The method for detecting hidden tunnels of Internet control messages provided in this embodiment uses a hidden tunnel detection model and a normal message detection model to dually determine whether message data is abnormal data, thereby reducing manual operation and maintenance costs and improving the detection efficiency and accuracy of hidden tunnels.

[0057] In this embodiment, a method for detecting a hidden tunnel of an Internet control message is provided, which can be used in the above-mentioned computer system. Figure 2 is a flow chart of a method for detecting a concealed tunnel of an Internet control message according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0058] Step S201, acquiring flow data of Internet control messages, and processing the flow data to obtain message data of Internet control messages.

[0059] Specifically, the above step S201 includes:

[0060] Step S2011, using a network sniffer to collect traffic data of the Internet control message, and determining the payload length of the Internet control message corresponding to the traffic data of the Internet control message.

[0061] Specifically, the network sniffer can be a data plane development kit (Data Plane Development Kit, DPDK). DPDK runs on the Linux system and is a set of function libraries and drivers for fast data packet processing, which can greatly improve data processing performance and throughput, and improve the work efficiency of data plane applications. It should be noted that message data refers to a complete data unit transmitted from the sender to the receiver during the data transmission process. Message data not only includes the information that the user really wants to transmit, that is, the payload data, but also includes some additional information added to ensure the correct transmission of data, such as header information (Header), trailer information (Trailer), checksum, etc. ICMP traffic data is collected using tools such as network sniffer DPDK, and the ICMP payload length of each message in the traffic data is determined. The ICMP payload length is the length occupied by the payload data, and the unit of the payload length is not limited.

[0062] Step S2012: If the payload length of the Internet control message is less than the preset payload length, the payload length of the Internet control message is padded and aligned using preset padding characters to obtain message data of the Internet control message of the preset payload length.

[0063] Specifically, the ICMP payload length is compared with the preset payload length. If the ICMP payload length is less than the preset payload length, the portion of the ICMP payload length that is less than the preset payload length is filled with a preset padding character (e.g., "0") to obtain ICMP message data of the preset payload length. For ICMP traffic data whose ICMP payload length is not less than the preset payload length, the input requirements of the detection model are met, and its payload can be directly input into the detection model for detection, which will not be repeated here.

[0064] The detection method for hidden tunnels of Internet control messages provided in this embodiment uses a network sniffer to collect traffic data, which can timely discover and affect security threats in the network, ensure stable acquisition of traffic data, fill and align traffic data with insufficient payload length, ensure that the obtained message data can be directly used by the detection model, and improve the detection efficiency of the detection model.

[0065] Step S202, input the message data of the Internet control message into the hidden tunnel detection model to obtain the abnormal message probability that the message data of the Internet control message is an abnormal message, and input the message data of the Internet control message into the normal message detection model to obtain the normal message probability that the message data of the Internet control message is a normal message.

[0066] In some optional implementations, the covert tunnel detection model includes: a plurality of attack communication detection sub-models, each of which is used to detect covert tunnels of different attack communication categories. The training process of each attack communication sub-model includes:

[0067] Step a1, acquiring transmission messages of multiple target attack communications as an abnormal sample set, and dividing the abnormal sample set into abnormal training samples and abnormal test samples.

[0068] Specifically, the deep learning technology based on tensorflow is used to learn the existing ICMP covert tunnel communication messages for model training, and obtain the covert tunnel detection model. Automatically learning and identifying complex ICMP covert tunnel network traffic has wider applicability and higher efficiency than traditional ICMP covert tunnel communication detection methods. Through tensorflow deep learning technology, known Trojan virus communication messages can be learned, and the model can be used to intelligently identify ICMP covert tunnel communication. Communication messages of this type can also be accurately identified for unknown Trojan communications, with stronger adaptability and richer detection types. Improved detection adaptability, higher efficiency and real-time performance.

[0069] Step a2: use abnormal training samples to train a preset neural network model, and use abnormal test samples to test the trained model to obtain an attack communication detection sub-model for detecting target attack communications.

[0070] Specifically, in the traditional rule detection method, each incoming message needs to match all the rules of the corresponding protocol. As the system runs longer, the more rules the system detects, the more CPU time is consumed for each message detection, and each message matches thousands of rules, resulting in lower and lower system performance. After using tensorflow machine learning detection, each type of attack communication corresponds to a related attack communication sub-model, the number of sub-models in the covert tunnel detection model is controllable, and the system performance is greatly improved.

[0071] Based on the load_data function in tensorflow to load training data, the model input parameters can be defined in order, such as the number of convolutional layers, pooling layers, and fully connected layers in the convolutional neural network structure. The model is compiled using the compile function and trained using the fit method. The trained model is then verified using the test set to ensure the accuracy of the model. The specific training process of the model is a mature existing technology and will not be described here.

[0072] In the detection method for covert tunnels of Internet control messages provided in this embodiment, each type of attack communication corresponds to a detection sub-model, and multiple detection sub-models detect traffic data in sequence, so that the detection types are more abundant, thereby improving the accuracy and adaptability of attack communication detection.

[0073] In some optional implementations, the training process of the normal message detection model includes:

[0074] Step b1, obtaining normal communication messages of a plurality of Internet control messages as a normal sample set, and dividing the normal sample set into normal training samples and normal test samples.

[0075] Step b2: Use normal training samples to train a preset neural network model, and use normal test samples to test the trained model to obtain a normal message detection model.

[0076] Specifically, the model architecture of the normal message detection model and the covert tunnel detection model can select the same preset neural network model, such as the Long Short-Term Memory (LSTM) network. The same model architecture can realize parameter sharing and reduce storage and computing costs. Using two models for detection at the same time can increase the model's tolerance to noise and outliers and improve the robustness of the model. The combination of the ICMP covert tunnel detection model and the normal message detection model improves detection accuracy and reduces false alarm rate.

[0077] The normal sample set used for training the normal message detection model contains normal message data. The model training process is the same as that of the covert tunnel detection model, which will not be repeated here.

[0078] The method for detecting hidden tunnels of Internet control messages provided in this embodiment also trains a neural network model for normal message data, judges the message data from both normal and abnormal aspects, improves the accuracy of message data judgment, and facilitates accurate discovery of hidden tunnels.

[0079] In some optional embodiments, the method further comprises:

[0080] Step c1, adding the message data of the Internet control message determined as abnormal message data to the abnormal sample data set, repeating the training process of the attack communication detection sub-model, and optimizing the covert tunnel detection model.

[0081] Step c2, adding the message data of the Internet control message determined to be normal message data to the normal sample data set, repeating the training process of the normal message detection model, and optimizing the normal message detection model.

[0082] Specifically, the covert tunnel detection model and the normal message detection model have been under optimization. When using tensorflow machine learning for detection, during network transmission, normal traffic is learned during normal communication; abnormal traffic is learned when an attack occurs. Detection and learning are carried out simultaneously, so that the longer the system runs, the higher the detection accuracy and the lower the false alarm rate, thereby reducing the cost of manual intervention.

[0083] The detection method for the Internet control message covert tunnel provided in this embodiment uses the newly determined abnormal message data to optimize the covert tunnel detection model, and uses the newly determined normal message data to optimize the normal message detection model, ensuring that unknown attack communications can also be accurately identified by the model, improving the accuracy of the model, and ensuring the accuracy of ICMP covert tunnel detection.

[0084] Step S203, determining whether the message data of the Internet control message is normal message data or abnormal message data according to the abnormal message probability, the normal message probability and a preset rule.

[0085] Specifically, the above step S203 includes:

[0086] Step S2031: If the abnormal message probability is greater than the preset abnormal probability, and the normal message probability is less than the preset normal probability, the message data of the Internet control message is abnormal message data.

[0087] Specifically, the preset abnormal probability and the preset normal probability can be set according to the actual situation. The larger the value, the more accurate the detection result. For example, the preset abnormal probability and the preset normal probability can be set to 95% at the same time. When the abnormal message probability is greater than 95% and the normal message probability is less than 95%, the ICMP message data is determined to be abnormal message data. For example, a certain ICMP message data is input into the hidden tunnel detection model and the normal message detection model respectively, and the abnormal message probability is 96% and the normal message probability is 4%. At this time, the ICMP message data is determined to be abnormal message data.

[0088] Step S2032: If the abnormal message probability is less than the preset abnormal probability, and the normal message probability is greater than the preset normal probability, the message data of the Internet control message is normal message data.

[0089] Specifically, when the probability of abnormal messages is less than 95% and the probability of normal messages is greater than 95%, the ICMP message data is determined to be normal message data. For example, a certain ICMP message data is respectively input into the hidden tunnel detection model and the normal message detection model, and the probability of abnormal messages is 3% and the probability of normal messages is 97%. At this time, the ICMP message data is determined to be normal message data. This is only an example, but not limited to this.

[0090] Step S2033: If the abnormal message probability is not greater than the preset abnormal probability, and the normal message probability is not greater than the preset normal probability, the message data of the Internet control message is determined to be normal message data or abnormal message data according to a preset rule.

[0091] Specifically, if a certain ICMP message data is input into the covert tunnel detection model and the normal message detection model respectively, the probability of abnormal message is 55% and the probability of normal message is 45%. At this time, it is impossible to use the model detection to determine whether the ICMP message data is normal. It is possible to determine whether there is a covert tunnel in the ICMP message data by deeply analyzing the characteristics and behavior of the ICMP message data. For example, it is possible to check whether there is an abnormal ICMP packet sequence, whether the packet characteristics conform to the normal ICMP traffic pattern, whether it matches the ICMP covert tunnel rules, etc., which are only examples, but not limited to this.

[0092] The method for detecting hidden tunnels of Internet control messages provided in this embodiment performs double judgment on message data through preset abnormal probability and preset normal probability. If judgment cannot be made, the existing preset rules are continued to be used for judgment, thereby ensuring complete detection of hidden tunnels, avoiding missed detections, and improving the detection accuracy of hidden tunnels.

[0093] In a specific implementation, the complete process of detecting network transmission data is as follows: Figure 3 As shown, DPDK first collects messages in network transmission, and then determines whether the messages are transmitted using the ICMP protocol. If not, the ICMP covert tunnel detection is terminated. If the messages are transmitted using the ICMP protocol, it further determines whether the ICMP payload length is less than the preset length threshold. If the ICMP payload length is less than the preset length threshold, the payload length of the message is supplemented to the preset length threshold using the preset padding character, and then the messages whose ICMP payload length is not less than the preset length threshold are included in the trained detection model for detection. If the detection result is a normal message, it is included in the normal message detection model to optimize the model training. If the detection result is an abnormal message, an alarm is issued, and the abnormal message is included in the covert tunnel detection model to optimize the model training.

[0094] In this embodiment, a detection device for a hidden tunnel of an Internet control message is also provided, and the device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made are not repeated here. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0095] This embodiment provides a detection device for a hidden tunnel of an Internet control message. Figure 4As shown, including:

[0096] The data preprocessing module 401 is used to obtain the flow data of the Internet control message and process it to obtain the message data of the Internet control message.

[0097] The model detection module 402 is used to input the message data of the Internet control message into the hidden tunnel detection model to obtain the abnormal message probability that the message data of the Internet control message is an abnormal message, and input the message data of the Internet control message into the normal message detection model to obtain the normal message probability that the message data of the Internet control message is a normal message.

[0098] The message data determination module 403 is used to determine whether the message data of the Internet control message is normal message data or abnormal message data according to the abnormal message probability, the normal message probability and preset rules.

[0099] In some optional implementations, the data preprocessing module 401 includes:

[0100] The load length determination unit is used to collect the flow data of the Internet control message by using a network sniffer, and determine the load length of the Internet control message corresponding to the flow data of the Internet control message.

[0101] The length filling unit is used to fill and align the payload length of the Internet control message with a preset filling character if the payload length of the Internet control message is less than the preset payload length, so as to obtain the message data of the Internet control message of the preset payload length.

[0102] In some optional implementations, the message data determination module 403 includes:

[0103] The abnormality determination unit is used to determine that if the abnormal message probability is greater than a preset abnormal probability and the normal message probability is less than a preset normal probability, the message data of the Internet control message is abnormal message data.

[0104] The normal determination unit is used to determine that if the abnormal message probability is less than a preset abnormal probability and the normal message probability is greater than a preset normal probability, the message data of the Internet control message is normal message data.

[0105] The rule determination unit is used to determine whether the message data of the Internet control message is normal message data or abnormal message data according to a preset rule if the abnormal message probability is not greater than a preset abnormal probability and the normal message probability is not greater than a preset normal probability.

[0106] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0107] The detection device for the covert tunnel of the Internet control message in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0108] The embodiment of the present invention also provides a computer device having the above Figure 4 The detection device for the hidden tunnel of Internet control messages is shown.

[0109] See also Figure 5 , Figure 5 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 5 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0110] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0111] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0112] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0113] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0114] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0115] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0116] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0117] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for detecting a hidden tunnel of an Internet control message, characterized in that: The method comprises: Obtaining flow data of Internet control messages and processing the flow data to obtain message data of Internet control messages; Inputting the message data of the Internet control message into the concealed tunnel detection model to obtain the abnormal message probability that the message data of the Internet control message is an abnormal message, and inputting the message data of the Internet control message into the normal message detection model to obtain the normal message probability that the message data of the Internet control message is a normal message; According to the abnormal message probability, the normal message probability and the preset rule, it is determined whether the message data of the Internet control message is normal message data or abnormal message data.

2. The method according to claim 1, characterized in that The method of obtaining the flow data of the Internet control message and processing the flow data to obtain the message data of the Internet control message includes: Collecting the flow data of the Internet control message by using a network sniffer, and determining the payload length of the Internet control message corresponding to the flow data of the Internet control message; If the payload length of the Internet control message is less than the preset payload length, the payload length of the Internet control message is padded and aligned using a preset padding character to obtain message data of the Internet control message of the preset payload length.

3. The method according to claim 1, characterized in that The concealed tunnel detection model includes: a plurality of attack communication detection sub-models, each attack communication detection sub-model is used to detect concealed tunnels of different attack communication categories; The training process of each attack communication sub-model includes: Acquire transmission messages of multiple target attack communications as an abnormal sample set, and divide the abnormal sample set into an abnormal training sample and an abnormal test sample; The abnormal training samples are used to train a preset neural network model, and the trained model is tested using the abnormal test samples to obtain an attack communication detection sub-model for detecting target attack communications.

4. The method according to claim 3, characterized in that The training process of the normal message detection model includes: Acquire normal communication messages of a plurality of Internet control messages as a normal sample set, and divide the normal sample set into a normal training sample and a normal test sample; The normal training samples are used to train a preset neural network detection model, and the trained model is tested using the normal test samples to obtain a normal message detection model.

5. The method according to claim 4, characterized in that The method further comprises: Adding the message data of the Internet control message determined as abnormal message data to the abnormal sample data set, repeating the training process of the attack communication detection sub-model, and optimizing the covert tunnel detection model; The message data of the Internet control message determined to be normal message data is added to the normal sample data set, and the training process of the normal message detection model is repeated to optimize the normal message detection model.

6. The method according to claim 1, characterized in that Determining whether the message data of the Internet control message is normal message data or abnormal message data according to the abnormal message probability, the normal message probability and a preset rule includes: If the abnormal message probability is greater than the preset abnormal probability, and the normal message probability is less than the preset normal probability, the message data of the Internet control message is abnormal message data; If the abnormal message probability is less than the preset abnormal probability, and the normal message probability is greater than the preset normal probability, the message data of the Internet control message is normal message data; If the abnormal message probability is not greater than the preset abnormal probability, and the normal message probability is not greater than the preset normal probability, the message data of the Internet control message is determined to be normal message data or abnormal message data according to a preset rule.

7. A detection device for a hidden tunnel of an Internet control message, characterized in that: The device comprises: A data preprocessing module, used to obtain the flow data of the Internet control message and process it to obtain the message data of the Internet control message; A model detection module, used for inputting the message data of the Internet control message into a concealed tunnel detection model to obtain an abnormal message probability that the message data of the Internet control message is an abnormal message, and inputting the message data of the Internet control message into a normal message detection model to obtain a normal message probability that the message data of the Internet control message is a normal message; The message data determination module is used to determine whether the message data of the Internet control message is normal message data or abnormal message data according to the abnormal message probability, the normal message probability and a preset rule.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the method according to any one of claims 1 to 6.

Images