A method, apparatus, and equipment for detecting covert tunnels in Internet control messages.

Abstract

This invention relates to the field of network security technology and discloses a method, apparatus, and device for detecting covert tunnels in Internet control messages. The method includes: acquiring traffic data of Internet control messages and processing it to obtain message data; inputting the message data into a covert tunnel detection model to obtain the probability that the Internet control message data is an abnormal message; inputting the Internet control message data into a normal message detection model to obtain the probability that the Internet control message data is a normal message; and determining whether the Internet control message data is normal or abnormal based on the probability of abnormal messages, the probability of normal messages, and preset rules. This invention utilizes both a covert tunnel detection model and a normal message detection model to determine whether the message data is abnormal, reducing manual maintenance costs and improving the detection efficiency and accuracy of covert tunnels.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a method, apparatus, and equipment for detecting covert tunnels in Internet control messages. Background Technology

[0002] With the rapid development of network technology, the application of various network protocols has become more complex, and network security issues are becoming increasingly prominent. Among them, the Internet Control Message Protocol (ICMP) is widely used for network diagnostics and security auditing. Some users may also exploit ICMP to build covert tunnels to transmit and hide malicious data, posing a serious threat to network security. ICMP covert tunneling is a new type of network attack that utilizes the characteristics of the ICMP protocol to hide malicious data within normal network data streams, thereby bypassing the detection of firewalls and other security devices. Therefore, developing an efficient and accurate method for detecting ICMP covert tunnels has become an important issue in the current field of network security.

[0003] Traditional ICMP covert tunnel detection methods are mainly based on traffic statistics or manual rule matching. While these methods have some effect, they often require a lot of computing resources and time, and their effectiveness is limited and overly dependent on the accuracy of the rules. They cannot cope with increasingly complex network environments and malicious attacks, resulting in low detection efficiency and accuracy. Summary of the Invention

[0004] In view of this, the present invention provides a method, apparatus and equipment for detecting covert tunnels of Internet control messages, so as to solve the problems of low detection efficiency and accuracy of traditional ICMP covert tunnel detection methods.

[0005] In a first aspect, the present invention provides a method for detecting covert tunnels of Internet control messages, the method comprising:

[0006] Obtain the traffic data of Internet control messages and process it to obtain the message data of Internet control messages;

[0007] Inputting the Internet control message data into the covert tunnel detection model yields the probability that the Internet control message data is an abnormal message. Inputting the Internet control message data into the normal message detection model yields the probability that the Internet control message data is a normal message.

[0008] The Internet control message data is determined to be normal or abnormal based on the probability of abnormal messages, the probability of normal messages, and preset rules.

[0009] The method for detecting hidden tunnels in Internet control messages provided by this invention utilizes both a hidden tunnel detection model and a normal message detection model to determine whether message data is abnormal, thereby reducing manual maintenance costs and improving the detection efficiency and accuracy of hidden tunnels.

[0010] In one optional implementation, traffic data of Internet control messages is acquired and processed to obtain message data of Internet control messages, including:

[0011] Use a network sniffer to collect Internet control message traffic data and determine the payload length of the Internet control message corresponding to the Internet control message traffic data.

[0012] If the payload length of the Internet control message is less than the preset payload length, the payload length of the Internet control message is filled and aligned using preset padding characters to obtain the message data of the Internet control message with the preset payload length.

[0013] The method for detecting covert tunnels in Internet control messages provided by this invention utilizes a network sniffer to collect traffic data, which can promptly detect and impact security threats in the network, ensure stable acquisition of traffic data, and fill and align traffic data with insufficient payload length, ensuring that the obtained message data can be directly used by the detection model, thereby improving the detection efficiency of the detection model.

[0014] In one optional implementation, the covert tunnel detection model includes: multiple attack communication detection sub-models, each attack communication detection sub-model being used to detect covert tunnels of different attack communication categories;

[0015] The training process for each attack communication sub-model includes:

[0016] The transmission messages of multiple target attack communications are obtained as an abnormal sample set, and the abnormal sample set is divided into abnormal training samples and abnormal test samples.

[0017] A pre-defined neural network model is trained using abnormal training samples, and the trained model is tested using abnormal test samples to obtain an attack communication detection sub-model for detecting target attack communications.

[0018] The method for detecting covert tunnels of Internet control messages provided by this invention has one detection sub-model for each type of attack communication, and multiple detection sub-models sequentially detect traffic data, resulting in a richer range of detection types and improving the accuracy and adaptability of attack communication detection.

[0019] In one optional implementation, the training process of the normal message detection model includes:

[0020] Obtain normal communication messages from multiple Internet control messages as a normal sample set, and divide the normal sample set into normal training samples and normal test samples;

[0021] A pre-defined neural network model is trained using normal training samples, and the trained model is tested using normal test samples to obtain a normal message detection model.

[0022] The method for detecting hidden tunnels in Internet control messages provided by this invention trains a neural network model for normal message data as well, and judges the message data from both normal and abnormal perspectives, thereby improving the accuracy of message data judgment and facilitating the accurate detection of hidden tunnels.

[0023] In one alternative implementation, the method further includes:

[0024] Add the message data of Internet control messages that are identified as abnormal message data to the abnormal sample dataset, repeat the training process of the attack communication detection sub-model, and optimize the covert tunnel detection model.

[0025] Add the Internet control message data that is determined to be normal message data to the normal sample dataset, repeat the training process of the normal message detection model, and optimize the normal message detection model.

[0026] The method for detecting covert tunnels in Internet control messages provided by this invention optimizes the covert tunnel detection model using newly identified abnormal message data and optimizes the normal message detection model using newly identified normal message data. This ensures that unknown attack communications can also be accurately identified by the model, improves the model's accuracy, and guarantees the accuracy of ICMP covert tunnel detection.

[0027] In one optional implementation, determining whether Internet control message data is normal or abnormal based on the probability of abnormal messages, the probability of normal messages, and preset rules includes:

[0028] If the probability of an abnormal message is greater than the preset abnormal probability and the probability of a normal message is less than the preset normal probability, then the message data of the Internet control message is abnormal message data.

[0029] If the probability of an abnormal message is less than the preset abnormal probability and the probability of a normal message is greater than the preset normal probability, then the message data of the Internet control message is normal message data.

[0030] If the probability of an abnormal message is not greater than the preset abnormal probability, and the probability of a normal message is not greater than the preset normal probability, then the message data of the Internet control message is determined to be normal message data or abnormal message data according to the preset rules.

[0031] The method for detecting hidden tunnels in Internet control messages provided by this invention performs dual judgment on message data by setting both anomaly probability and normal probability. If the judgment cannot be made, the existing preset rules are used to make the judgment, thereby ensuring complete detection of hidden tunnels, avoiding missed detections, and improving the detection accuracy of hidden tunnels.

[0032] Secondly, the present invention provides a detection device for covert tunneling of Internet control messages, the device comprising:

[0033] The data preprocessing module is used to acquire the traffic data of Internet control messages and process it to obtain the message data of Internet control messages.

[0034] The model detection module is used to input the message data of Internet control messages into the covert tunnel detection model to obtain the probability that the message data of Internet control messages is an abnormal message, and to input the message data of Internet control messages into the normal message detection model to obtain the probability that the message data of Internet control messages is a normal message.

[0035] The message data determination module is used to determine whether the message data of Internet control messages is normal or abnormal based on the probability of abnormal messages, the probability of normal messages, and preset rules.

[0036] Thirdly, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the method described in the first aspect or any corresponding embodiment thereof.

[0037] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to perform the method described in the first aspect or any corresponding embodiment thereof.

[0038] Fifthly, the present invention provides a computer program product, including computer instructions for causing a computer to perform the method described in the first aspect or any corresponding embodiment thereof. Attached Figure Description

[0039] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0040] Figure 1This is a flowchart illustrating a method for detecting covert tunnels of Internet control messages according to an embodiment of the present invention.

[0041] Figure 2 This is a flowchart illustrating another method for detecting covert tunnels of Internet control messages according to an embodiment of the present invention.

[0042] Figure 3 This is a flowchart illustrating a specific embodiment of the method for detecting covert tunnels in Internet control messages according to an embodiment of the present invention;

[0043] Figure 4 This is a structural block diagram of a device for detecting covert tunnels of Internet control messages according to an embodiment of the present invention;

[0044] Figure 5 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0046] This invention provides a method, apparatus, and device for detecting covert tunnels in Internet control messages. By using both a covert tunnel detection model and a normal message detection model to dual-determine message data, the detection efficiency and accuracy of covert tunnels are improved.

[0047] According to an embodiment of the present invention, a method for detecting covert tunnels of Internet control messages is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0048] This embodiment provides a method for detecting covert tunnels of Internet control messages, which can be used in the aforementioned computer system. Figure 1 This is a flowchart of a method for detecting covert tunnels in Internet control messages according to an embodiment of the present invention, as follows: Figure 1 As shown, the process includes the following steps:

[0049] Step S101: Obtain the traffic data of Internet control messages and process it to obtain the message data of Internet control messages.

[0050] Specifically, the Internet Control Message Protocol (ICMP) is a protocol within the Internet Protocol suite (TCP / IP protocol suite) used to send error reporting messages in IP networks. ICMP resides at Layer 4 (Transport Layer) of the TCP / IP protocol stack, above the IP protocol. ICMP messages can be transmitted between two devices for diagnosing network connectivity problems and reporting errors.

[0051] ICMP traffic data is the total amount of data transmitted through the ICMP network within a certain time period. It belongs to raw data and includes all message data and their header information, as well as any types of network communication activities that may exist, such as control signals and management information. ICMP traffic data contains multiple message data. The purpose of processing it is to unify the format of the directly acquired data so that it can be analyzed uniformly later. By continuously processing the traffic data, a continuous stream of ICMP message data is obtained. The data to be detected in this embodiment is the ICMP message data during the ICMP network transmission process.

[0052] Step S102: Input the Internet control message data into the covert tunnel detection model to obtain the probability that the Internet control message data is an abnormal message; input the Internet control message data into the normal message detection model to obtain the probability that the Internet control message data is a normal message.

[0053] Specifically, for the ICMP message data to be detected, two models are needed for detection processing. The ICMP message data to be detected is input into the covert tunnel detection model to obtain the probability that the ICMP message data is an abnormal message; the ICMP message data is input into the normal message detection model to obtain the probability that the ICMP message data is a normal message. It should be noted that both the covert tunnel detection model and the normal message detection model are pre-trained models.

[0054] Step S103: Determine whether the Internet control message data is normal or abnormal based on the probability of abnormal messages, the probability of normal messages, and preset rules.

[0055] Specifically, for a single ICMP message, the detection result has only two possibilities: a normal message or an abnormal message. Therefore, the sum of the probabilities of abnormal and normal messages is 1. If the probability of an abnormal message is high (greater than the preset abnormal threshold), it is determined to be an abnormal message and an alarm is issued. If the probability of a normal message is high (greater than the preset normal threshold), it is determined to be a normal message. However, it is possible that for the same ICMP message, both the probability of an abnormal message and the probability of a normal message are not high, and the difference between them is not significant (e.g., both are 50%, this is just an example and not a limitation). This means that the covert tunnel detection model and the normal message detection model cannot accurately identify whether the ICMP message is a normal or abnormal message. In this case, preset rules can be used to further analyze the characteristics and behavior of the ICMP message to determine whether the ICMP message is an abnormal message from other perspectives, and thus determine whether a covert tunnel exists. For example, it is possible to check whether there are abnormal ICMP packet sequences, whether the packet characteristics conform to normal ICMP traffic patterns, and whether they match ICMP covert tunnel rules, etc. This is just an example and not a limitation.

[0056] The method for detecting hidden tunnels in Internet control messages provided in this embodiment uses both a hidden tunnel detection model and a normal message detection model to determine whether the message data is abnormal, reducing manual maintenance costs and improving the detection efficiency and accuracy of hidden tunnels.

[0057] This embodiment provides a method for detecting covert tunnels of Internet control messages, which can be used in the aforementioned computer system. Figure 2 This is a flowchart of a method for detecting covert tunnels in Internet control messages according to an embodiment of the present invention, as follows: Figure 2 As shown, the process includes the following steps:

[0058] Step S201: Obtain the traffic data of Internet control messages and process it to obtain the message data of Internet control messages.

[0059] Specifically, step S201 includes:

[0060] Step S2011: Use a network sniffer to collect traffic data of Internet control messages and determine the payload length of the Internet control message corresponding to the traffic data of the Internet control messages.

[0061] Specifically, a network sniffer can be a Data Plane Development Kit (DPDK). DPDK runs on Linux and is a collection of function libraries and drivers for fast packet processing, which can greatly improve data processing performance and throughput, thus increasing the efficiency of data plane applications. It's important to note that packet data refers to a complete unit of data transmitted from the sender to the receiver during data transmission. Packet data includes not only the information the user actually wants to transmit (payload data) but also additional information added to ensure correct data transmission, such as headers, trailers, and checksums. Using tools like the DPDK network sniffer, ICMP traffic data can be collected, and the ICMP payload length of each packet in the traffic data can be determined. The ICMP payload length is the length occupied by the payload data, and the unit of payload length is not limited.

[0062] Step S2012: If the payload length of the Internet control message is less than the preset payload length, then the payload length of the Internet control message is filled and aligned using preset padding characters to obtain the message data of the Internet control message with the preset payload length.

[0063] Specifically, the ICMP payload length is compared with the preset payload length. If the ICMP payload length is less than the preset payload length, a preset padding character (e.g., "0") is used to fill in the portion of the ICMP payload length that is less than the preset payload length, thus obtaining ICMP message data with the preset payload length. For ICMP traffic data with an ICMP payload length not less than the preset payload length, which meets the input requirements of the detection model, the payload can be directly input into the detection model for detection, which will not be elaborated further here.

[0064] The method for detecting covert tunnels in Internet control messages provided in this embodiment utilizes a network sniffer to collect traffic data, which can promptly detect and impact security threats in the network, ensure stable acquisition of traffic data, and fill and align traffic data with insufficient payload length to ensure that the obtained message data can be directly used by the detection model, thereby improving the detection efficiency of the detection model.

[0065] Step S202: Input the Internet control message data into the covert tunnel detection model to obtain the probability that the Internet control message data is an abnormal message; input the Internet control message data into the normal message detection model to obtain the probability that the Internet control message data is a normal message.

[0066] In some optional implementations, the covert tunnel detection model includes: multiple attack communication detection sub-models, each used to detect covert tunnels of different attack communication categories. The training process for each attack communication sub-model includes:

[0067] Step a1: Obtain the transmission messages of multiple target attack communications as an abnormal sample set, and divide the abnormal sample set into abnormal training samples and abnormal test samples.

[0068] Specifically, a deep learning technology based on TensorFlow was employed to train a model using existing ICMP covert tunnel communication packets, resulting in a covert tunnel detection model. This model automatically learns and identifies complex ICMP covert tunnel network traffic, offering wider applicability and higher efficiency compared to traditional ICMP covert tunnel communication detection methods. Through TensorFlow deep learning, it can learn from known Trojan virus communication packets, intelligently identifying ICMP covert tunnel communication packets. It can also accurately identify unknown Trojan communication, demonstrating greater adaptability and a richer range of detection types. This improves detection adaptability, resulting in higher efficiency and real-time performance.

[0069] Step a2: Train a preset neural network model using abnormal training samples, and test the trained model using abnormal test samples to obtain an attack communication detection sub-model for detecting target attack communication.

[0070] Specifically, traditional rule-based detection methods require matching each incoming packet against all rules of the corresponding protocol. As the system runs longer and the number of rules increases, the CPU time consumed per packet increases, leading to increasingly lower system performance due to matching thousands of rules per packet. However, using TensorFlow machine learning detection, each type of attack communication corresponds to a relevant attack communication sub-model. The number of sub-models in the covert tunnel detection model is controllable, resulting in a significant improvement in system performance.

[0071] Training data is loaded using the `load_data` function in TensorFlow, allowing you to define model input parameters sequentially, such as the number of convolutional, pooling, and fully connected layers in a convolutional neural network. The model is then compiled using the `compile` function, trained using the `fit` method, and validated on a test set to ensure accuracy. The specific training process is a mature, existing technique and will not be elaborated upon here.

[0072] The method for detecting covert tunnels of Internet control messages provided in this embodiment has one detection sub-model for each type of attack communication. Multiple detection sub-models sequentially detect traffic data, resulting in a richer range of detection types and improving the accuracy and adaptability of attack communication detection.

[0073] In some optional implementations, the training process for the normal message detection model includes:

[0074] Step b1: Obtain normal communication messages from multiple Internet control messages as a normal sample set, and divide the normal sample set into normal training samples and normal test samples.

[0075] Step b2: Train a preset neural network model using normal training samples, and test the trained model using normal test samples to obtain a normal message detection model.

[0076] Specifically, the normal message detection model and the covert tunnel detection model can use the same preset neural network model, such as a Long Short-Term Memory (LSTM) network. Using the same model architecture allows for parameter sharing, reducing storage and computational costs. Simultaneously using both models increases the model's tolerance to noise and outliers, improving its robustness. Combining the ICMP covert tunnel detection model with the normal message detection model improves detection accuracy and reduces false positives.

[0077] The normal message detection model is trained using normal message data from the normal sample set. The training process is the same as that of the hidden tunnel detection model, and will not be repeated here.

[0078] The method for detecting hidden tunnels in Internet control messages provided in this embodiment also trains a neural network model for normal message data, judging the message data from both normal and abnormal perspectives, thereby improving the accuracy of message data judgment and facilitating the accurate detection of hidden tunnels.

[0079] In some alternative implementations, the method further includes:

[0080] Step c1 involves adding the Internet control message data identified as abnormal message data to the abnormal sample dataset, repeating the training process of the attack communication detection sub-model, and optimizing the covert tunnel detection model.

[0081] Step c2: Add the Internet control message data that is determined to be normal message data to the normal sample dataset, repeat the training process of the normal message detection model, and optimize the normal message detection model.

[0082] Specifically, the covert tunnel detection model and the normal message detection model are constantly being optimized. When using TensorFlow machine learning for detection, normal traffic is learned during normal communication in the network transmission process, and abnormal traffic is learned when an attack occurs. Detection and learning are carried out simultaneously, so that the longer the system runs, the higher the detection accuracy and the lower the false alarm rate, thereby reducing the cost of manual intervention.

[0083] The Internet control message covert tunnel detection method provided in this embodiment optimizes the covert tunnel detection model using newly determined abnormal message data and optimizes the normal message detection model using newly determined normal message data. This ensures that unknown attack communications can also be accurately identified by the model, improves the model's accuracy, and guarantees the accuracy of ICMP covert tunnel detection.

[0084] Step S203: Determine whether the Internet control message data is normal or abnormal based on the probability of abnormal messages, the probability of normal messages, and preset rules.

[0085] Specifically, step S203 includes:

[0086] Step S2031: If the probability of an abnormal message is greater than the preset abnormal probability and the probability of a normal message is less than the preset normal probability, then the message data of the Internet control message is abnormal message data.

[0087] Specifically, the preset anomaly probability and preset normal probability can both be set according to the actual situation. The higher the value, the more accurate the detection results. For example, the preset anomaly probability and preset normal probability can both be set to 95%. When the probability of an abnormal message is greater than 95% and the probability of a normal message is less than 95%, the ICMP message data is determined to be abnormal. For example, if a certain ICMP message data is input into the concealed tunnel detection model and the normal message detection model respectively, and the probability of an abnormal message is 96% and the probability of a normal message is 4%, then the ICMP message data is determined to be abnormal.

[0088] Step S2032: If the probability of an abnormal message is less than the preset abnormal probability and the probability of a normal message is greater than the preset normal probability, then the message data of the Internet control message is normal message data.

[0089] Specifically, when the probability of abnormal messages is less than 95% and the probability of normal messages is greater than 95%, ICMP message data is determined to be normal message data. For example, if a certain ICMP message data is input into the concealed tunnel detection model and the normal message detection model respectively, and the probability of abnormal messages is 3% and the probability of normal messages is 97%, then the ICMP message data is determined to be normal message data. This is just an example, but it is not limited to this.

[0090] Step S2033: If the probability of an abnormal message is not greater than the preset abnormal probability and the probability of a normal message is not greater than the preset normal probability, then the message data of the Internet control message is determined to be normal message data or abnormal message data according to the preset rules.

[0091] Specifically, if a certain ICMP message data is input into a covert tunnel detection model and a normal message detection model respectively, and the probability of an abnormal message is 55% and the probability of a normal message is 45%, then the model cannot be used to determine whether the ICMP message data is normal. However, it is necessary to conduct in-depth analysis of the characteristics and behavior of the ICMP message data to determine whether a covert tunnel exists within it. For example, one can check for abnormal ICMP packet sequences, whether the packet characteristics conform to normal ICMP traffic patterns, and whether they match ICMP covert tunnel rules. These are just examples and are not the only possibilities.

[0092] The method for detecting hidden tunnels in Internet control messages provided in this embodiment performs dual judgment on message data by setting both a preset abnormal probability and a preset normal probability. If the judgment cannot be made, the existing preset rules are used to make the judgment, thereby ensuring complete detection of hidden tunnels, avoiding missed detections, and improving the detection accuracy of hidden tunnels.

[0093] In one specific implementation, the complete process of detecting network transmission data is as follows: Figure 3 As shown, DPDK first collects packets in network transmission, then determines whether the packets are transmitted using the ICMP protocol. If not, the ICMP covert tunnel detection ends. If they are transmitted using the ICMP protocol, it further determines whether the ICMP payload length is less than a preset length threshold. If the ICMP payload length is less than the preset length threshold, it uses preset padding characters to supplement the packet payload length to the preset length threshold. Then, packets with ICMP payload lengths not less than the preset length threshold are included in the trained detection model for detection. If the detection result is a normal packet, it is included in the normal packet detection model for model optimization and training. If the detection result is an abnormal packet, an alarm is issued, and the abnormal packet is included in the covert tunnel detection model for model optimization and training.

[0094] This embodiment also provides a detection device for covert tunneling of Internet control messages. This device is used to implement the above embodiments and preferred embodiments, and details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0095] This embodiment provides a detection device for covert tunneling of Internet control messages, such as... Figure 4As shown, it includes:

[0096] The data preprocessing module 401 is used to acquire the traffic data of Internet control messages and process it to obtain the message data of Internet control messages.

[0097] The model detection module 402 is used to input the message data of Internet control messages into the covert tunnel detection model to obtain the probability that the message data of Internet control messages is an abnormal message, and to input the message data of Internet control messages into the normal message detection model to obtain the probability that the message data of Internet control messages is a normal message.

[0098] The message data determination module 403 is used to determine whether the message data of Internet control messages is normal message data or abnormal message data based on the probability of abnormal messages, the probability of normal messages and preset rules.

[0099] In some alternative implementations, the data preprocessing module 401 includes:

[0100] The payload length determination unit is used to collect traffic data of Internet control messages using a network sniffer and determine the payload length of the Internet control message corresponding to the traffic data of the Internet control message.

[0101] The length padding unit is used to fill and align the payload length of the Internet control message with a preset padding character if the payload length of the Internet control message is less than the preset payload length, so as to obtain the message data of the Internet control message with the preset payload length.

[0102] In some optional implementations, the message data determination module 403 includes:

[0103] The anomaly determination unit is used to determine that if the probability of an abnormal message is greater than the preset anomaly probability and the probability of a normal message is less than the preset normal probability, then the message data of the Internet control message is abnormal message data.

[0104] The normal determination unit is used to determine that if the probability of an abnormal message is less than the preset abnormal probability and the probability of a normal message is greater than the preset normal probability, then the message data of the Internet control message is normal message data.

[0105] The rule determination unit is used to determine whether the data of the Internet control message is normal or abnormal according to the preset rules if the probability of abnormal messages is not greater than the preset abnormal probability and the probability of normal messages is not greater than the preset normal probability.

[0106] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0107] The detection device for the Internet control message covert tunnel in this embodiment is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0108] This invention also provides a computer device having the above-described features. Figure 4 The device shown is for detecting the covert tunnel of Internet control messages.

[0109] Please see Figure 5 , Figure 5 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 5 As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 5 Take a processor 10 as an example.

[0110] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0111] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0112] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0113] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0114] The computer device also includes a communication interface 30 for communicating with other devices or communication networks.

[0115] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0116] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0117] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for detecting covert tunnels in Internet control messages, characterized in that, The method includes: Obtain the traffic data of Internet control messages and process it to obtain the message data of Internet control messages; The message data of the Internet control message is input into the covert tunnel detection model to obtain the probability that the message data of the Internet control message is an abnormal message. The message data of the Internet control message is input into the normal message detection model to obtain the probability that the message data of the Internet control message is a normal message. The covert tunnel detection model and the normal message detection model are obtained through training. Determining whether the Internet control message data is normal or abnormal based on the abnormal message probability, normal message probability, and preset rules includes: if the abnormal message probability is greater than a preset abnormal probability and the normal message probability is less than a preset normal probability, then the Internet control message data is abnormal; if the abnormal message probability is less than the preset abnormal probability and the normal message probability is greater than the preset normal probability, then the Internet control message data is normal; if the abnormal message probability is not greater than the preset abnormal probability and the normal message probability is not greater than the preset normal probability, then determining whether the Internet control message data is normal or abnormal based on preset rules, wherein the preset rules are based on the characteristics and behavior of the message data to determine whether there is a hidden tunnel in the message data.

2. The method according to claim 1, characterized in that, The process of acquiring and processing Internet control message traffic data to obtain Internet control message data includes: Use a network sniffer to collect Internet control message traffic data and determine the payload length of the Internet control message corresponding to the Internet control message traffic data. If the payload length of the Internet control message is less than the preset payload length, the payload length of the Internet control message is filled and aligned using preset padding characters to obtain the message data of the Internet control message with the preset payload length.

3. The method according to claim 1, characterized in that, The covert tunnel detection model includes: multiple attack communication detection sub-models, each of which is used to detect covert tunnels of different attack communication categories; The training process for each attack communication sub-model includes: The transmission messages of multiple target attack communications are obtained as an abnormal sample set, and the abnormal sample set is divided into abnormal training samples and abnormal test samples. A preset neural network model is trained using the abnormal training samples, and the trained model is tested using the abnormal test samples to obtain an attack communication detection sub-model for detecting target attack communications.

4. The method according to claim 3, characterized in that, The training process of the normal message detection model includes: Obtain normal communication messages from multiple Internet control messages as a normal sample set, and divide the normal sample set into normal training samples and normal test samples; A preset neural network detection model is trained using the normal training samples, and the trained model is tested using the normal test samples to obtain a normal message detection model.

5. The method according to claim 4, characterized in that, The method further includes: Add the message data of Internet control messages that are determined to be abnormal message data to the abnormal sample dataset, repeat the training process of the attack communication detection sub-model, and optimize the covert tunnel detection model. The message data of Internet control messages that are determined to be normal message data are added to the normal sample dataset, and the training process of the normal message detection model is repeated to optimize the normal message detection model.

6. A detection device for concealed tunneling of Internet control messages, characterized in that, The device includes: The data preprocessing module is used to acquire the traffic data of Internet control messages and process it to obtain the message data of Internet control messages. The model detection module is used to input the packet data of the Internet control message into the covert tunnel detection model to obtain the probability that the packet data of the Internet control message is an abnormal message, and to input the packet data of the Internet control message into the normal message detection model to obtain the probability that the packet data of the Internet control message is a normal message. The covert tunnel detection model and the normal message detection model are obtained through training. The message data determination module is used to determine whether the message data of the Internet control message is normal or abnormal based on the abnormal message probability, the normal message probability, and a preset rule. This includes: if the abnormal message probability is greater than a preset abnormal probability and the normal message probability is less than a preset normal probability, then the message data of the Internet control message is abnormal; if the abnormal message probability is less than the preset abnormal probability and the normal message probability is greater than the preset normal probability, then the message data of the Internet control message is normal; if the abnormal message probability is not greater than the preset abnormal probability and the normal message probability is not greater than the preset normal probability, then the message data of the Internet control message is determined to be normal or abnormal based on a preset rule, whereby the preset rule determines whether a hidden tunnel exists in the message data based on the characteristics and behavior of the message data.

7. A computer device, characterized in that, include: A memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, the processor executing the computer instructions to perform the method of any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a computer to perform the method of any one of claims 1 to 5.

9. A computer program product, characterized in that, Includes computer instructions for causing a computer to perform the method of any one of claims 1 to 5.

Images