Feature construction method for encrypted domain name service discovery and encrypted domain name service discovery method

Abstract

The invention provides a feature construction method for encrypted domain name service discovery and an encrypted domain name service discovery method, and the method comprises the steps: obtaining a plurality of data streams which are formed by a plurality of data packets and are generated by different IPs corresponding to different domain name services in real time, and carrying out the classification according to the IPs, and obtaining at least one data stream of each IP; marking a corresponding label for each data stream of each IP, wherein the label comprises encrypted and non-encrypted domain name services; extracting a field feature of each data packet from each data stream of the label corresponding to each IP, and obtaining a statistical feature and a sequence feature of each data stream; fluctuation analysis is carried out on the sequence features, a fluctuation point position set is obtained, transverse and longitudinal fluctuation degree estimation of each fluctuation point is obtained, and fluctuation point sequence features are obtained based on the transverse and longitudinal fluctuation degree estimation of all the fluctuation points; and splicing the statistical feature, the sequence feature and the fluctuation point sequence feature of each data stream of the tag corresponding to each IP, thereby obtaining a plurality of features for encrypted domain name service discovery.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic feature analysis, and in particular to a feature construction method for encrypted domain name service discovery, encrypted domain name service discovery model training and encrypted domain name service discovery method. Background Art

[0002] Encrypted domain name services refer to domain name services that use encryption technology to identify and distinguish in network traffic. The discovery of encrypted domain name services is crucial to maintaining network security and user privacy. Given that attackers' malicious activities may be carried out covertly with the help of encrypted domain name services, the discovery and analysis of encrypted domain name services enables network administrators to effectively identify and manage encrypted traffic, thereby helping to identify potential malicious activities and data leakage risks. Encrypted domain name services generate corresponding traffic data during execution. Service characteristics refer to the specific attributes required to describe the type of encrypted domain name service and its operation process in the generated traffic data, as well as the unique information that can be used to identify the service. When used for service discovery, these characteristics mainly represent the specific behaviors generated during the service process to distinguish different service types, focusing on describing the operation mode and usage habits of the service, that is, how the service performs its functions in the network. Service characteristics are essentially the extraction and expression of specific features that can represent service behavior during the service process. Usually, service analysis is mainly achieved with the help of features such as packet length and packet time in the IP communication activities between the server and the client, which are used to reflect the operation characteristics and usage patterns of the service.

[0003] Current technologies usually rely mainly on the statistical characteristics of the above-mentioned service characteristics to detect traffic data packets, thereby achieving service discovery. However, service characteristics not only have statistical characteristics of statistical characteristics, such as numerical characteristics such as packet length in traffic data packets, but also have sequence characteristics that characterize the periodic characteristics of services. Sequence characteristics are usually a periodic measurement variable, which refers to the characteristics extracted from multiple traffic data packets generated by an encrypted domain name service from the beginning of service provision to the end of service provision. This time characteristic can reflect the activity cycle and continuity of the service over a period of time. For example, the arrival time of the data packet can reflect the activity of the service in certain specific time periods.

[0004] Current technologies lack the detection of sequence features, do not fully utilize and deeply explore sequence features, and especially lack the exploration of data volatility. This may cause some in-depth potential regularities and periodic changes in the traffic data generated by encrypted domain name services to be ignored, thus affecting the accuracy and effectiveness of service discovery. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a feature construction method for encrypted domain name service discovery, encrypted domain name service discovery model training and encrypted domain name service discovery method to eliminate or improve one or more defects existing in the prior art.

[0006] One aspect of the present invention provides a feature construction method for encrypted domain name service discovery, the method comprising the following steps:

[0007] Acquire multiple data streams generated when different domain name services corresponding to different target IP addresses are running in real time, classify the multiple data streams according to the target IP addresses, and obtain at least one data stream for each target IP address, wherein the data stream is a data packet sequence composed of multiple data packets;

[0008] Marking each data flow of each target IP address with a corresponding label based on the correspondence between the target IP address and the running domain name service, wherein the label includes an encrypted domain name service and a non-encrypted domain name service;

[0009] Extracting the field features of each data packet from each data flow of the label corresponding to the mark of each target IP address, and obtaining the statistical features and sequence features of each data flow of the label corresponding to the mark of each target IP address based on the field features;

[0010] Performing volatility analysis on the sequence characteristics to obtain a set of fluctuation point positions of the sequence characteristics, obtaining a horizontal volatility degree estimate and a vertical volatility degree estimate for each fluctuation point based on the set of fluctuation point positions, and obtaining a fluctuation point sequence characteristic based on the horizontal volatility degree estimate and the vertical volatility degree estimate of all fluctuation points;

[0011] The statistical features, sequence features and the fluctuation point sequence features of each data stream of the tag corresponding to each target IP address are spliced ​​together to obtain multiple features for encrypted domain name service discovery.

[0012] In some embodiments of the present invention, the field characteristics include packet length, packet direction, packet arrival time, and packet response time; obtaining statistical characteristics and sequence characteristics of each data flow corresponding to the tag of each target IP address based on the field characteristics includes:

[0013] Based on the packet length, packet arrival time and packet response time of all data packets in each data flow corresponding to the label of each target IP address, statistical features corresponding to the packet length, packet arrival time and packet response time are obtained respectively, and the statistical features corresponding to the packet length, packet arrival time and packet response time are spliced ​​to obtain the statistical features of each data flow corresponding to the label of each target IP address;

[0014] Based on the packet length, packet direction and packet arrival time of each data packet in each data flow corresponding to the label of each target IP address, the corresponding triplet feature is obtained, and the corresponding sequence feature is formed by the triplet features of all data packets in each data flow.

[0015] In some embodiments of the present invention, performing a volatility analysis on the sequence feature to obtain a set of fluctuation point positions of the sequence feature includes:

[0016] Performing wavelet transform on the sequence features;

[0017] Uniformly sampling the triplet features of every three consecutive data packets in the sequence features after wavelet transformation, and determining all data packets belonging to maximum value points and minimum value points in the sequence features after wavelet transformation based on the triplet features of every three consecutive data packets;

[0018] The attribute of the data packet belonging to the maximum value point is recorded as the first attribute value, and the attribute of the data packet belonging to the minimum value point is recorded as the second attribute value. In the sequence features after wavelet transformation, every two consecutive data packets with the first attribute value, the second attribute value, or the second attribute value, the first attribute value are all fluctuation points, and the positions of all fluctuation points in the corresponding data packet sequence of the corresponding target IP address are recorded;

[0019] All fluctuation points are arranged according to the order of their positions in the corresponding data packet sequence of the corresponding target IP address, and a fluctuation point position set is formed based on the positions of all arranged fluctuation points in the corresponding data packet sequence of the corresponding target IP address.

[0020] In some embodiments of the present invention, obtaining a lateral volatility degree estimate and a longitudinal volatility degree estimate for each fluctuation point based on the fluctuation point position set includes:

[0021] Based on the fluctuation point position set, all data packets in the corresponding data packet sequence corresponding to the target IP address are obtained as fluctuation points, and based on the triplet features of each fluctuation point and the triplet features of the data packets before and after each fluctuation point in the corresponding data packet sequence corresponding to the target IP address, the horizontal volatility degree estimation of each fluctuation point is obtained;

[0022] The longitudinal volatility degree estimation of each fluctuation point is obtained based on the triplet feature of each fluctuation point and the average value of the triplet features of all data packets in the corresponding data packet sequence of the corresponding target IP address.

[0023] In some embodiments of the present invention, the fluctuation point sequence characteristics are obtained according to the following formula based on the horizontal volatility degree estimation and the vertical volatility degree estimation of all fluctuation points:

[0024]

[0025]

[0026] Among them, B V represents the characteristics of the fluctuation point sequence, sigmoid() represents the normalization function, HBD i It represents the horizontal volatility estimation of the ith fluctuation point, ZBD i represents the vertical volatility estimate of the ith fluctuation point, y i represents the triple feature of the i-th fluctuation point, bi represents the position of the fluctuation point obtained based on the i-th fluctuation point position in the fluctuation point position set in the corresponding data packet sequence of the corresponding target IP address, and n represents the number of fluctuation points.

[0027] In some embodiments of the present invention, the statistical features include variance, standard deviation, mean, median, mode, the inclination of the packet length, packet arrival time or packet response time relative to the median, the skewness of the packet length, packet arrival time or packet response time relative to the mode, and the coefficient of variation of the packet length, packet arrival time or packet response time.

[0028] Another aspect of the present invention provides a method for training an encrypted domain name service discovery model, the method comprising the following steps:

[0029] Multiple features for encrypted domain name service discovery constructed by the aforementioned feature construction method for encrypted domain name service discovery and corresponding labels are input into a preset encrypted domain name service discovery model to train the encrypted domain name service discovery model, wherein the labels include encrypted domain name services and non-encrypted domain name services.

[0030] Another aspect of the present invention provides a method for discovering an encrypted domain name service, the method comprising the following steps:

[0031] Acquire multiple data streams generated when different domain name services corresponding to different target IP addresses are running in real time, classify the multiple data streams according to the target IP addresses, and obtain at least one data stream for each target IP address, wherein the data stream is a data packet sequence composed of multiple data packets;

[0032] Extracting field features of each data packet from each data flow of each target IP address, and obtaining statistical features and sequence features of each data flow of each target IP address based on the field features;

[0033] Performing volatility analysis on the sequence characteristics to obtain a set of fluctuation point positions of the sequence characteristics, obtaining a horizontal volatility degree estimate and a vertical volatility degree estimate for each fluctuation point based on the set of fluctuation point positions, and obtaining a fluctuation point sequence characteristic based on the horizontal volatility degree estimate and the vertical volatility degree estimate of all fluctuation points;

[0034] The statistical features, sequence features and the fluctuation point sequence features of each data flow of each target IP address are spliced ​​together to obtain multiple features for encrypted domain name service discovery;

[0035] The multiple features used for encrypted domain name service discovery are input into the encrypted domain name service discovery model trained by the aforementioned encrypted domain name service discovery model training method, so that the encrypted domain name service discovery model outputs a result of whether it is an encrypted domain name service.

[0036] In some embodiments of the present invention, the field characteristics include packet length, packet direction, packet arrival time, and packet response time; and obtaining statistical characteristics and sequence characteristics of each data flow of each target IP address based on the field characteristics includes:

[0037] Based on the packet length, packet arrival time and packet response time of all data packets in each data flow of each target IP address, statistical features corresponding to the packet length, packet arrival time and packet response time are obtained respectively, and the statistical features corresponding to the packet length, packet arrival time and packet response time are spliced ​​to obtain the statistical features of each data flow of each target IP address;

[0038] The corresponding triplet features are obtained based on the packet length, packet direction and packet arrival time of each data packet in each data flow of each target IP address, and the corresponding sequence features are formed by the triplet features of all data packets in each data flow.

[0039] Another aspect of the present invention provides an electronic device, which includes: a processor, a memory, and computer instructions stored in the memory, wherein the processor is used to execute the computer instructions, and when the computer instructions are executed, the device implements the steps of the aforementioned feature construction method for encrypted domain name service discovery, encrypted domain name service discovery model training method, or encrypted domain name service discovery method.

[0040] Another aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned feature construction method for encrypted domain name service discovery, encrypted domain name service discovery model training method, or encrypted domain name service discovery method.

[0041] Another aspect of the present invention provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the aforementioned feature construction method for encrypted domain name service discovery, encrypted domain name service discovery model training method, or encrypted domain name service discovery method.

[0042] The feature construction method for encrypted domain name service discovery, encrypted domain name service discovery model training and encrypted domain name service discovery method of the present invention, wherein the feature construction method introduces volatility analysis of sequence features on the basis of numerical dimensions of statistical features and sequence features, can effectively capture behavioral relationship patterns in traffic data generated by encrypted domain name services, and is of great significance for characterizing encrypted domain name service behaviors and further encrypted domain name service discovery tasks.

[0043] Additional advantages, purposes, and features of the present invention will be described in part in the following description, and will become apparent to those skilled in the art after studying the following, or may be learned from the practice of the present invention. The purposes and other advantages of the present invention may be achieved and obtained by the structures specifically indicated in the specification and the accompanying drawings.

[0044] Those skilled in the art will appreciate that the objectives and advantages that can be achieved with the present invention are not limited to the above specific description, and the above and other objectives that can be achieved by the present invention will be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of this application, and do not constitute a limitation of the present invention.

[0046] Figure 1 A flowchart of a feature construction method for encrypted domain name service discovery in one embodiment of the present invention;

[0047] Figure 2 A flowchart of a method for training an encrypted domain name service discovery model in one embodiment of the present invention;

[0048] Figure 3 The figure is a flow chart of an encrypted domain name service discovery method in one embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0050] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present invention are shown in the accompanying drawings, while other details that are not closely related to the present invention are omitted.

[0051] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0052] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0053] In view of the fact that the existing encrypted domain name service discovery methods lack analysis and exploration of the volatility of sequence characteristics, and the sequence characteristics relied on by some methods are only reflected in the data dimension, which is too single and cannot deeply analyze the behavior rules of domain name services from the volatility of time series. The present invention takes into account the differences in specific events and activity rules between encrypted domain name services and non-encrypted domain name services during the service resolution process. The encrypted domain name services present different special rules in the fluctuation of the time series of the generated traffic data from the non-encrypted domain name services. For example, when some services use encrypted domain name services for malicious activities, the volatility of service traffic data is usually greater than that of encrypted domain name services under normal circumstances. At the same time, the startup, interruption and termination of encrypted domain name services often lead to obvious feature changes in the corresponding generated traffic data. This change in service characteristics can be reflected and explored through the volatility of sequence characteristics.

[0054] Therefore, the embodiment of the present invention provides a feature construction method for encrypted domain name service discovery, encrypted domain name service discovery model training and encrypted domain name service discovery method combined with sequence fluctuation characteristics, which introduces the volatility analysis of sequence characteristics on the basis of statistical characteristics and numerical dimensions of sequence characteristics, and can effectively capture the behavior relationship pattern in the traffic data generated by the encrypted domain name service, which is of great significance for characterizing the behavior of the encrypted domain name service and further tasks of encrypted domain name service discovery. The method can also play a positive role in timely identifying abnormal behaviors in the traffic data generated by the encrypted domain name service and sequence characteristic traits generated by emergencies. When malicious encrypted domain name services appear and cause traffic fluctuations, it can promote the discovery and identification of malicious encrypted domain name services, greatly reducing network security risks.

[0055] Figure 1 FIG. 1 is a flow chart of a feature construction method for encrypted domain name service discovery in one embodiment of the present invention. Figure 1 As shown, the feature construction method includes the following steps:

[0056] Step S110, real-time acquisition of multiple data streams generated when different domain name services corresponding to different target IP addresses are running, and the multiple data streams are classified according to the target IP addresses to obtain at least one data stream for each target IP address, wherein the data stream is a data packet sequence composed of multiple data packets.

[0057] In this step, the domain name service can be different services provided by multiple servers with different IP addresses accessing the same domain name at the same time, including encrypted domain name services and non-encrypted domain name services. In the specific application scenario of this method, a router with a network monitoring function (Netflow) can be deployed in the gateway server of the network. After manually testing the network access function, the multiple traffic data streams (IP data streams) generated when multiple servers with different IP addresses run different domain name services (including encrypted domain name services and non-encrypted domain name services) are collected in real time through the Netflow router, and then the original data streams collected by the Netflow router are sent to the network behavior monitoring (NBOS) resident system for subsequent analysis.

[0058] The NBOS on-site system organizes and records the stored original data streams and preprocesses the original data streams. The preprocessing operation mainly converts the original data streams into standardized data stream records, parses the standardized data stream records, obtains the server IP address of the corresponding service provided, and defines the server IP address as the target IP address. The target IP address is used as the identifier of the service activity. Each data stream record is then classified according to the target IP address, and all data stream records for each target IP address are obtained by counting. All preprocessed data streams are sent to the activity library for storing key data and features. Each data stream record is regarded as a domain name service activity.

[0059] Step S120, marking each data flow of each target IP address with a corresponding label based on the correspondence between the target IP address and the running domain name service, wherein the label includes an encrypted domain name service and a non-encrypted domain name service.

[0060] In this step, the correspondence between the target IP address and the running domain name service is preset. In a specific application scenario, each pre-processed data stream stored in the active library is labeled by the NBOS resident system. Specifically, if the server of a certain target IP address provides or runs an encrypted domain name service, the data stream generated when the server of the target IP address runs the service is marked as the label of the encrypted domain name service; if the server of a certain target IP address provides or runs a non-encrypted domain name service, the data stream generated when the server of the target IP address runs the service is marked as the label of the non-encrypted domain name service.

[0061] Step S130, extracting the field features of each data packet from each data flow of the label corresponding to each target IP address, and obtaining the statistical features and sequence features of each data flow of the label corresponding to each target IP address based on the field features.

[0062] In this step, in a specific application scenario, the field features used to characterize two types of service features, namely, statistical features and sequence features, are extracted from each pre-processed data stream stored in the activity library through the NBOS resident system. Through this step, it can be clearly known whether the label to which the field features of each extracted data packet belong is an encrypted domain name service or a non-encrypted domain name service, that is, it is clearly known which field features belong to the encrypted domain name service and which field features belong to the non-encrypted domain name service.

[0063] In one embodiment of the present invention, the field characteristics include packet length, packet direction, packet arrival time and packet response time.

[0064] For a single domain name service activity performed by a server at a target IP address, the direction in which the data packet of the data stream flows into the target IP address is set as the inbound direction of the domain name service, and the direction in which the data packet flows out of the target IP address is set as the outbound direction of the domain name service. The mapping from the inbound direction to the outbound direction is the packet direction of each data packet in the data stream. Packet arrival time refers to the time when the data packet arrives at the target IP address. Packet response time refers to the time difference between the sending of a data packet and the receiving of a reply, that is, the time difference obtained by subtracting the time when the sender sends the data packet from the time when the sender receives the response packet. This time difference can reflect the response performance of the network and the delay characteristics of the service. Field features can also include source IP address, destination IP address, source port, and destination port used to determine session flow features.

[0065] In one embodiment, obtaining the statistical characteristics and sequence characteristics of each data flow of the tag corresponding to each target IP address based on the field characteristics in step S130 specifically includes the following steps:

[0066] Step S133, based on the packet length, packet arrival time and packet response time of all data packets in each data flow corresponding to the label of each target IP address, obtain the statistical characteristics corresponding to the packet length, packet arrival time and packet response time respectively, and splice the statistical characteristics corresponding to the packet length, packet arrival time and packet response time to obtain the statistical characteristics of each data flow corresponding to the label of each target IP address.

[0067] In this step, the statistical features include variance, standard deviation, mean, median, mode, the inclination of the packet length, packet arrival time or packet response time relative to the median, the skewness of the packet length, packet arrival time or packet response time relative to the mode, and the coefficient of variation of the packet length, packet arrival time or packet response time.

[0068] For multiple data packets in a data stream generated when a server with a target IP address runs a domain name service activity, the statistical characteristics of the three variables corresponding to the data stream of the domain name service V containing all the data packets are obtained as Tv = [S1, S2, ..., S8, A1, A2, ..., A8, R1, R2, ..., R8], where the three variables include packet length S, packet arrival time A and packet response time R, and S1, S2, ..., S8 represent the variance, standard deviation, mean, median, mode, and packet length relative to The median slope, the skewness of the packet length relative to the mode, and the coefficient of variation of the packet length; A1, A2, ..., A8 represent the variance, standard deviation, mean, median, mode, the slope of the packet arrival time relative to the median, the skewness of the packet arrival time relative to the mode, and the coefficient of variation of the packet arrival time; R1, R2, ..., R8 represent the variance, standard deviation, mean, median, mode, the slope of the packet response time relative to the median, the skewness of the packet response time relative to the mode, and the coefficient of variation of the packet response time. The mode is used to represent the degree of change, distribution, average size, middle value, and the most frequent value of the variable. The slope of the variable relative to the median and the skewness of the variable relative to the mode can be used to calculate the asymmetry of the distribution of the variable. The coefficient of variation of the variable can be used to calculate the ratio of the standard deviation to the mean.

[0069] Since the statistical characteristics of the above three variables play an important role in the detection and identification of encrypted domain name services, the calculation of the statistical characteristics of the above three variables can reflect, quantify and describe the behavior of domain name service traffic data from the perspective of numerical statistics by numerically defining the traffic data characteristics / domain name service characteristics from the statistical characteristics of the data packet. Different types of statistical numerical calculations can reflect different data characteristics, so the above eight types of statistical numerical calculations are performed for each variable.

[0070] Step S134, based on the packet length, packet direction and packet arrival time of each data packet in each data flow corresponding to the label of each target IP address, the corresponding triplet feature is obtained, and the corresponding sequence feature is formed by the triplet features of all data packets in each data flow.

[0071] This step describes and reveals the behavior pattern information of the encrypted domain name service traffic data in the periodic time period by selecting the packet length S, packet direction D and packet arrival time A of the traffic data packet in the domain name service V. Assume that the traffic data stream generated in a domain name service contains N data packet samples, and the sequence feature of the data stream finally formed is Hv = [(Sx1, Dx1, Ax1), (Sx2, Dx2, Ax2), ..., (Sx N ,Dx N ,AxN )], where the triplet feature of each data packet is y i =(Sx i ,Dx i ,Ax i ), x i Represents the i-th data packet, i=1,2,…,N.

[0072] Step S140, performing volatility analysis on the sequence characteristics to obtain a set of fluctuation point positions of the sequence characteristics, obtaining a horizontal volatility degree estimate and a vertical volatility degree estimate for each fluctuation point based on the fluctuation point position set, and obtaining a fluctuation point sequence characteristic based on the horizontal volatility degree estimate and the vertical volatility degree estimate of all fluctuation points.

[0073] This step can evaluate the overall change trend of the sequence features by extracting the fluctuation point sequence features from the sequence features. Sequence features are an important dimension for detecting and identifying encrypted domain name services, but simple sequence features cannot measure the fluctuations in the traffic data stream and further identify the abnormal points and fluctuation points therein. For example, when the traffic of the encrypted domain name service suddenly increases at a certain point in time, the simple sequence features cannot characterize this abnormal behavior or reflect this law, and thus it is difficult to accurately identify the encrypted domain name service. Therefore, the present invention introduces a volatility measurement index of the sequence features, namely the fluctuation point sequence features extracted in this step.

[0074] In one embodiment of the present invention, the step S140 performs a volatility analysis on the sequence feature to obtain a set of fluctuation point positions of the sequence feature, which specifically includes the following steps:

[0075] Step S141, performing wavelet transform on the sequence features.

[0076] Step S142, uniformly sampling the triplet features of every three consecutive data packets in the sequence features after wavelet transformation, and determining all data packets belonging to the maximum and minimum points in the sequence features after wavelet transformation based on the triplet features of every three consecutive data packets. i-1 、x i and x i+1 , and the triplet features of these three data packets have the following relationship: (y i -y i-1 )(y i+1 -y i )﹤0, then the data packet x in the sequence feature after wavelet transformation i is an extreme point. Further, if x i ﹥x i-1 , then the data packet x i is a maximum point, if x i ﹤xi-1 , then the data packet x i is the minimum point.

[0077] Step S143, record the attribute of the data packet belonging to the maximum point as the first attribute value, record the attribute of the data packet belonging to the minimum point as the second attribute value, in the sequence feature after wavelet transformation, every two consecutive data packets with the attributes of the first attribute value, the second attribute value, or the second attribute value, the first attribute value are all fluctuation points, and record the positions of all fluctuation points in the corresponding data packet sequence of the corresponding target IP address. For example, the attribute of the data packet belonging to the maximum point is marked as 1, and the attribute of the data packet belonging to the minimum point is marked as -1. If the attributes of two consecutive data packets are "1, -1" or "-1, 1", then the two data packets are called fluctuation points. In this way, all fluctuation points are screened out, and the positions of all fluctuation points in the corresponding data packet sequence of the corresponding target IP address are recorded as b1, b2...bn. The position is determined by the arrival time of the data packet corresponding to the fluctuation point at the target IP address.

[0078] Step S144, all the fluctuation points are arranged according to the order of their positions in the corresponding data packet sequence of the corresponding target IP address, and a fluctuation point position set is formed based on the positions of all the arranged fluctuation points in the corresponding data packet sequence of the corresponding target IP address. For example, the fluctuation point position set may be [b1, b2, ..., bn].

[0079] In one embodiment of the present invention, obtaining the horizontal volatility degree estimation and the vertical volatility degree estimation of each fluctuation point based on the fluctuation point position set in step S140 specifically includes the following steps:

[0080] Step S145, based on the fluctuation point position set, all data packets that serve as fluctuation points in the corresponding data packet sequence of the corresponding target IP address are obtained, and based on the triplet features of each fluctuation point and the triplet features of the data packets before and after each fluctuation point in the corresponding data packet sequence of the corresponding target IP address, an estimate of the degree of lateral volatility of each fluctuation point is obtained.

[0081] Specifically, the horizontal volatility of each fluctuation point is estimated according to the following formula:

[0082]

[0083] Among them, HBD i Represents the horizontal volatility estimate of the ith fluctuation point, y i Represents the triple feature of the i-th fluctuation point, y i+1 The triplet feature of the data packet located after the ith fluctuation point in the corresponding data packet sequence of the target IP address, y i-1The triplet feature representing the data packet located before the i-th fluctuation point in the data packet sequence corresponding to the target IP address.

[0084] Step S146, obtaining an estimate of the longitudinal volatility of each fluctuation point based on the triplet feature of each fluctuation point and the average value of the triplet features of all data packets in the corresponding data packet sequence of the target IP address.

[0085] Specifically, the vertical volatility of each fluctuation point is estimated according to the following formula:

[0086]

[0087] Among them, ZBD i It represents the estimation of the vertical volatility of the ith fluctuation point, It represents the average value of the triplet features of all packets in the corresponding packet sequence of the target IP address where the fluctuation point is located, and n represents the number of fluctuation points.

[0088] In one embodiment of the present invention, in step S140, the fluctuation point sequence characteristics are obtained based on the horizontal fluctuation degree estimation and the vertical fluctuation degree estimation of all fluctuation points according to the following formula:

[0089]

[0090]

[0091] Among them, B V represents the characteristics of the fluctuation point sequence, sigmoid() represents the normalization function, HBD i It represents the horizontal volatility estimation of the ith fluctuation point, ZBD i represents the vertical volatility estimate of the ith fluctuation point, y i represents the triple feature of the i-th fluctuation point, bi represents the position of the fluctuation point obtained based on the i-th fluctuation point position in the fluctuation point position set in the corresponding data packet sequence of the corresponding target IP address, and n represents the number of fluctuation points.

[0092] Through the above steps, the sequence features converted by wavelet transform are defined to obtain each fluctuation point. By defining the relevant indicators of the fluctuation point and the triplet features of the data packets before and after the original data packet sequence and the degree of numerical change between the fluctuation point and the average triplet features of the original data packet sequence as a whole, the above formulas for measuring the degree of fluctuation of data points in the sequence features are determined. The fluctuation point sequence contained in the fluctuation point sequence features obtained by this formula is helpful to improve the accuracy of discovery and identification of encrypted domain name services.

[0093] Step S150, concatenate the statistical features, sequence features and the fluctuation point sequence features of each data stream of the tag corresponding to each target IP address, so as to obtain a plurality of features for encrypted domain name service discovery.

[0094] In this step, specifically, by splicing the statistical features, sequence features and fluctuation point sequence features of the data stream including the statistical features corresponding to the packet length, packet arrival time and packet response time, the feature Zv = (Tv, Hv, Bv) finally constructed for encrypted domain name service discovery can be obtained. For the statistical features, sequence features and fluctuation point sequence features obtained in this method, it can be clearly known whether the labels corresponding to these features are encrypted domain name services or non-encrypted domain name services. The multiple features finally obtained for encrypted domain name service discovery are multiple spliced ​​features constructed from multiple data streams corresponding to labels marked with different target IP addresses (the statistical features, sequence features and fluctuation point sequence features of each data stream are spliced).

[0095] Figure 2 FIG. 1 is a flow chart of a method for training an encrypted domain name service discovery model in one embodiment of the present invention. Figure 2 As shown, an embodiment of the present invention also provides an encrypted domain name service discovery model training method, the method comprising the following steps:

[0096] Step S210, input multiple features and corresponding labels for encrypted domain name service discovery constructed by the feature construction method of encrypted domain name service discovery in the aforementioned embodiments into a preset encrypted domain name service discovery model to train the encrypted domain name service discovery model, wherein the labels include encrypted domain name services and non-encrypted domain name services.

[0097] In one embodiment of the present invention, the preset encrypted domain name service discovery model is a TextConvolutional Neural Network (TextCNN) classifier. TextCNN is a general deep learning model that can extract certain timing information from sequence features and has a good effect on capturing discrete features. In other embodiments, the preset encrypted domain name service discovery model can also be other deep learning models.

[0098] Figure 3 FIG. 1 is a flow chart of a method for discovering an encrypted domain name service according to an embodiment of the present invention. Figure 3 As shown, the embodiment of the present invention also provides an encrypted domain name service discovery method, which includes the following steps:

[0099] Step S310, acquiring in real time a plurality of data streams generated when different domain name services corresponding to different target IP addresses are running, classifying the plurality of data streams according to the target IP addresses, and obtaining at least one data stream for each target IP address, wherein the data stream is a sequence of data packets consisting of a plurality of data packets;

[0100] Step S320, extracting the field features of each data packet from each data flow of each target IP address, and obtaining the statistical features and sequence features of each data flow of each target IP address based on the field features;

[0101] Step S330, performing volatility analysis on the sequence feature to obtain a set of fluctuation point positions of the sequence feature, obtaining a horizontal volatility degree estimate and a vertical volatility degree estimate of each fluctuation point based on the set of fluctuation point positions, and obtaining a fluctuation point sequence feature based on the horizontal volatility degree estimates and the vertical volatility degree estimates of all fluctuation points;

[0102] Step S340, concatenating the statistical features, sequence features and the fluctuation point sequence features of each data flow of each target IP address, thereby obtaining a plurality of features for encrypted domain name service discovery;

[0103] Step S350, input the multiple features used for encrypted domain name service discovery into the encrypted domain name service discovery model trained by the encrypted domain name service discovery model training method in the aforementioned embodiments, so that the encrypted domain name service discovery model outputs whether it is a result of encrypted domain name service.

[0104] In one embodiment of the present invention, the field characteristics include packet length, packet direction, packet arrival time, and packet response time; obtaining statistical characteristics and sequence characteristics of each data flow of each target IP address based on the field characteristics in step S320 includes the following steps:

[0105] Step S323, based on the packet length, packet arrival time and packet response time of all data packets in each data flow of each target IP address, respectively obtain statistical features corresponding to the packet length, packet arrival time and packet response time, and splice the statistical features corresponding to the packet length, packet arrival time and packet response time to obtain the statistical features of each data flow of each target IP address;

[0106] Step S324, based on the packet length, packet direction and packet arrival time of each data packet in each data stream of each target IP address, a corresponding triplet feature is obtained, and a corresponding sequence feature is formed by the triplet features of all data packets in each data stream.

[0107] The feature construction method, encrypted domain name service discovery model training and encrypted domain name service discovery method for the embodiment of the present invention, wherein the feature construction method for encrypted domain name service discovery is based on the statistical features of the data stream, combined with the sequence features of the data stream, and introduces the fluctuation point sequence features. By connecting or splicing the statistical features, the sequence features and the fluctuation point sequence features, and jointly constructing the features for encrypted domain name service discovery, it is possible to increase the dynamic insight into the behavior of the domain name service, more accurately characterize the behavior of the encrypted domain name service from multiple angles, and improve the accuracy of the discovery of the encrypted domain name service. The fluctuation point sequence features are specifically obtained by defining and identifying the fluctuation points in the sequence features, and defining the degree of fluctuation of the data packets (fluctuation points) in the data stream according to the horizontal fluctuation and vertical fluctuation of the fluctuation points around the data stream. It can reflect the overall change trend and key point trend in the service traffic, and realize the quantification of the volatility of the sequence features, so as to help identify the periodic changes and trends in the traffic data generated by the domain name service, and the special behavior laws contained in the domain name service data, and finally realize the accurate discovery of the encrypted domain name service.

[0108] Corresponding to the above method, the present invention also provides an electronic device, which includes a computer device, the computer device includes a processor and a memory, the memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the aforementioned feature construction method for encrypted domain name service discovery, encrypted domain name service discovery model training method or encrypted domain name service discovery method.

[0109] The embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the aforementioned feature construction method for encrypted domain name service discovery, encrypted domain name service discovery model training method or encrypted domain name service discovery method are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0110] An embodiment of the present invention also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the aforementioned feature construction method for encrypted domain name service discovery, encrypted domain name service discovery model training method, or encrypted domain name service discovery method.

[0111] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0112] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0113] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0114] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the embodiments of the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A feature construction method for encrypted domain name service discovery, characterized in that: The method comprises: Acquire multiple data streams generated when different domain name services corresponding to different target IP addresses are running in real time, classify the multiple data streams according to the target IP addresses, and obtain at least one data stream for each target IP address, wherein the data stream is a data packet sequence composed of multiple data packets; Marking each data flow of each target IP address with a corresponding label based on the correspondence between the target IP address and the running domain name service, wherein the label includes an encrypted domain name service and a non-encrypted domain name service; Extracting the field features of each data packet from each data flow of the label corresponding to the mark of each target IP address, and obtaining the statistical features and sequence features of each data flow of the label corresponding to the mark of each target IP address based on the field features; Performing volatility analysis on the sequence characteristics to obtain a set of fluctuation point positions of the sequence characteristics, obtaining a horizontal volatility degree estimate and a vertical volatility degree estimate for each fluctuation point based on the set of fluctuation point positions, and obtaining a fluctuation point sequence characteristic based on the horizontal volatility degree estimate and the vertical volatility degree estimate of all fluctuation points; The statistical features, sequence features and the fluctuation point sequence features of each data stream of the tag corresponding to each target IP address are spliced ​​together to obtain multiple features for encrypted domain name service discovery.

2. The method according to claim 1, characterized in that The field features include packet length, packet direction, packet arrival time, and packet response time; based on the field features, the statistical features and sequence features of each data flow corresponding to the tag of each target IP address are obtained, including: Based on the packet length, packet arrival time and packet response time of all data packets in each data flow corresponding to the label of each target IP address, statistical features corresponding to the packet length, packet arrival time and packet response time are obtained respectively, and the statistical features corresponding to the packet length, packet arrival time and packet response time are spliced ​​to obtain the statistical features of each data flow corresponding to the label of each target IP address; The corresponding triplet features are obtained based on the packet length, packet direction and packet arrival time of each data packet in each data flow corresponding to the label of each target IP address, and the corresponding sequence features are formed by the triplet features of all data packets in each data flow; Performing a volatility analysis on the sequence feature to obtain a set of fluctuation point positions of the sequence feature includes: Performing wavelet transform on the sequence features; Uniformly sampling the triplet features of every three consecutive data packets in the sequence features after wavelet transformation, and determining all data packets belonging to maximum value points and minimum value points in the sequence features after wavelet transformation based on the triplet features of every three consecutive data packets; The attribute of the data packet belonging to the maximum value point is recorded as the first attribute value, and the attribute of the data packet belonging to the minimum value point is recorded as the second attribute value. In the sequence features after wavelet transformation, every two consecutive data packets with the first attribute value, the second attribute value, or the second attribute value, the first attribute value are all fluctuation points, and the positions of all fluctuation points in the corresponding data packet sequence of the corresponding target IP address are recorded; All fluctuation points are arranged according to the order of their positions in the corresponding data packet sequence of the corresponding target IP address, and a fluctuation point position set is formed based on the positions of all arranged fluctuation points in the corresponding data packet sequence of the corresponding target IP address.

3. The method according to claim 2, characterized in that Obtaining a lateral volatility degree estimate and a longitudinal volatility degree estimate for each fluctuation point based on the fluctuation point position set includes: Based on the fluctuation point position set, all data packets in the corresponding data packet sequence corresponding to the target IP address are obtained as fluctuation points, and based on the triplet features of each fluctuation point and the triplet features of the data packets before and after each fluctuation point in the corresponding data packet sequence corresponding to the target IP address, the horizontal volatility degree estimation of each fluctuation point is obtained; The longitudinal volatility degree estimation of each fluctuation point is obtained based on the triplet feature of each fluctuation point and the average value of the triplet features of all data packets in the corresponding data packet sequence of the corresponding target IP address.

4. The method according to claim 3, characterized in that: Based on the estimation of the horizontal volatility and vertical volatility of all fluctuation points, the characteristics of the fluctuation point sequence are obtained according to the following formula: Among them, B V represents the characteristics of the fluctuation point sequence, sigmoid() represents the normalization function, HBD i It represents the horizontal volatility estimation of the ith fluctuation point, ZBD i represents the vertical volatility estimate of the ith fluctuation point, y i represents the triple feature of the i-th fluctuation point, bi represents the position of the fluctuation point obtained based on the i-th fluctuation point position in the fluctuation point position set in the corresponding data packet sequence of the corresponding target IP address, and n represents the number of fluctuation points.

5. The method according to claim 2, characterized in that: The statistical characteristics include variance, standard deviation, mean, median, mode, the inclination of the packet length, packet arrival time or packet response time relative to the median, the skewness of the packet length, packet arrival time or packet response time relative to the mode, and the coefficient of variation of the packet length, packet arrival time or packet response time.

6. A method for discovering an encrypted domain name service, characterized in that: The method comprises: Acquire multiple data streams generated when different domain name services corresponding to different target IP addresses are running in real time, classify the multiple data streams according to the target IP addresses, and obtain at least one data stream for each target IP address, wherein the data stream is a data packet sequence composed of multiple data packets; Extracting field features of each data packet from each data flow of each target IP address, and obtaining statistical features and sequence features of each data flow of each target IP address based on the field features; Performing volatility analysis on the sequence characteristics to obtain a set of fluctuation point positions of the sequence characteristics, obtaining a horizontal volatility degree estimate and a vertical volatility degree estimate for each fluctuation point based on the set of fluctuation point positions, and obtaining a fluctuation point sequence characteristic based on the horizontal volatility degree estimate and the vertical volatility degree estimate of all fluctuation points; The statistical features, sequence features and the fluctuation point sequence features of each data flow of each target IP address are spliced ​​together to obtain multiple features for encrypted domain name service discovery; The multiple features for encrypted domain name service discovery are input into an encrypted domain name service discovery model trained by an encrypted domain name service discovery model training method, so that the encrypted domain name service discovery model outputs a result of whether it is an encrypted domain name service; the encrypted domain name service discovery model training method includes: inputting multiple features for encrypted domain name service discovery constructed by the method as described in any one of claims 1 to 5 and corresponding labels into a preset encrypted domain name service discovery model to train the encrypted domain name service discovery model, the labels including encrypted domain name services and non-encrypted domain name services.

7. The method according to claim 6, characterized in that The field characteristics include packet length, packet direction, packet arrival time, and packet response time; based on the field characteristics, statistical characteristics and sequence characteristics of each data flow of each target IP address are obtained, including: Based on the packet length, packet arrival time and packet response time of all data packets in each data flow of each target IP address, statistical features corresponding to the packet length, packet arrival time and packet response time are obtained respectively, and the statistical features corresponding to the packet length, packet arrival time and packet response time are spliced ​​to obtain the statistical features of each data flow of each target IP address; The corresponding triplet features are obtained based on the packet length, packet direction and packet arrival time of each data packet in each data flow of each target IP address, and the corresponding sequence features are formed by the triplet features of all data packets in each data flow.

8. An electronic device comprising a processor, a memory and computer instructions stored in the memory, characterized in that: The processor is used to execute the computer instructions, and when the computer instructions are executed, the device implements the steps of the method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images