A method and system for identifying network traffic of unknown cryptographic protocols

Abstract

The present invention provides a network traffic identification method and system for unknown cryptographic protocols, which relates to the field of network traffic analysis technology, including: pre-processing captured dynamic traffic data to obtain target traffic data; collecting a multi-dimensional feature parameter set based on predetermined feature dimensions; constructing an initial knowledge graph, and introducing a graph dimensionality reduction mechanism to perform dimensionality reduction processing to obtain a target knowledge graph; clustering analysis of the network traffic knowledge graph database to obtain a target cluster; reading a predetermined clustering degree evaluation strategy, and performing clustering degree evaluation analysis to obtain a target clustering degree; if a predetermined clustering degree limit is reached, the target protocol type corresponding to the target cluster is recorded as the protocol type of the target traffic data. The present invention solves the technical problem that the prior art generally adopts a static feature recognition method, lacks effective detection of unknown cryptographic protocols, and is unable to adapt to the needs of the ever-evolving protocols, thereby leading to network security vulnerabilities.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic analysis, and in particular to a method and system for identifying network traffic of an unknown cryptographic protocol. Background Art

[0002] Unknown cryptographic protocols typically refer to network protocols that conceal their content through encryption or other methods. These protocols can evade traditional network traffic analysis and intrusion detection systems, posing security risks. Currently, network traffic analysis technologies primarily rely on traffic identification methods based on protocol signatures. These methods typically rely on identifying the signatures of known protocols, but are inadequate for detecting unknown cryptographic protocols. Existing technologies lack effective detection methods for unknown cryptographic protocols and are therefore unable to adapt to the evolving demands of protocols. This results in an inability to identify encrypted or hidden traffic types, leading to network security vulnerabilities that attackers can exploit to conduct malicious activities such as data theft and illegal access. Summary of the Invention

[0003] This application provides a method and system for identifying network traffic of unknown cryptographic protocols, aiming to solve the technical problem that the existing technology usually adopts static feature recognition methods, lacks effective detection of unknown cryptographic protocols, and is unable to adapt to the needs of the ever-evolving protocols, which in turn leads to network security vulnerabilities.

[0004] The first aspect disclosed in the present application provides a method for identifying network traffic of an unknown cryptographic protocol, the method comprising: pre-processing captured dynamic traffic data to obtain target traffic data; reading predetermined feature dimensions, and collecting a multidimensional feature parameter set of the target traffic data based on the predetermined feature dimensions; constructing an initial knowledge graph in combination with the multidimensional feature parameter set, and introducing a graph dimensionality reduction mechanism to perform dimensionality reduction processing on the initial knowledge graph to obtain a target knowledge graph; clustering analysis is performed on a network traffic knowledge graph database using the target knowledge graph as a clustering benchmark to obtain a target cluster corresponding to the target knowledge graph; reading a predetermined clustering degree evaluation strategy, and performing clustering degree evaluation analysis on the target cluster and the target traffic data according to the predetermined clustering degree evaluation strategy to obtain a target clustering degree; if the target clustering degree reaches a predetermined clustering degree limit, the target protocol type corresponding to the target cluster is recorded as the protocol type of the target traffic data.

[0005] The second aspect disclosed in the present application provides a network traffic identification system for an unknown cryptographic protocol, the system being used for the above-mentioned network traffic identification method for an unknown cryptographic protocol, the system comprising: a data preprocessing module for preprocessing the captured dynamic traffic data to obtain target traffic data; a feature parameter acquisition module for reading a predetermined feature dimension and collecting a multidimensional feature parameter set of the target traffic data based on the predetermined feature dimension; a dimensionality reduction processing module for constructing an initial knowledge graph in combination with the multidimensional feature parameter set, and introducing a graph dimensionality reduction mechanism to reduce the dimension of the initial knowledge graph. Processing to obtain a target knowledge graph; a clustering analysis module, used to perform clustering analysis on the network traffic knowledge graph database with the target knowledge graph as the clustering benchmark, to obtain a target cluster corresponding to the target knowledge graph; an evaluation analysis module, used to read a predetermined clustering degree evaluation strategy, and perform clustering degree evaluation analysis on the target cluster and the target traffic data according to the predetermined clustering degree evaluation strategy to obtain a target clustering degree; a protocol type determination module, used to record the target protocol type corresponding to the target cluster as the protocol type of the target traffic data if the target clustering degree reaches a predetermined clustering degree limit.

[0006] One or more technical solutions provided in this application have at least the following beneficial effects:

[0007] By preprocessing the captured dynamic traffic data, redundant data, noise and invalid information can be effectively removed, making subsequent analysis and identification more accurate and efficient. The target traffic data obtained after preprocessing is purer, which improves the accuracy of subsequent feature extraction and protocol identification. By reading the predetermined feature dimensions and extracting the multidimensional feature parameter set of the target traffic data based on these dimensions, the multidimensional information of the network traffic can be captured comprehensively and finely. Different feature dimensions provide a more comprehensive basis for protocol identification and enhance the richness and accuracy of feature expression. By combining the multidimensional feature parameter set to construct the initial knowledge graph and introducing the graph dimensionality reduction mechanism, high-dimensional data can be converted into a graph representation in a low-dimensional space. After dimensionality reduction, the target knowledge graph is convenient for further processing and analysis, while effectively reducing the computational complexity. The graph after dimensionality reduction retains important structural information, improving The efficiency and accuracy of subsequent analysis are improved; by taking the target knowledge graph as the clustering benchmark and performing cluster analysis on the network traffic knowledge graph database, the clustering pattern of similar traffic data can be identified, and the target clusters after clustering can clearly identify different protocols or communication modes, thereby providing a clear classification basis for protocol identification; through the predetermined clustering degree evaluation strategy, the clustering degree of the target cluster and the target traffic data is evaluated, which can quantify the degree of cluster aggregation. The evaluation results help confirm whether the clustering effect meets the predetermined standards, further improving the reliability and accuracy of the cluster analysis; if the clustering degree of the target cluster reaches the predetermined limit, the protocol type corresponding to the cluster can be accurately used as the protocol type of the target traffic data. This method ensures the automatic identification of protocol types, improves the accuracy in network traffic analysis, and can effectively identify unknown cryptographic protocol types.

[0008] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 A flowchart of a method for identifying network traffic of an unknown cryptographic protocol provided in an embodiment of the present application.

[0010] Figure 2 A schematic diagram of the structure of a network traffic identification system for an unknown cryptographic protocol provided in an embodiment of the present application.

[0011] Explanation of the reference numerals: data preprocessing module 10 , characteristic parameter acquisition module 20 , dimensionality reduction processing module 30 , cluster analysis module 40 , evaluation and analysis module 50 , protocol type determination module 60 . DETAILED DESCRIPTION

[0012] The embodiments of the present application provide a method and system for identifying network traffic of unknown cryptographic protocols, thereby solving the technical problem that the prior art generally adopts a static feature identification method, lacks effective detection of unknown cryptographic protocols, and is unable to adapt to the needs of the ever-evolving protocols, thereby leading to network security vulnerabilities.

[0013] After introducing the basic principles of this application, various non-limiting embodiments of this application will be specifically described below in conjunction with the accompanying drawings. It should be understood that the specific embodiments described here are only used to explain this application and are not used to limit this application.

[0014] Example 1, as Figure 1 As shown, an embodiment of the present application provides a method for identifying network traffic of an unknown cryptographic protocol, the method comprising:

[0015] The captured dynamic traffic data is preprocessed to obtain the target traffic data.

[0016] Capture dynamic traffic data from the network in real time. Dynamic traffic data includes various packet characteristics, such as source IP address, destination IP address, port number, packet length, and protocol type. Because the captured data may contain noise or irrelevant information, it requires preprocessing. This includes removing missing or incomplete packets; eliminating outliers, such as erroneous packets or packets that do not conform to the expected format; and deduplicating data to ensure that each traffic record is unique. Aggregate multiple packets from the same session or data flow into a single target traffic record for further processing.

[0017] The predetermined characteristic dimensions are read, and a multi-dimensional characteristic parameter set of the target flow data is collected based on the predetermined characteristic dimensions.

[0018] Read the predefined feature dimensions, which include at least port features, IP address features, statistical features, and content features. After reading the predefined feature dimensions, specific values are extracted from the target traffic data based on these dimensions and aggregated into a multi-dimensional feature parameter set. Each dimension corresponds to a characteristic of the traffic data, such as port, IP address, or statistical value. The combination of these feature parameters helps to comprehensively describe the traffic behavior pattern.

[0019] An initial knowledge graph is constructed in combination with the multidimensional feature parameter set, and a graph dimensionality reduction mechanism is introduced to reduce the dimensionality of the initial knowledge graph to obtain a target knowledge graph.

[0020] By visualizing the relationships between multidimensional feature parameter sets, a graph structure is constructed to form an initial knowledge graph. Specifically, when constructing the initial knowledge graph, each network traffic feature vector is treated as a node, and each node corresponds to a multidimensional feature parameter set for network traffic data. The relationship (edge) between nodes is determined based on a similarity metric. For example, if two traffic data have a high degree of similarity in multiple features, such as port numbers and IP addresses, they will be connected by an edge. This edge can be assigned a weight representing the similarity between the two nodes. Common similarity metrics include Euclidean distance and cosine similarity. By connecting traffic data with similar features, an initial knowledge graph is constructed. In this graph, nodes represent traffic features, and edges represent similarity relationships between features.

[0021] Since the initial knowledge graph constructed has high-dimensional characteristics, especially when the network traffic data contains multiple features, the feature space is very large. In order to better analyze it, the graph is subjected to dimensionality reduction processing. By adopting the graph dimensionality reduction mechanism, the high-dimensional data is mapped to two-dimensional or three-dimensional space while maintaining the local structure of the data. After dimensionality reduction processing, the target knowledge graph is obtained. This graph contains the node positions in the low-dimensional space and can more intuitively display the relationship and clustering structure between traffic data.

[0022] Taking the target knowledge graph as the clustering benchmark, cluster analysis is performed on the network traffic knowledge graph database to obtain the target cluster corresponding to the target knowledge graph.

[0023] The similarity structure of the nodes in the target knowledge graph will be used as the basis for clustering. Through the clustering method, different clusters will be divided based on the similarity between the nodes in the graph. For example, any graph is extracted from the network traffic knowledge graph database as the object of comparison, and the similarity coefficient between the target knowledge graph and other graphs is calculated. According to the similarity coefficient, similar knowledge graphs are classified into one category. These clusters represent the patterns or protocol types of traffic data in a specific feature space. After clustering analysis, the target clusters are finally obtained. These clusters represent a set of traffic data with similar characteristics in network traffic.

[0024] A predetermined clustering degree evaluation strategy is read, and clustering degree evaluation analysis is performed on the target cluster and the target traffic data according to the predetermined clustering degree evaluation strategy to obtain a target clustering degree.

[0025] Read the predetermined clustering evaluation strategy, which is used to evaluate the quality and consistency of the target cluster. Specifically, the clustering evaluation strategy mainly defines how to quantify the similarity of data points within a cluster and the difference between clusters. The evaluation indicators include intra-cluster closeness and inter-cluster separation. Intra-cluster closeness is measured by calculating the distance between all data points in the cluster. For example, the average distance or minimum distance between data points within a cluster can be used as a measure of closeness. Inter-cluster separation is measured by calculating the distance between a cluster and other clusters. For example, the minimum distance or average distance between the target cluster and other clusters can be used as a measure of separation. By performing the above evaluation on the target cluster and the target traffic data, the target clustering value is finally obtained, which is used to judge the clustering quality of the cluster.

[0026] If the target clustering degree reaches a predetermined clustering degree limit, the target protocol type corresponding to the target cluster is recorded as the protocol type of the target traffic data.

[0027] The predetermined clustering degree limit is a pre-set threshold used to judge the quality of clustering. For example, the clustering degree limit is set to 0.7, which means that if the clustering degree value is greater than or equal to 0.7, the clustering quality is considered satisfactory; if the clustering degree value is less than 0.7, the clustering strategy needs to be further adjusted or the cluster needs to be abandoned.

[0028] If the target clustering degree is greater than or equal to the predetermined clustering degree limit, that is, the clustering quality is good, then the target cluster is considered to be a valid cluster. Each cluster represents a specific network protocol type or communication mode. Usually, the protocol type is determined based on the source, destination, port number, protocol characteristics, etc. of the traffic data. For example, a cluster may correspond to the HTTP protocol, and another cluster may correspond to the FTP protocol. When the target clustering degree meets the predetermined limit, the protocol type corresponding to the target cluster is marked as the protocol type of the target traffic data. This means that based on clustering analysis and evaluation, the network traffic data is successfully identified as a specific protocol type.

[0029] On the contrary, if the target clustering degree does not reach the predetermined limit, that is, the clustering quality is poor, the target cluster needs to be adjusted, such as re-clustering, adjusting clustering algorithm parameters, etc., or abandoning the cluster and performing other analysis methods.

[0030] Furthermore, the predetermined feature dimensions include at least port features, IP address features, statistical features and content features.

[0031] Ports are identifiers that distinguish different services or applications in computer networks. Port characteristics are often used to identify specific applications or protocols involved in traffic data. By analyzing port numbers, it is possible to identify the protocols used on the network. For example, port 80 is commonly used for HTTP, port 443 for HTTPS, and port 21 for FTP. An IP address is a unique address used to identify a computer or network device, including the source and destination IP addresses. By analyzing IP addresses, it is possible to understand the transmission path of network traffic and the devices involved. Furthermore, detecting unusual IP address patterns can reveal potential attacks.

[0032] Statistical features involve analyzing network traffic data to extract numerical characteristics that reflect traffic behavior, including traffic size, number of packets, duration, and flow rate. These statistical features can help analyze traffic behavior patterns, capacity, and frequency. For example, concentrated traffic during peak hours or excessive traffic fluctuations may indicate anomalies. Content features involve analyzing the payload content of network packets. In many protocols, the content of the packet carries protocol-specific information, and analyzing this content helps identify the protocol type. For example, HTTP requests typically contain specific header fields, and DNS requests contain query fields.

[0033] Furthermore, an initial knowledge graph is constructed by combining the multidimensional feature parameter set, and a graph dimensionality reduction mechanism is introduced to reduce the dimensionality of the initial knowledge graph to obtain a target knowledge graph, including:

[0034] The graph similarity probability distribution is set based on the graph dimensionality reduction mechanism; the initial knowledge graph is reduced in dimension according to the graph similarity probability distribution to obtain the target knowledge graph; wherein the expression of the graph similarity probability distribution is:

[0035] ;

[0036] in, It is used to characterize the difference between the initial knowledge graph and the target knowledge graph. The initial knowledge graph is subjected to dimensionality reduction processing with the constraint of tending to 0. Characterize the divergence of the similarity between the initial knowledge graph and the target knowledge graph, Representing the nodes in the initial knowledge graph With node The similarity probability of Representing the nodes in the target knowledge graph With node The similarity probability.

[0037] The purpose of graph dimensionality reduction is to convert the high-dimensional features in the initial knowledge graph into a low-dimensional representation, while trying to maintain the similarity and connection relationship between the graph nodes. By reducing the dimensionality, the graph can be made more concise and easier to analyze in the low-dimensional space. In order to achieve this goal, a similarity probability distribution is pre-set to help decide which nodes or data points should be mapped to similar positions during the dimensionality reduction process.

[0038] Based on the set graph similarity probability distribution, a dimensionality reduction algorithm is used to map the initial knowledge graph from high-dimensional space to low-dimensional space to obtain the target knowledge graph. Specifically, dimensionality reduction is achieved by minimizing the difference between the similarity distributions in high-dimensional space and low-dimensional space. Specifically, the similarity probability distribution between nodes in high-dimensional space is calculated and mapped to low-dimensional space, where similar nodes are kept close and dissimilar nodes are kept far apart. The target knowledge graph after dimensionality reduction contains the node representations in the low-dimensional space. At this point, the position of the nodes in the graph reflects the similarity relationship between them, preserving the structural information in the original graph as much as possible.

[0039] Specifically, the expression of the probability distribution of graph similarity is:

[0040] ;

[0041] Representing nodes in the initial knowledge graph With node The similarity probability of Representing nodes in the target knowledge graph With node For each pair of nodes, the formula calculates the KL divergence between them to measure the difference in the probability distribution of the two nodes. Specifically calculate how the initial map deviates from the target map. This quantifies the difference between the two probability distributions, with the goal of minimizing the KL divergence. This indicates that the target knowledge graph Q should be as similar to the initial knowledge graph P after transformation as possible. Overall, this formula measures the overall difference between the initial and target graphs by calculating the KL divergence between each pair of nodes. By minimizing this difference, the target knowledge graph is ensured to be as close as possible to the initial knowledge graph in terms of structure and relationships.

[0042] Furthermore, cluster analysis is performed on the network traffic knowledge graph database using the target knowledge graph as a clustering benchmark to obtain target clusters corresponding to the target knowledge graph, including:

[0043] Extract any knowledge graph from the network traffic knowledge graph database; calculate any similarity coefficient between the target knowledge graph and the arbitrary knowledge graph; when the arbitrary similarity coefficient is within a predetermined coefficient threshold, form the target cluster based on the target knowledge graph and the arbitrary knowledge graph.

[0044] The Network Traffic Knowledge Graph Database contains multiple analyzed and processed network traffic graphs. Each graph represents a different network traffic characteristic, protocol type, or communication mode. Each graph consists of multiple nodes (network traffic data) and edges connecting these nodes (similarity relationships between nodes). An arbitrary knowledge graph is a graph randomly selected from the Network Traffic Knowledge Graph Database.

[0045] Calculate any similarity coefficient between the target knowledge graph and any knowledge graph. The similarity coefficient is used to quantify the degree of similarity between two knowledge graphs. The similarity coefficient calculation methods include cosine similarity and Euclidean distance. For example, the similarity is measured by calculating the cosine value between the vector representations of nodes and edges in the graph. The value range of cosine similarity is from -1 to +1, -1 means completely different, and +1 means exactly the same.

[0046] The predetermined coefficient threshold is a pre-set similarity standard used to determine whether the similarity between the target knowledge graph and any knowledge graph is high enough to classify them into the same cluster. This threshold is usually adjusted according to the specific problem in the experiment. For example, if the similarity between the target graph and any graph is higher than 0.8, they are considered to belong to the same cluster.

[0047] If the similarity between the target graph and any graph is higher than a predetermined threshold, the two graphs can be classified into the same cluster to form a target cluster. Furthermore, whenever a new graph is found to be similar to the target graph, the graph will also be included to form a larger target cluster. The target cluster represents a set of network traffic data with similar characteristics or protocols.

[0048] Furthermore, a predetermined clustering degree evaluation strategy is read, and clustering degree evaluation analysis is performed on the target cluster and the target traffic data according to the predetermined clustering degree evaluation strategy to obtain a target clustering degree, including:

[0049] Obtain a first knowledge graph corresponding to the first traffic data in the target cluster; perform eigendecomposition on a first Laplace matrix of the first knowledge graph to obtain a first decomposition result; construct a cluster eigenvalue scatter plot based on a first correspondence between a first eigenvalue in the first decomposition result and the first traffic data; perform spline curve processing on the cluster eigenvalue scatter plot to obtain a cluster spline curve; obtain a target eigenvalue of the target knowledge graph, and calculate the distance from the target eigenvalue to the cluster spline curve to obtain a target distance; normalize the target distance to obtain the target clustering degree.

[0050] First traffic data refers to any traffic data in the target cluster other than the target traffic data. This traffic data is a sample of other data in the cluster. Each traffic data can be constructed into a corresponding knowledge graph using predefined feature dimensions, where nodes represent traffic features and edges represent similarities between features. The first knowledge graph corresponding to the first traffic data is extracted for subsequent analysis.

[0051] The Laplace matrix is a basic matrix in graph theory, which reflects the connection relationship between nodes in the graph. In graph analysis, the Laplace matrix is often used for eigenvalue decomposition of the graph to extract the main features of the graph structure. The construction process of the Laplace matrix is as follows: Suppose there is an undirected graph G, whose adjacency matrix is A and degree matrix is D. The Laplace matrix L is defined as L=DA, where D is a diagonal matrix whose diagonal elements represent the degree of the node, and A is the adjacency matrix, which represents the connection relationship between nodes. For a knowledge graph, nodes represent traffic features and edges represent the similarity between nodes. The Laplace matrix can reflect the connection strength between these nodes and the overall structure of the graph.

[0052] By performing eigendecomposition on the first Laplacian matrix of the first knowledge graph, the eigenvalues and eigenvectors of the graph can be obtained as the first decomposition results. These eigenvalues and eigenvectors are used to reflect the relationship between the nodes in the first knowledge graph and the structural characteristics of the graph.

[0053] The first eigenvalue obtained from the feature decomposition represents certain important properties of the graph structure, such as the connection strength between nodes, the density of the graph, etc. By analyzing the relationship between these eigenvalues and the first traffic data, we can further understand the distribution of these traffic data in the graph. The cluster eigenvalue scatter plot uses the eigenvalue of each traffic data as the coordinate to visualize it in the graph. The horizontal axis of the scatter plot can be the first eigenvalue, and the vertical axis is other related eigenvalues or other attributes of the traffic data such as traffic size, duration, etc., which is used to intuitively display the characteristic distribution of nodes in the graph and the structure of the cluster.

[0054] A spline curve is a method for fitting a smooth curve through a set of data points. Piecewise polynomials are typically used to fit the relationships between data points. Common spline curves include cubic splines, which ensure smooth transitions between data points. Specifically, each data point in a cluster eigenvalue scatter plot is used as input. Using a spline curve fitting method, such as cubic spline interpolation, these data points are connected into a smooth curve to create a cluster spline curve. A characteristic of spline curves is that they not only smoothly fit the relationships between data points, but also maintain a low risk of overfitting.

[0055] Using the same first eigenvalue method, perform eigendecomposition on the target Laplacian matrix of the target knowledge graph to obtain a target decomposition result, and extract the target eigenvalue of the target knowledge graph from the target decomposition result. Calculate the distance from the target eigenvalue to the cluster spline curve. For example, using the Euclidean distance method, calculate the straight-line distance between the target eigenvalue and the cluster spline curve to obtain the target distance, which represents the degree of difference between the target eigenvalue and the cluster.

[0056] In order to make the target distance value suitable for further analysis and be able to be compared with other clustering results, the target distance needs to be normalized. The purpose of normalization is to limit the range of the target distance to a specific interval, usually between 0 and 1. Common normalization methods are to standardize the target distance according to its maximum value, or use the minimum-maximum normalization method. After normalization, the target clustering degree is obtained, which is used to measure the similarity between the target knowledge graph and the target cluster. The closer the target clustering degree value is to 1, the higher the similarity between the target graph and the cluster, and the better the clustering quality; the closer the value is to 0, the poorer the clustering effect.

[0057] Furthermore, eigendecomposition is performed on the first Laplacian matrix of the first knowledge graph to obtain a first decomposition result, including:

[0058] Convert the first knowledge graph into a first undirected graph; obtain a first degree matrix and a first adjacency matrix of the first undirected graph respectively; and take the difference between the first degree matrix and the first adjacency matrix as the first Laplacian matrix.

[0059] The knowledge graph is a graph structure composed of nodes and edges. Converting the first knowledge graph into the first undirected graph is actually to analyze it using methods in graph theory. An undirected graph is a graph composed of a set of nodes and undirected edges connecting these nodes. Unlike directed graphs, the edges in undirected graphs have no directionality, that is, the edges represent the symmetrical relationship between nodes. Specifically, each node in the knowledge graph represents an entity or a feature. In an undirected graph, these nodes remain unchanged as vertices in the graph. In the knowledge graph, edges represent the relationship between nodes and are usually directional, for example, pointing from one node to another. In the process of converting directed edges into undirected edges, the directionality of the edges is removed, indicating that the relationship between nodes is symmetrical.

[0060] Obtain the first degree matrix and first adjacency matrix of the first undirected graph respectively. The degree matrix is a diagonal matrix representing the degree of each node in the undirected graph. The degree of a node refers to the number of edges connected to the node. For an undirected graph, the degree matrix is an N×N diagonal matrix, where N is the total number of nodes. The elements on the diagonal represent the degree of the node, that is, the number of edges connected to the node. The elements in other positions are 0. The adjacency matrix is an N×N matrix that represents the connection relationship between nodes in the undirected graph. For an undirected graph, the adjacency matrix is a symmetric matrix, where each element indicates whether there is an edge between two nodes. Each element is 0 or 1. If there is an edge connecting the two nodes, the corresponding element is 1, otherwise it is 0.

[0061] The Laplace matrix is a basic matrix in graph theory. It reflects the relationship between nodes and the structure of a graph. The first Laplace matrix is defined as the difference between the first degree matrix and the first adjacency matrix. The first Laplace matrix can be used to further analyze structural features such as graph connectivity, graph balance, and similarity between nodes.

[0062] Furthermore, performing spline curve processing on the cluster feature value scatter plot to obtain a cluster spline curve includes:

[0063] A first scatter point group is formed based on the cluster eigenvalue scatter plot; the first scatter point group is splined to obtain a first spline curve; the cluster eigenvalue scatter plot is compared with the first scatter point group to obtain a first verification group; a first verification result of the first verification group on the first spline curve is obtained; when the first verification result meets a predetermined curvilinear constraint, the first spline curve is recorded as the cluster spline curve.

[0064] The first scatter point group is a subset extracted from the cluster eigenvalue scatter plot. By selecting and filtering the scatter points in the cluster eigenvalue scatter plot, a part of the scatter points is selected as the first scatter point group. These scatter points are used for further analysis. When selecting scatter points, they are screened based on their distribution in the scatter plot, density, or similarity with other scatter points in the cluster to ensure that the selected scatter points are representative.

[0065] Spline curves are a technique for fitting smooth curves through a series of control points. Through spline processing, a smooth fitting curve can be provided for the discrete data points in the first scatter point group, helping to reveal the overall trend of the data. Specifically, using techniques such as cubic spline interpolation, the discrete data points in the first scatter point group are fitted into a smooth curve. Cubic spline interpolation ensures a smooth transition between the curves by constructing a polynomial between each adjacent scatter point. The first spline curve obtained through spline processing can more clearly demonstrate the characteristic distribution trend in the cluster, simplify data analysis, and make subsequent comparison and verification more intuitive.

[0066] Compare the cluster eigenvalue scatter plot with the first scatter point group to verify whether the cluster characteristics are consistent with the spline curve fitted to the scatter point group. This includes evaluating whether the first scatter point group can well fit the cluster eigenvalue scatter plot or whether they exhibit similar distribution trends. The accuracy of the fit is evaluated by calculating the distance between the scatter points and the spline curve, such as the least squares error. Through this comparison, a first validation group is obtained, which contains a set of data points that conform to the distribution of the cluster eigenvalues and have a similar pattern in the feature space to the cluster eigenvalue scatter plot.

[0067] Verify whether the first spline curve can effectively fit the data points in the first verification group. This means that it is hoped that the distance between these data points and the spline curve is as small as possible, and the curve can reflect the trend of the data points. For example, the sum of squared errors between each data point in the first verification group and the spline curve is calculated to obtain an error index. If the error is small, it indicates that the spline curve fits well. The first verification result obtained is used to determine whether the spline curve can reasonably fit the data features in the cluster.

[0068] Predetermined curvilinear constraints are expected conditions set for the spline curve fitting results. For example, a predetermined error range is set. When the errors between all validation group data points and the spline curve are within this range, the fit is considered valid. If the first validation result meets the predetermined curvilinear constraints, that is, the error of the spline curve is less than the predetermined error range and meets the smoothness requirements and error limit constraints, it means that the spline curve successfully describes the characteristics of the cluster. In this case, the first spline curve is confirmed as the cluster spline curve and serves as the representative characteristic of the cluster.

[0069] Furthermore, if the target clustering degree reaches a predetermined clustering degree limit, the target protocol type corresponding to the target cluster is recorded as the protocol type of the target traffic data, including:

[0070] Obtain the first protocol type corresponding to the first traffic data, and count the first total number of the first protocol type in the target cluster; descend the first protocol type based on the first total number to obtain a descending list of cluster protocol types; take the first protocol type in the descending list of cluster protocol types as the target protocol type.

[0071] In network traffic data, each traffic data item corresponds to a protocol type, such as HTTP, FTP, or DNS. A corresponding first protocol type is obtained from the first traffic data item, indicating the protocol type to which this traffic data item belongs. A first total number of the first protocol type is counted in the target cluster. That is, by traversing all traffic data items in the target cluster, the number of traffic data items having the same protocol type as the first traffic data item is counted. For example, if the protocol type of the first traffic data item is HTTP, the number of all traffic data items in the target cluster whose protocol type is HTTP needs to be counted.

[0072] Taking the first total number as the descending basis, sort the number of occurrences of each protocol type in the target cluster to obtain a descending list of cluster protocol types. Common sorting algorithms, such as quick sort, merge sort, etc., can be used to sort the number of occurrences of protocol types in descending order to ensure that the most frequently occurring protocol type is at the front.

[0073] According to the descending list of cluster protocol types obtained by sorting, the protocol type that ranks first is selected as the target protocol type. This is the protocol type that appears the most times and is the most representative in the target cluster.

[0074] Furthermore, reading the predetermined feature dimensions and collecting and obtaining a multi-dimensional feature parameter set of the target traffic data based on the predetermined feature dimensions includes:

[0075] Obtaining predetermined weight distributions of the predetermined feature dimensions; and adjusting the multidimensional feature parameter set based on the predetermined weight distributions.

[0076] The predetermined feature dimensions include at least port features, IP address features, statistical features, and content features. Each feature dimension represents an attribute in network traffic and is used to describe the nature and behavior of the traffic. The predetermined weight allocation refers to allocating a weight to each feature dimension in the predetermined feature dimension. This weight indicates the importance of the feature in the overall analysis. For example, feature selection algorithms, such as information gain and chi-square test, are used to evaluate the contribution of each feature dimension and then determine the weight of each feature.

[0077] The predetermined weight distribution is applied to the multidimensional feature parameter set for adjustment. The adjustment method is usually to multiply each eigenvalue by its corresponding weight so that the contribution of each feature in the feature vector matches its importance in the analysis. By adjusting the multidimensional feature parameter set, it can be effectively ensured that the importance of the features is correctly reflected in the data, thereby producing more accurate results in subsequent analysis processes such as clustering, classification or protocol identification.

[0078] In summary, the method for identifying network traffic of an unknown cryptographic protocol provided by the embodiments of the present application has the following technical effects:

[0079] By preprocessing the captured dynamic traffic data, redundant data, noise and invalid information can be effectively removed, making subsequent analysis and identification more accurate and efficient. The target traffic data obtained after preprocessing is purer, which improves the accuracy of subsequent feature extraction and protocol identification. By reading the predetermined feature dimensions and extracting the multidimensional feature parameter set of the target traffic data based on these dimensions, the multidimensional information of the network traffic can be captured comprehensively and finely. Different feature dimensions provide a more comprehensive basis for protocol identification and enhance the richness and accuracy of feature expression. By combining the multidimensional feature parameter set to construct the initial knowledge graph and introducing the graph dimensionality reduction mechanism, high-dimensional data can be converted into a graph representation in a low-dimensional space. After dimensionality reduction, the target knowledge graph is convenient for further processing and analysis, while effectively reducing the computational complexity. The graph after dimensionality reduction retains important structural information, improving The efficiency and accuracy of subsequent analysis are improved; by taking the target knowledge graph as the clustering benchmark and performing cluster analysis on the network traffic knowledge graph database, the clustering pattern of similar traffic data can be identified, and the target clusters after clustering can clearly identify different protocols or communication modes, thereby providing a clear classification basis for protocol identification; through the predetermined clustering degree evaluation strategy, the clustering degree of the target cluster and the target traffic data is evaluated, which can quantify the degree of cluster aggregation. The evaluation results help confirm whether the clustering effect meets the predetermined standards, further improving the reliability and accuracy of the cluster analysis; if the clustering degree of the target cluster reaches the predetermined limit, the protocol type corresponding to the cluster can be accurately used as the protocol type of the target traffic data. This method ensures the automatic identification of protocol types, improves the accuracy in network traffic analysis, and can effectively identify unknown cryptographic protocol types.

[0080] Example 2, based on the same inventive concept as the method for identifying network traffic of an unknown cryptographic protocol in the above embodiment, Figure 2 As shown, an embodiment of the present application provides a network traffic identification system for an unknown cryptographic protocol, the system comprising:

[0081] The data preprocessing module 10 is used to preprocess the captured dynamic flow data to obtain target flow data.

[0082] The characteristic parameter acquisition module 20 is used to read the predetermined characteristic dimensions and collect and obtain a multi-dimensional characteristic parameter set of the target flow data based on the predetermined characteristic dimensions.

[0083] The dimensionality reduction processing module 30 is used to construct an initial knowledge graph in combination with the multi-dimensional feature parameter set, and introduce a graph dimensionality reduction mechanism to perform dimensionality reduction processing on the initial knowledge graph to obtain a target knowledge graph.

[0084] The clustering analysis module 40 is used to perform cluster analysis on the network traffic knowledge graph database based on the target knowledge graph as a clustering benchmark to obtain the target cluster corresponding to the target knowledge graph.

[0085] The evaluation and analysis module 50 is configured to read a predetermined clustering degree evaluation strategy, and perform clustering degree evaluation and analysis on the target cluster and the target traffic data according to the predetermined clustering degree evaluation strategy to obtain a target clustering degree.

[0086] The protocol type determination module 60 is configured to record the target protocol type corresponding to the target cluster as the protocol type of the target traffic data if the target clustering degree reaches a predetermined clustering degree limit.

[0087] Furthermore, the predetermined feature dimensions include at least port features, IP address features, statistical features and content features.

[0088] Furthermore, the dimensionality reduction processing module 30 is configured to perform the following steps:

[0089] The graph similarity probability distribution is set based on the graph dimensionality reduction mechanism; the initial knowledge graph is reduced in dimension according to the graph similarity probability distribution to obtain the target knowledge graph; wherein the expression of the graph similarity probability distribution is:

[0090] ;

[0091] in, It is used to characterize the difference between the initial knowledge graph and the target knowledge graph. The initial knowledge graph is subjected to dimensionality reduction processing with the constraint of tending to 0. Characterize the divergence of the similarity between the initial knowledge graph and the target knowledge graph, Representing the nodes in the initial knowledge graph With node The similarity probability of Representing the nodes in the target knowledge graph With node The similarity probability.

[0092] Furthermore, the cluster analysis module 40 is configured to perform the following steps:

[0093] Extract any knowledge graph from the network traffic knowledge graph database; calculate any similarity coefficient between the target knowledge graph and the arbitrary knowledge graph; when the arbitrary similarity coefficient is within a predetermined coefficient threshold, form the target cluster based on the target knowledge graph and the arbitrary knowledge graph.

[0094] Furthermore, the evaluation and analysis module 50 is configured to perform the following steps:

[0095] Obtain a first knowledge graph corresponding to the first traffic data in the target cluster; perform eigendecomposition on a first Laplace matrix of the first knowledge graph to obtain a first decomposition result; construct a cluster eigenvalue scatter plot based on a first correspondence between a first eigenvalue in the first decomposition result and the first traffic data; perform spline curve processing on the cluster eigenvalue scatter plot to obtain a cluster spline curve; obtain a target eigenvalue of the target knowledge graph, and calculate the distance from the target eigenvalue to the cluster spline curve to obtain a target distance; normalize the target distance to obtain the target clustering degree.

[0096] Furthermore, the evaluation and analysis module 50 is configured to perform the following steps:

[0097] Convert the first knowledge graph into a first undirected graph; obtain a first degree matrix and a first adjacency matrix of the first undirected graph respectively; and take the difference between the first degree matrix and the first adjacency matrix as the first Laplacian matrix.

[0098] Furthermore, the evaluation and analysis module 50 is configured to perform the following steps:

[0099] A first scatter point group is formed based on the cluster eigenvalue scatter plot; the first scatter point group is splined to obtain a first spline curve; the cluster eigenvalue scatter plot is compared with the first scatter point group to obtain a first verification group; a first verification result of the first verification group on the first spline curve is obtained; when the first verification result meets a predetermined curvilinear constraint, the first spline curve is recorded as the cluster spline curve.

[0100] Furthermore, the protocol type determination module 60 is configured to perform the following steps:

[0101] Obtain the first protocol type corresponding to the first traffic data, and count the first total number of the first protocol type in the target cluster; descend the first protocol type based on the first total number to obtain a descending list of cluster protocol types; take the first protocol type in the descending list of cluster protocol types as the target protocol type.

[0102] Furthermore, the characteristic parameter acquisition module 20 is used to perform the following operation steps:

[0103] Obtaining predetermined weight distributions of the predetermined feature dimensions; and adjusting the multidimensional feature parameter set based on the predetermined weight distributions.

[0104] Through the detailed description of the network traffic identification method of an unknown cryptographic protocol mentioned above in this specification, those skilled in the art can clearly understand the network traffic identification system of an unknown cryptographic protocol in this embodiment. Since it corresponds to the method disclosed in the embodiment, the description is relatively simple. For relevant matters, please refer to the method part description.

[0105] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for identifying network traffic of an unknown cryptographic protocol, characterized in that: The method comprises: Preprocess the captured dynamic traffic data to obtain target traffic data; Reading predetermined characteristic dimensions, and collecting and obtaining a multi-dimensional characteristic parameter set of the target flow data based on the predetermined characteristic dimensions; Constructing an initial knowledge graph based on the multidimensional feature parameter set, and introducing a graph dimensionality reduction mechanism to reduce the dimensionality of the initial knowledge graph to obtain a target knowledge graph; Taking the target knowledge graph as a clustering benchmark, cluster analysis is performed on the network traffic knowledge graph database to obtain a target cluster corresponding to the target knowledge graph; Reading a predetermined clustering degree evaluation strategy, and performing clustering degree evaluation analysis on the target cluster and the target traffic data according to the predetermined clustering degree evaluation strategy to obtain a target clustering degree; If the target clustering degree reaches a predetermined clustering degree limit, the target protocol type corresponding to the target cluster is recorded as the protocol type of the target traffic data; The target knowledge graph is used as a clustering benchmark to perform cluster analysis on the network traffic knowledge graph database to obtain target clusters corresponding to the target knowledge graph, including: Extracting any knowledge graph from the network traffic knowledge graph database; Calculate any similarity coefficient between the target knowledge graph and the arbitrary knowledge graph; When the arbitrary similarity coefficient is within a predetermined coefficient threshold, the target cluster is formed based on the target knowledge graph and the arbitrary knowledge graph.

2. The method for identifying network traffic of an unknown cryptographic protocol according to claim 1, characterized in that: The predetermined feature dimensions include at least port features, IP address features, statistical features and content features.

3. The method for identifying network traffic of an unknown cryptographic protocol according to claim 1, characterized in that: An initial knowledge graph is constructed by combining the multidimensional feature parameter set, and a graph dimensionality reduction mechanism is introduced to reduce the dimensionality of the initial knowledge graph to obtain a target knowledge graph, including: Setting a graph similarity probability distribution based on the graph dimensionality reduction mechanism; Performing dimensionality reduction on the initial knowledge graph according to the graph similarity probability distribution to obtain the target knowledge graph; The expression of the probability distribution of the graph similarity is: ； in, It is used to characterize the difference between the initial knowledge graph and the target knowledge graph. The initial knowledge graph is subjected to dimensionality reduction processing with the constraint of tending to 0. Characterize the divergence of the similarity between the initial knowledge graph and the target knowledge graph, Representing the nodes in the initial knowledge graph With node The similarity probability of Representing the nodes in the target knowledge graph With node The similarity probability.

4. The method for identifying network traffic of an unknown cryptographic protocol according to claim 1, characterized in that: Reading a predetermined clustering degree evaluation strategy, and performing clustering degree evaluation analysis on the target cluster and the target traffic data according to the predetermined clustering degree evaluation strategy to obtain a target clustering degree, including: Obtaining a first knowledge graph corresponding to the first traffic data in the target cluster; Performing eigendecomposition on a first Laplacian matrix of the first knowledge graph to obtain a first decomposition result; Constructing a cluster eigenvalue scatter plot based on a first correspondence between a first eigenvalue in the first decomposition result and the first traffic data; Performing spline curve processing on the cluster characteristic value scatter plot to obtain a cluster spline curve; Obtaining a target feature value of the target knowledge graph, and calculating the distance from the target feature value to the cluster spline curve to obtain a target distance; The target distance is normalized to obtain the target clustering degree.

5. The method for identifying network traffic of an unknown cryptographic protocol according to claim 4, characterized in that: Performing eigendecomposition on the first Laplacian matrix of the first knowledge graph to obtain a first decomposition result, including: Converting the first knowledge graph into a first undirected graph; Obtaining a first degree matrix and a first adjacency matrix of the first undirected graph respectively; The difference between the first degree matrix and the first adjacency matrix is taken as the first Laplacian matrix.

6. The method for identifying network traffic of an unknown cryptographic protocol according to claim 4, characterized in that: Performing spline curve processing on the cluster characteristic value scatter plot to obtain a cluster spline curve, including: Forming a first scatter point group based on the cluster feature value scatter plot; Performing spline curve processing on the first scattered point group to obtain a first spline curve; Comparing the cluster feature value scatter plot with the first scatter point group to obtain a first validation group; Obtaining a first verification result of the first spline curve by the first verification group; When the first verification result meets the predetermined curvilinear constraint, the first spline curve is recorded as the cluster spline curve.

7. The method for identifying network traffic of an unknown cryptographic protocol according to claim 4, characterized in that: If the target clustering degree reaches a predetermined clustering degree limit, the target protocol type corresponding to the target cluster is recorded as the protocol type of the target traffic data, including: Obtaining a first protocol type corresponding to the first traffic data, and counting a first total number of the first protocol type in the target cluster; sorting the first protocol types in descending order based on the first total number to obtain a descending list of cluster protocol types; The first protocol type in the descending list of the cluster protocol types is taken as the target protocol type.

8. The method for identifying network traffic of an unknown cryptographic protocol according to claim 1, characterized in that: Reading a predetermined feature dimension, and collecting and obtaining a multi-dimensional feature parameter set of the target flow data based on the predetermined feature dimension, including: Obtaining a predetermined weight distribution for the predetermined feature dimension; The multi-dimensional feature parameter set is adjusted based on the predetermined weight distribution.

9. A network traffic identification system for unknown cryptographic protocols, characterized in that: A method for identifying network traffic of an unknown cryptographic protocol according to any one of claims 1 to 8, the system comprising: The data preprocessing module is used to preprocess the captured dynamic traffic data to obtain target traffic data; A characteristic parameter acquisition module is used to read predetermined characteristic dimensions and collect and obtain a multi-dimensional characteristic parameter set of the target flow data based on the predetermined characteristic dimensions; A dimensionality reduction processing module is used to construct an initial knowledge graph based on the multidimensional feature parameter set, and introduce a graph dimensionality reduction mechanism to perform dimensionality reduction processing on the initial knowledge graph to obtain a target knowledge graph; A clustering analysis module is used to perform cluster analysis on the network traffic knowledge graph database using the target knowledge graph as a clustering benchmark to obtain a target cluster corresponding to the target knowledge graph; An evaluation and analysis module is used to read a predetermined clustering degree evaluation strategy, and perform clustering degree evaluation and analysis on the target cluster and the target traffic data according to the predetermined clustering degree evaluation strategy to obtain a target clustering degree; The protocol type determination module is configured to record the target protocol type corresponding to the target cluster as the protocol type of the target traffic data if the target clustering degree reaches a predetermined clustering degree limit.

Images