Identifying method and device for ICMP tunnel and computer program product

Abstract

The invention provides a method and equipment for identifying an Internet Control Message Protocol (ICMP) tunnel, and a computer program product. The method may comprise: obtaining ICMP traffic within a sampling unit time from an input signal; constructing an ICMP sample vector based on the ICMP traffic; providing the ICMP sample vector as input to a trained machine learning model; obtaining model output of the trained machine learning model; and identifying whether an ICMP tunnel exists in the ICMP traffic based on the model output.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technologies, and more particularly, to a method, device, and computer program product for identifying Internet Control Message Protocol (ICMP) tunnels based on neural networks. Background Art

[0002] The Internet Control Message Protocol (ICMP) is a key part of the IP protocol suite, used to transmit control messages, report errors, and provide important information about communication status between network devices.

[0003] An ICMP tunnel is a technology that uses the ICMP protocol to encapsulate and transmit other types of data. This technology allows users to transmit unauthorized or unencrypted data by forging ICMP packets, bypassing the monitoring of traditional network firewalls and intrusion detection systems. This technology is usually used by malicious actors for covert communication, data leakage, or other offensive purposes, because normal firewall configurations often do not block ICMP traffic. Therefore, identifying ICMP tunnel activities in ICMP traffic has become an important topic in the field of network security. Summary of the Invention

[0004] The present disclosure provides a method, device, and computer program product for identifying ICMP tunnels.

[0005] According to one aspect of the present disclosure, a method for identifying an Internet Control Message Protocol (ICMP) tunnel is provided. The method may include: obtaining ICMP traffic within a sampling unit time from an input signal; constructing an ICMP sample vector based on the ICMP traffic; providing the ICMP sample vector as an input to a trained machine learning model; obtaining a model output of the trained machine learning model; and identifying whether an ICMP tunnel exists in the ICMP traffic based on the model output.

[0006] According to one embodiment, in the above method, the parameters of the ICMP sample vector may include: the minimum length of an ICMP request message, the maximum length of an ICMP request message, the average length of an ICMP request message, the standard variance of the length of an ICMP request message, the minimum length of an ICMP response message, the maximum length of an ICMP response message, the average length of an ICMP response message, the standard variance of the length of an ICMP response message, and the number of ICMP response messages.

[0007] According to one embodiment, in the foregoing method, the trained machine learning model may be a neural network model.

[0008] According to one embodiment, in the foregoing method, the neural network model may include an input layer, a first hidden layer, a second hidden layer, and an output layer.

[0009] According to one embodiment, in the foregoing method, both the input layer and the first hidden layer may include neurons with the number of parameters of the ICMP sample vector; the second hidden layer may include neurons with half the number of parameters of the ICMP sample vector; and the output layer may include one neuron.

[0010] According to one embodiment, in the foregoing method, a fully connected connection may be adopted between the input layer, the first hidden layer, the second hidden layer, and the output layer.

[0011] According to one embodiment, in the foregoing method, the output layer may adopt SIGMOID as the activation function, and its range may be [-1, 1].

[0012] According to one embodiment, in the foregoing method, the error calculation method of the trained machine learning model may be the mean squared error (MSE).

[0013] According to another aspect of the present disclosure, there is provided a device for identifying an Internet Control Message Protocol (ICMP) tunnel. The device may include: a memory storing instructions; and at least one processor coupled to the memory and configured to execute the instructions to perform the method for identifying an Internet Control Message Protocol (ICMP) tunnel as described herein.

[0014] According to another aspect of the present disclosure, there is provided a computer program product including a computer program, which when executed by at least one processor, causes the at least one processor to perform the method for identifying an Internet Control Message Protocol (ICMP) tunnel as described herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] From the following description in conjunction with the drawings, the above and other aspects, features, and advantages of certain embodiments of the present disclosure will become more apparent. In the drawings:

[0016] Figure 1 A flowchart showing a method for identifying an ICMP tunnel according to an exemplary embodiment of the present disclosure is shown.

[0017] Figure 2 An exemplary structure and data flow diagram of an ICMP tunnel identification device according to an exemplary embodiment of the present disclosure are shown.

[0018] Figure 3 A flowchart showing a method for training a machine learning model according to an exemplary embodiment of the present disclosure is shown.

[0019] Figure 4 A block diagram of an electronic device according to an exemplary embodiment of the present disclosure is shown. Detailed implementation manners

[0020] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although some embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. On the contrary, these embodiments are provided to more thoroughly and completely understand the present disclosure. It should also be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not used to limit the protection scope of the present disclosure.

[0021] It should be understood that the various steps recorded in the method embodiments of the present disclosure can be executed in different orders and / or executed in parallel. In addition, the method embodiments may include other steps and / or omit certain steps. In the present disclosure, descriptions of details well known in the art are omitted to avoid unnecessarily obscuring the scope of the present disclosure.

[0022] The term "including" and its variations used herein are open-ended, that is, "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the following description.

[0023] It should be understood that the concepts such as "first", "second", etc. mentioned in the present disclosure are only used to distinguish different devices, equipment, modules, units, models, data, etc., and are not used to limit the order of functions executed by these devices, equipment, modules, units, models, data, the generation order, or the interdependent relationship.

[0024] It should be noted that the modification of "one" and "multiple" mentioned in the present disclosure is illustrative rather than restrictive. Those skilled in the art should understand that, unless clearly indicated otherwise in the context, it should be understood as "one or more".

[0025] Generally, there are several main identification methods for ICMP tunnels as follows:

[0026] Method 1: A statistical-based identification method.

[0027] In the statistical-based identification method, ICMP traffic is obtained from the input signal, and statistical characteristics such as the number, frequency, and size of ICMP packets in it are observed to detect whether there is ICMP tunnel activity (which can be abbreviated as ICMP tunnel hereinafter) in the ICMP traffic. Generally speaking, uncommon high-frequency ICMP interactions or ICMP packets with unconventional lengths may indicate ICMP tunnel activity.

[0028] Method 2: Behavior model-based identification method.

[0029] In the behavior model-based identification method, first, a machine learning algorithm is used to train a behavior model. The trained behavior model is used to identify and detect normal ICMP interaction patterns and abnormal ICMP interaction patterns, thereby identifying ICMP tunnels.

[0030] In the behavior model-based identification method, common behavior models include Support Vector Machine (SVM) or Convolutional Neural Network (CNN), etc.

[0031] However, the foregoing identification methods for ICMP tunnels all have defects.

[0032] For example, in the statistical-based identification method, the identification result is overly dependent on the sampled situation. For unknown scenarios, due to few sampled data and lack of sample support, the statistical-based identification method usually has low detection quality and low identification accuracy for ICMP tunnels.

[0033] In addition, in the behavior model-based identification method, different defects exist according to the adopted behavior model. For example, the SVM model does not extract sufficient features of ICMP traffic, resulting in inaccurate identification of ICMP tunnels and inability to further distinguish similar situations. Another example is that the convolutional neural network model has too many neurons, and operations such as convolution are computationally complex, resulting in a large amount of computation and long detection time during the detection of ICMP tunnels, making it unsuitable for use in devices with strict real-time requirements such as network devices.

[0034] In view of the above defects, according to the embodiments of the present disclosure, an identification method, device, and computer program product for ICMP tunnels are provided.

[0035] In the present disclosure, for the identification of ICMP tunnels, a sample vector composed of specific parameters is constructed. During the construction of this sample vector, key features related to the identification of ICMP tunnels in ICMP traffic can be extracted in a targeted manner, and these features are represented in the form of a sample vector for the pre-training of machine learning models and the post-processing of trained machine learning models, thereby contributing to training a machine learning model for high-quality identification of ICMP tunnels and achieving high-quality identification of ICMP tunnels during actual application. Compared with the statistical-based identification method, even for unknown scenarios, the sample vector construction method in the present disclosure is beneficial to the effective training of machine learning models, enabling the ICMP identification method based on this machine learning model to solve the problem of lack of sample support and effectively improving the quality of ICMP tunnel detection.

[0036] In the present disclosure, for the identification of ICMP tunnels, a machine learning model, such as a neural network model, is also constructed. By restricting the number and connection mode of neurons in this neural network model and using a simplified calculation method, the identification accuracy of ICMP tunnels and the identification time are taken into account, meeting the requirements of network device communication delay while effectively identifying ICMP tunnels. In addition, the structure of the neural network model in the present disclosure determines that the neural network model extracts features more fully than SVM, thereby improving the identification accuracy of ICMP tunnels compared with SVM. Based on this, even for cases where ICMP traffic is similar, the neural network model in the present disclosure can make further distinctions. In addition, since the neural network model in the present disclosure has a simpler structure compared with CNN, the computational amounts of the identification and training processes are both significantly reduced. Therefore, the time of the identification and training processes can be significantly reduced, improving the identification and training efficiency without compromising the identification accuracy, and it is suitable for use in devices with strict real-time requirements such as network devices. In addition, the ICMP tunnel identification method in the present disclosure uses a streamlined sample vector and a simplified neural network model, so it greatly saves relevant network transmission resources, processor resources, computational resources, and memory resources.

[0037] Figure 1 A flowchart of an ICMP tunnel identification method 100 according to an exemplary embodiment of the present disclosure is shown.

[0038] According to an embodiment of the present disclosure, the method 100 can be executed in a device for ICMP tunnel identification. In the embodiment, the device can be a network device. In the embodiment, the device can be the ICMP tunnel identification device 200 described below with reference to Figure 2 the ICMP tunnel identification device 200.

[0039] Method 100 begins at step 101. In step 101, ICMP traffic is obtained. In an embodiment, the device may obtain ICMP traffic from the outside. In an embodiment, obtaining ICMP traffic may include the device obtaining ICMP traffic from an input signal within a sampling unit time. In an embodiment, a sampling unit of the device may be used to obtain ICMP traffic from the input signal. In an embodiment, the sampling unit time may be in units of milliseconds, seconds, minutes, hours, etc. The length of the sampling unit time may be reasonably determined according to the actual application scenario and data acquisition requirements. In one example, for the ICMP tunnel identification scenario, the sampling unit time may be 30 seconds, so as to use the 30-second sampling unit time as the granularity of ICMP tunnel identification. It should be noted that the 30-second sampling unit time is only exemplary and not restrictive, and other sampling unit times may also be used without departing from the scope of the present disclosure. Generally speaking, a larger sampling unit time may correspond to a coarser ICMP tunnel identification granularity, which is beneficial to identifying whether there is an ICMP tunnel within a longer time period and is beneficial to roughly locating the position of the ICMP tunnel. In addition, a larger sampling unit time is also beneficial to ensuring that there are a sufficient number of ICMP request messages and response messages within the sampling unit time to obtain representative data. A smaller sampling unit time may correspond to a finer ICMP tunnel identification granularity, which is beneficial to accurately locating the specific position of the ICMP tunnel. Although it is described in the present disclosure that ICMP traffic may be obtained by the sampling unit of the device, the present disclosure is not limited thereto. For example, at least one processor and / or transceiver of the device may obtain ICMP traffic from the input signal.

[0040] In step 103, an ICMP sample vector is constructed. Specifically, the device can construct an ICMP sample vector (hereinafter simply referred to as the sample vector) based on the ICMP traffic obtained in step 101. In an embodiment, the sample vector can be constructed by a sample vector construction unit of the device. In an embodiment, for example, the sample vector construction unit can construct the sample vector by calculating the corresponding parameters of the ICMP request messages and ICMP reply messages included in the ICMP traffic within a sampling unit time (e.g., 30 seconds). As an example, the parameters constituting the ICMP sample vector may include the minimum length of the ICMP request message, the maximum length of the ICMP request message, the average length of the ICMP request message, the standard variance of the ICMP request message length, the minimum length of the ICMP reply message, the maximum length of the ICMP reply message, the average length of the ICMP reply message, the standard variance of the ICMP reply message length, and the number of ICMP reply messages, arranged in a specific order. It should be understood that the above parameters are merely exemplary and not restrictive, and other ICMP message-related parameters are also considered within the scope of the present disclosure. The above parameters of the ICMP sample vector are reasonably selected to include the key features related to the identification of the ICMP tunnel in the ICMP traffic, so that the constructed sample vector has sufficient representativeness to achieve effective identification of the ICMP tunnel and is not excessive, thus avoiding excessive computational complexity in the ICMP tunnel identification process. Although it is described in the present disclosure that the sample vector can be constructed by the sample vector construction unit of the device, the present disclosure is not limited thereto. For example, at least one processor of the device can be configured to construct the sample vector based on the obtained ICMP traffic.

[0041] In an embodiment according to the present disclosure, constructing the sample vector may include arranging the above parameters (i.e., the minimum length, maximum length, average length, standard variance of the length of the ICMP request message, the minimum length, maximum length, average length, standard variance of the length of the ICMP reply message, and the number of ICMP reply messages) in a specific order in sequence to form a sample vector including nine elements. For example, the sample vector can be represented as [the minimum length of the ICMP request message, the maximum length of the ICMP request message, the average length of the ICMP request message, the standard variance of the ICMP request message length, the minimum length of the ICMP reply message, the maximum length of the ICMP reply message, the average length of the ICMP reply message, the standard variance of the ICMP reply message length, the number of ICMP reply messages], and this sample vector can be used for subsequent ICMP tunnel identification and / or machine learning model training processes.

[0042] According to an embodiment of the present disclosure, in step 105, the ICMP sample vector constructed in step 103 can be provided to a trained machine learning model as the input of the model. In an embodiment, the trained machine learning model can be a neural network model. In an embodiment, the neural network model can include an input layer, a first hidden layer, a second hidden layer, and an output layer.

[0043] In an embodiment, the input layer, the first hidden layer, the second hidden layer, and the output layer can be connected in a fully connected manner. This fully connected neural network model has the following advantages. During the training and inference processes, the fully connected neural network can parallelize a large number of computational tasks, simultaneously performing operations such as activation calculations and weight updates for multiple neurons. This parallel computing ability can not only shorten the training time of the model, enabling faster optimization and improvement of the model, but also improve the real-time response ability of the model in practical applications, meeting scenarios with high real-time requirements, such as real-time monitoring of ICMP tunnels.

[0044] In an embodiment, the ICMP sample vector constructed in step 103 can be input into the input layer of the neural network model. Both the input layer and the first hidden layer can include neurons equal in number to the number of parameters of the ICMP sample vector. Such a design avoids premature loss of information in the initial stage, enabling the neural network model to fully learn the complex representation of the input sample vector, especially suitable for tasks that require retaining details, such as the ICMP tunnel identification task. As mentioned above, an ICMP sample vector including nine parameters is constructed. In this case, both the input layer and the first hidden layer can include nine neurons. In an embodiment, the input layer of the neural network includes neurons equal in number to the number of parameters of the ICMP sample vector, such that each neuron in the input layer receives one parameter of the input sample vector respectively, ensuring that the neural network model can completely receive all the parameters of the sample vector arranged in a specific order.

[0045] In an embodiment, the second hidden layer can include neurons equal in number to half of the number of parameters of the ICMP sample vector. Halving the number of neurons in the second hidden layer achieves progressive dimensionality reduction. This design filters out key features by compressing redundant information, enhancing the model's abstraction ability. At the same time, compared with a full-size hidden layer, the number of parameters is reduced (for example, the number of parameters is reduced by 50%), thereby reducing the risk of overfitting and improving computational efficiency. The total number of parameters of the neural network model is significantly less than that of a network model with all layers being full-size, enabling faster model training and lower demand for computing resources. Continuing with the previous example, the number of neurons in the second hidden layer can be determined by dividing the number of parameters of the ICMP sample vector by two and rounding if necessary. Continuing with the previous example, the second hidden layer can include five neurons.

[0046] In an embodiment, the output layer may include one neuron. In an embodiment, the output layer may adopt SIGMOID as the activation function, and its range is [-1, 1]. The SIGMOID activation function can perform a non-linear transformation on the input, increasing the expressive power of the neural network, enabling the neural network to learn more complex data patterns. In an embodiment, the model output of the entire neural network model is output at the neuron of the output layer. The single-neuron design of the output layer is naturally adapted to binary classification tasks such as ICMP tunnel identification (in combination with the aforementioned SIGMOID activation function), with a simple structure and clear output, avoiding redundant calculations.

[0047] In an embodiment, in the method for identifying an ICMP tunnel by processing an ICMP sample vector through a neural network model, by considering the constructed ICMP sample vector, the number and connection method of neurons in each layer of the neural network model are restricted, such that the amount of computation involved in the processing is significantly less than that of a convolutional neural network. While maintaining the recognition accuracy of the ICMP tunnel, the recognition speed is improved and the processing time is shortened. Therefore, this method can effectively identify the ICMP tunnel while meeting the requirements of the communication delay of network devices, and is suitable for use in devices with strict real-time requirements such as network devices. At the same time, based on the differences in structure and principle between the fully-connected neural network model and the SVM model, the fully-connected neural network model of the present disclosure is superior to the SVM model in feature extraction, has a higher recognition accuracy for ICMP tunnels, and can further distinguish similar situations.

[0048] In step 107, the model output of the trained machine learning model is obtained. In an embodiment, in the embodiment where the trained machine learning model is the aforementioned neural network model, the model output is output from the output layer of the neural network model. The model output may be a value between -1 and 1.

[0049] In step 109, based on the model output, it is identified whether there is an ICMP tunnel in the ICMP traffic. In an embodiment, the device may identify whether there is an ICMP tunnel in the ICMP traffic based on the model output. In an embodiment, the ICMP tunnel identification unit of the device may identify whether there is an ICMP tunnel in the ICMP traffic based on the model output. By way of example and not limitation, the ICMP tunnel identification unit may receive the model output from a trained machine learning model and identify whether there is an ICMP tunnel in the ICMP traffic based on the following. For example, a model output value of 1 may indicate that there is an ICMP tunnel in the ICMP traffic. For example, a model output value of -1 may indicate that there is no ICMP tunnel in the ICMP traffic. Therefore, the closer the model output is to 1, the greater the likelihood that the corresponding ICMP traffic includes an ICMP tunnel, and the closer the model output is to -1, the smaller the likelihood that the corresponding ICMP traffic includes an ICMP tunnel. A model output close to 0 indicates that it is not possible to determine whether the ICMP traffic includes an ICMP tunnel. Optionally, in an embodiment, the identification result of the ICMP tunnel identification unit may be visually displayed to the user of the device. Optionally, in an embodiment, when the ICMP tunnel identification result indicates the presence of ICMP tunnel activity, an alert in the form of light, sound, and / or vibration may be issued to the user of the device. Those skilled in the art should understand that although it is described in the present disclosure that the ICMP tunnel identification unit of the device may identify whether there is an ICMP tunnel in the ICMP traffic, the present disclosure is not limited thereto. For example, at least one processor of the device may be configured to identify whether there is an ICMP tunnel in the ICMP traffic based on the model output. Optionally, the model output of the trained machine learning model may be displayed to directly indicate whether there is an ICMP tunnel in the ICMP traffic. That is, the ICMP tunnel identification unit may be omitted according to requirements.

[0050] Figure 2 FIG. 4 shows an example structure and an example data flow diagram of an ICMP tunnel identification device 200 according to an example embodiment of the present disclosure. The ICMP tunnel identification device 200 may be configured to use Figure 1 the method shown to identify an ICMP tunnel.

[0051] In an embodiment, as Figure 2 shown, the ICMP tunnel identification device 200 may include a sampling unit 210, a sample vector construction unit 220, a trained machine learning model 230, and an ICMP tunnel identification unit 240.

[0052] In an embodiment, the sampling unit 210 may be configured to obtain ICMP traffic. For example, the sampling unit 210 may obtain ICMP traffic from an input signal received from outside the ICMP tunnel identification device. In an embodiment, the sampling unit 210 may provide the ICMP traffic obtained from the input signal within a sampling unit time to the sample vector construction unit 220. In an embodiment, the sampling unit time may be 30 seconds.

[0053] In an embodiment, the sample vector construction unit 220 may receive ICMP traffic from the sampling unit 210 and construct an ICMP sample vector based on the ICMP traffic. In an embodiment, the sample vector construction unit 220 may construct a sample vector by calculating corresponding parameters of ICMP request messages and ICMP reply messages included in the ICMP traffic within a sampling unit time (e.g., 30 seconds), as the output of the sample vector construction unit 220. As an example, the parameters constituting the ICMP sample vector may include the minimum length of the ICMP request message, the maximum length of the ICMP request message, the average length of the ICMP request message, the standard variance of the ICMP request message length, the minimum length of the ICMP reply message, the maximum length of the ICMP reply message, the average length of the ICMP reply message, the standard variance of the ICMP reply message length, and the number of ICMP reply messages. The above parameters arranged in a specific order may form an ICMP sample vector.

[0054] After constructing the ICMP sample vector, the sample vector construction unit 220 may provide the constructed ICMP sample vector to the trained machine learning model 230.

[0055] In an embodiment, the trained machine learning model 230 may be a neural network model as described in reference Figure 1 The trained machine learning model 230 may process the ICMP sample vector provided by the sample vector construction unit 220 and output a model output. Subsequently, the trained machine learning model 230 may provide the model output to the ICMP tunnel identification unit 240.

[0056] In an embodiment, the ICMP tunnel identification unit 240 may identify whether there is an ICMP tunnel in the ICMP traffic obtained from the input signal based on the model output received from the trained machine learning model 230 and output an ICMP tunnel identification result. The ICMP tunnel identification unit 240 may be based on reference Figure 1Identify whether there is an ICMP tunnel in the ICMP traffic in the described manner. For example, the model output value of 1 can indicate the existence of an ICMP tunnel in the ICMP traffic. For example, the model output value of -1 can indicate the non-existence of an ICMP tunnel in the ICMP traffic. Therefore, the closer the model output is to 1, the greater the possibility that the corresponding ICMP traffic includes an ICMP tunnel, and the closer the model output is to -1, the smaller the possibility that the corresponding ICMP traffic includes an ICMP tunnel. When the model output is close to 0, it means that it is impossible to determine whether the ICMP traffic includes an ICMP tunnel. Optionally, in an embodiment, the identification result of the ICMP tunnel identification unit 240 can be visually displayed to the user of the ICMP tunnel identification device 200. Optionally, in an embodiment, when the ICMP tunnel identification result indicates the existence of ICMP tunnel activity, an alarm in the form of light, sound, and / or vibration can be issued to the user of the ICMP tunnel identification device 200.

[0057] Figure 3 The flowchart of a method 300 for training a machine learning model according to an exemplary embodiment of the present disclosure is shown.

[0058] In an embodiment, the machine learning model to be trained can be the four-layer fully connected neural network model as described above. That is, the neural network model can include an input layer, a first hidden layer, a second hidden layer, and an output layer connected in a fully connected manner. The activation function of the output layer can be SIGMOID, and its range can be [-1, 1].

[0059] In method 300, in step 310, a plurality of training sample vectors are constructed. In an embodiment, each of the training sample vectors is similar to the ICMP sample vectors constructed with reference to Figure 1 described above. That is, each of the training sample vectors has nine parameters arranged in a specific order as described with reference to Figure 1 above. In addition, each of the training sample vectors also has a label indicating whether the ICMP traffic corresponding to the training sample vector includes an ICMP tunnel, that is, the ground truth. In an embodiment, optionally, the plurality of training sample vectors include a sufficient number of positive training sample vectors and a sufficient number of negative training sample vectors. In an embodiment, to improve efficiency, the training sample vectors can be artificially collected and made. Without limiting the collection time, relatively representative data can be extracted from the traffic manually to make the training sample vectors.

[0060] In step 320, the constructed plurality of training sample vectors are input into the machine learning model to be trained. When the machine learning model to be trained is a four-layer fully connected neural network model, the constructed plurality of training sample vectors are input into the input layer of the neural network model.

[0061] In step 330, calculate the error between the model output of the trained machine learning model and the true value.

[0062] In an embodiment, multiple training sample vectors are processed using the trained machine learning model to obtain a model output. When the trained machine learning model is the four-layer fully connected neural network model described in the reference Figure 1 In the case of, each parameter of each training sample vector is processed through a neural network model similar to that described in the reference Figure 1 to obtain a model output. In an embodiment, an appropriate method is used to calculate the error of the model output. In an embodiment, the error calculation method of the trained machine learning model is the mean square error (MSE). That is, calculate the mean square error between the model output of the trained machine learning model and the true value as the error.

[0063] In step 340, based on the error, adjust the weights of the trained machine learning model. In an embodiment, for example, based on the error calculated in step 330, gradually adjust the weights of the trained machine learning model to minimize the error. Determine the weights of the machine learning model when the error is minimized as the final weights of the model.

[0064] The model trained using the above method 300 can be used to identify ICMP tunnels in actual ICMP traffic.

[0065] The present disclosure provides a method for identifying ICMP tunnel behavior based on a machine learning model (for example, a four-layer fully connected neural network model). Compared with the identification method based on a standard convolutional neural network model, the method of the present disclosure has advantages such as small computational complexity and short detection time while ensuring the identification accuracy. In addition, the method of the present disclosure has a higher identification accuracy than other traditional detection methods, such as the statistical-based identification method and the SVM-based identification method.

[0066] The neural network model constructed in the present disclosure has high identification accuracy, a wide range of applicable scenarios, small computational complexity, and fast detection speed. At least based on the foregoing advantages, the method of the present disclosure will not affect the network communication quality when used in network devices, and is particularly suitable for use in devices with strict real-time requirements.

[0067] Figure 4 FIG. shows a block diagram of an electronic device according to an exemplary embodiment of the present disclosure. In an embodiment, the electronic device may be the device described in the reference Figure 1 or the ICMP tunnel identification device 200 described in the reference Figure 2 .

[0068] Reference Figure 4, the electronic device 400 may include a memory 410, at least one processor 420, and a transceiver 430. Under the control of the at least one processor 420, the electronic device 400 (including the memory 410 and the transceiver 430) may be configured to perform the operations of the methods or devices described herein. Although the memory 410, the at least one processor 420, and the transceiver 430 are shown as separate entities, they may be implemented as a single entity, such as a single chip. The memory 410, the at least one processor 420, and the transceiver 430 may be electrically connected or coupled to each other. Optionally, the transceiver 430 of the electronic device 400 may be omitted. The transceiver 430 may be configured to send signals to other network entities and / or receive signals from other network entities. In the case where the transceiver 430 is omitted, the at least one processor 420 may be configured to execute instructions stored in the memory 410 to control the overall operation of the electronic device 400, thereby performing the operations of the methods or devices described herein.

[0069] According to another aspect of the present disclosure, there is also provided a computer program product, which includes a computer program that, when executed by at least one processor, can implement the ICMP tunnel identification method according to the embodiments of the present disclosure.

[0070] The whole or its components of the electronic device described in the present disclosure may be implemented by various suitable hardware means, including but not limited to field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), systems on a chip (SoCs), discrete gate or transistor logic, discrete hardware components, or any combination thereof. The devices, equipment, methods, and systems involved in the present disclosure are not limited to any specific hardware architecture or configuration. The components in the disclosed devices, equipment, and systems may be separate or integrated, and may be combined in different ways and / or replaced or supplemented by other components. It should be understood that the teachings of the present disclosure may be implemented in various forms of hardware, software, firmware, dedicated processors, or combinations thereof.

[0071] The block diagrams of the devices, equipment, units, etc. involved in the present disclosure are merely exemplary and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, equipment, and units may be connected, arranged, and configured in any manner as long as the desired purpose can be achieved.

[0072] In the above description, the present disclosure has been described based on embodiments. These embodiments are merely illustrative, and those skilled in the art should understand that the combinations of the constituent elements and processes of these embodiments may be modified in various ways, and such modifications are also within the scope of the present disclosure.

[0073] Those skilled in the art will recognize that the present disclosure can be implemented in other specific forms without changing the technical idea or basic characteristics of the present disclosure. Therefore, it should be understood that the above embodiments are merely illustrative and not restrictive. The scope of the present disclosure is defined by the appended claims rather than by the detailed description. Therefore, it should be understood that all modifications or variations derived from the meaning and scope of the appended claims and their equivalents are within the scope of the present disclosure.

[0074] Although the present disclosure has been shown and described with reference to various embodiments thereof, those skilled in the art will understand that various changes in form and detail can be made therein without departing from the spirit and scope of the present disclosure as defined by the appended claims and their equivalents.

Claims

1. A method for identifying an Internet Control Message Protocol (ICMP) tunnel, the method comprising: Obtain the ICMP traffic within the sampling unit time from the input signal; Constructing an ICMP sample vector based on the ICMP traffic; Providing the ICMP sample vector as input to a trained machine learning model; obtaining a model output of the trained machine learning model; as well as Based on the model output, it is identified whether an ICMP tunnel exists in the ICMP traffic.

2. The method of claim 1, wherein: The parameters of the ICMP sample vector include: the minimum length of the ICMP request message, the maximum length of the ICMP request message, the average length of the ICMP request message, the standard deviation of the ICMP request message length, the minimum length of the ICMP reply message, the maximum length of the ICMP reply message, the average length of the ICMP reply message, the standard deviation of the ICMP reply message length, and the number of ICMP reply messages.

3. The method of claim 1, wherein: The trained machine learning model is a neural network model.

4. The method of claim 3, wherein: The neural network model includes an input layer, a first hidden layer, a second hidden layer and an output layer.

5. The method of claim 4, wherein: The input layer and the first hidden layer each include a parameter number of neurons of the ICMP sample vector; The second hidden layer includes neurons having half the number of parameters of the ICMP sample vector; and The output layer includes one neuron.

6. The method according to any one of claims 4 to 5, wherein: The input layer, the first hidden layer, the second hidden layer and the output layer are all connected in a fully connected manner.

7. The method according to any one of claims 4 to 5, wherein: The output layer uses SIGMOID as the activation function, and its range is [-1, 1].

8. The method of claim 1, wherein: The error calculation method of the trained machine learning model is mean square error (MSE).

9. A device for identifying an Internet Control Message Protocol (ICMP) tunnel, the device comprising: Memory, which stores instructions; as well as At least one processor is coupled to the memory and is configured to execute the instructions to perform the method according to any one of claims 1-8.

10. A computer program product, comprising a computer program, which, when executed by at least one processor, causes the at least one processor to perform the method according to any one of claims 1 to 8.

Images