Concealed scanning behavior identification method, device, equipment, medium and program

Abstract

The present application relates to the computer technical field, provide a kind of covert scanning behavior identification method, device, equipment, medium and program, method includes: the data packet of the data to be encapsulated into message data is carried out exception message detection, obtains exception message detection result;According to exception message detection result, determine that message is not abnormal, utilize preset sliding window sliding selection data packet, obtain the data flow characteristics corresponding to selected data packet;The data flow characteristics of all selected data packet are input into covert scanning behavior identification model, and covert scanning behavior identification model carries out feature extraction according to the data flow characteristics of all selected data packet input, and carries out feature fusion in combination with attention mechanism, to carry out covert scanning behavior identification to fusion feature, obtains covert scanning behavior identification result.The present application can realize the accurate detection of high covert scanning behavior, effectively improve the identification ability of attacker's covert scanning, reduce false alarm rate and miss rate.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to a covert scanning behavior identification method, device, equipment, medium and program. BACKGROUND

[0002] Highly covert scanning usually adopts multiple technical means to conceal its detection process, avoiding detection and prevention. Common concealment means include using malformed packets to bypass traditional network detection mechanisms and using proxies to hide the mapping subject and content. Using malformed packets to bypass traditional network detection mechanisms, by designing packet structure to make it not conform to the regular format, so as to bypass the common detection rules, so that the mapping traffic can be disguised as normal communication traffic in the network, and it is not easy to be identified by the monitoring system. In addition, some attackers will also use slow scanning technology, that is, slowly launching a large number of requests in a long time, reducing the characteristics of burst traffic, so that the scanning behavior is not easy to be detected by the network monitoring system, ensuring that the attacker can collect information of the target network gradually in a longer time range, reducing the risk of being discovered. Using proxies to hide the mapping subject and content mainly uses proxy servers as intermediaries to hide the source address of the mapping request behind the proxy server, so that the real identity and IP address of the attacker cannot be directly traced, and by using multiple proxy nodes or combining anonymization technology, the attacker can further increase the concealment of the mapping behavior, so that the traditional IP address tracking and behavior identification method is invalid. These technical means make it difficult for traditional defense mechanisms to accurately detect mapping behavior, increasing the difficulty of identification and response.

[0003] The currently adopted scanning behavior detection method mostly adopts a method based on feature matching or rule detection. The feature matching method mainly identifies scanning behavior by matching specific patterns or signatures in traffic, and the detection rule method mainly analyzes traffic by pre-defined rules, such as detecting access requests to multiple ports or URLs in a short time.

[0004] Although the above-mentioned methods can effectively identify some known scanning behaviors, there are limitations when facing distributed, low-frequency, and highly covert mapping activities, and such mapping behaviors usually use distributed proxies, anonymous networks, or multi-source coordination technology for detection, making it difficult for single-point detection to accurately locate the attack source and intention. In addition, due to the complexity of the network environment, traffic disorder, incomplete traffic acquisition, and other situations often occur in reality, further increasing the difficulty of identifying mapping behavior. In this case, simply relying on a certain feature, traffic data at a certain time point for analysis, it is difficult to accurately discover scanning behaviors with high concealment. SUMMARY

[0005] The application provides a hidden scanning behavior identification method, device, equipment, medium and program, which aims at solving the problem that it is difficult to accurately find scanning behaviors with high concealment by simply relying on a certain feature and traffic data at a certain time point for analysis in the prior art, and realizes accurate detection of high-concealment scanning behaviors and effectively improves the identification ability of hidden scanning of attackers.

[0006] The application provides a hidden scanning behavior identification method, device, equipment, medium and program, which aims at solving the problem that it is difficult to accurately find scanning behaviors with high concealment by simply relying on a certain feature and traffic data at a certain time point for analysis in the prior art, and realizes accurate detection of high-concealment scanning behaviors and effectively improves the identification ability of hidden scanning of attackers.

[0007] According to the hidden scanning behavior identification method provided by the application, the data packets are classified according to five tuples, and the classification results are obtained. The five tuples include source Internet Protocol (IP), destination IP, source port, destination port and protocol. According to the classification results, each type of data packet is sorted in time sequence, and the sorting results of each type are obtained. According to the sorting results of each type, the data packets in the corresponding type of sorting results are selected by using a preset sliding window, and the corresponding data flow features are obtained.

[0008] According to the method for identifying hidden scanning behavior provided by the application, according to the sorting result of each type, the data packets in the corresponding type sorting result are selected by using a preset sliding window, and the corresponding data flow characteristics are obtained, including: according to the sorting result of each type, the data packets in the corresponding type sorting result are selected by using a preset sliding window; for the data packets selected by each preset sliding window, the total number of data packets in the flow, the number of bytes in the flow, the average data packet size, the data packet size standard deviation, the average arrival time, the arrival interval standard deviation, the flow duration, the number of data packets per second, the number of bytes per second, the amount of data of different protocols used, the number of different ports used, and the maximum port frequency are determined to obtain basic statistical characteristics; and the maximum data packet rate and the data packet rate standard deviation in the preset sliding window are determined to obtain time window fluctuation characteristics; and the SYN count, ACK count, FIN count, RST count, PSH count, URG count, ECE count, CWR count, NONCE count, and NULL count of the transmission control protocol (TCP) flag are determined to obtain TCP flag characteristics; and the average window size and the window size standard deviation of the TCP window are determined to obtain TCP window characteristics; wherein the TCP window is used to represent the buffer management strategy of the sender and the receiver; and the number of non-TCP / UDP protocols and the number of times of non-TCP / UDP protocols appearing more than a preset use threshold are determined to obtain other protocol characteristics; and the corresponding data flow characteristics are obtained according to the basic statistical characteristics, the time window fluctuation characteristics, the TCP flag characteristics, the TCP window characteristics, and the other protocol characteristics.

[0009] According to the method for identifying hidden scanning behavior provided by the application, the hidden scanning behavior identification model includes: a first feature extraction layer that extracts features from input basic statistical characteristics to obtain a flow time sequence feature vector; a second feature extraction layer that extracts features from input time window fluctuation characteristics to obtain a rate fluctuation feature vector; a third feature extraction layer that extracts features from input TCP flag characteristics to obtain a connection intent feature vector; a fourth feature extraction layer that extracts features from input TCP window characteristics to obtain a flow fluctuation feature vector; a fifth feature extraction layer that extracts features from input other protocol characteristics to obtain other abnormal feature vectors; an attention layer that combines the flow time sequence feature vector, the rate fluctuation feature vector, the connection intent feature vector, the flow fluctuation feature vector, and the other abnormal feature vectors to obtain a fusion feature by using an attention mechanism; and a behavior identification layer that identifies the fusion feature to obtain a hidden scanning behavior identification result.

[0010] According to the method for identifying hidden scanning behavior provided in the application, before inputting data flow features of all selected data packets into a hidden scanning behavior identification model, the following steps are included: obtaining data flow training features and scanning behavior labels corresponding to the data flow training features; taking the data flow training features as input data for training, taking the scanning behavior labels corresponding to the data flow training features as labels for training, training the model to be trained, and obtaining the hidden scanning behavior identification model for identifying hidden scanning behavior.

[0011] According to the method for identifying hidden scanning behavior provided in the application, the following steps are included: monitoring network flow, capturing data packets for data to be encapsulated into message data in the network; wherein the network is established by using a connection request with a preset control flag and a communication entity, and the communication entity is used to represent a hardware or software process for sending or receiving data packets; performing abnormal flag detection and abnormal flag detection on the captured data packets to obtain abnormal message detection results; and / or monitoring network flow, determining whether to send abnormal messages to multiple communication entities within a target time, and obtaining abnormal message detection results according to the determination results; wherein the network is established by using a connection request with a communication entity without containing a flag.

[0012] The application further provides a device for identifying hidden scanning behavior, which includes: an abnormality detection module, which performs abnormal message detection on data packets to be encapsulated into message data to obtain abnormal message detection results; a feature acquisition module, which, according to the abnormal message detection results, determines when the message is normal, uses a preset sliding window to select data packets to obtain data flow features corresponding to the selected data packets; wherein the data flow features are used to represent statistical characteristics of the data packets of the message data; and a behavior identification module, which inputs the data flow features of all selected data packets into a hidden scanning behavior identification model to obtain hidden scanning behavior identification results output by the hidden scanning behavior identification model; wherein the hidden scanning behavior identification model is trained based on data flow training features and scanning behavior labels corresponding to the data flow training features; the hidden scanning behavior identification model is used to extract features according to the input data flow features of all selected data packets, and combine the attention mechanism to perform feature fusion, so as to identify hidden scanning behavior of the fused features and obtain hidden scanning behavior identification results.

[0013] The application further provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method for identifying hidden scanning behavior according to any one of the above methods when executing the computer program.

[0014] The application further provides a non-transitory computer-readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the covert scanning behavior identification method.

[0015] The application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the covert scanning behavior identification method.

[0016] The application provides a covert scanning behavior identification method, device, equipment, medium and program, which performs abnormal message detection on a data packet to be packaged into a message data, performs preliminary filtering on the data packet based on the abnormal message detection result, identifies and excludes obviously malicious or erroneous data packets in advance, discovers abnormal messages early, prevents potential attack behaviors, and avoids them from entering a subsequent covert scanning behavior identification process, thereby reducing the burden of subsequent processing, improving efficiency, selecting data packets through a preset sliding window, and extracting data flow characteristics, so as to extract valuable information that can reflect different network behavior mode characteristics from original network flow data, provide a basis for subsequent covert scanning behavior identification, and further utilize a trained covert scanning behavior identification model to automatically extract the most useful characteristics for covert scanning behavior identification from the data flow characteristics, and combine an attention mechanism to dynamically weight the characteristics according to the importance of the characteristics, fuse important characteristics, and realize accurate detection of high-covert scanning behaviors, effectively improve the recognition ability of the attacker's covert scanning, and reduce the false positive rate and the false negative rate. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0018] Figure 1 is one of the flowcharts of the covert scanning behavior identification method provided by the application;

[0019] Figure 2 is the second flowchart of the covert scanning behavior identification method provided by the application;

[0020] Figure 3 is the structural schematic diagram of the covert scanning behavior identification device provided by the application;

[0021] Figure 4 is the structural schematic diagram of the electronic equipment provided by the application. DETAILED DESCRIPTION

[0022] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described clearly and completely below with reference to the drawings in the present application. Obviously, the described embodiments are part of, but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0023] Figure 1 is a flowchart of the concealed scanning behavior recognition method provided by the present application, as shown in Figure 1 The method comprises the following steps.

[0024] S11, performing abnormal message detection on the data packets to be encapsulated into message data to obtain an abnormal message detection result.

[0025] S12, according to the abnormal message detection result, when the message is normal, using a preset sliding window to slide and select data packets to obtain data flow characteristics corresponding to the selected data packets; wherein the data flow characteristics are used to represent the statistical characteristics of the data packets of the message data.

[0026] S13, inputting the data flow characteristics of all the selected data packets into a concealed scanning behavior recognition model to obtain a concealed scanning behavior recognition result output by the concealed scanning behavior recognition model; wherein the concealed scanning behavior recognition model is trained based on data flow training characteristics and scanning behavior labels corresponding to the data flow training characteristics; the concealed scanning behavior recognition model is used to perform feature extraction according to the input data flow characteristics of all the selected data packets, and perform feature fusion combined with an attention mechanism, so as to perform concealed scanning behavior recognition on the fused features and obtain a concealed scanning behavior recognition result.

[0027] It should be noted that the step number "S1N" in the present specification does not represent the sequence of the concealed scanning behavior recognition method, which will be described below in detail. Figure 2 The concealed scanning behavior recognition method of the present application is described.

[0028] Step S11, performing abnormal message detection on the data packets to be encapsulated into message data to obtain an abnormal message detection result.

[0029] In the embodiment, the data packet to be encapsulated into the message data is subjected to abnormal message detection to obtain an abnormal message detection result, including: monitoring network traffic, and capturing the data packet in the network for being encapsulated into the message data; wherein the network is established by a connection request using a preset control flag bit, and the communication entity is used to represent a hardware or software process for sending or receiving the data packet; the captured data packet is subjected to abnormal flag bit detection and abnormal flag bit detection to obtain the abnormal message detection result; and / or, monitoring network traffic, determining whether to send abnormal messages to multiple communication entities within a target time, and obtaining the abnormal message detection result according to the determination result; wherein the network is established by a connection request not containing a flag bit.

[0030] It should be noted that the preset control flag bit includes termination (FIN), push and termination (PUSH+FIN), reset (RESET), etc. The FIN flag bit is used to request termination of a transmission control protocol (TCP) connection, the PUSH+FIN flag bit is used to request closing the connection while sending data, and the RESET flag bit is used to immediately terminate a TCP connection.

[0031] Since the network mapper often chooses some uncommon flag bit combinations, such as FIN, PUSH+FIN, RESET, etc., in order to conceal its behavior, and may even send a connection request without any flag bit, the abnormal mode of the traffic is analyzed to preliminarily reveal the highly concealed network scanning behavior. However, in addition to the means of concealing the scanning process by sending abnormal messages, the attacker can also use other ways to bypass the traditional detection mechanism, such as intermittent scanning, encryption proxy, and other strategies, etc. Therefore, in order to improve the accuracy of identifying the concealed scanning behavior, further identification of the undetected abnormal data packet is needed, as described below. It should be noted that according to the abnormal message detection result, when it is determined that the message is abnormal, it is determined that there is a scanning behavior, and the process is ended.

[0032] In step S12, according to the abnormal message detection result, when it is determined that the message is not abnormal, the preset sliding window is used to select the data packet to obtain the data traffic characteristics corresponding to the selected data packet; wherein the data traffic characteristics are used to represent the statistical characteristics of the data packet of the message data.

[0033] In the embodiment, the data packet to be encapsulated into the message data is subjected to abnormal message detection to obtain an abnormal message detection result, including: monitoring network traffic, and capturing the data packet in the network for being encapsulated into the message data; wherein the network is established by a connection request using a preset control flag bit, and the communication entity is used to represent a hardware or software process for sending or receiving the data packet; the captured data packet is subjected to abnormal flag bit detection and abnormal flag bit detection to obtain the abnormal message detection result; and / or, monitoring network traffic, determining whether to send abnormal messages to multiple communication entities within a target time, and obtaining the abnormal message detection result according to the determination result; wherein the network is established by a connection request not containing a flag bit. Figure 2The preset sliding window is used to select data packets to obtain data flow characteristics corresponding to the selected data packets, including: classifying all data packets according to a five-tuple to obtain a classification result; wherein the five-tuple includes a source Internet Protocol (IP), a destination IP, a source port, a destination port and a protocol; according to the classification result, each type of data packet is sorted in time sequence to obtain a sorting result of each type; and according to the sorting result of each type, the data packets in the corresponding type of sorting result are selected by using the preset sliding window to obtain the corresponding data flow characteristics.

[0034] It should be noted that all data packets are classified by the five-tuple (source IP, destination IP, source port, destination port and protocol) to accurately attribute the data packets to different communication flows, and each type of data packet is sorted in time sequence to maintain the session time sequence characteristics, which significantly improves the accuracy of subsequent feature extraction, thereby facilitating the selection of each type of data packet by using the preset sliding window, thereby facilitating the dynamic observation of the feature changes of the data flow in different time windows, capturing the fluctuations and changes of the data flow in the time dimension, thereby extracting more accurate and comprehensive data flow characteristics to better reflect the normal and abnormal behaviors of the data flow, providing rich information for subsequent covert scanning behavior identification, enhancing the perception ability of the model to the time sequence structure, and improving the identification accuracy of the covert scanning behavior.

[0035] Specifically, according to the sorting result of each type, the data packets in the corresponding type sorting result are selected by using a preset sliding window to obtain corresponding data flow features, including: according to the sorting result of each type, the data packets in the corresponding type sorting result are selected by using a preset sliding window; for the data packets selected by each preset sliding window, the total number of data packets in the flow, the number of bytes in the flow, the average packet size, the packet size standard deviation, the average arrival time, the arrival interval standard deviation, the flow duration, the number of packets per second, the number of bytes per second, the amount of data used by different protocols, the number of different ports used, and the maximum port frequency are determined to obtain basic statistical features; and the maximum packet rate and packet rate standard deviation in the preset sliding window are determined to obtain time window fluctuation features; and the SYN count, ACK count, FIN count, RST count, PSH count, URG count, ECE count, CWR count, NONCE count, and NULL count are determined to obtain TCP flag features; and the average window size and window size standard deviation of the TCP window are determined to obtain TCP window features; wherein the TCP window is used to represent the buffer management strategy of the sender and the receiver; and the number of non-TCP / UDP protocols and the number of occurrences of non-TCP / UDP protocols that exceed a preset usage threshold are determined to obtain other protocol features; and the corresponding data flow features are obtained according to the basic statistical features, time window fluctuation features, TCP flag features, TCP window features, and other protocol features.

[0036] It should be noted that the total number of data packets in the flow is used to measure the degree of communication activity, and an abnormally large number may be a feature of an attack (such as a denial of service attack DoS); the number of bytes in the flow is used to describe the total amount of transmitted data; the average packet size is used to distinguish between application types, such as video streaming and domain name system DNS requests; the packet size standard deviation is used to describe the packet size fluctuation, and an abnormal fluctuation may be a manifestation of malicious communication; the average arrival time is used to represent the communication frequency, and a low interval may be an automated tool or an attack behavior; the arrival interval standard deviation is used to measure the regularity of communication, and a large fluctuation may indicate an anomaly; the flow duration is used to determine the session type, such as short connections and long connections; the number of packets per second (PPS) is used to discover high-frequency attacks, such as flood attacks; the number of bytes per second (BPS) is used to determine bandwidth occupancy, and data leakage can cause an abnormal increase; the amount of data used by different protocols is used to identify protocol multipurpose and determine whether it is a multi-protocol probe or a mixed attack behavior; the number of different ports used is used to measure whether multi-port connections are port scanning or probing behavior; the maximum port frequency is used to determine whether a certain port is frequently accessed to identify target service attacks.

[0037] In addition, the maximum packet rate in the preset sliding window is used to capture burst traffic behavior, such as a distributed denial of service attack (DDoS) or a port scanning peak; the packet rate standard deviation is used to measure whether the traffic is smooth, and large fluctuations may be abnormal communication; the SYN count of the synchronization sequence number is used to represent the count of the connection initiation behavior, and the SYN flood can be detected by the SYN; the ACK count is used to represent the count of the confirmation communication, and the normal communication ACK is more, and the abnormal communication ACK may be less or abnormal; the FIN count is used to represent the normal closing signal of the connection; the RST count is used to represent the count of the non-normal disconnection, and the frequent RST may be abnormal or rejection behavior; the PSH count is used to represent the count of the data immediately sent, and some attacks will frequently use it; the URG count is used to represent the count of the emergency packet, which is rarely seen in normal cases, and abuse may be a hidden attack; the ECE count of the explicit congestion notification echo is used to represent the count of the congestion notification response, which supports network congestion feedback detection; the CWR count of the congestion window reduction is used to represent the count of the congestion window reduction flag, which is used for congestion control, and abnormal use is suspicious; the NONCE count is used to represent the count of the extension field, which is usually not common; and the NULL count is used to represent the count of all flag bits being 0, which is often used for detection and scanning.

[0038] In addition, the average window size of the TCP window is used to reflect the connection quality, and a small window size may represent a rate limit (such as a slow attack), and the window size standard deviation is used to reflect the quality problem of the communication, and a large fluctuation in the window size may represent an abnormal communication mode or performance problem; the number of non-TCP / UDP is used to determine whether there is scanning, tunneling or control behavior, and the non-TCP / UDP includes ICMP, IGMP, etc.; and the number of non-TCP / UDP protocols whose occurrence frequency exceeds a preset use threshold is used to identify whether a non-mainstream protocol is frequently used, so as to further determine whether it is a sign of hidden communication or tunneling.

[0039] In an optional embodiment, before obtaining the corresponding data flow features by respectively sliding the data packets in the corresponding class sorting results using the preset sliding window according to the sorting results of each class, the method comprises: when the length of each class sorting result exceeds the length of the preset sliding window, directly obtaining the corresponding data flow features by respectively sliding the data packets in the corresponding class sorting results using the preset sliding window according to the sorting results of each class; and when the length of each class sorting result does not exceed the length of the preset sliding window, first filling the corresponding sorting result using a filling strategy to ensure that all sorting results have the same length, so as to facilitate subsequent feature extraction and model input using the preset sliding window.

[0040] In addition, the filling strategy can select characters that meet the corresponding requirements for filling according to the five-tuple type actually involved, and the length and step of the preset sliding window can be set according to actual design requirements, such as 1 minute in length and 30 seconds in step, which are not further limited here.

[0041] In step S13, the data flow features of all the selected data packets are input into the covert scanning behavior recognition model to obtain a covert scanning behavior recognition result output by the covert scanning behavior recognition model; wherein the covert scanning behavior recognition model is trained based on the data flow training features and the scanning behavior labels corresponding to the data flow training features; the covert scanning behavior recognition model is used for feature extraction according to the input data flow features of all the selected data packets, and feature fusion is performed in combination with an attention mechanism to recognize the fusion features for covert scanning behavior recognition to obtain the covert scanning behavior recognition result.

[0042] In this embodiment, the covert scanning behavior recognition model includes: a first feature extraction layer for performing feature extraction on the input basic statistical features to obtain a flow time sequence feature vector; a second feature extraction layer for performing feature extraction on the input time window fluctuation features to obtain a rate fluctuation feature vector; a third feature extraction layer for performing feature extraction on the input TCP flag features to obtain a connection intention feature vector; a fourth feature extraction layer for performing feature extraction on the input TCP window features to obtain a flow fluctuation feature vector; a fifth feature extraction layer for performing feature extraction on the input other protocol features to obtain an other abnormal feature vector; an attention layer for performing feature fusion on the flow time sequence feature vector, the rate fluctuation feature vector, the connection intention feature vector, the flow fluctuation feature vector and the other abnormal feature vector in combination with an attention mechanism to obtain a fusion feature; and a behavior recognition layer for performing covert scanning behavior recognition on the fusion feature to obtain a covert scanning behavior recognition result.

[0043] It should be noted that the statistical features and time sequence features in the basic statistical features are extracted by the first feature extraction layer, so as to facilitate subsequent fusion of the basic statistical quantity (such as the number of data packets, the flow duration, and the flow rate) and the time distribution feature (such as the average arrival interval and the standard deviation thereof), improve the recognition ability of the model to the flow stability and burst behavior, facilitate the improvement of the recognition ability of the model to the slow scanning and mutation detection behavior, the time window fluctuation feature and the degree of change (standard deviation) of the data packet rate are extracted by the second feature extraction layer, so as to enhance the recognition ability of the model to the burst behavior (such as high-frequency scanning in a short time), break through the problem of global average covering local fluctuation, the TCP flag feature is extracted by the third feature extraction layer, so as to construct the behavior intention portrait, make up for the limitation of traditional statistics of the flow size, capture the active connection attempt and the abnormal disconnection mode, improve the recognition accuracy of the model to the mapping behavior (such as port scanning and IP scanning), and the statistical feature of the TCP window size is extracted by the fourth feature extraction layer, so as to reflect the flow transmission stability and potential anomaly from the side, and the frequency of use of non-TCP / UDP protocol is introduced as a supplementary semantic dimension, which assists in identifying abnormal protocol combination or tunnel transmission behavior, so that the model can capture the behavior logic evolving across time, identify the feature change before and after the attack, and improve the recognition ability of the model.

[0044] In an optional embodiment, the covert scanning behavior recognition model adopts a multi-head neural network LSTM architecture, which is divided into multiple heads according to basic statistical features, sub-window features, TCP flag features, TCP window features, and other protocol features, and attention layers connected to each head. Each feature is respectively input into the corresponding head for encoding to capture the evolution rule of each dimension in time, and the captured feature vector is input into the attention layer connected to the current head and the attention layer connected to other heads. The final attention layer performs weighted fusion on the output of the current head and the output of other heads through the attention mechanism, and inputs the fused features into the behavior recognition layer. The behavior recognition layer performs covert scanning behavior recognition based on the fused features input by all the attention layers, so as to realize multi-angle and fine recognition of the overall attack behavior, effectively solve the problems of weak fusion ability of heterogeneous features and limited context learning ability of single-channel models, and improve the recognition accuracy and generalization ability to the covert scanning and low-frequency detection scene.

[0045] In other words, the data flow characteristics of all selected data packets are input into the covert scanning behavior recognition model to obtain a covert scanning behavior recognition result output by the covert scanning behavior recognition model, including: inputting the basic statistical characteristics into the first feature extraction layer for feature extraction to obtain a flow time sequence feature vector; inputting the time window fluctuation characteristics into the second feature extraction layer for feature extraction to obtain a rate fluctuation feature vector; inputting the TCP flag characteristics into the third feature extraction layer for feature extraction to obtain a connection intention feature vector; inputting the TCP window characteristics into the fourth feature extraction layer for feature extraction to obtain a flow fluctuation feature vector; inputting the other protocol characteristics into the fifth feature extraction layer for feature extraction to obtain an other abnormality feature vector; inputting the flow time sequence feature vector, the rate fluctuation feature vector, the connection intention feature vector, the flow fluctuation feature vector and the other abnormality feature vector into the attention layer to combine the attention mechanism for feature fusion to obtain a fusion feature; and inputting the fusion feature into the behavior recognition layer for covert scanning behavior recognition to obtain the covert scanning behavior recognition result.

[0046] In an optional embodiment, before inputting the data flow characteristics of all selected data packets into the covert scanning behavior recognition model, the following steps are included: obtaining data flow training characteristics and scanning behavior labels corresponding to the data flow training characteristics; using the data flow training characteristics as input data for training and using the scanning behavior labels corresponding to the data flow training characteristics as labels for training to train the to-be-trained model to obtain a covert scanning behavior recognition model for identifying covert scanning behaviors. It should be noted that the to-be-trained model can be an existing network, which usually includes a network structure, or other networks specified by a user, such as a multi-head neural network model.

[0047] In summary, the embodiment of the present application performs abnormal message detection on data packets to be packaged into message data, performs preliminary filtering on the data packets based on the abnormal message detection result, identifies and excludes obviously malicious or erroneous data packets in advance, discovers abnormal messages early, prevents potential attack behaviors, and can avoid them from entering the subsequent covert scanning behavior recognition process, thereby reducing the burden of subsequent processing, improving efficiency, selecting data packets through a preset sliding window and extracting data flow characteristics to extract valuable information that can reflect different network behavior mode characteristics from original network flow data, providing a basis for subsequent covert scanning behavior recognition, and further using the trained covert scanning behavior recognition model to automatically extract the most useful features for covert scanning behavior recognition from the data flow characteristics, combining the attention mechanism to dynamically weight the features according to their importance, and fusing important features to achieve accurate detection of high-covert scanning behaviors, effectively improving the recognition ability of the attacker's covert scanning, and reducing the false positive rate and the false negative rate.

[0048] The hidden scanning behavior recognition device provided by the present application is described below, and the hidden scanning behavior recognition device described below can be correspondingly referred to the hidden scanning behavior recognition method described above.

[0049] Figure 3 A structural schematic diagram of a hidden scanning behavior recognition device is shown. The device comprises:

[0050] The anomaly detection module 31 performs anomaly packet detection on the data packets to be encapsulated into the message data to obtain an anomaly packet detection result.

[0051] The feature acquisition module 32 determines, according to the anomaly packet detection result, that the message is normal, and selects data packets by using a preset sliding window to obtain data flow features corresponding to the selected data packets; wherein the data flow features are used to represent the statistical characteristics of the data packets of the message data.

[0052] The behavior recognition module 33 inputs the data flow features of all selected data packets into a hidden scanning behavior recognition model to obtain a hidden scanning behavior recognition result output by the hidden scanning behavior recognition model; wherein the hidden scanning behavior recognition model is trained based on the data flow training features and the scanning behavior labels corresponding to the data flow training features; the hidden scanning behavior recognition model is used to extract features according to the input data flow features of all selected data packets, and to fuse features by using an attention mechanism, so as to recognize the fused features for hidden scanning behavior recognition to obtain the hidden scanning behavior recognition result.

[0053] In this embodiment, the anomaly detection module 31 comprises: a monitoring unit that monitors network traffic and captures data packets in the network for encapsulation into message data; wherein the network is established by using a connection request with a preset control flag and a communication entity, and the communication entity is used to represent a hardware or software process for sending or receiving data packets; a monitoring unit that performs anomaly flag detection and abnormal flag detection on the captured data packets to obtain an anomaly packet detection result; and / or, the monitoring unit monitors the network traffic, the monitoring unit determines whether to send abnormal messages to multiple communication entities within a target time, and according to the determination result, obtains the anomaly packet detection result; wherein the network is established by using a connection request that does not contain a flag and a communication entity.

[0054] The feature acquisition module 32 comprises: a classification unit configured to classify all data packets according to five-tuples to obtain a classification result; wherein the five-tuples comprise a source Internet Protocol (IP), a destination IP, a source port, a destination port and a protocol; an ordering unit configured to order each type of data packet according to a time sequence based on the classification result to obtain an ordering result of each type; and a sliding selection unit configured to use a preset sliding window to slide and select data packets in the ordering result of each type according to the ordering result of each type to obtain corresponding data flow features.

[0055] Specifically, the sliding selection unit is configured to: use a preset sliding window to slide and select data packets in the ordering result of each type according to the ordering result of each type; determine, for the data packets selected by each preset sliding window each time, a total number of data packets in a flow, a number of bytes in the flow, an average data packet size, a standard deviation of the data packet size, an average arrival time, a standard deviation of an arrival interval, a flow duration, a number of data packets per second, a number of bytes per second, a data volume of different protocols used, a number of different ports used and a maximum port frequency to obtain basic statistical features; determine a maximum data packet rate in the preset sliding window and a standard deviation of the data packet rate to obtain time window fluctuation features; determine a synchronization sequence number (SYN) count, an acknowledgement (ACK) count, a termination (FIN) count, a reset (RST) count, a push (PSH) count, an urgent (URG) count, an explicit congestion notification echo (ECE) count, a congestion window reduction (CWR) count, a nonce (NONCE) count and a null flag (NULL) count to obtain transmission control protocol (TCP) flag features; determine an average window size of a TCP window and a standard deviation of the window size to obtain TCP window features; wherein the TCP window is used to represent a buffer management strategy of a sender and a receiver; determine a number of non-TCP / User Datagram Protocol (UDP) protocols and a number of occurrences of non-TCP / UDP protocols that exceed a preset usage threshold to obtain other protocol features; and obtain corresponding data flow features based on the basic statistical features, the time window fluctuation features, the TCP flag features, the TCP window features and the other protocol features.

[0056] In an optional embodiment, the feature acquisition module 32 further comprises: a length determination unit, which determines whether the length of each type of sorting result exceeds the length of the preset sliding window before obtaining the corresponding data flow features by slidingly selecting the data packets in the corresponding type of sorting result using the preset sliding window according to the sorting result of each type; when it is determined that the length of each type of sorting result exceeds the length of the preset sliding window, the corresponding data flow features are directly obtained by slidingly selecting the data packets in the corresponding type of sorting result using the preset sliding window according to the sorting result of each type through the sliding selection unit; when it is determined that the length of each type of sorting result does not exceed the length of the preset sliding window, the corresponding sorting result is first filled by the filling unit using a filling strategy to ensure that all sorting results have the same length, so as to facilitate subsequent feature extraction and model input using the preset sliding window.

[0057] The behavior recognition module 33 comprises: a first feature extraction unit, which inputs the basic statistical features into the first feature extraction layer for feature extraction to obtain a flow timing feature vector; a second feature extraction unit, which inputs the time window fluctuation features into the second feature extraction layer for feature extraction to obtain a rate fluctuation feature vector; a third feature extraction unit, which inputs the TCP flag features into the third feature extraction layer for feature extraction to obtain a connection intention feature vector; a fourth feature extraction unit, which inputs the TCP window features into the fourth feature extraction layer for feature extraction to obtain a flow fluctuation feature vector; a fifth feature extraction unit, which inputs the other protocol features into the fifth feature extraction layer for feature extraction to obtain other abnormal feature vectors; a fusion unit, which inputs the flow timing feature vector, the rate fluctuation feature vector, the connection intention feature vector, the flow fluctuation feature vector and the other abnormal feature vectors into the attention layer for feature fusion in combination with the attention mechanism to obtain fusion features; and a recognition unit, which inputs the fusion features into the behavior recognition layer for covert scanning behavior recognition to obtain a covert scanning behavior recognition result.

[0058] In an optional embodiment, the device further comprises: a sample acquisition module, which acquires data flow training features and scanning behavior labels corresponding to the data flow training features before inputting the data flow features of all selected data packets into the covert scanning behavior recognition model; and a training module, which trains the to-be-trained model by taking the data flow training features as input data for training and taking the scanning behavior labels corresponding to the data flow training features as labels for training to obtain a covert scanning behavior recognition model for identifying covert scanning behaviors.

[0059] In summary, the embodiment of the present application performs abnormal message detection on the data packets to be encapsulated into message data by the abnormal detection module, performs preliminary filtering on the data packets based on the abnormal message detection result, identifies and excludes obviously malicious or erroneous data packets in advance, discovers abnormal messages early, prevents potential attack behaviors, and can avoid them from entering the subsequent covert scanning behavior identification process, thereby reducing the burden of subsequent processing, improving efficiency, and using the preset sliding window to select data packets and extract data flow features by the feature acquisition module, so as to extract valuable information that can reflect different network behavior mode characteristics from original network flow data, provide a basis for subsequent covert scanning behavior identification, and further extract the most useful features for covert scanning behavior identification from the data flow features by the behavior identification module using the trained covert scanning behavior identification model, and combine the attention mechanism to dynamically weight according to the importance of the features, fuse important features, realize accurate detection of high-covert scanning behaviors, effectively improve the recognition ability of the attacker's covert scanning, and reduce the false positive rate and the false negative rate.

[0060] Figure 4 An example of a schematic diagram of the physical structure of an electronic device is shown in Figure 4 As shown, the electronic device can include a processor 410, a communications interface 420, a memory 430, and a communications bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other through the communications bus 440. The processor 410 can invoke the logical instructions in the memory 430 to execute the covert scanning behavior identification method, which includes: performing abnormal message detection on data packets to be encapsulated into message data to obtain an abnormal message detection result; determining that the message is normal according to the abnormal message detection result, and using a preset sliding window to select data packets to obtain data flow features corresponding to the selected data packets; wherein the data flow features are used to represent the statistical characteristics of the data packets of the message data; inputting the data flow features of all selected data packets into a covert scanning behavior identification model to obtain a covert scanning behavior identification result output by the covert scanning behavior identification model; wherein the covert scanning behavior identification model is trained based on the data flow training features and the scanning behavior labels corresponding to the data flow training features; and the covert scanning behavior identification model is used to extract features according to the input data flow features of all selected data packets, and fuse features combined with the attention mechanism to identify the fused features for covert scanning behavior, and obtain the covert scanning behavior identification result.

[0061] In addition, the logic instructions in the memory 430 described above can be implemented in the form of a software function unit and sold or used as an independent product, which can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0062] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor to enable a computer to execute the covert scanning behavior identification method provided by the above-mentioned method, which comprises: performing abnormal message detection on data packets to be encapsulated into message data to obtain an abnormal message detection result; determining that the message is normal according to the abnormal message detection result, and selecting data packets by using a preset sliding window to obtain data flow characteristics corresponding to the selected data packets; wherein the data flow characteristics are used to represent the statistical characteristics of the data packets of the message data; inputting the data flow characteristics of all selected data packets into a covert scanning behavior identification model to obtain a covert scanning behavior identification result output by the covert scanning behavior identification model; wherein the covert scanning behavior identification model is trained based on data flow training features and scanning behavior labels corresponding to the data flow training features; the covert scanning behavior identification model is used to extract features according to the input data flow characteristics of all selected data packets, and combines an attention mechanism to perform feature fusion, so as to identify the fusion features to obtain the covert scanning behavior identification result.

[0063] In yet another aspect, the present application also provides a non-transitory computer-readable storage medium having stored thereon a computer program, which, when executed by a processor, implements the covert scanning behavior identification method provided by the above method, and the method comprises: performing abnormal message detection on data packets to be encapsulated into message data to obtain an abnormal message detection result; when it is determined that the message is normal according to the abnormal message detection result, using a preset sliding window to slide and select data packets to obtain data flow characteristics corresponding to the selected data packets; wherein the data flow characteristics are used to represent the statistical characteristics of the data packets of the message data; inputting the data flow characteristics of all the selected data packets into a covert scanning behavior identification model to obtain a covert scanning behavior identification result output by the covert scanning behavior identification model; wherein the covert scanning behavior identification model is trained based on data flow training features and scanning behavior labels corresponding to the data flow training features; and the covert scanning behavior identification model is used to perform feature extraction according to the input data flow characteristics of all the selected data packets, and perform feature fusion combined with an attention mechanism to identify the fusion features to obtain the covert scanning behavior identification result.

[0064] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, i.e., they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0065] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be implemented by means of software and the necessary general hardware platform, and of course, can also be implemented by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0066] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for covert scan behavior recognition, the method comprising: The method comprises the following steps: performing abnormal message detection on the data packets to be encapsulated into message data to obtain an abnormal message detection result; when it is determined that the message is normal according to the abnormal message detection result, using a preset sliding window to select the data packets to obtain data flow characteristics corresponding to the selected data packets; wherein the data flow characteristics are used to represent statistical characteristics of the data packets of the message data; inputting the data flow characteristics of all the selected data packets into a covert scanning behavior recognition model to obtain a covert scanning behavior recognition result output by the covert scanning behavior recognition model; wherein the covert scanning behavior recognition model is trained based on data flow training characteristics and scanning behavior labels corresponding to the data flow training characteristics; the covert scanning behavior recognition model is used to perform feature extraction according to the input data flow characteristics of all the selected data packets, and perform feature fusion combined with an attention mechanism to recognize the fused features for a covert scanning behavior recognition result; using a preset sliding window to select the data packets to obtain data flow characteristics corresponding to the selected data packets, comprising: classifying all the data packets according to five tuples to obtain a classification result; wherein the five tuples include source Internet Protocol (IP), destination IP, source port, destination port and protocol; according to the classification result, sorting each type of data packet in time sequence to obtain a sorting result of each type; according to the sorting result of each type, using a preset sliding window to select data packets in the corresponding type sorting result to obtain corresponding data flow characteristics; according to the sorting result of each type, using a preset sliding window to select data packets in the corresponding type sorting result to obtain corresponding data flow characteristics, comprising: according to the sorting result of each type, using a preset sliding window to select data packets in the corresponding type sorting result; for each data packet selected by the preset sliding window, determining the total number of data packets in the flow, the number of bytes in the flow, the average data packet size, the data packet size standard deviation, the average arrival time, the arrival interval standard deviation, the flow duration, the number of data packets per second, the number of bytes per second, the amount of data using different protocols, the number of different ports used, and the maximum port frequency to obtain basic statistical characteristics; and determining the maximum data packet rate and data packet rate standard deviation in the preset sliding window to obtain time window fluctuation characteristics; and determining the SYN count, ACK count, FIN count, RST count, PSH count, URG count, ECE count, CWR count, NONCE count and NULL count to obtain TCP flag characteristics; and determining the average window size and window size standard deviation of the TCP window to obtain TCP window characteristics; wherein the TCP window is used to represent the buffer management strategy of the sender and the receiver; and determine a number of non-Transmission Control Protocol (TCP) / User Datagram Protocol (UDP) protocols and a number of occurrences of the non-TCP / UDP protocols that exceed a preset use threshold, to obtain other protocol features; obtain corresponding data flow features according to the basic statistical features, the time window fluctuation features, the TCP flag features, the TCP window features, and the other protocol features; The covert scanning behavior recognition model comprises: a first feature extraction layer configured to perform feature extraction on the input basic statistical features to obtain a flow time sequence feature vector; a second feature extraction layer configured to perform feature extraction on the input time window fluctuation features to obtain a rate fluctuation feature vector; a third feature extraction layer configured to perform feature extraction on the input TCP flag features to obtain a connection intention feature vector; a fourth feature extraction layer configured to perform feature extraction on the input TCP window features to obtain a flow fluctuation feature vector; a fifth feature extraction layer configured to perform feature extraction on the input other protocol features to obtain other abnormal feature vectors; an attention layer configured to perform feature fusion on the flow time sequence feature vector, the rate fluctuation feature vector, the connection intention feature vector, the flow fluctuation feature vector, and the other abnormal feature vectors in combination with an attention mechanism to obtain fused features; a behavior recognition layer configured to perform covert scanning behavior recognition on the fused features to obtain a covert scanning behavior recognition result.

2. The covert scan behavior identification method of claim 1, wherein, Before inputting the data flow features of all selected data packets into the covert scanning behavior recognition model, the method comprises: obtaining data flow training features and scanning behavior labels corresponding to the data flow training features; training the model to be trained by taking the data flow training features as input data for training and taking the scanning behavior labels corresponding to the data flow training features as labels for training, to obtain a covert scanning behavior recognition model for identifying covert scanning behaviors.

3. The covert scan behavior identification method of claim 1, wherein, performing abnormal packet detection on the data packets to be encapsulated into the packet data to obtain an abnormal packet detection result, comprising: monitoring network traffic to capture data packets in the network for the packet data to be encapsulated; wherein the network is established by a connection request using a preset control flag bit and a communication entity, and the communication entity is used to represent a hardware or software process for sending or receiving data packets; performing abnormal flag bit detection and abnormal flag bit detection on the captured data packets to obtain an abnormal packet detection result; and / or monitoring network traffic to determine whether to send abnormal packets to multiple communication entities within a target time, and obtaining an abnormal packet detection result according to the determination result; wherein the network is established by a connection request that does not contain a flag bit and a communication entity.

4. A covert scan-behavior identification apparatus characterized by, comprising: an abnormal detection module configured to perform abnormal packet detection on the data packets to be encapsulated into the packet data to obtain an abnormal packet detection result; a feature acquisition module configured to, according to the abnormal packet detection result, determine that the packet is normal, and select the data packets by using a preset sliding window to obtain data flow features corresponding to the selected data packets; wherein the data flow features are used to represent statistical characteristics of the data packets of the packet data. The behavior recognition module inputs the data flow features of all the selected data packets into a covert scanning behavior recognition model to obtain a covert scanning behavior recognition result output by the covert scanning behavior recognition model; wherein the covert scanning behavior recognition model is trained based on data flow training features and scanning behavior labels corresponding to the data flow training features; The covert scanning behavior recognition model is used for feature extraction according to the input data flow features of all the selected data packets, and feature fusion is performed in combination with an attention mechanism to perform covert scanning behavior recognition on the fused features to obtain a covert scanning behavior recognition result; The feature acquisition module comprises: The classification unit classifies all the data packets according to five tuples to obtain a classification result; wherein the five tuples include a source Internet Protocol (IP), a destination IP, a source port, a destination port, and a protocol; The sorting unit sorts each type of data packet in time sequence according to the classification result to obtain a sorting result of each type; The sliding selection unit respectively selects data packets in the sorting result of each type by using a preset sliding window to obtain corresponding data flow features; The sliding selection unit is configured to: select data packets in the sorting result of each type by using a preset sliding window; determine the total number of data packets in a flow, the number of bytes in a flow, the average data packet size, the data packet size standard deviation, the average arrival time, the arrival interval standard deviation, the flow duration, the number of data packets per second, the number of bytes per second, the amount of data using different protocols, the number of different ports used, and the maximum port frequency, to obtain basic statistical features; and determine the maximum data packet rate and the data packet rate standard deviation in the preset sliding window to obtain time window fluctuation features; and determine the SYN count, ACK count, FIN count, RST count, PSH count, URG count, ECE count, CWR count, NONCE count, and NULL count to obtain TCP flag features; and determine the average window size and window size standard deviation of the TCP window to obtain TCP window features; wherein the TCP window is used to represent the buffer management strategy of the sender and the receiver; and determine the number of non-TCP / UDP protocols and the number of occurrences of non-TCP / UDP protocols that exceed a preset usage threshold to obtain other protocol features; The covert scanning behavior recognition model comprises: The first feature extraction layer extracts features from the input basic statistical features to obtain a flow time sequence feature vector; ​ The second feature extraction layer extracts features of the input time window fluctuation feature to obtain a rate fluctuation feature vector; The third feature extraction layer extracts features of the input TCP flag feature to obtain a connection intention feature vector; The fourth feature extraction layer extracts features of the input TCP window feature to obtain a flow fluctuation feature vector; The fifth feature extraction layer extracts features of the input other protocol feature to obtain an other abnormal feature vector; The attention layer combines the attention mechanism to perform feature fusion according to the flow time sequence feature vector, the rate fluctuation feature vector, the connection intention feature vector, the flow fluctuation feature vector and the other abnormal feature vector, to obtain a fusion feature; The behavior recognition layer performs a stealth scan behavior recognition on the fusion feature to obtain a stealth scan behavior recognition result.

5. An electronic device comprising a memory, a processor, and a computer program stored on the memory and running on the processor, characterized in that, The processor executes the computer program to implement the stealth scan behavior recognition method according to any one of claims 1 to 3.

6. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the stealth scan behavior recognition method according to any one of claims 1 to 3.

7. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the stealth scan behavior recognition method according to any one of claims 1 to 3.

Images