Network traffic auditing optimization defense method based on traffic feature camouflage

Abstract

This invention relates to an optimized defense method for network traffic auditing based on traffic feature masquerading attacks, belonging to the field of network security technology. The optimized defense method for network traffic auditing designed in this invention optimizes the network traffic auditing system by constructing multi-dimensional feature modeling, a dynamic defense mechanism, and an incremental learning system, enabling it to accurately detect masquerading attacks.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a network traffic audit optimization and defense method based on traffic feature masquerading. Background Technology

[0002] Network traffic auditing is an important component of network security, used to detect and prevent network attacks, data breaches, and other malicious activities. Traffic auditing systems typically identify abnormal traffic by analyzing its characteristics, such as packet size, protocol type, and traffic patterns.

[0003] Attackers typically bypass auditing systems by spoofing characteristics such as packet size and protocol type. Existing network traffic auditing systems have three major flaws: 1. Difficulty in detecting advanced traffic signature spoofing; 2. Lack of dynamic and evolving defense mechanisms; 3. High false positive rate for spoofing attacks. Summary of the Invention

[0004] (a) Technical problems to be solved

[0005] The technical problem to be solved by this invention is: to design an optimized defense method for network traffic auditing against traffic feature spoofing attacks.

[0006] (II) Technical Solution

[0007] To address the aforementioned technical problems, this invention provides a network traffic audit optimization and defense method based on traffic feature masquerading, comprising the following steps:

[0008] Step 1. Initialization: Analyze the detection rules of the traffic auditing system to determine the traffic characteristics that need to be disguised, including the size of the data packets to be disguised, the protocol type, and the traffic pattern; determine the disguise strategy according to the traffic characteristics to be disguised;

[0009] Step 2. Traffic masquerading: Disguise abnormal traffic according to the masquerading strategy;

[0010] Step 3. Dynamic Adaptation: Monitor the updates and adjustments of the traffic auditing system in real time, and adjust the camouflage strategy based on the monitoring results;

[0011] Step 4. Traffic Injection and Transmission: Capture normal traffic and inject the disguised traffic into the normal traffic; send the traffic with the injected disguised traffic to the target network;

[0012] Step 5. Traffic Audit System Optimization: Obtain the attack characteristics of abnormal traffic, add the attack characteristics to the training set, train the attack detection model of the network traffic audit system, update the attack detection strategy of the network traffic audit system, and realize the optimization of the network traffic audit system.

[0013] Preferably, the spoofing method in step 2 includes packet size spoofing:

[0014] Packet segmentation: dividing a large data packet into multiple smaller data packets, so that the segmented data packets conform to the data packet size distribution of normal traffic;

[0015] Packet merging: Merging multiple small packets into one large packet, so that the merged packet conforms to the normal packet size distribution of traffic.

[0016] Preferably, the spoofing method in step 2 includes protocol type spoofing:

[0017] Protocol type modification: Disguise the protocol type of the attack traffic as HTTP or HTTPS traffic;

[0018] Protocol header spoofing: Modifying the protocol header information of data packets to make it conform to the protocol header characteristics of normal traffic.

[0019] Preferably, the spoofing method in step 2 includes traffic pattern spoofing:

[0020] Traffic smoothing: By adjusting the data packet sending rate, burst traffic is transformed into stable traffic, making it conform to the traffic pattern of normal traffic.

[0021] Traffic randomization: By randomizing the sending time of data packets, periodic traffic is adjusted to random traffic, making it conform to the traffic pattern of normal traffic.

[0022] Preferably, the camouflage method in step 2 includes camouflage of the following features:

[0023] Packet arrival time adjustment: By adjusting the packet sending interval, the arrival time of the packets is adjusted to conform to the arrival time distribution of normal traffic;

[0024] Source IP address spoofing: Modifying the source IP address of data packets to make them appear as normal traffic. For example, changing the source IP address of attack traffic to an IP address within a preset range.

[0025] Preferably, step 3 specifically involves: if the traffic auditing system updates the detection rules for packet size, then adjusting the packet size spoofing strategy; if the traffic auditing system updates the detection rules for protocol type, then adjusting the protocol type spoofing strategy.

[0026] Preferably, in step 5, if the traffic has one of the following attack characteristics, it is determined to be abnormal traffic: the data packet size does not meet the preset conditions, the distribution dispersion does not meet the preset conditions, the data packet header and payload consistency verification fails, or the traffic pattern does not meet the preset conditions.

[0027] Preferably, a traffic detection step is included between step 4 and step 5: triggering connection blocking, using a Hidden Markov Model (HMM) to identify abnormal traffic, and if abnormal traffic is detected, proceeding to the next step; otherwise, reacquiring traffic.

[0028] The present invention also provides a system for implementing the method.

[0029] (III) Beneficial Effects

[0030] This invention provides an optimized defense method for network traffic auditing against traffic feature spoofing attacks. By constructing multi-dimensional feature modeling, dynamic defense mechanism and incremental learning system, it optimizes the network traffic auditing system, enabling it to accurately detect spoofing attacks. Attached Figure Description

[0031] Figure 1 This is a flowchart illustrating the process of detecting abnormal traffic in the auditing system of this invention. Detailed Implementation

[0032] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0033] This invention provides an optimized defense method for network traffic auditing against traffic feature spoofing attacks. By constructing multi-dimensional feature modeling, dynamic defense mechanism and incremental learning system, it achieves accurate detection of spoofing attacks.

[0034] The technical solution is detailed below, with a detailed description of the implementation details of each step and module.

[0035] 1. Modeling of camouflage attack features

[0036] Multidimensional feature baseline library

[0037]

[0038] Deep feature association analysis:

[0039] - Cross-layer association engine: Associates protocol types with payload content (e.g., mismatch between HTTP headers and encrypted payloads);

[0040] - Behavioral pattern analysis: Establish a normal traffic behavior graph and detect deviations (such as burst traffic from the DNS protocol).

[0041] 2. Traffic feature spoofing

[0042] The traffic feature masquerading module is responsible for masquerading traffic features based on the analysis results, making abnormal traffic appear as normal traffic. The specific steps are as follows:

[0043] 2.1 Packet Size Spoofing

[0044] ● Packet segmentation: Divide large data packets into multiple smaller data packets to conform to the normal data packet size distribution of traffic.

[0045] ● Packet merging: Merging multiple small packets into one large packet to conform to the normal packet size distribution of traffic.

[0046] 2.2 Protocol Type Impersonation

[0047] ●Protocol Type Modification: Modify the protocol type of the data packet to match the protocol type of normal traffic. For example, disguise the protocol type of the attack traffic as common HTTP or HTTPS traffic.

[0048] ● Protocol header spoofing: Modifying the protocol header information of data packets to make them appear as normal traffic. For example, modifying TCP / UDP header information to conform to the protocol header characteristics of normal traffic.

[0049] 2.3 Traffic Pattern Disguise

[0050] ● Traffic smoothing: Adjusting burst traffic to stable traffic patterns, making it conform to normal traffic patterns. For example, smoothing burst traffic to stable traffic by adjusting the data packet sending rate.

[0051] ● Traffic Randomization: Adjusts periodic traffic to random traffic, making it conform to the traffic pattern of normal traffic. For example, periodic traffic can be adjusted to random traffic by randomizing the sending time of data packets.

[0052] 2.4 Other Feature Camouflage

[0053] ● Packet arrival time adjustment: Adjust the arrival time of data packets to match the arrival time distribution of normal traffic. For example, by adjusting the sending interval of data packets, the arrival time can appear to be normal traffic.

[0054] ●Source IP address spoofing: Modifying the source IP address of data packets to make them appear as normal traffic. For example, spoofing the source IP address of attack traffic to a common IP address range.

[0055] 3. Dynamic defense mechanism

[0056] The dynamic adaptation module is responsible for dynamically adjusting the traffic feature masquerading strategy based on updates and adjustments to the traffic auditing system. The specific steps are as follows:

[0057] 3.1 Traffic Audit System Monitoring

[0058] ●Detection Rule Monitoring: Monitor in real time whether the detection rules of the traffic auditing system are updated. For example, observe the changes in the response of the traffic auditing system by periodically sending test traffic.

[0059] ●Model Update Monitoring: Monitors in real time whether the detection model of the traffic auditing system has been updated. For example, it detects model changes by analyzing the logs or configuration files of the traffic auditing system.

[0060] 3.2 Adjustment of camouflage strategy

[0061] ● Packet size adjustment: If the traffic auditing system updates its packet size detection rules, adjust the packet size masquerading strategy. For example, increase the frequency of packet splitting or merging.

[0062] ●Protocol Type Adjustment: If the traffic auditing system updates the protocol type detection rules, adjust the protocol type masquerading strategy. For example, increase the frequency of protocol type modifications.

[0063] ● Traffic Pattern Adjustment: If the traffic auditing system updates its traffic pattern detection rules, adjust the traffic pattern masquerading strategy. For example, increase the frequency of traffic smoothing or randomization.

[0064] ● Adjustments to other characteristics: If the traffic auditing system updates the detection rules for other characteristics, the spoofing strategies for those characteristics will be adjusted. For example, the frequency of packet arrival time manipulation or source IP address spoofing may be increased.

[0065] 3.3 Dynamic Adaptation Process

[0066] ● Real-time monitoring: Continuously monitor the updates and adjustments to the traffic auditing system.

[0067] ● Strategy Adjustment: Dynamically adjust the traffic feature masquerading strategy based on monitoring results.

[0068] ● Iterative optimization: Repeat traffic feature analysis and camouflage process to ensure that the camouflage strategy can adapt to changes in the traffic audit system.

[0069] 4. Traffic Injection

[0070] The traffic injection module is responsible for injecting disguised traffic into network traffic, thereby optimizing the traffic auditing system. The specific steps are as follows:

[0071] 4.1 Traffic Capture

[0072] ● Normal traffic capture: Captures normal traffic data in the network as the basis for spoofing traffic.

[0073] ● Traffic Analysis: Analyze the characteristics of normal traffic to determine the location and method of injecting spoofed traffic.

[0074] 4.2 Traffic Spoofing

[0075] ●Spoofed Traffic Generation: Generates disguised traffic based on spoofing strategies.

[0076] ● Traffic Reassembly: Reassembles disguised traffic with normal traffic to ensure it complies with network protocol specifications.

[0077] 4.3 Traffic Sending

[0078] ● Traffic injection: Injecting reconstituted traffic into network traffic and sending it to the target network.

[0079] ●Traffic verification: Verify the effectiveness of detecting spoofed traffic through a traffic auditing system.

[0080] 5. Flow detection

[0081] The connection is blocked upon triggering a Hidden Markov Model (HMM) to identify abnormal traffic. If abnormal traffic is detected, the next step is executed; otherwise, traffic is reacquired. Traffic is considered abnormal if it exhibits any of the following attack characteristics: packet size does not meet preset conditions, distribution dispersion does not meet preset conditions, packet header and payload consistency verification fails, or traffic pattern does not meet preset conditions. Figure 1 As shown.

[0082] 6. Traffic auditing system optimization

[0083] The attack characteristics of abnormal traffic are obtained, and these characteristics are added to the training set to train the attack detection model of the network traffic auditing system. This updates the attack detection strategy of the network traffic auditing system and optimizes the system.

[0084] Example:

[0085] 1. System Architecture

[0086] The system architecture of this embodiment includes the following five main modules:

[0087] 1. Traffic Feature Analysis Module:

[0088] ○ Responsible for analyzing the detection rules of the traffic auditing system and determining the traffic characteristics that need to be disguised.

[0089] ○ By analyzing characteristics such as packet size, protocol type, and traffic patterns, a spoofing strategy can be determined.

[0090] 2. Traffic Feature Spoofing Module:

[0091] ○ Responsible for disguising traffic characteristics to make abnormal traffic look like normal traffic.

[0092] ○ Includes functions such as packet size spoofing, protocol type spoofing, and traffic pattern spoofing.

[0093] 3. Dynamic Adaptation Module:

[0094] ○ Responsible for monitoring the updates and adjustments of the traffic auditing system, and dynamically adjusting the masquerade strategy.

[0095] ○ Adjust the camouflage strategy by monitoring the detection rules and model updates of the traffic audit system in real time.

[0096] 4. Traffic Injection Module:

[0097] ○ Responsible for injecting disguised traffic into network traffic.

[0098] ○ Capture normal traffic and inject the spoofed traffic into the normal traffic before sending it to the target network.

[0099] 5. Traffic Audit System Simulation Module:

[0100] ○ Simulate a target traffic auditing system to test the effectiveness of detecting spoofed traffic. This module can be a rule-based or machine learning-based traffic detection model to verify its effectiveness.

[0101] 2. Algorithm Flow

[0102] The algorithm flow of this embodiment is as follows:

[0103] 1. Initialization:

[0104] ○ Analyze the detection rules of the traffic auditing system to determine the traffic characteristics that need to be disguised.

[0105] For example, determine the size, protocol type, and traffic pattern of the packets that need to be spoofed.

[0106] 2. Traffic spoofing:

[0107] ○ Disguise abnormal traffic based on camouflage strategies.

[0108] For example:

[0109] ■ Divide large data packets into multiple smaller data packets;

[0110] ■ Disguise the protocol type of the attack traffic as common HTTP or HTTPS traffic;

[0111] ■ Adjust the sudden surge in traffic to a stable flow rate.

[0112] 3. Dynamic adaptation:

[0113] ○ Monitor the updates and adjustments of the traffic auditing system in real time.

[0114] ○ Adjust the camouflage strategy based on the monitoring results.

[0115] For example:

[0116] ■ If the traffic auditing system updates the packet size detection rules, then adjust the packet size spoofing strategy;

[0117] ■ If the traffic auditing system updates the detection rules for protocol types, then adjust the spoofing strategy for protocol types.

[0118] 4. Traffic Injection:

[0119] ○ Capture normal traffic data and inject the spoofed traffic into the normal traffic.

[0120] ○ Send traffic injected with spoofed traffic to the target network.

[0121] 5. Result Verification:

[0122] ○ Use the traffic auditing system simulation module to verify the effectiveness of detecting spoofed traffic.

[0123] ○ If the traffic auditing system cannot detect the disguised traffic, the optimization fails, and you should return to step 2 to continue adjusting the disguise strategy; otherwise, the optimization succeeds.

[0124] 3. Specific examples

[0125] Assuming the target traffic auditing system detects anomalies in packet size and protocol type, this embodiment can optimize the auditing effect through the following steps:

[0126] 1. Traffic characteristic analysis:

[0127] ○ Analyze the detection rules of the traffic auditing system to determine the size and protocol type of the data packets that need to be disguised.

[0128] For example, traffic auditing systems detect abnormal traffic if the packet size exceeds 1500 bytes or the protocol type is not HTTP / HTTPS.

[0129] 2. Traffic spoofing:

[0130] ○ Packet size spoofing: Split large packets (e.g., 2000 bytes) into two smaller packets (e.g., 1000 bytes and 1000 bytes) to make them conform to the packet size distribution of normal traffic.

[0131] ○ Protocol type spoofing: Disguise the protocol type of the attack traffic (such as a custom protocol) as common HTTP or HTTPS traffic.

[0132] ○ Traffic pattern spoofing: Adjusting sudden traffic surges to stable traffic patterns to match those of normal traffic.

[0133] 3. Dynamic adaptation:

[0134] ○ Monitor the updates and adjustments of the traffic auditing system in real time.

[0135] For example, if the traffic auditing system updates its packet size detection rules, adjusting the maximum packet size limit from 1500 bytes to 1400 bytes, then the packet size masquerading strategy will be adjusted to split large packets into smaller packets (such as 700 bytes and 700 bytes).

[0136] 4. Traffic Injection:

[0137] ○ Capture normal traffic data and inject the spoofed traffic into the normal traffic.

[0138] ○ Send traffic injected with spoofed traffic to the target network.

[0139] 5. Result Verification:

[0140] ○ Use the traffic auditing system's simulation module to detect spoofed traffic.

[0141] ○ The optimization failed if the traffic auditing system could not detect the disguised traffic; otherwise, the optimization was successful.

[0142] 4. Results Analysis

[0143] Through the above embodiments, the present invention demonstrates how to optimize a network traffic auditing system by comprehensively masquerading traffic characteristics.

[0144] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A network traffic auditing and defense optimization method based on traffic feature masquerading, characterized in that, Includes the following steps: Step 1. Initialization: Analyze the detection rules of the traffic auditing system to determine the traffic characteristics that need to be disguised, including the size of the data packets to be disguised, the protocol type, and the traffic pattern; determine the disguise strategy according to the traffic characteristics to be disguised; Step 2. Traffic masquerading: Disguise abnormal traffic according to the masquerading strategy; Step 3. Dynamic Adaptation: Monitor the updates and adjustments of the traffic auditing system in real time, and adjust the camouflage strategy based on the monitoring results; Step 4. Traffic Injection and Transmission: Capture normal traffic and inject the disguised traffic into the normal traffic; Send traffic that has been injected with spoofed traffic to the target network; Step 5. Optimize the traffic auditing system: Obtain the attack characteristics of abnormal traffic, add the attack characteristics to the training set, train the attack detection model of the network traffic auditing system, update the attack detection strategy of the network traffic auditing system, and optimize the network traffic auditing system. Step 3 specifically involves: if the traffic auditing system updates the packet size detection rules, then adjust the packet size spoofing strategy; if the traffic auditing system updates the protocol type detection rules, then adjust the protocol type spoofing strategy.

2. The method as described in claim 1, characterized in that, The spoofing methods in step 2 include packet size spoofing: Packet segmentation: dividing a large data packet into multiple smaller data packets, so that the segmented data packets conform to the data packet size distribution of normal traffic; Packet merging: Merging multiple small packets into one large packet, so that the merged packet conforms to the normal packet size distribution of traffic.

3. The method as described in claim 1, characterized in that, The spoofing methods in step 2 include protocol type spoofing: Protocol type modification: Disguise the protocol type of the attack traffic as HTTP or HTTPS traffic; Protocol header spoofing: Modifying the protocol header information of data packets to make it conform to the protocol header characteristics of normal traffic.

4. The method as described in claim 1, characterized in that, The spoofing methods in step 2 include traffic pattern spoofing: Traffic smoothing: By adjusting the data packet sending rate, burst traffic is transformed into stable traffic, making it conform to the traffic pattern of normal traffic. Traffic randomization: By randomizing the sending time of data packets, periodic traffic is adjusted to random traffic, making it conform to the traffic pattern of normal traffic.

5. The method as described in claim 1, characterized in that, The camouflage methods in step 2 include the following feature camouflage: Packet arrival time adjustment: By adjusting the packet sending interval, the arrival time of the packets is adjusted to conform to the arrival time distribution of normal traffic; Source IP address spoofing: Modify the source IP address of data packets to make them appear as normal traffic, changing the source IP address of attack traffic to an IP address within a preset range.

6. The method as described in claim 1, characterized in that, In step 5, if the traffic has one of the following attack characteristics, it is determined to be abnormal traffic: the packet size does not meet the preset conditions, the distribution dispersion does not meet the preset conditions, the packet header and payload consistency verification fails, or the traffic pattern does not meet the preset conditions.

7. The method as described in claim 1, characterized in that, Between steps 4 and 5, there is also a traffic detection step: triggering connection blocking, using a Hidden Markov Model (HMM) to identify abnormal traffic, if abnormal traffic is detected, proceeding to the next step, otherwise reacquiring traffic.

8. The method according to any one of claims 1 to 7, characterized in that, This method is applied in the field of network security technology.

Images