A wireless network-based encrypted traffic lightweight risk feature extraction method and device, a server, and a storage medium

Abstract

The present application relates to a kind of wireless network-based encrypted traffic lightweight risk feature extraction method, device, server and storage medium, the present application is by collecting the frame of data link layer in MESH network as analysis object, using clustering algorithm to the frame of data link layer in MESH network clustering, obtain multiple clusters after clustering, and by increasing ordinary traffic set and increasing the way of malicious traffic set Positioning and malicious traffic related cluster, and then obtain the risk feature of malicious traffic in data link layer, solve the extraction of risk feature in prior art depends on network layer and the problem that MESH network is not good at supporting network layer, reach the technical effect of extracting risk in MESH network, avoid malicious traffic to occupy bandwidth, improve user experience, reduce resource consumption, guarantee network security.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication network technology, and in particular to a method, device, server and storage medium for extracting lightweight risk features of encrypted traffic based on a wireless network. Background Art

[0002] With the development of wireless communication technology, wireless high-bandwidth, low-latency network access has become popular. At the same time, with the basic popularization of the Hypertext Transfer Protocol Security Protocol, encrypted traffic has become increasingly common on the Internet. The resulting continuous increase in the total amount of encrypted traffic has also brought new challenges in network traffic identification and security.

[0003] Encrypted traffic mainly refers to the actual plaintext content that has been encrypted and transmitted during the communication process. Due to the special nature of encrypted traffic, traditional traffic detection technology cannot achieve the purpose of detecting risky traffic. At present, research on malicious encrypted traffic detection mainly focuses on feature extraction and the selection of machine learning and deep learning algorithms. In the field of machine learning, feature engineering has always occupied a core position, and the quality of feature engineering determines the effectiveness of machine learning.

[0004] Most existing features include features in multiple dimensions, such as spatiotemporal features, background features, handshake features, and certificate features. Based on these four categories of features, they are further divided into multiple subcategories. However, these four categories of features and multiple subcategories are all features above the network layer, and risk features cannot be directly extracted. A classifier must first be used to classify encrypted traffic according to the four categories of features and subcategories, and then the corresponding risk features in different types of encrypted traffic must be matched to detect malicious encrypted traffic. The entire process consumes a lot of performance and causes network delays to a certain extent.

[0005] With the increasing demand for wireless networks, MESH networks are becoming increasingly popular. However, since MESH networks mainly work at the physical layer and data link layer, the main task of the network layer in the MESH network is to provide communication for different hosts on the network. It mainly implements routing control algorithms and selects appropriate transmission paths for different data packets. It does not have functions such as flow control and congestion control in the traditional network layer, nor can it realize risk feature extraction based on the network layer. Summary of the Invention

[0006] The present invention provides a lightweight risk feature extraction method, device, server and storage medium for encrypted traffic based on a wireless network. The method clusters frames at the data link layer in a MESH network using a clustering algorithm to obtain multiple clusters, and locates clusters related to malicious traffic by adding ordinary traffic sets and malicious traffic sets, thereby obtaining risk features of malicious traffic at the data link layer. This solves the problem in the prior art that the extraction of risk features depends on the network layer, and achieves the technical effect of extracting risk features in a MESH network.

[0007] The method for extracting lightweight risk features of encrypted traffic based on wireless networks proposed in the present invention includes the following steps:

[0008] The frames of the data link layer in the MESH network are collected as analysis objects, and a mixed traffic set containing malicious traffic and normal traffic, a normal traffic set containing only normal traffic, and a malicious traffic set containing only malicious traffic are obtained;

[0009] Using the mixed traffic set to perform cluster analysis to obtain a preset number of benchmark clustering results of clusters, using the mixed traffic set and the normal traffic set to perform cluster analysis to obtain a preset number of normal clustering results of clusters, and using the mixed traffic set and the malicious traffic set to perform cluster analysis to obtain a preset number of malicious clustering results of clusters;

[0010] Comparing the benchmark clustering result with the common clustering result, marking a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a common cluster, and comparing the benchmark clustering result with the malicious clustering result, marking a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a malicious cluster;

[0011] Only the clusters marked as malicious clusters are regarded as clusters related to malicious traffic, and features of the clusters related to malicious traffic are extracted as risk features.

[0012] Preferably, the step of collecting frames of the data link layer in the MESH network as analysis objects to obtain a mixed traffic set containing malicious traffic and ordinary traffic, an ordinary traffic set containing only ordinary traffic, and a malicious traffic set containing only malicious traffic specifically includes:

[0013] Build a MESH network and collect data link layer frames in the MESH network at the MESH sub-router as analysis objects;

[0014] Deploy known malware on the terminal device connected to the MESH sub-router, execute corresponding attack actions, and use network security tools to generate malicious traffic, and use the collected analysis objects as the malicious traffic set;

[0015] Deploy commonly used software on the terminal device, execute user actions corresponding to the commonly used software, and use network security tools to generate malicious traffic, and use the collected analysis objects as the mixed traffic set;

[0016] Deploy commonly used software on the terminal device, execute user actions corresponding to the commonly used software, and use the collected analysis objects as the common traffic set.

[0017] Preferably, the step of building a MESH network and collecting frames of a data link layer in the MESH network as analysis objects at a MESH sub-route specifically includes:

[0018] Building the MESH network;

[0019] Applying co-frequency interference and inter-frequency interference to the MESH network and periodically adjusting the wireless power of the MESH sub-routers;

[0020] The data link layer frames in the MESH network are collected at the MESH sub-route as the analysis objects.

[0021] Preferably, the step of collecting frames of the data link layer in the MESH network as analysis objects at the MESH sub-route specifically includes:

[0022] Collecting frames of the data link layer in the MESH network at the MESH sub-route;

[0023] Use the frame length and the difference between the frame lengths of the preset number of frames before and after as the analysis content;

[0024] The collected frames are set as analysis objects.

[0025] Preferably, the step of treating only clusters marked as malicious clusters as clusters related to malicious traffic and extracting features of the clusters related to malicious traffic as risk features specifically includes:

[0026] The clusters marked only as malicious clusters are used as clusters related to malicious traffic, and one of the clusters related to the malicious traffic is selected as a target cluster;

[0027] The mixed traffic set, the malicious traffic set and the common traffic set are used as input data, and the target cluster is used as the output result to train a feature model of the target cluster using a large model;

[0028] The feature model output features of the target cluster are used as risk features.

[0029] Preferably, after the steps of comparing the benchmark clustering result with the common clustering result and marking a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a common cluster, and comparing the benchmark clustering result with the malicious clustering result and marking a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a malicious cluster, the step further includes:

[0030] The clusters marked only as malicious clusters are regarded as clusters related to malicious traffic, and clusters with a similar increase ratio in number among the clusters related to malicious traffic are selected as target clusters;

[0031] The mixed traffic set, the malicious traffic set and the common traffic set are used as input data, and the target cluster is used as the output result to train a feature model of the target cluster using a large model;

[0032] The feature model output features of the target cluster are used as risk features.

[0033] The present invention also proposes a device for extracting lightweight risk features of encrypted traffic based on a wireless network, the device comprising:

[0034] The collection unit is used to collect frames of the data link layer in the MESH network as analysis objects, and obtain a mixed traffic set containing malicious traffic and ordinary traffic, an ordinary traffic set containing only ordinary traffic, and a malicious traffic set containing only malicious traffic;

[0035] a clustering unit, configured to perform cluster analysis using the mixed traffic set to obtain a preset number of baseline clustering results of clusters, perform cluster analysis using the mixed traffic set and the normal traffic set to obtain a preset number of normal clustering results of clusters, and perform cluster analysis using the mixed traffic set and the malicious traffic set to obtain a preset number of malicious clustering results of clusters;

[0036] a comparing unit, configured to compare the benchmark clustering result with the common clustering result, mark a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a common cluster, and compare the benchmark clustering result with the malicious clustering result, mark a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a malicious cluster;

[0037] The extraction unit is configured to take only the clusters marked as malicious clusters as clusters related to malicious traffic, and extract features of the clusters related to malicious traffic as risk features.

[0038] The present invention also proposes a server, which includes: a memory, a processor, and a lightweight risk feature extraction program for encrypted traffic based on a wireless network stored on the memory and capable of running on the processor. When the lightweight risk feature extraction program for encrypted traffic based on a wireless network is executed by the processor, the lightweight risk feature extraction method for encrypted traffic based on a wireless network as described above is implemented.

[0039] The present invention also proposes a readable storage medium, which stores a lightweight risk feature extraction program for encrypted traffic based on a wireless network. When the lightweight risk feature extraction program for encrypted traffic based on a wireless network is executed by a processor, it implements the above-mentioned lightweight risk feature extraction method for encrypted traffic based on a wireless network.

[0040] The present invention collects frames of the data link layer in the MESH network as analysis objects, uses a clustering algorithm to cluster the frames of the data link layer in the MESH network, obtains multiple clusters after clustering, and locates clusters related to malicious traffic by adding ordinary traffic sets and malicious traffic sets, thereby obtaining risk characteristics of malicious traffic at the data link layer. This solves the problem in the prior art that the extraction of risk characteristics depends on the network layer while the MESH network has poor support for the network layer, achieves the technical effect of extracting risks in the MESH network, avoids malicious traffic from occupying bandwidth, improves user experience, reduces resource consumption, and ensures network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a structural diagram of the hardware operating environment involved in an embodiment of the method for extracting lightweight risk features of encrypted traffic based on a wireless network of the present invention;

[0042] Figure 2 This is a flow chart of another embodiment of a method for extracting lightweight risk features of encrypted traffic based on a wireless network according to the present invention;

[0043] Figure 3 This is a flow chart of an embodiment of MESH network construction in the method for extracting lightweight risk features of encrypted traffic based on wireless networks of the present invention;

[0044] Figure 4 This is a schematic diagram of an embodiment of a lightweight risk feature extraction device for encrypted traffic based on a wireless network according to the present invention;

[0045] Figure 5 Schematic diagram of the server structure in an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The principles and features of the present invention are described below in conjunction with specific embodiments. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0047] Reference Figure 1 The method for extracting lightweight risk features of encrypted traffic based on wireless networks includes the following steps:

[0048] S100, collecting frames of the data link layer in the MESH network as analysis objects, obtaining a mixed traffic set containing malicious traffic and normal traffic, a normal traffic set containing only normal traffic, and a malicious traffic set containing only malicious traffic;

[0049] It is easy to understand that in the experimental environment, the daily work traffic of the R&D team can be collected in the MESH network as ordinary traffic, malicious traffic can be generated through third-party software and known malicious programs, and mixed traffic can be achieved by actively generating malicious traffic while doing daily work. However, in the feasibility judgment stage, scripts and software are used to generate ordinary traffic and malicious traffic.

[0050] S200, using the mixed traffic set to perform cluster analysis to obtain a preset number of benchmark clustering results of clusters, using the mixed traffic set and the normal traffic set to perform cluster analysis to obtain a preset number of normal clustering results of clusters, and using the mixed traffic set and the malicious traffic set to perform cluster analysis to obtain a preset number of malicious clustering results of clusters;

[0051] It should be noted that, in this embodiment, the preset number of clusters is set by observing the quantity trend of effective malicious clustering results after multiple experiments with different values.

[0052] S300, comparing the benchmark clustering result with the common clustering result, marking a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a common cluster, and comparing the benchmark clustering result with the malicious clustering result, marking a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a malicious cluster;

[0053] It is worth emphasizing that in the actual working process, ordinary traffic or malicious traffic will be added to the clustering results of the mixed traffic set, and then the malicious clusters will be marked by weight. For example, when ordinary traffic is added, the cluster whose number of frames increases by a ratio exceeding the total number of frames will be considered to have more ordinary traffic assigned to it, and the weight of the cluster marked as a malicious cluster will be reduced according to the excess ratio. When malicious traffic is added, the cluster whose number of frames increases by a ratio exceeding the total number of frames will be considered to have more malicious traffic assigned to it, and the weight of the cluster marked as a malicious cluster will be increased according to the excess ratio.

[0054] S400: taking only the clusters marked as malicious clusters as clusters related to malicious traffic, and extracting features of the clusters related to malicious traffic as risk features.

[0055] It should be noted that some clusters increase in both the malicious traffic set and the normal traffic set, and the increase ratio is similar. In this case, the cluster is marked as both a normal cluster and a malicious cluster. It is considered that the cluster cannot distinguish between normal traffic and malicious traffic, and the characteristics of the cluster cannot be used as risk characteristics.

[0056] This embodiment collects frames of the data link layer in the MESH network as analysis objects, uses a clustering algorithm to cluster the frames of the data link layer in the MESH network, obtains multiple clusters after clustering, and locates clusters related to malicious traffic by adding ordinary traffic sets and malicious traffic sets, thereby obtaining risk characteristics of malicious traffic at the data link layer. This solves the problem in the prior art that the extraction of risk characteristics depends on the network layer and the MESH network has poor support for the network layer, achieves the technical effect of extracting risks in the MESH network, avoids malicious traffic from occupying bandwidth, improves user experience, reduces resource consumption, and ensures network security.

[0057] Reference Figure 2 According to the classification result, the steps of collecting frames of the data link layer in the MESH network as analysis objects and obtaining a mixed traffic set containing malicious traffic and normal traffic, a normal traffic set containing only normal traffic, and a malicious traffic set containing only malicious traffic specifically include:

[0058] S110, build a MESH network, and collect data link layer frames in the MESH network at the MESH sub-router as analysis objects;

[0059] It is easy to understand that since the MESH network built by finished routers is not very conducive to collecting data link layer frames, this application uses soft routers with APs to collect data link layer frames.

[0060] S120: Deploy known malware on a terminal device connected to the MESH sub-router, execute corresponding attack actions, and use network security tools to generate malicious traffic, and use the collected analysis objects as the malicious traffic set;

[0061] It should be noted that this embodiment only runs one type of malware at the same time, but the malicious traffic generated by the network security tool is not limited.

[0062] S130: Deploy common software on the terminal device, execute user actions corresponding to the common software, and use network security tools to generate malicious traffic, and use the collected analysis objects as the mixed traffic set;

[0063] It is worth emphasizing that since most of the basic data is generated by scripts and software, the extracted risk features can only identify about 30% of malicious traffic. After collecting and retraining the company's employees' daily traffic, the recognition of malicious traffic has increased by an average of 7%. By further optimizing the source of the analysis object, the extraction effect of risk features can be further improved.

[0064] S140 deploys common software on the terminal device, executes user actions corresponding to the common software, and uses the collected analysis objects as the common traffic set.

[0065] It should be noted that after the initial verification phase, the collection of common traffic sets can be directly obtained through users and company employees. After experiments, real samples can improve the results of cluster analysis to a certain extent.

[0066] This embodiment improves the technical solution by disclosing the sources of normal traffic and malicious traffic. After optimizing the sources of normal traffic and malicious traffic, the risk feature extraction effect of this embodiment can be further improved.

[0067] Reference Figure 3 , Figure 3 This is a flow chart of MESH network construction in the lightweight risk feature extraction method for encrypted traffic based on wireless network of the present invention, and its construction steps specifically include:

[0068] S111, building the MESH network;

[0069] It is worth emphasizing that the MESH network built in this embodiment does not adopt the MESH network of finished routers, but the existing MESH networks built by various brands do not affect the data interaction at the data link layer. Therefore, the MESH network built in this embodiment has strong availability and does not require separate customized solutions for all brands of routers.

[0070] S112: Apply co-frequency interference and inter-frequency interference to the MESH network, and periodically adjust the wireless power of the MESH sub-routers;

[0071] It is easy to understand that the purpose of increasing interference is to simulate a real signal environment, and the purpose of periodically adjusting the wireless power of the MESH sub-route is to simulate an environment with good and poor signals, artificially creating an environment with asymmetric bandwidth, asymmetric packet loss rate and asymmetric routing, and ensuring the availability of the technical solution of this embodiment in the user environment.

[0072] S113 , collecting frames of the data link layer in the MESH network at the MESH sub-route as analysis objects.

[0073] It is worth emphasizing that since the MESH main route can usually be analyzed at the network layer, and malicious traffic has occupied the bandwidth between the sub-route and the main route after reaching the main route, in order to ensure user experience and utilize the idle performance of the upper sub-route, this application collects the data link layer frames in the MESH network at the MESH sub-route as analysis objects.

[0074] Specifically, the steps of collecting frames of the data link layer in the MESH network as analysis objects at the MESH sub-route include:

[0075] Collecting frames of the data link layer in the MESH network at the MESH sub-route;

[0076] Use the frame length and the difference between the frame lengths of the preset number of frames before and after as the analysis content;

[0077] It is worth noting that since a single frame has only one parameter, frame length, and different network services are reflected in the data link layer frames more through the change trends and frame length differences between multiple frames, this embodiment uses the frame length difference between a single frame and a preset number of frames as the information contained in a single frame.

[0078] The collected frames are set as analysis objects.

[0079] It is easy to understand that, through observation of frame length statistics under different services, this embodiment sets the preset number to a value greater than 12.

[0080] This embodiment improves the technical solution by disclosing the details of the MESH network, and further improves the accuracy of the cluster analysis results and the effectiveness of the extracted risk features by disclosing the specific information contained in the analysis object, namely the frame length and frame length difference.

[0081] Specifically, the step of treating only the clusters marked as malicious clusters as clusters related to malicious traffic and extracting features of the clusters related to malicious traffic as risk features specifically includes:

[0082] The clusters marked only as malicious clusters are used as clusters related to malicious traffic, and one of the clusters related to the malicious traffic is selected as a target cluster;

[0083] It is worth noting that the cluster selected in this embodiment is the cluster with the smallest difference between the benchmark clustering result and the ordinary clustering result and a large difference between the benchmark clustering result and the malicious clustering result.

[0084] The mixed traffic set, the malicious traffic set and the common traffic set are used as input data, and the target cluster is used as the output result to train a feature model of the target cluster using a large model;

[0085] It is easy to understand that since the characteristics of the cluster geometric center are usually difficult to express through mathematical formulas, this embodiment uses a feature model trained with a large model instead of a mathematical formula to express it.

[0086] The feature model output features of the target cluster are used as risk features.

[0087] Specifically, after the step of comparing the benchmark clustering result with the common clustering result and marking a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a common cluster, and comparing the benchmark clustering result with the malicious clustering result and marking a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a malicious cluster, the method further includes:

[0088] The clusters marked only as malicious clusters are regarded as clusters related to malicious traffic, and clusters with a similar increase ratio in number among the clusters related to malicious traffic are selected as target clusters;

[0089] The mixed traffic set, the malicious traffic set and the common traffic set are used as input data, and the target cluster is used as the output result to train a feature model of the target cluster using a large model;

[0090] It should be noted that some malicious traffic is generated by the same network action. Therefore, when the number of malicious traffic-related clusters increases at a similar rate, it can be considered that these malicious traffic are generated by the same network action. Combining them for analysis can improve the accuracy of the features.

[0091] The feature model output features of the target cluster are used as risk features.

[0092] This embodiment improves the technical solution by disclosing the process of extracting malicious traffic-related clusters into risk features, and further improves the accuracy of feature extraction by merging clusters with similar growth rates in the number of malicious traffic-related clusters.

[0093] Reference Figure 4 , Figure 4 : This is a schematic diagram of an embodiment of a device for extracting lightweight risk features of encrypted traffic based on a wireless network according to the present invention. The device for extracting lightweight risk features of encrypted traffic based on a wireless network according to the present invention comprises:

[0094] The collection unit is used to collect frames of the data link layer in the MESH network as analysis objects, and obtain a mixed traffic set containing malicious traffic and ordinary traffic, an ordinary traffic set containing only ordinary traffic, and a malicious traffic set containing only malicious traffic;

[0095] a clustering unit, configured to perform cluster analysis using the mixed traffic set to obtain a preset number of baseline clustering results of clusters, perform cluster analysis using the mixed traffic set and the normal traffic set to obtain a preset number of normal clustering results of clusters, and perform cluster analysis using the mixed traffic set and the malicious traffic set to obtain a preset number of malicious clustering results of clusters;

[0096] a comparing unit, configured to compare the benchmark clustering result with the common clustering result, mark a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a common cluster, and compare the benchmark clustering result with the malicious clustering result, mark a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a malicious cluster;

[0097] The extraction unit is configured to take only the clusters marked as malicious clusters as clusters related to malicious traffic, and extract features of the clusters related to malicious traffic as risk features.

[0098] The encrypted traffic lightweight risk feature extraction device based on wireless network provided by an embodiment of the present invention can execute the encrypted traffic lightweight risk feature extraction method based on wireless network provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method, which will not be repeated here one by one.

[0099] like Figure 5 As shown, Figure 5 FIG. 1 is a schematic diagram of a server structure of another embodiment. The server includes a processor 70, a memory 71, an input device 72, and an output device 73. The number of processors 70 in the server can be one or more. Figure 5 In the example, a processor 70 is used; the processor 70, memory 71, input device 72 and output device 73 in the server can be connected by a bus or other means. Figure 5 The bus connection is taken as an example.

[0100] Memory 71, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as the program instructions corresponding to the method for calculating the incremental power generation of a photovoltaic power station in the embodiments of the present invention. Processor 70 executes the software programs, instructions, and modules stored in memory 71 to execute various server functions and data processing, thereby implementing the aforementioned method for calculating the incremental power generation of a photovoltaic power station.

[0101] The memory 71 may primarily include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function; the data storage area may store data generated based on the use of the terminal. Furthermore, the memory 71 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state memory device. In some instances, the memory 71 may further include memory remotely located relative to the processor 70, and these remote memories may be connected to a server via a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0102] The input device 72 may be used to receive input digital or character information and generate key signal input related to the user settings and function control of the server. The output device 73 may include a display screen or other display server.

[0103] An embodiment of the present invention further provides a storage medium containing computer-executable instructions, which, when executed by a computer processor, is used to perform a method for extracting lightweight risk features of encrypted traffic based on a wireless network, the method comprising:

[0104] The frames of the data link layer in the MESH network are collected as analysis objects, and a mixed traffic set containing malicious traffic and normal traffic, a normal traffic set containing only normal traffic, and a malicious traffic set containing only malicious traffic are obtained;

[0105] Using the mixed traffic set to perform cluster analysis to obtain a preset number of benchmark clustering results of clusters, using the mixed traffic set and the normal traffic set to perform cluster analysis to obtain a preset number of normal clustering results of clusters, and using the mixed traffic set and the malicious traffic set to perform cluster analysis to obtain a preset number of malicious clustering results of clusters;

[0106] Comparing the benchmark clustering result with the common clustering result, marking a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a common cluster, and comparing the benchmark clustering result with the malicious clustering result, marking a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a malicious cluster;

[0107] Only the clusters marked as malicious clusters are regarded as clusters related to malicious traffic, and features of the clusters related to malicious traffic are extracted as risk features.

[0108] Specifically, the steps of collecting frames of the data link layer in the MESH network as analysis objects and obtaining a mixed traffic set containing malicious traffic and ordinary traffic, an ordinary traffic set containing only ordinary traffic, and a malicious traffic set containing only malicious traffic specifically include:

[0109] Build a MESH network and collect data link layer frames in the MESH network at the MESH sub-router as analysis objects;

[0110] Deploy known malware on the terminal device connected to the MESH sub-router, execute corresponding attack actions, and use network security tools to generate malicious traffic, and use the collected analysis objects as the malicious traffic set;

[0111] Deploy commonly used software on the terminal device, execute user actions corresponding to the commonly used software, and use network security tools to generate malicious traffic, and use the collected analysis objects as the mixed traffic set;

[0112] Deploy commonly used software on the terminal device, execute user actions corresponding to the commonly used software, and use the collected analysis objects as the common traffic set.

[0113] Specifically, the steps of building a MESH network and collecting frames of a data link layer in the MESH network as analysis objects at a MESH sub-route include:

[0114] Building the MESH network;

[0115] Applying co-frequency interference and inter-frequency interference to the MESH network and periodically adjusting the wireless power of the MESH sub-routers;

[0116] The data link layer frames in the MESH network are collected at the MESH sub-route as the analysis objects.

[0117] Specifically, the steps of collecting frames of the data link layer in the MESH network as analysis objects at the MESH sub-route include:

[0118] Collecting frames of the data link layer in the MESH network at the MESH sub-route;

[0119] Use the frame length and the difference between the frame lengths of the preset number of frames before and after as the analysis content;

[0120] The collected frames are set as analysis objects.

[0121] Specifically, the step of treating only the clusters marked as malicious clusters as clusters related to malicious traffic and extracting features of the clusters related to malicious traffic as risk features specifically includes:

[0122] The clusters marked only as malicious clusters are used as clusters related to malicious traffic, and one of the clusters related to the malicious traffic is selected as a target cluster;

[0123] The mixed traffic set, the malicious traffic set and the common traffic set are used as input data, and the target cluster is used as the output result to train a feature model of the target cluster using a large model;

[0124] The feature model output features of the target cluster are used as risk features.

[0125] Specifically, after the step of comparing the benchmark clustering result with the common clustering result and marking a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a common cluster, and comparing the benchmark clustering result with the malicious clustering result and marking a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a malicious cluster, the method further includes:

[0126] The clusters marked only as malicious clusters are regarded as clusters related to malicious traffic, and clusters with a similar increase ratio in number among the clusters related to malicious traffic are selected as target clusters;

[0127] The mixed traffic set, the malicious traffic set and the common traffic set are used as input data, and the target cluster is used as the output result to train a feature model of the target cluster using a large model;

[0128] The feature model output features of the target cluster are used as risk features.

[0129] Of course, the storage medium containing computer-executable instructions provided in an embodiment of the present invention is not limited to the method operations described above, but can also execute relevant operations in the lightweight risk feature extraction method for encrypted traffic based on wireless networks provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method, which will not be repeated here.

[0130] Through the above description of the embodiments, those skilled in the art will clearly understand that the present invention can be implemented using software and necessary general-purpose hardware. Of course, it can also be implemented using hardware, but in many cases the former is a more preferred embodiment. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk, or optical disk, and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments of the present invention.

[0131] It is worth noting that in the embodiment of the above-mentioned search device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0132] Note that the above are only preferred embodiments of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments, and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments and may include many other equivalent embodiments without departing from the concept of the present invention. The scope of the present invention is determined by the scope of the appended claims.

Claims

1. A lightweight risk feature extraction method for encrypted traffic based on wireless networks, characterized in that: Specifically include: The frames of the data link layer in the MESH network are collected as analysis objects, and a mixed traffic set containing malicious traffic and normal traffic, a normal traffic set containing only normal traffic, and a malicious traffic set containing only malicious traffic are obtained; Using the mixed traffic set to perform cluster analysis to obtain a preset number of benchmark clustering results of clusters, using the mixed traffic set and the normal traffic set to perform cluster analysis to obtain a preset number of normal clustering results of clusters, and using the mixed traffic set and the malicious traffic set to perform cluster analysis to obtain a preset number of malicious clustering results of clusters; Comparing the benchmark clustering result with the common clustering result, marking a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a common cluster, and comparing the benchmark clustering result with the malicious clustering result, marking a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a malicious cluster; The clusters marked only as malicious clusters are regarded as clusters related to malicious traffic, and clusters with a similar increase ratio in number among the clusters related to the malicious traffic are selected as first target clusters. The mixed traffic set, the malicious traffic set, and the common traffic set are used as input data, and the first target cluster is used as the output result to train a feature model of the first target cluster using a large model. The features output by the feature model of the first target cluster are used as risk features. And / or the cluster marked only as a malicious cluster is regarded as a cluster related to malicious traffic, and one of the clusters related to the malicious traffic is selected as the second target cluster, the mixed traffic set, the malicious traffic set and the ordinary traffic set are used as input data, the second target cluster is used as the output result to train a large model to obtain a feature model of the second target cluster, and the feature model output features of the second target cluster are used as risk features.

2. The method for extracting lightweight risk features of encrypted traffic based on wireless networks according to claim 1 is characterized in that: The steps of collecting frames of the data link layer in the MESH network as analysis objects and obtaining a mixed traffic set containing malicious traffic and ordinary traffic, an ordinary traffic set containing only ordinary traffic, and a malicious traffic set containing only malicious traffic specifically include: Build a MESH network and collect data link layer frames in the MESH network at the MESH sub-router as analysis objects; Deploy known malware on the terminal device connected to the MESH sub-router, execute corresponding attack actions, and use network security tools to generate malicious traffic, and use the collected analysis objects as the malicious traffic set; Deploying common software on the terminal device, executing user actions corresponding to the common software, and using network security tools to generate malicious traffic, and using the collected analysis objects as the mixed traffic set; Deploy commonly used software on the terminal device, execute user actions corresponding to the commonly used software, and use the collected analysis objects as the common traffic set.

3. The method for extracting lightweight risk features of encrypted traffic based on wireless networks according to claim 2 is characterized in that: The steps of building a MESH network and collecting frames of a data link layer in the MESH network as analysis objects at a MESH sub-route specifically include: Building the MESH network; Applying co-frequency interference and inter-frequency interference to the MESH network and periodically adjusting the wireless power of the MESH sub-routers; The data link layer frames in the MESH network are collected at the MESH sub-route as the analysis objects.

4. The method for extracting lightweight risk features of encrypted traffic based on wireless networks according to claim 3 is characterized in that: The steps of collecting data link layer frames in the MESH network as analysis objects at the MESH sub-router include: Collecting frames of the data link layer in the MESH network at the MESH sub-route; Use the frame length and the difference between the frame lengths of the preset number of frames before and after as the analysis content; The collected frames are set as analysis objects.

5. A lightweight risk feature extraction device for encrypted traffic based on wireless network, characterized in that: The encrypted traffic lightweight risk feature extraction device based on a wireless network includes: The collection unit is used to collect frames of the data link layer in the MESH network as analysis objects, and obtain a mixed traffic set containing malicious traffic and ordinary traffic, an ordinary traffic set containing only ordinary traffic, and a malicious traffic set containing only malicious traffic; a clustering unit, configured to perform cluster analysis using the mixed traffic set to obtain a preset number of baseline clustering results of clusters, perform cluster analysis using the mixed traffic set and the normal traffic set to obtain a preset number of normal clustering results of clusters, and perform cluster analysis using the mixed traffic set and the malicious traffic set to obtain a preset number of malicious clustering results of clusters; a comparing unit, configured to compare the benchmark clustering result with the common clustering result, mark a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a common cluster, and compare the benchmark clustering result with the malicious clustering result, mark a cluster whose number of analysis objects increases by a ratio exceeding a preset threshold as a malicious cluster; An extraction unit is used to treat clusters that are only marked as malicious clusters as clusters related to malicious traffic, and select clusters with a similar increase rate in the number of clusters related to the malicious traffic as first target clusters, use the mixed traffic set, the malicious traffic set and the ordinary traffic set as input data, and use the first target cluster as the output result to train using a large model to obtain a feature model of the first target cluster, and use the feature model of the first target cluster to output features as risk features; and / or treat the clusters that are only marked as malicious clusters as clusters related to malicious traffic, and select one cluster in the clusters related to the malicious traffic as a second target cluster, use the mixed traffic set, the malicious traffic set and the ordinary traffic set as input data, and use the second target cluster as the output result to train using a large model to obtain a feature model of the second target cluster, and use the feature model of the second target cluster to output features as risk features.

6. A server, characterized in that: The server includes: a memory, a processor, and a wireless network-based encrypted traffic lightweight risk feature extraction program stored in the memory and running on the processor. When the wireless network-based encrypted traffic lightweight risk feature extraction program is executed by the processor, it implements the wireless network-based encrypted traffic lightweight risk feature extraction method as described in any one of claims 1 to 4.

7. A readable storage medium, characterized in that: The readable storage medium stores a wireless network-based encrypted traffic lightweight risk feature extraction program, and when the wireless network-based encrypted traffic lightweight risk feature extraction program is executed by the processor, it implements the wireless network-based encrypted traffic lightweight risk feature extraction method according to any one of claims 1 to 4.

Images