A covert channel communication traffic identification method

Abstract

The application provides a hidden channel communication flow recognition method, which comprises the following steps: obtaining a hidden communication flow sample set; extracting data features and converting the data features to obtain data feature values, and performing vectorization processing on the data feature values to obtain a feature vector representation; extracting time sequence features of the hidden communication flow sample set to recognize interactive mode features of the hidden communication flow sample set, and fusing the interactive mode features to generate a context feature vector; splicing the context feature vector and the feature vector representation to obtain an enhanced feature vector; assigning a label according to a communication behavior type of the hidden communication flow to obtain a conditional label; constructing a multi-head generator and a multi-head discriminator; training the generator and the discriminator according to a set loss function to obtain a trained generator and a trained discriminator; and setting a dynamic weight adjustment mechanism, and using the discriminator to determine whether to-be-recognized flow data is real hidden communication flow. The method has obvious advantages in improving the diversity, accuracy and calculation efficiency of hidden communication flow detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a covert channel communication flow identification method. BACKGROUND

[0002] With the rapid development of network communication and information technology, the Internet has become the core infrastructure for information dissemination and data transmission. However, this also provides a way for network attackers to hide communication, especially through the use of legal protocols for illegal data transmission of covert channel communication. Covert channel communication is a means of unauthorized data transmission using legal network protocols (such as DNS, HTTP, etc.), and attackers hide from traditional network security monitoring tools by disguising as legitimate traffic, causing significant security risks.

[0003] Currently, there have been research and technology attempts to generate realistic false covert communication flows based on generative adversarial networks (GANs, Generative Adversarial Networks) to assist the discriminator in distinguishing between real traffic and disguised traffic. However, the existing implementation scheme has many problems and limitations, which are specifically manifested in the following aspects:

[0004] Although the existing cGANs model generates different types of covert communication flows by introducing a conditional variable, the diversity of the generated samples is still insufficient. Due to the high complexity of network communication flow content, the existing model cannot fully capture the features in network communication flow, so the samples generated by the generator often only conform to the surface features of the covert communication mode, lacking the fine-grained time sequence dependence in real traffic, which results in weak generation ability of the generator and inability to fully simulate real covert communication flow patterns.

[0005] Most existing discriminators use simple binary classification networks to determine the authenticity of samples and simultaneously classify the types of covert communication. However, the discriminator cannot fully distinguish the features of different types of covert traffic when dealing with multiple types of covert communication, resulting in insufficient generalization ability when facing multiple task discrimination. Especially when facing complex covert communication flows, the classification performance decreases significantly.

[0006] In the existing technology, the generator and the discriminator cannot dynamically adjust the weights according to the complexity of the current task when dealing with different tasks, resulting in unstable training, especially in the case of multiple types of covert communication coexisting, the model converges slowly and easily falls into local optimum.

[0007] Therefore, it is necessary to provide a covert channel communication flow identification method that has strong adaptability to multiple covert communication modes and high robustness and training stability. SUMMARY

[0008] The application aims to provide a covert channel communication flow recognition method to solve the problem that the covert channel communication behavior under the conventional protocol is difficult to effectively recognize.

[0009] In the first aspect, the application provides a covert channel communication flow recognition method, which comprises the following steps:

[0010] Data features of network flow in the covert communication flow sample set are extracted and data standardization transformation is performed to obtain data feature values, vectorization processing is performed on the data feature values to obtain a feature vector representation, time sequence features of the covert communication flow sample set are extracted, interaction mode features of the covert communication flow sample set are recognized, the time sequence features and the interaction mode features are fused to generate a context feature vector, and the context feature vector and the feature vector representation are spliced to obtain an enhanced feature vector.

[0011] According to the communication behavior type of the covert communication flow, a label is assigned to the communication flow in the covert communication flow sample set to obtain a conditional label.

[0012] A multi-head generator for generating a covert communication flow pseudo sample according to the enhanced feature vector, the conditional label and a randomly generated noise vector is constructed.

[0013] A multi-head discriminator is constructed, which adopts a multi-head discrimination structure and a self-attention mechanism, and is used for judging the authenticity of the covert communication flow and recognizing the covert communication type according to data features.

[0014] According to a set loss function, the multi-head generator and the multi-head discriminator are trained to obtain a trained generator and discriminator, a dynamic weight adjustment mechanism is set to adjust the task weight of the generator and the discriminator, the discriminator is used to determine whether the to-be-recognized flow data is real covert communication flow, and the flow data determined as covert communication flow is determined for the type of covert communication signal.

[0015] The method for identifying covert channel communication traffic provided by the application has the beneficial effects that: the learning strategy of multi-task conditional generative adversarial networks (MT-cGANs) is introduced, so that the discriminator can simultaneously learn on the classification task and the true-false judgment task, greatly improving the detection efficiency in the multi-task scene. The time sequence dependence relationship and interaction mode between network traffic data packets are analyzed and integrated as context features, improving the model's ability to capture the timing and context association features of covert communication. The design of the generator and the discriminator adopts a multi-head structure, improving the flexibility and robustness of the model, enabling it to exhibit better performance when facing various covert communication modes. The dynamic weight adjustment mechanism based on game equilibrium theory dynamically adjusts the weights of the generator and the discriminator in multi-task learning, improving the training efficiency and stability of the model. By designing a two-stage prediction output strategy, the computational burden of the model is optimized, and the classification efficiency is improved.

[0016] In a possible embodiment, the data feature values include traffic metadata feature values and protocol content feature values; the vectorization processing of the data feature values to obtain the feature vector representation includes: one-hot encoding the traffic metadata feature values to obtain the corresponding feature vectors, and bag-of-words model processing or word embedding processing the protocol content feature values to obtain the corresponding feature vectors.

[0017] In another possible embodiment, the covert communication traffic sample set includes T data packets, T is a positive integer, and the data features of the traffic in the covert communication traffic sample set include source IP and target IP; the time sequence features of the covert communication traffic sample set are extracted, the interaction mode features of the covert communication traffic sample set are identified, and the context feature vectors are generated by fusing the time sequence features and the interaction mode features, including: calculating the time interval between each data packet and the previous data packet as the time sequence feature; identifying the interaction mode between the source IP and the target IP, and constructing an interaction matrix as the interaction mode feature; and the context feature vectors generated by fusing the time sequence features and the interaction mode features satisfy the following formula, wherein, represents the context feature vector, represents the time sequence feature, represents the interaction mode feature, and f represents a feature fusion function.

[0018] In other possible embodiments, a multi-head generator for generating covert communication traffic pseudo samples according to the enhanced feature vectors, the condition labels, and randomly generated noise vectors is constructed, including:

[0019] The multi-head generator includes a plurality of generation heads;

[0020] The generation head receives a random noise vector and a conditional label, and generates a covert communication traffic pseudo sample based on the random noise vector and the conditional label in combination with the enhanced feature vector;

[0021] The output of each generation head satisfies wherein, represents a covert communication traffic pseudo sample, represents an applied random noise, represents a conditional label, represents a covert communication type, represents a generator parameter.

[0022] The multi-head generator and the multi-head discriminator constructed are trained according to a set loss function, including: the multi-head generator and the multi-head discriminator are trained with the minimum loss function as the target; the loss function of the multi-head generator satisfies: wherein, represents a loss function of the multi-head generator, represents an expectation calculation on a random variable, represents a random noise, represents a conditional label, represents a generator parameter, represents a discriminator parameter, represents a true or false judgment result of the discriminator on the generated sample given the conditional label y, The loss function of the multi-head discriminator satisfies: wherein, , , represents a loss function of the multi-head discriminator, represents a discrimination loss of a real sample, represents a discrimination loss of the discriminator on the generated sample, represents a real sample, represents a probability distribution of the real sample x, represents a true or false judgment result of the discriminator on the input sample x given the conditional label y.

[0023] A dynamic weight adjustment mechanism is set for adjusting the task weights of the generator and the discriminator, including: defining a total loss function of dynamic weight adjustment as: wherein, represents a total loss function of dynamic weight adjustment, represents a number of covert communication traffic types, represents a weight of the generator on the i-th task, represents a loss of the generator on the i-th task, represents a total loss of the generator, represents a total loss of the discriminator, denotes the loss of the discriminator on the i-th task, denotes the weight of the discriminator on the i-th task, denotes the loss of the discriminator on the i-th task; and and dynamically changes, specifically satisfies: , wherein, denotes the loss change rate of the generator in the current task, denotes the loss change rate of the discriminator in the current task, denotes the adjustment parameter, denotes a natural constant.

[0024] In a second aspect, the present application also provides a covert channel communication flow recognition device, comprising: a sample acquisition unit, configured to acquire a covert communication flow sample set;

[0025] a data processing unit, configured to extract data features of network flow in the covert communication flow sample set and perform data standardization conversion to obtain data feature values, perform vectorization processing on the data feature values to obtain a feature vector representation, extract time sequence features of the covert communication flow sample set, identify interaction mode features of the covert communication flow sample set, fuse the time sequence features and the interaction mode features to generate a context feature vector, and splice the context feature vector and the feature vector representation to obtain an enhanced feature vector;

[0026] a label assignment unit, configured to assign labels to communication flows in the covert communication flow sample set according to communication behavior types of the covert communication flows to obtain conditional labels;

[0027] a generator construction unit, configured to construct a multi-head generator for generating a covert communication flow pseudo sample according to the enhanced feature vector, the conditional labels, and a randomly generated noise vector;

[0028] a discriminator construction unit, configured to construct a multi-head discriminator, the multi-head discriminator adopting a multi-head discrimination structure and a self-attention mechanism, and being used for judging the authenticity of the covert communication flow and identifying the covert communication type according to data features;

[0029] a training and optimization unit, configured to train the constructed multi-head generator and multi-head discriminator according to a set loss function, obtain a trained generator and discriminator, set a dynamic weight adjustment mechanism for adjusting task weights of the generator and the discriminator, use the discriminator to determine whether to-be-recognized flow data is real covert communication flow, and determine the covert communication signal type for flow data determined as covert communication flow.

[0030] In a third aspect, the present application also provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the covert channel communication traffic identification method.

[0031] In a fourth aspect, the present application also provides an electronic device, comprising a processor and a memory, wherein the memory is configured to store a computer program, and the processor is configured to execute the computer program stored in the memory to enable the electronic device to perform the covert channel communication traffic identification method.

[0032] The beneficial effects of the second aspect to the fourth aspect can be referred to the description of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 A flowchart of a covert channel communication traffic identification method provided by an embodiment of the present application;

[0034] Figure 2 A flowchart of a covert channel communication traffic identification method provided by an embodiment of the present application;

[0035] Figure 3 A schematic diagram of a covert channel communication traffic identification device provided by an embodiment of the present application;

[0036] Figure 4 A schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to make the objectives, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application. Unless otherwise defined, the technical terms or scientific terms used herein should be understood as the common meanings by those skilled in the art. The words such as “comprise” and the like used herein mean that the elements or objects before the words encompass the elements or objects listed after the words and their equivalents, and do not exclude other elements or objects.

[0038] The present embodiment provides a covert channel communication traffic identification method. Referring to Figure 1 and Figure 2 , the method comprises:

[0039] S101: obtaining a covert communication traffic sample set.

[0040] The traffic data in the network includes normal network traffic and covert communication traffic, wherein the normal network traffic includes normal data packets of a conventional network protocol (such as DNS, HTTP, etc.); and the covert communication traffic includes various covert communication tunnel traffic (such as DNS tunnel, HTTP tunnel, etc.), which is similar to the normal traffic in surface features.

[0041] In a specific embodiment, the traffic samples in the covert communication traffic sample set obtained by the network traffic are composed of two data features: traffic metadata, such as source IP, target IP, packet size, timestamp, etc.; and protocol content features, such as DNS query field, HTTP request header, and other specific protocol field contents.

[0042] S102: Extracting data features of the network traffic in the covert communication traffic sample set and performing data standardization conversion to obtain data feature values, performing vectorization processing on the data feature values to obtain a feature vector representation, extracting time sequence features of the covert communication traffic sample set, identifying interaction mode features of the covert communication traffic sample set, fusing the time sequence features and the interaction mode features to generate a context feature vector, and splicing the context feature vector and the feature vector representation to obtain an enhanced feature vector.

[0043] In a possible embodiment, the data feature values include traffic metadata feature values and protocol content feature values; and the vectorization processing on the data feature values to obtain the feature vector representation includes: performing one-hot encoding on the traffic metadata feature values to obtain corresponding feature vectors, and performing bag-of-words model processing or word embedding processing on the protocol content feature values to obtain corresponding feature vectors.

[0044] In a possible embodiment, the covert communication traffic sample set includes T data packets, T is a positive integer, and the data features of the traffic in the covert communication traffic sample set include source IP and target IP; the extraction of the time sequence features of the covert communication traffic sample set, the identification of the interaction mode features of the covert communication traffic sample set, and the fusion of the time sequence features and the interaction mode features to generate the context feature vector include: calculating a time interval between each data packet and a previous data packet as the time sequence feature; identifying an interaction mode between the source IP and the target IP, and constructing an interaction matrix as the interaction mode feature; and the fusion of the time sequence features and the interaction mode features to generate the context feature vector satisfies the following formula, wherein, represents the context feature vector, represents the time sequence feature, represents the interaction mode feature, and f represents a feature fusion function.

[0045] In a specific embodiment, to eliminate the differences between different feature value ranges and prevent gradient vanishing or exploding during model training due to some feature values ​​being too large or too small, it is necessary to standardize the traffic data in the covert communication traffic sample set. Specifically, the standardization operation involves scaling each feature value to a standard normal distribution with a mean of 0 and a variance of 1. The specific operation is as follows: ,in, This represents the raw feature value obtained by extracting data features from network traffic. The mean of the feature. The standard deviation of a feature This represents the standardized feature value.

[0046] The data in the covert communication traffic sample set is transformed into numerical vectors to serve as input for subsequent steps. This includes network traffic metadata vectorization and protocol content feature vectorization. Network traffic metadata vectorization specifically involves one-hot encoding of categorical features such as source IP and destination IP, and converting timestamps into relative time intervals while maintaining continuous numerical values. Protocol content feature vectorization specifically involves processing textual features such as DNS query requests and HTTP request header fields using a bag-of-words model or word embedding, transforming them into fixed-length numerical vectors.

[0047] For example, the sample set of covert communication traffic captured within a preset time period includes T data packets, and the traffic sequence is represented as follows: Each data packet Includes the following features: Network traffic metadata: timestamps Protocol type Source IP Target IP Data packet size ...; Protocol content characteristics: DNS query fields HTTP request header fields ...

[0048] The above features are processed into data vectors to obtain numerical vectors. ,in, Indicates the first Numerical representation of each feature Indicates the number of features.

[0049] Calculate the time interval between each data packet and the previous data packet. This is then incorporated as part of the temporal characteristics. Interaction patterns between source and target IPs are identified, and an interaction matrix is ​​constructed. , record the number and mode of packet interaction between different IP pairs. The timing features and interaction mode features are fused to generate a context feature vector , which is specifically expressed as: , where f represents a feature fusion function. The context feature is spliced with the original feature to form an enhanced feature vector . .

[0050] Context reconstruction extracts and combines time interval, interaction mode and other features into original features by analyzing the dependency between each packet, to generate a context feature vector. The final enhanced feature vector extracts the timing dependency between packets, and performs sequence processing on the communication traffic, so that the enhanced feature vector not only contains detailed features of individual packets, but also incorporates timing dependency and interaction mode information in the traffic sequence, thereby providing more rich and semantic input data for subsequent generative adversarial network models.

[0051] S103: Label assignment is performed on the communication traffic in the covert communication traffic sample set according to the communication behavior type of the covert communication traffic, to obtain a conditional label.

[0052] In one possible embodiment, a unique label is assigned to each type of covert communication. For example, the label of normal traffic is , the label of DNS covert tunnel communication is , the label of HTTP covert tunnel communication is , and so on.

[0053] S104: A multi-head generator for generating covert communication traffic pseudo samples according to the enhanced feature vector, the conditional label and the randomly generated noise vector is constructed.

[0054] In one possible embodiment, the multi-head generator for generating covert communication traffic pseudo samples according to the enhanced feature vector, the conditional label and the randomly generated noise vector is constructed, including: the multi-head generator includes multiple generation heads; the generation head receives a random noise vector and a conditional label, and generates a covert communication traffic pseudo sample according to the random noise vector and the conditional label in combination with the enhanced feature vector; the output of each generation head satisfies , where represents a covert communication traffic pseudo sample, represents a random noise applied, represents a conditional label, Indicates the type of covert communication. Indicates the generator parameters.

[0055] In one specific embodiment, the generator's task is to receive a random noise vector. and conditional tags The algorithm combines enhanced feature vectors to generate fake samples with covert communication characteristics. The generator structure is a multi-head generator, with each generator head corresponding to a covert communication type.

[0056] The input to the multi-head generator includes random noise. and conditional tags ,in ( (This is the dimension of the noise vector). This is a one-hot vector, representing the type of covert communication.

[0057] A multi-head generator consists of multiple generator heads, each of which is dedicated to generating a specific type of covert communication traffic sample. ,in Indicates the type of covert communication. Indicates the generator parameters.

[0058] The output of the multi-head generator is the samples generated under given conditional labels: The generated sample contains features of covert communication and combines them with a feature vector of protocol context features. This generates more realistic fake samples.

[0059] S105: Construct a multi-head discriminator. The multi-head discriminator adopts a multi-head discrimination structure and a self-attention mechanism to determine the authenticity of covert communication traffic and identify the type of covert communication based on data characteristics.

[0060] In one specific embodiment, the discriminator's task is to determine the authenticity of input samples and classify their covert communication types. The discriminator employs a multi-head discrimination structure and a self-attention mechanism to enhance its ability to handle complex multi-task processing.

[0061] The input to the multi-head discriminator includes enhanced feature vector samples after standardization and protocol context feature fusion. and conditional tags , and the pseudo-samples of covert communication traffic generated by the generator.

[0062] The multi-head discriminator's output layer is designed with a dual, multi-task output structure, including a true / false determination node and a covert communication type classification node. The true / false determination node refers to the determination of the authenticity of the output sample. ,in Represents a real sample. represents the generated sample. The covert communication type classification node indicates the covert communication type to which the output sample belongs wherein represents the number of covert communication types.

[0063] The total output of the multi-head discriminator is: Through the multi-task output structure, the discriminator can simultaneously process the authenticity judgment and communication type classification tasks.

[0064] In one possible embodiment, the covert channel communication flow recognition of the present application is based on multi-task conditional generative adversarial networks (MT-cGANs) for recognition, and the model for performing covert channel communication flow recognition is composed of a generator and a discriminator.

[0065] S106: Train the multi-head generator and the multi-head discriminator constructed according to the set loss function to obtain the trained generator and discriminator, set a dynamic weight adjustment mechanism for adjusting the task weights of the generator and the discriminator, use the discriminator to determine whether the to-be-recognized flow data is real covert communication flow, and determine the covert communication signal type for the flow data determined as covert communication flow.

[0066] In one possible embodiment, the multi-head generator and the multi-head discriminator constructed according to the set loss function are trained, including: the multi-head generator and the multi-head discriminator are trained with the minimum loss function as the target; the loss function of the multi-head generator satisfies: wherein represents the loss function of the multi-head generator, represents the expectation calculation of a random variable, represents random noise, represents a conditional label, represents a generator parameter, represents a discriminator parameter, represents the true or false judgment result of the generated sample by the discriminator given the conditional label The loss function of the multi-head discriminator satisfies: wherein , , represents the loss function of the multi-head discriminator, represents the discrimination loss of the real sample, represents the discrimination loss of the generated sample by the discriminator, represents a real sample, i.e., data sampled from a real data distribution, represents the probability distribution of the real sample x, represents the true or false judgment result of the input sample x by the discriminator given the conditional label y.

[0067] In one possible embodiment, a dynamic weight adjustment mechanism is provided for adjusting the task weights of the generator and the discriminator, including: defining a total loss function for dynamic weight adjustment as: wherein, represents the total loss function for dynamic weight adjustment, represents the number of covert communication traffic types, represents the weight of the generator in the i-th task, represents the loss of the generator on the i-th task, represents the weight of the discriminator in the i-th task, represents the loss of the discriminator on the i-th task. and dynamically change, specifically satisfying: , wherein, represents the loss change rate of the generator in the current task, represents the loss change rate of the discriminator in the current task, represents an adjustment parameter, represents a natural constant. Exemplarily, the loss function of the multi-head generator aims to maximize its ability to deceive the discriminator, so that the discriminator is difficult to correctly distinguish the generated samples and the real samples under the given condition label . The goal of the multi-head generator is to make the output of the discriminator on the generated samples as close to the output on the real samples as possible, i.e., to determine that it is real. The formula of the multi-head generator loss function satisfies:

[0068] wherein, and are the parameters of the multi-head generator and the multi-head discriminator, respectively. represents the true or false judgment result of the multi-head discriminator on the generated samples under the given condition label . The goal of the multi-head discriminator is to distinguish real samples and generated samples, and at the same time, to classify the input samples according to the input condition y. The loss function of the discriminator includes two parts: one part is used to judge the authenticity of the input sample, and the other part is used for covert communication type classification. The loss function of the discriminator

[0069] includes two parts: one part is used to judge the authenticity of the input sample, and the other part is used for covert communication type classification.

[0070] ​​​Comprise two parts: the discriminant loss of real samples and the discriminant loss of generated samples. The loss function of the discriminant loss part of the real sample maximizes the correct classification probability of the discriminator to the real sample. The discriminator wants to correctly judge the real sample as true under the given condition Next, the loss function specifically satisfies the formula: .

[0071] The loss function of the discriminant loss part of the generated sample is used to maximize the correct judgment probability of the discriminator to the generated sample. The discriminator wants to identify the false sample generated by the generator and judge it as false.

[0072] The total loss function of the multi-head discriminator is the sum of the above two parts: The total loss function considers the true and false judgment of the real sample and the false identification of the generated sample, ensuring that the discriminator can continuously improve its ability to distinguish real and false samples in the adversarial training process.

[0073] Under the framework of multi-task learning, the generator and the discriminator undertake multiple different tasks: the generator not only needs to generate realistic covert communication traffic, but also needs to ensure the diversity of the generated samples in multiple different types of covert communication modes; The discriminator needs to perform true and false judgment and covert communication type classification tasks at the same time. In order to reasonably balance the loss functions of each task in the training process, the invention introduces a dynamic weight adjustment mechanism, which adjusts the task weight adaptively based on the complexity and loss state of the current task. The total loss function of dynamic weight adjustment is defined as: . Wherein: represents the number of covert communication traffic types, represents the weight of the generator in the th task to represent the importance of the generator in the task, represents the weight of the discriminator in the th task, and represent the loss of the generator and the discriminator in the th task, respectively.

[0074] The weights and dynamically change, automatically adjust according to the game equilibrium theory, so that the generator and the discriminator maintain dynamic balance between different tasks. The specific adjustment method satisfies: . Wherein, and represent the loss change rate of the generator and the discriminator in the current task, represents the adjustment parameter. This mechanism can ensure that different tasks will not be biased too much to a certain type of task in the training process, thereby ensuring the balance of multi-task learning.

[0075] The hidden communication traffic recognition model is optimized through the adversarial learning of the generator and the discriminator. The goal of the generator is to generate fake samples with hidden communication features, making it difficult for the discriminator to distinguish between true and false, while the discriminator is constantly learning to improve its ability to distinguish between real and generated samples. Through this adversarial training mechanism, a dynamic game is formed between the generator and the discriminator, so that the model is constantly optimized. By designing the specific loss function of the generator and the discriminator, and introducing a dynamic weight adjustment mechanism and a multi-task loss balancing strategy, the performance of the model is further improved.

[0076] After setting the dynamic weight adjustment mechanism of the generator and the discriminator for the training set, the discriminator can be used to distinguish the traffic data to be identified. In order to improve the classification efficiency and reduce the computational burden, the discriminator adopts a two-stage prediction output strategy for discrimination. The two-stage prediction output strategy is divided into two stages: the first stage: the discriminator judges the true and false of all input traffic, that is, it judges whether the input sample is real hidden communication traffic. At this time, it mainly depends on the true and false judgment node in the discriminator, and outputs a binary classification result. The second stage: only the samples judged as "suspicious" in the first stage are further classified by the hidden communication type. Based on the classification node of the discriminator, the specific hidden communication type of the input traffic sample is judged by multi-classification. This two-stage strategy can greatly reduce the amount of calculation, especially in the case of large amount of traffic samples, reducing the classification operation of normal traffic, significantly improving the classification efficiency.

[0077] The hidden channel communication traffic recognition method of the present application introduces the learning strategy of multi-task conditional generative adversarial network (MT-cGANs), so that the generator can generate false traffic samples that meet specific conditions under different hidden communication modes, and the discriminator can be optimized in true and false judgment and multi-task classification, thereby improving the generalization ability and adaptability of the model. In the generation process, condition labels are introduced, and the commonality and difference of hidden communication traffic are learned through shared features, ensuring the stability and robustness of the model when processing multiple hidden communication modes. This strategy allows the model to learn the features of multiple hidden communication traffic at the same time, and guides the generator to generate specific types of data through condition labels. Compared with the prior art, MT-cGANs through conditional generation and discrimination process, so that the discriminator can learn synchronously in classification task and true and false judgment task, greatly improving the detection efficiency in multi-task scene.

[0078] By analyzing the timing dependency and interaction patterns between network traffic data packets, a protocol context reconstruction mechanism is proposed, which integrates these information into context features, and uses them together with original packet features in the generation of the adversarial network, improving the model's ability to capture timing and context-related features of covert communication.

[0079] The design of the generator and discriminator adopts a multi-head structure, with the generator generating independent fake samples for each type of covert communication traffic, and the discriminator providing independent true-false judgment nodes and multi-classification nodes for each type of covert communication. This structure ensures that the generator and discriminator can be optimized and processed separately for different types of covert communication patterns. By introducing a multi-head structure, the invention greatly improves the flexibility and robustness of the model, enabling it to perform better when faced with multiple covert communication patterns.

[0080] The dynamic weight adjustment mechanism based on game equilibrium theory dynamically adjusts the weights of the generator and discriminator in multi-task learning, allowing the loss functions of different tasks to adaptively balance according to the current training situation, improving the training efficiency and stability of the model. This allows the model to more robustly learn and optimize in multiple covert communication traffic patterns.

[0081] By designing a two-stage prediction output strategy, the discriminator first determines the authenticity of the input traffic, and only suspicious samples are further classified by the type of covert communication. This design optimizes the computational burden of the model and improves classification efficiency. The phased processing greatly reduces the redundant classification calculation of normal traffic, improving the overall detection efficiency.

[0082] In summary, the invention has innovative designs in multiple key technical points, effectively improving the diversity, accuracy and computational efficiency of covert communication traffic detection, and providing a more robust and practical solution compared to existing technologies.

[0083] Referring to the drawings accompanying the Figure 3 The embodiment also provides a covert channel communication traffic recognition device, which is used to implement the method embodiment. The device comprises:

[0084] The sample acquisition unit 201 is configured to acquire a set of covert communication traffic samples.

[0085] The data processing unit 202 is used to extract data features of network traffic in the covert communication traffic sample set and perform data standardization transformation to obtain data feature values, perform vectorization processing on the data feature values ​​to obtain feature vector representation, extract the temporal features of the covert communication traffic sample set, identify the interaction mode features of the covert communication traffic sample set, fuse the temporal features and the interaction mode features to generate a context feature vector, and concatenate the context feature vector with the feature vector representation to obtain an enhanced feature vector.

[0086] The label allocation unit 203 is used to allocate conditional labels to the communication traffic in the covert communication traffic sample set according to the communication behavior type of the covert communication traffic.

[0087] Generator building unit 204 is used to build a multi-head generator that generates covert communication traffic pseudo samples based on enhanced feature vectors, conditional labels and randomly generated noise vectors.

[0088] The discriminator construction unit 205 is used to construct a multi-head discriminator. The multi-head discriminator adopts a multi-head discrimination structure and a self-attention mechanism to determine the authenticity of covert communication traffic and identify the type of covert communication based on data characteristics.

[0089] The training and optimization unit 206 is used to train the constructed multi-head generator and multi-head discriminator according to the set loss function to obtain the trained generator and discriminator. A dynamic weight adjustment mechanism is set to adjust the task weights of the generator and discriminator. The discriminator is used to determine whether the traffic data to be identified is real covert communication traffic, and the covert communication information type is determined for the traffic data determined to be covert communication traffic.

[0090] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0091] In other embodiments of this application, an electronic device is disclosed, such as... Figure 4 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more application programs (not shown); and one or more computer programs 304. These devices can be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions that can be used to perform actions such as... Figure 1 , Figure 3 And the various steps in the corresponding embodiments.

[0092] Those skilled in the art can clearly understand the technical solutions of the present application according to the above description of the embodiments, and for the convenience and brevity of description, only the division of the above functional modules is taken as an example, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0093] The functional units in the various embodiments of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0094] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application essentially or say the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor execute all or part of the steps of the method described in various embodiments of the present application. The foregoing storage medium includes: a flash memory, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, and various media that can store program codes.

[0095] The above is only a specific implementation of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any change or replacement within the technical scope disclosed in the embodiments of the present application should be covered in the protection scope of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application should be subject to the protection scope of the claims.

Claims

1. A method for covert channel communication traffic identification, the method comprising: receiving a plurality of packets; determining a plurality of packet characteristics; and identifying a covert channel based on the plurality of packet characteristics. The method comprises: obtaining a covert communication traffic sample set; extracting data features of network traffic in the covert communication traffic sample set and performing data standardization to obtain data feature values, performing vectorization processing on the data feature values to obtain a feature vector representation, extracting time sequence features of the covert communication traffic sample set, identifying interaction mode features of the covert communication traffic sample set, fusing the time sequence features and the interaction mode features to generate a context feature vector, and splicing the context feature vector and the feature vector representation to obtain an enhanced feature vector; performing label assignment on communication traffic in the covert communication traffic sample set according to a communication behavior type of the covert communication traffic to obtain a conditional label; constructing a multi-head generator for generating a covert communication traffic pseudo sample according to the enhanced feature vector, the conditional label, and a randomly generated noise vector; constructing a multi-head discriminator, which adopts a multi-head discrimination structure and a self-attention mechanism, for judging the authenticity of the covert communication traffic and identifying the covert communication type according to data features; training the constructed multi-head generator and multi-head discriminator according to a set loss function to obtain a trained generator and discriminator, setting a dynamic weight adjustment mechanism for adjusting the task weights of the generator and the discriminator, using the discriminator to determine whether the to-be-identified traffic data is real covert communication traffic, and determining the covert communication type for traffic data determined as real covert communication traffic.

2. The method of claim 1, wherein, The data feature values include traffic metadata feature values and protocol content feature values; The vectorization processing on the data feature values to obtain the feature vector representation comprises: one-hot encoding the traffic metadata feature values to obtain corresponding feature vectors, and bag-of-words model processing or word embedding processing the protocol content feature values to obtain corresponding feature vectors.

3. The method of claim 1, wherein, The covert communication traffic sample set includes T data packets, T being a positive integer, and the data features of the traffic in the covert communication traffic sample set include source IP and target IP; The extraction of the time sequence features of the covert communication traffic sample set and the identification of the interaction mode features of the covert communication traffic sample set, and the fusion of the time sequence features and the interaction mode features to generate the context feature vector comprise: calculating the time interval between each data packet and the previous data packet as a time sequence feature; identifying the interaction mode between the source IP and the target IP, and constructing an interaction matrix as an interaction mode feature; The timing feature and the interaction mode feature are fused to generate a context feature vector satisfying the following formula, wherein, represents the context feature vector, represents the timing feature, represents the interaction mode feature, and f represents a feature fusion function.

4. The method of claim 1, wherein, The multi-head generator for generating a covert communication traffic pseudo sample according to the enhanced feature vector, the conditional label, and a randomly generated noise vector comprises: The multi-head generator includes multiple generation heads; The generation heads receive a random noise vector and a conditional label, generate a covert communication traffic pseudo sample based on the random noise vector and the conditional label, and the enhanced feature vector; The output of each of the generation heads satisfies wherein, denotes covert communication traffic pseudo samples, denotes random noise applied, denotes conditional labels, denotes covert communication types, denotes generator parameters.

5. The method of claim 4, wherein, The training of the constructed multi-head generator and multi-head discriminator according to a set loss function comprises: The multi-head generator and the multi-head discriminator are trained to minimize the loss function; The loss function of the multi-head generator satisfies: wherein, denotes the loss function of the multi-head generator, denotes an expectation calculation over random variables, denotes a random noise subject to a noise distribution denotes a conditional label, denotes a generator parameter, denotes a discriminator parameter, denotes a true or false judgment result of the discriminator on the generated sample given the conditional label .​ The loss function of the multi-head discriminator satisfies: wherein, , , represents the loss function of the multi-head discriminator, represents the discriminant loss of the real sample, represents the discriminant loss of the generated sample by the discriminator, represents the real sample, represents the probability distribution of the real sample x, represents the true or false judgment result of the input sample x by the discriminator under the given condition label y.

6. The method of claim 5, wherein, The dynamic weight adjustment mechanism for adjusting the task weights of the generator and the discriminator comprises: Define the total loss function for dynamic weight adjustment as follows: ,in, This represents the total loss function for dynamic weight adjustment. Indicates the number of covert communication types. Indicates the generator at the 1st... The weight of each task, Indicates the generator at the 1st... Losses in each task The discriminator is in the first... The weight of each task, The discriminator is in the first... Losses on individual tasks; and dynamically changes, specifically satisfies: , wherein, represents the loss change rate of the generator in the current task, represents the loss change rate of the discriminator in the current task, represents the adjustment parameter, represents a natural constant.

7. A covert channel communication traffic identification apparatus characterized by, The apparatus comprises: A sample acquisition unit is configured to acquire a covert communication traffic sample set; A data processing unit is configured to extract data features of network traffic in the covert communication traffic sample set, perform data standardization conversion to obtain data feature values, perform vectorization processing on the data feature values to obtain a feature vector representation, extract time sequence features of the covert communication traffic sample set, identify interaction mode features of the covert communication traffic sample set, fuse the time sequence features and the interaction mode features to generate a context feature vector, and splice the context feature vector and the feature vector representation to obtain an enhanced feature vector; A label allocation unit is configured to allocate labels to communication traffic in the covert communication traffic sample set according to communication behavior types of the covert communication traffic to obtain conditional labels; A generator construction unit is configured to construct a multi-head generator for generating a covert communication traffic pseudo sample according to the enhanced feature vector, the conditional labels, and a randomly generated noise vector; A discriminator construction unit is configured to construct a multi-head discriminator, which adopts a multi-head discrimination structure and a self-attention mechanism, and is configured to determine the authenticity of covert communication traffic and identify a covert communication type according to data features; A training and optimization unit is configured to train the constructed multi-head generator and multi-head discriminator according to a set loss function, obtain a trained generator and discriminator, set a dynamic weight adjustment mechanism to adjust task weights of the generator and the discriminator, use the discriminator to determine whether to-be-identified traffic data is real covert communication traffic, and determine a covert communication type for traffic data determined as real covert communication traffic.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by a processor to implement the covert channel communication traffic recognition method in any one of claims 1 to 6.

9. An electronic device, comprising: It comprises: a processor and a memory; the memory is configured to store a computer program; the processor is configured to execute the computer program stored in the memory, so that the electronic device executes the covert channel communication traffic recognition method in any one of claims 1 to 6.

Images