Data packet hierarchical detection method, system and electronic device

Abstract

The application discloses a data packet hierarchical detection method, a system and an electronic device, wherein the hierarchical detection method is used when a data packet sent by a terminal or a data packet sent to the terminal is acquired; the current data packet detection level of the terminal is determined; when it is determined that the current data packet detection level of the terminal is a shallow layer detection, shallow layer detection is performed on the data packet; when it is determined that the current data packet detection level of the terminal is a middle layer detection, middle layer detection is performed on the data packet; and when it is determined that the current data packet detection level of the terminal is a deep layer detection, deep layer detection is performed on the data packet. The method can realize data packet detection with different depths according to the data packet detection levels corresponding to the terminals, effectively avoids the problems of high consumption and large delay caused by uniformly using deep packet detection, and is beneficial to improving network throughput, reducing operation and maintenance cost and reducing security policy configuration work.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a data packet hierarchical detection method, system and electronic equipment. BACKGROUND

[0002] Packet Inspection is one of the core technologies of network security, traffic management and network monitoring, which realizes content identification, risk filtering, traffic optimization and other goals by analyzing the content of data packets transmitted in the network.

[0003] Deep Packet Inspection (DPI) is a commonly used detection technology in packet inspection.

[0004] In the prior art, in order to ensure the sufficiency of detection, deep packet inspection is used for data analysis for data packets transmitted and received by various terminals (mobile phones, computers, notebook computers, tablet computers, printers, copiers, servers, network phones, Internet of Things devices, etc.), which results in high CPU / memory consumption and large delay. SUMMARY

[0005] The purpose of the present application is to solve the above problems existing in the prior art, and to provide a data packet hierarchical detection method, system and electronic equipment.

[0006] The purpose of the present application is achieved by the following technical solutions:

[0007] The data packet hierarchical detection method comprises the following steps:

[0008] Obtaining a data packet sent by a terminal or a data packet sent to the terminal;

[0009] Determining the current data packet detection level of the terminal; the data packet detection level is determined based on at least the activity score of the terminal; the activity score is calculated according to the following formula:

[0010] ;

[0011] Wherein, S is the activity score; w1, w2 and w3 are the respective weights of the traffic feature, the connection feature and the protocol feature; is the value of the i-th feature parameter in the traffic feature after normalization processing; is the value of the i-th feature parameter in the connection feature after normalization processing; is the value of the i-th feature parameter in the protocol feature after normalization processing; l is the number of feature parameters of the traffic feature; m is the number of feature parameters of the connection feature; n is the number of feature parameters of the protocol feature;

[0012] when it is determined that the current data packet detection level of the terminal is a shallow detection, performing shallow detection on the data packet; the shallow detection detects the network layer protocol header and the transport layer protocol header of the data packet;

[0013] when it is determined that the current data packet detection level of the terminal is a middle detection, performing middle detection on the data packet; the middle detection detects the network layer protocol header, the transport layer protocol header and the application layer protocol header of the data packet;

[0014] when it is determined that the current data packet detection level of the terminal is a deep detection, performing deep detection on the data packet; the deep detection detects the network layer protocol header, the transport layer protocol header, the application layer protocol header and the application layer data of the data packet.

[0015] Preferably,

[0016] The traffic feature at least includes the following feature parameters: packet rate, byte number, packet length distribution entropy;

[0017] The connection feature at least includes the following feature parameters: new connection number, concurrent connection number, short connection number;

[0018] The protocol feature at least includes the following feature parameters: protocol type distribution entropy, special protocol occurrence number.

[0019] Preferably,

[0020] The activity score corresponding to the shallow detection is between 0-30;

[0021] The activity score corresponding to the middle detection is between 31-70;

[0022] The activity score corresponding to the deep detection is above 70.

[0023] Preferably,

[0024] Real-time acquiring the feature parameters of each terminal during each time window and updating the mean value, standard deviation and feature baseline of each feature parameter of each terminal, updating the activity score corresponding to each terminal based on the updated mean value or upper limit value of the feature baseline of each feature parameter, and determining the data packet detection level of each terminal according to the updated activity score.

[0025] Preferably,

[0026] When the data packet detection level corresponding to the updated activity score of a terminal is higher than the current data packet detection level of the terminal, adjusting the data packet detection level of the terminal to the data packet detection level corresponding to the updated activity score of the terminal;

[0027] When the updated activity score of a terminal corresponds to a data packet detection level lower than the current data packet detection level of the terminal, it is determined whether the difference between the updated activity score and the lower limit value of the activity score corresponding to the current data packet detection level of the terminal exceeds a threshold value, and if so, the data packet detection level of the terminal is adjusted to the data packet detection level corresponding to the updated activity score, and if not, the terminal is kept at the current detection data packet detection level.

[0028] Preferably,

[0029] When it is determined that the current data packet detection level of a terminal is not deep packet detection, it is determined whether the feature parameters obtained by the terminal during the current time window are abnormal, and when it is determined that there is an abnormality, the data packet detection level of the terminal is adjusted to deep packet detection;

[0030] After the data packet detection level of the terminal is adjusted to deep packet detection, if it is determined that the feature parameters obtained by the terminal during consecutive multiple time windows have all returned to normal, the data packet detection level of the terminal is adjusted to the data packet detection level corresponding to the activity score determined according to the upper limit value of the mean value of the latest updated feature parameters or the feature baseline.

[0031] Preferably,

[0032] The feature parameters obtained during the current time window are compared with the feature baseline corresponding to each feature parameter of the terminal, and when it is determined that at least one of the feature parameters exceeds the corresponding feature baseline, it is determined that the feature parameters obtained by the terminal during the current time window are abnormal.

[0033] Preferably,

[0034] The current data packet detection level of a terminal is determined, and if it is determined that the data packet detection levels corresponding to the activity scores of the terminal during consecutive m time windows all exceed the current data packet detection level of the terminal, the data packet detection level of the terminal is raised;

[0035] After the data packet detection level of the terminal is raised, if it is determined that the data packet detection levels corresponding to the activity scores of the terminal during consecutive n time windows are all lower than the current data packet detection level of the terminal, the data packet detection level of the terminal is lowered; n and m are positive integers and n is greater than m.

[0036] A data packet hierarchical detection system, comprising:

[0037] A data packet acquisition unit for acquiring data packets sent by a terminal or data packets sent to the terminal;

[0038] A hierarchy determining unit is configured to determine a current data packet detection hierarchy of the terminal, which is determined based on at least an activity score of the terminal; and the activity score is calculated according to the following formula:

[0039] ;

[0040] wherein S is the activity score; w1, w2 and w3 are weights corresponding to the flow feature, the connection feature and the protocol feature respectively; is a value of an i-th feature parameter in the flow feature after normalization processing; is a value of an i-th feature parameter in the connection feature after normalization processing; is a value of an i-th feature parameter in the protocol feature after normalization processing; l is a number of feature parameters in the flow feature; m is a number of feature parameters in the connection feature; and n is a number of feature parameters in the protocol feature.

[0041] A detection unit is configured to perform shallow layer detection on the data packet when it is determined that the current data packet detection hierarchy of the terminal is the shallow layer detection; the shallow layer detection detects a network layer protocol header and a transport layer protocol header of the data packet;

[0042] perform medium layer detection on the data packet when it is determined that the current data packet detection hierarchy of the terminal is the medium layer detection; the medium layer detection detects a network layer protocol header, a transport layer protocol header and an application layer protocol header of the data packet;

[0043] perform deep layer detection on the data packet when it is determined that the current data packet detection hierarchy of the terminal is the deep layer detection; the deep layer detection detects a network layer protocol header, a transport layer protocol header, an application layer protocol header and application layer data of the data packet.

[0044] An electronic device includes a memory and a processor, the memory stores a program executable by the processor, and the program is executed to implement the data packet hierarchical detection method.

[0045] The technical scheme of the present application has the following advantages:

[0046] The method of the present application can determine the corresponding data packet detection hierarchy according to the activity score of each terminal, and can implement data packet detection with different depths according to the corresponding data packet detection hierarchy of each terminal when detecting data packets of different terminals, thereby effectively avoiding the problems of high consumption and large delay caused by uniform deep packet detection, and improving network throughput, reducing operation and maintenance cost, reducing security policy configuration work, and effectively ensuring the reliability of data packet detection according to the actual situation of different terminals.

[0047] The application can dynamically change the data packet detection level of each terminal according to the abnormal state found when different terminals run, can effectively automatically identify and respond to abnormal traffic, does not need manual intervention, and significantly enhances the zero-day vulnerability detection capability.

[0048] The application can make the data packet detection level accurately match the actual running condition of each terminal by updating the mean value and feature baseline of each feature parameter in real time and adjusting the data packet detection level based on the updated mean value or feature baseline, thereby guaranteeing the accuracy of data packet detection. BRIEF DESCRIPTION OF DRAWINGS

[0049] Figure 1 is a flowchart of the method of the application;

[0050] Figure 2 is a process schematic diagram in the application, wherein the data packet detection level of each terminal is adjusted according to the abnormal condition of the feature parameter of the terminal in each time window;

[0051] Figure 3 is a process schematic diagram in the application, wherein the data packet detection level of the terminal is dynamically adjusted according to the change condition of the activity score of the terminal determined in each time window. DETAILED DESCRIPTION

[0052] The purposes, advantages and characteristics of the application will be illustrated and explained by the non-limiting description of the preferred embodiments. These embodiments are only typical examples of the application of the technical solutions of the application, and any technical solutions formed by equivalent replacement or equivalent transformation fall within the scope of the application.

[0053] In the description of the scheme, it should be noted that the orientations or positional relationships indicated by the terms “center”, “upper”, “lower”, “left”, “right”, “front”, “back”, “vertical”, “horizontal”, “inner”, “outer” and the like are based on the orientations or positional relationships shown in the drawings, and are only for the convenience of description and simplification of description, and are not intended to indicate or imply that the devices or elements referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as limiting the application. In addition, the terms “first”, “second”, “third” are only for the purpose of description, and cannot be understood as indicating or implying relative importance. Embodiment 1

[0054] The data packet hierarchical detection method disclosed by the application will be described below in conjunction with the drawings, as shown in FIG. Figure 1 The method comprises the following steps:

[0055] obtaining a data packet sent by a terminal or a data packet sent to the terminal;

[0056] determining a current packet detection level of the terminal, the packet detection level being determined based on at least the activity score of the terminal;

[0057] when the current packet detection level of the terminal is determined to be a shallow detection, performing shallow detection on the packet; the shallow detection detects the network layer protocol header and the transport layer protocol header of the packet;

[0058] when the current packet detection level of the terminal is determined to be a middle detection, performing middle detection on the packet; the middle detection detects the network layer protocol header, the transport layer protocol header and the application layer protocol header of the packet;

[0059] when the current packet detection level of the terminal is determined to be a deep detection, performing deep detection on the packet; the deep detection, i.e., the deep packet inspection, detects the network layer protocol header, the transport layer protocol header, the application layer protocol header and the application layer data of the packet.

[0060] The detection content of the shallow detection specifically includes: source / destination IP address, port number, protocol type, packet size and other basic information, which has the advantages of fast detection speed and low resource consumption, but can only identify basic network characteristics, and therefore is suitable for packet detection of terminals with low activity, because terminals with low activity initiate fewer network connections and have relatively fixed connection objects, and the probability of malicious connection or data leakage is extremely low, and therefore, the use of shallow detection can effectively avoid unnecessary investment.

[0061] The detection content of the middle detection specifically includes: HTTP request header, DNS query content, FTP command, SMTP email header, etc. The middle detection can identify application types and basic behaviors, and has moderate resource consumption, and therefore is suitable for terminals with medium activity, and the inventors have found that terminals with medium activity usually have the characteristics of regular network behavior, controllable traffic and risk concentrated in protocol violations, and therefore the use of middle detection can avoid both the missed judgment of shallow detection and the resource waste of deep detection, and can effectively achieve the compatibility of low consumption and high security.

[0062] The detection content of the deep detection specifically includes file content, malicious code, sensitive information, encrypted traffic analysis, etc., which is the most comprehensive detection, but has high resource consumption and relatively slow processing speed. The high-activity terminal (such as a server or a workstation frequently connected to the network) has the characteristics of multiple connections, large traffic, and complex behavior. It can simultaneously communicate with hundreds of nodes and is extremely vulnerable to hackers. For example, it can continuously transmit data after being implanted with malicious programs. Threats are often hidden in the payload of legal protocols, such as transmitting malicious code through HTTPS. Therefore, only by analyzing the data payload can the legal protocol disguise be penetrated, and content-level risks such as malicious code in HTTPS traffic and data leakage behavior in database connections can be identified. Although resource consumption is high, high cost corresponds to high income - large-scale losses caused by missed advanced threats, such as server intrusion and core data leakage, can be avoided.

[0063] For each terminal, known packet capture tools can be used to obtain its historical network usage data, and flow table counters and protocol analyzers can be used to process the historical network usage data of each terminal according to a set time window to statistically evaluate the activity of each terminal during each time window. The specific packet capture and activity evaluation feature statistical techniques are known techniques and are not the innovation of the present application, and will not be described here.

[0064] The activity evaluation features include three types, specifically: traffic features, connection features, and protocol features.

[0065] The traffic features include but are not limited to the following feature parameters: message rate (unit: packets per second, pps), byte count, packet length distribution entropy, etc. The higher the message rate and byte count, the more frequent the terminal communication, and the higher the activity. The greater the packet length distribution entropy, the more diverse the terminal message size, and the higher the activity.

[0066] The connection features include but are not limited to the following feature parameters: new connection number, concurrent connection number, and short connection number. The more new connections, concurrent connections, and short connections, the more intensive the terminal interacts with the outside, and the higher the activity.

[0067] The protocol features include but are not limited to the following feature parameters: protocol type distribution entropy and special protocol occurrence number. The greater the protocol distribution entropy, the more complex the protocols used by the terminal, and the higher the activity. The increase in the number of special protocols (such as P2P, FTP, and uncommon ports) indicates that the terminal behavior is more active or abnormal.

[0068] The packet length distribution entropy and the protocol type distribution entropy can be calculated according to the formula For example, the protocol type distribution entropy, in the formula, H is the protocol type distribution entropy, is the proportion of the i-th protocol in a time window, and j is the number of protocol types used by a terminal in a time window; the higher the entropy value, the more diverse the protocols used by the terminal and the higher the activity level. If the packet length distribution entropy is calculated, then is the proportion of the i-th packet length in a time window.

[0069] In addition, the mean and standard deviation of each feature parameter determined for each terminal in multiple time windows can be determined to determine the feature baseline corresponding to each feature parameter of each terminal. For example, for the message rate, the mean and standard deviation of the message rate in multiple time windows can be calculated, and the mean ± standard deviation is taken as the feature baseline of the message rate.

[0070] At the same time, the activity score can be calculated based on the following formula:

[0071] ;

[0072] where S is the activity score; w1, w2, and w3 are the weights corresponding to the traffic feature, connection feature, and protocol feature, respectively, which are set values, and for security considerations, w3 can be higher than w1 and w2. At the same time, the traffic feature directly reflects the frequency of data exchange, and accordingly, w1 can be higher than w2. For example, w3 is set to 40%, w1 is set to 35%, and w2 is set to 25%. Alternatively, w1 and w3 can be set to 35%, and w2 can be set to 30%. Such weights can take into account both security control requirements and performance optimization control requirements. is the value of the i-th feature parameter in the traffic feature after normalization; is the value of the i-th feature parameter in the connection feature after normalization; is the value of the i-th feature parameter in the protocol feature after normalization; l is the number of feature parameters of the traffic feature; m is the number of feature parameters of the connection feature; and n is the number of feature parameters of the protocol feature.

[0073] When the activity score of each terminal is calculated based on the mean or upper limit value of the feature baseline according to various feature parameters, the , , is the mean or upper limit value of the feature baseline after normalization. When the activity score of each terminal is determined in real time based on the feature parameters of each time window, the This is achieved by normalizing the values ​​of each feature parameter obtained within a time window. Using normalized values ​​for activity scoring effectively eliminates dimensional differences, improving the stability and accuracy of the calculation. Furthermore, traffic features, connection features, and protocol features are calculated using multiple feature parameters, effectively considering the influence of various feature parameters and further enhancing the accuracy of the activity score. Moreover, using the same weight for feature parameters of the same type significantly reduces the difficulty of weight configuration.

[0074] Once the initial activity score for each terminal is determined, the initial packet detection level for each terminal can be determined according to the following rules:

[0075] When a terminal's activity score is between 0 and 30, the terminal's data packet detection level is shallow detection.

[0076] When a terminal's activity score is between 31 and 70, the terminal's data packet detection level is mid-level detection.

[0077] When a terminal's activity score is above 70, the terminal's data packet detection level is deep detection.

[0078] Of course, in other embodiments, the packet detection level corresponding to each terminal at the beginning can also be determined manually. For example, the packet detection level of all terminals is initially deep detection.

[0079] After determining the initial packet detection level for each terminal, this level can be stored in the packet hierarchical detection system. Subsequently, the hierarchical detection method described above can be used to detect packets sent by or destined for each terminal. For example, if a terminal's initial packet detection level is shallow detection, the packet hierarchical detection system will perform shallow detection on a packet sent by that terminal; similarly, it will perform shallow detection on a packet destined for that terminal. Furthermore, known firewalls, switches, routers, etc., can be used to determine which terminal a packet is intended for and inform the packet hierarchical detection system, allowing the system to identify the terminal to which the packet is intended and perform detection based on that terminal's corresponding packet detection level.

[0080] Furthermore, during the subsequent real-time network usage of each terminal, the mean, standard value, feature baseline, activity score, and packet detection level of each terminal can be updated based on the feature parameters obtained by each terminal in each time window.

[0081] At this time, the duration of the time window corresponding to the terminal of different packet detection level can be determined as needed, preferably, when the current packet detection level of a terminal is deep detection or shallow detection, a time window with longer duration can be used, for example, the length of the time window is 10 seconds, 20 seconds, etc.

[0082] When the current packet detection level of a terminal is middle detection, a time window with shorter duration can be used, for example, the length of the time window is 5 seconds.

[0083] This is because the activity score of the terminal corresponding to deep detection and shallow detection changes relatively stably, so a relatively long duration time window can be used to ensure stability, while reducing the judgment frequency. The activity of the terminal corresponding to middle detection changes more frequently, so a short duration time window can be used to ensure sensitivity, which is beneficial to improve the accuracy and timeliness of the activity score.

[0084] The time windows can be separated by a predetermined time, for example, after determining the activity score of a terminal once, the next activity score of the terminal can be determined after 1 second or several seconds. Of course, the two consecutive activity scores can also be without time interval, that is, after determining the activity score of a terminal once, the feature parameters of the terminal during the next time window are counted and the next activity score is calculated.

[0085] Meanwhile, in the process of each terminal using the network in real time subsequently, the feature parameters during each time window are determined, and the mean, standard deviation and feature baseline of each feature parameter of the terminal are updated when each time window feature parameter is obtained. Then, the activity score corresponding to the terminal is updated based on the updated mean or upper limit value of the feature baseline of each feature parameter, and the specific activity score calculation formula is the same as above, which is not described here. Finally, the packet detection level of each terminal is determined according to the updated activity score.

[0086] When the packet detection level corresponding to the updated activity score of a terminal is higher than the current packet detection level of the terminal, the packet detection level of the terminal is adjusted to the packet detection level corresponding to the updated activity score.

[0087] When the packet detection level corresponding to the updated activity score of a terminal is lower than the current packet detection level of the terminal, it is determined whether the difference between the updated activity score and the lower limit value of the activity score corresponding to the current packet detection level of the terminal exceeds a threshold value, which can be determined as needed and is not limited here. If yes, the packet detection level of the terminal is adjusted to the packet detection level corresponding to the updated activity score, and if no, the terminal remains at the current detection packet detection level.

[0088] For example, if a terminal's initial activity score is 25, and the corresponding packet detection level is shallow detection, when the activity score determined by the mean of each feature parameter or the upper limit of the feature baseline after a time window is 35, then the terminal's packet detection level is updated to medium detection.

[0089] For example, if a terminal's initial activity score is 85, corresponding to a deep detection packet inspection level, and when the updated activity score drops to 69, the terminal's packet inspection level is not immediately downgraded to a mid-level detection level. Instead, it is determined whether the difference between the updated activity score (69) and the lower limit of the activity score corresponding to deep detection (70) exceeds a threshold, for example, 10. Since the difference between the updated activity score and the lower limit of the deep detection activity score is 1, which does not exceed the threshold of 10, the terminal's packet inspection level remains at deep detection. If the updated activity score drops to 55, the difference between the updated activity score and the lower limit of the deep detection activity score is 15, which is greater than the threshold of 10. Only then is the terminal's packet inspection level downgraded to mid-level detection. This approach minimizes the problem of frequent packet inspection level adjustments due to fluctuations in the terminal's activity score when downgrading the packet inspection level immediately.

[0090] On the other hand, the network behavior of the terminal can be determined based on the feature baseline of each feature parameter. When an anomaly is determined, the packet detection level is increased to ensure that the abnormal situation can be handled in a timely manner.

[0091] As attached Figure 2 As shown, when it is determined that the current packet detection level of a terminal is not deep detection, it is determined whether the feature parameters acquired by the terminal during the current time window are abnormal. Specifically, the feature parameters acquired during the current time window are compared with the feature baselines of each feature parameter of the terminal. If it is determined that at least one of the feature parameters exceeds its corresponding feature baseline, then it is determined that the feature parameters acquired by the terminal during the current time window are abnormal. Conversely, if all feature parameters do not exceed their corresponding feature baselines, then it is determined that the feature parameters acquired by the terminal during the current time window are normal.

[0092] When an anomaly is detected, the terminal's packet detection level is adjusted to deep detection; when no anomaly is detected, the terminal maintains its current packet detection level.

[0093] After the data packet detection level of the terminal is adjusted to deep detection, if it is determined that the feature parameters acquired by the terminal during multiple consecutive time windows have all returned to normal, for example, when it is determined that the feature parameters of 3-5 consecutive time windows have all returned to the corresponding feature baseline, then the data packet detection level of the terminal is adjusted to the data packet detection level corresponding to the activity score determined according to the mean of the latest updated feature parameters or the upper limit of the feature baseline.

[0094] During subsequent network usage by each terminal, the packet detection level for each terminal can be dynamically adjusted based on the changes in the packet detection level corresponding to the activity score determined for each terminal during each time window.

[0095] As attached Figure 3 As shown, for each terminal, after determining the terminal's current packet detection level, especially when it is determined that the terminal's current packet detection level is not deep detection, it is determined whether the packet detection level corresponding to the terminal's activity score during a consecutive m time windows all exceed the terminal's current packet detection level. If not, the terminal maintains its current packet detection level; if so, the terminal's packet detection level is increased. Furthermore, the packet detection levels corresponding to the activity scores during the m time windows may be the same or different. If the packet detection levels corresponding to the activity scores during the m time windows are the same, the terminal's packet detection level is increased to the packet detection level corresponding to the activity scores during the m time windows. When the packet detection levels corresponding to the activity scores during the m time windows are different, the average activity score during the m time windows is determined, and the corresponding packet detection level is determined based on the average activity score during the m time windows. Simultaneously, the terminal's packet detection level is increased to the packet detection level corresponding to the average activity score during the m time windows.

[0096] After the packet detection level of the terminal is increased, it is determined whether the packet detection level corresponding to the activity score of the terminal during the m consecutive time windows exceeds the current packet detection level of the terminal. If so, the packet detection level is increased again. If not, it is determined whether the packet detection level corresponding to the activity score of the terminal during the n consecutive time windows is lower than the current packet detection level of the terminal.

[0097] If it is determined that the data packet detection levels corresponding to the activity scores of the terminal in the continuous n time windows are all lower than the current data packet detection level of the terminal, the data packet detection level of the terminal is lowered, in particular, the data packet detection level of the terminal is adjusted to the data packet detection level corresponding to the activity score determined according to the upper limit value of the mean value or the feature baseline of the latest updated feature parameters.

[0098] The n and m are positive integers and n is greater than m, and the difference between n and m is not less than 2, so that the data packet detection level is prevented from frequently jumping due to small fluctuations in the activity score, and higher requirements are needed to lower the data packet detection level, thereby ensuring that the abnormal situation is fully handled before the data packet detection level is restored to a lower level.

[0099] For example, when the data packet detection level is lowered, the data packet detection levels corresponding to the activity scores of the continuous 5 time windows are lower than the current data packet detection level of the terminal, and when the data packet detection level is raised, the data packet detection levels corresponding to the activity scores of the continuous 2 time windows are higher than the current data packet detection level of the terminal.

[0100] For example, if the data packet detection level of a terminal is initially determined to be shallow detection, and the activity scores determined in the continuous 2 time windows are both between 31-70 points, and the corresponding data packet detection levels are both medium detection, the data packet detection level of the terminal is adjusted to medium detection. After being adjusted to medium detection, if the activity scores determined in the continuous 5 time windows are between 0-30 points, the data packet detection level of the terminal is adjusted to shallow detection. In this way, the data packet detection level of a terminal can be effectively prevented from frequently switching, and abnormal situations can be discovered as much as possible and handled in time.

[0101] In order to quickly switch the data packet detection level so that the switching time is less than 100 milliseconds to ensure continuous service, all possible DPI (deep packet inspection) plugins, such as HTTP, DNS, and TLS, are loaded into the memory when the system starts, and when the data packet detection level is switched, the corresponding plugin enable flag is directly opened or closed without dynamically loading the plugin, thereby avoiding the overhead caused by dynamic loading at runtime. Embodiment 2

[0102] The embodiment discloses a data packet hierarchical detection system, comprising:

[0103] A data packet acquisition unit is configured to acquire a data packet sent by a terminal or a data packet sent to the terminal.

[0104] A hierarchy determining unit is configured to determine a current data packet detection hierarchy of the terminal, the data packet detection hierarchy being determined based on at least an activity score of the terminal; and the activity score is calculated according to the following formula:

[0105] ;

[0106] wherein S is the activity score; w1, w2 and w3 are weights corresponding to the flow feature, the connection feature and the protocol feature respectively; is a value of an i-th feature parameter in the flow feature after normalization processing; is a value of an i-th feature parameter in the connection feature after normalization processing; is a value of an i-th feature parameter in the protocol feature after normalization processing; l is a number of feature parameters in the flow feature; m is a number of feature parameters in the connection feature; and n is a number of feature parameters in the protocol feature;

[0107] A detecting unit is configured to perform shallow layer detection on the data packet when it is determined that the current data packet detection hierarchy of the terminal is the shallow layer detection; the shallow layer detection detects a network layer protocol header and a transport layer protocol header of the data packet;

[0108] perform medium layer detection on the data packet when it is determined that the current data packet detection hierarchy of the terminal is the medium layer detection; the medium layer detection detects a network layer protocol header, a transport layer protocol header and an application layer protocol header of the data packet;

[0109] perform deep layer detection on the data packet when it is determined that the current data packet detection hierarchy of the terminal is the deep layer detection; the deep layer detection detects a network layer protocol header, a transport layer protocol header, an application layer protocol header and application layer data of the data packet. Embodiment 3

[0110] The embodiment discloses an electronic device, comprising a memory and a processor, the memory stores a program which can be executed by the processor, and the program is executed to implement the data packet hierarchical detection method as described above.

[0111] The present application has various embodiments, and all technical solutions formed by equivalent transformation or equivalent transformation fall within the protection scope of the present application.

Claims

1. A data packet classification detection method, characterized in that, Includes the following steps: Acquire data packets sent by a terminal or data packets sent to the terminal; The current packet detection level of the terminal is determined; the packet detection level is determined at least based on the terminal's activity score; the activity score is calculated according to the following formula: ； Where S is the activity score; w1, w2, and w3 are the weights corresponding to traffic characteristics, connection characteristics, and protocol characteristics, respectively. This represents the value of the i-th feature parameter in the flow characteristics after normalization. This refers to the value of the i-th feature parameter in the connected features after normalization. The value of the i-th feature parameter in the protocol features after normalization; l is the number of feature parameters of the traffic feature; m is the number of feature parameters of the connection feature; n is the number of feature parameters of the protocol feature. When it is determined that the current data packet detection level of the terminal is shallow detection, shallow detection is performed on the data packet; the shallow detection detects the network layer protocol header and transport layer protocol header of the data packet; When it is determined that the current data packet detection level of the terminal is intermediate layer detection, intermediate layer detection is performed on the data packet; the intermediate layer detection detects the network layer protocol header, transport layer protocol header and application layer protocol header of the data packet; When it is determined that the current data packet detection level of the terminal is deep detection, deep detection is performed on the data packet; the deep detection detects the network layer protocol header, transport layer protocol header, application layer protocol header and application layer data of the data packet.

2. The data packet hierarchical detection method according to claim 1, characterized in that: The traffic characteristics include at least the following characteristic parameters: message rate, number of bytes, and packet length distribution entropy; The connection features include at least the following feature parameters: number of newly established connections, number of concurrent connections, and number of short connections; The protocol features include at least the following feature parameters: protocol type distribution entropy and the number of times special protocols appear.

3. The data packet hierarchical detection method according to claim 1, characterized in that: The activity score corresponding to shallow detection is between 0 and 30. The activity score corresponding to the mid-level detection is between 31 and 70 points; The activity score corresponding to deep detection is above 70.

4. The data packet hierarchical detection method according to claim 1, characterized in that: The system acquires the characteristic parameters of each terminal in real time during each time window and updates the mean, standard deviation and baseline of each characteristic parameter of each terminal. Based on the updated mean or upper limit of the characteristic baseline, the system updates the activity score of each terminal and determines the data packet detection level of each terminal based on the updated activity score.

5. The data packet hierarchical detection method according to claim 4, characterized in that: When the packet detection level corresponding to the updated activity score of a terminal is higher than the current packet detection level of the terminal, the packet detection level of the terminal is adjusted to the packet detection level corresponding to the updated activity score. When the packet detection level corresponding to the updated activity score of a terminal is lower than the current packet detection level of the terminal, it is determined whether the difference between the updated activity score and the lower limit of the activity score corresponding to the current packet detection level of the terminal exceeds a threshold. If yes, the packet detection level of the terminal is adjusted to the packet detection level corresponding to the updated activity score. If no, the terminal maintains its current packet detection level.

6. The data packet hierarchical detection method according to any one of claims 1-5, characterized in that: When it is determined that the current packet detection level of a terminal is not deep detection, it is determined whether there is any abnormality in the feature parameters obtained by the terminal during the current time window. If it is determined that there is an abnormality, the packet detection level of the terminal is adjusted to deep detection. After the terminal's packet detection level is adjusted to deep detection, if it is determined that the feature parameters acquired by the terminal during multiple consecutive time windows have all returned to normal, then the terminal's packet detection level is adjusted to the packet detection level corresponding to the activity score determined based on the mean of the latest updated feature parameters or the upper limit of the feature baseline.

7. The data packet hierarchical detection method according to claim 6, characterized in that: The feature parameters acquired during the current time window are compared with the feature baselines corresponding to each feature parameter of the terminal. If it is determined that at least one of the feature parameters exceeds its corresponding feature baseline, it is determined that the feature parameters acquired by the terminal during the current time window are abnormal.

8. The data packet hierarchical detection method according to any one of claims 1-5, characterized in that: Determine the current packet detection level of a terminal. If it is determined that the packet detection level corresponding to the activity score of the terminal exceeds the current packet detection level of the terminal during m consecutive time windows, then upgrade the packet detection level of the terminal. After the packet detection level of the terminal is improved, if it is determined that the packet detection level corresponding to the activity score of the terminal during n consecutive time windows is lower than the current packet detection level of the terminal, then the packet detection level of the terminal is reduced; where n and m are positive integers and n is greater than m.

9. A data packet classification and detection system, characterized in that, include: A data packet acquisition unit is used to acquire data packets sent by a terminal or data packets sent to the terminal; A layer determination unit is used to determine the current packet detection layer of the terminal, wherein the packet detection layer is determined based at least on the terminal's activity score; the activity score is calculated according to the following formula: ； Where S is the activity score; w1, w2, and w3 are the weights corresponding to traffic characteristics, connection characteristics, and protocol characteristics, respectively. This represents the value of the i-th feature parameter in the flow characteristics after normalization. This refers to the value of the i-th feature parameter in the connected features after normalization. The value of the i-th feature parameter in the protocol features after normalization; l is the number of feature parameters of the traffic feature; m is the number of feature parameters of the connection feature; n is the number of feature parameters of the protocol feature. The detection unit performs shallow detection on the data packet when it determines that the current data packet detection level of the terminal is shallow detection; the shallow detection detects the network layer protocol header and transport layer protocol header of the data packet. When it is determined that the current data packet detection level of the terminal is intermediate layer detection, intermediate layer detection is performed on the data packet; the intermediate layer detection detects the network layer protocol header, transport layer protocol header and application layer protocol header of the data packet; When it is determined that the current data packet detection level of the terminal is deep detection, deep detection is performed on the data packet; the deep detection detects the network layer protocol header, transport layer protocol header, application layer protocol header and application layer data of the data packet.

10. An electronic device, comprising a memory and a processor, the memory storing a program executable by the processor, characterized in that: When the program is executed, it implements the data packet hierarchical detection method as described in any one of claims 1-8.

Images