RDP tunnel encrypted traffic detection method and device based on interaction behaviors
By extracting session and interaction features from RDP tunnel traffic and using machine learning networks to generate detection models, the problem of early detection of attacks under RDP tunnels is solved, and accurate identification of attacks under RDP tunnels is achieved.
Patent Information
- Application Number
- CN202511163650.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-19
- Publication Date
- 2025-12-12
AI Technical Summary
Existing methods for detecting encrypted traffic in RDP tunnels struggle to effectively identify attacks in the early stages, especially when attack traffic is encapsulated within data packets under the RDP tunnel, making it difficult for traditional network detection systems to identify.
By extracting metadata from RDP traffic, aggregating it into basic units, and extracting session and interaction features, a pre-trained machine learning network is used for detection to generate an RDP attack behavior detection model to determine whether the traffic is dangerous.
It enables early and accurate detection of attacks under RDP tunnels, thereby improving network security protection capabilities.
Smart Images
Figure CN121125178A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of network security, and particularly relates to an RDP tunnel encrypted traffic detection method and device based on interactive behavior. BACKGROUND
[0002] With the rapid development of network technology, Remote Data Protocol (RDP) has become a widely used remote desktop connection tool for enterprise and personal users. RDP tunnel provides secure remote desktop access for users by encrypting and encapsulating data streams. However, with the popularity of RDP protocol, security risks have gradually emerged, especially in the face of complex network attacks, RDP protocol itself has certain vulnerabilities, which is easy to become the target of hacker attacks. Attackers can bypass traditional network firewalls and intrusion detection systems through RDP tunnel to perform malicious behavior such as data theft, remote control, and denial of service attacks.
[0003] Traditional traffic feature detection methods identify malicious activities by analyzing statistical features of network traffic. For example, some studies use statistical features such as traffic size, duration, transmission rate to distinguish between normal and malicious traffic. Since RDP traffic usually uses TLS / SSL encryption, traditional methods may not perform well due to interference from the encryption layer. That is, in the current network security protection system, traditional rule-based intrusion detection systems (IDS) often rely on static feature libraries or traffic analysis models, making it difficult to deal with new attack methods. Especially in RDP tunnels, attack traffic is often encapsulated in RDP packets, making it difficult for regular network detection systems to directly identify it. This makes it difficult to effectively detect attack behavior under RDP tunnel in the early stage, thereby posing a serious challenge to network security. SUMMARY
[0004] The present application provides an RDP tunnel encrypted traffic detection method and device based on interactive behavior to solve the problem that attack behavior under RDP tunnel is difficult to be effectively detected in the early stage.
[0005] The present application provides an RDP tunnel encrypted traffic detection method based on interactive behavior, the method comprising:
[0006] Obtaining unknown RDP traffic to be detected;
[0007] Extracting metadata of the unknown RDP traffic, aggregating metadata of 10 flows with the same source IP, destination IP and destination port into a basic unit, and then extracting session features and interactive features of the basic unit;
[0008] input the extracted features into a pre-trained RDP attack behavior detection model to obtain a probability prediction value output by the RDP attack behavior detection model;
[0009] if the probability prediction value is greater than a preset probability value, it is determined that the unknown RDP flow is dangerous flow;
[0010] The RDP attack behavior detection model is obtained by training a pre-constructed machine learning network using sample flows and corresponding probability labels.
[0011] In some embodiments, the RDP attack behavior detection model is obtained by training a pre-constructed machine learning network using sample flows and corresponding probability labels, and specifically includes:
[0012] A large amount of sample flows are obtained, and the sample flows are divided into a black flow data set and a white flow data set;
[0013] Target metadata is extracted from each RDP session in the sample flows;
[0014] Time features and length features of the payloads in each RDP session are extracted, and a black flow feature set and a white flow feature set are constructed, respectively. The features in the black flow feature set and the features in the white flow feature set are labeled, respectively. A feature set is constructed from the extracted features and corresponding labels.
[0015] The feature set is input into a pre-constructed machine learning network for training to obtain the RDP attack behavior detection model.
[0016] In some embodiments, the target metadata specifically includes session start time, session end time, client IP, server IP, server port, encrypted payload length list, ACK number list of the frame where the encrypted payload is located, and time list of the frame where the encrypted payload is located.
[0017] In some embodiments, the feature set is constructed specifically as follows:
[0018] Field data is extracted from each RDP session;
[0019] The maximum value, minimum value, average value, and difference coefficient of each target list in the field data are calculated, respectively;
[0020] The first N interactions of each session are extracted, and target interaction data in each interaction is extracted;
[0021] Transition matrices of the length list, time list, and number list in the target list are calculated, respectively;
[0022] Based on the transition matrix of the length list, the time list and the number list of each session, a feature set is constructed.
[0023] In some embodiments, the target list specifically includes a client packet length list, a client packet time interval list, a client length list calculated according to ACK, a server packet length list, a server packet time interval list, and a server length list calculated according to ACK.
[0024] In some embodiments, target interaction data in each interaction is extracted, specifically including:
[0025] A client first packet length feature in N interactions is extracted;
[0026] A server first packet length feature in N interactions is extracted;
[0027] A client last packet length feature in N interactions is extracted;
[0028] A server last packet length feature in N interactions is extracted;
[0029] A client total payload length feature in N interactions is extracted;
[0030] A server total payload length feature in N interactions is extracted;
[0031] A client total payload number feature in N interactions is extracted;
[0032] A server total payload number feature in N interactions is extracted;
[0033] A time interval feature between N interactions is extracted;
[0034] A duration feature of N interactions is extracted.
[0035] The application also provides an RDP tunnel encrypted traffic detection device based on interaction behavior, which comprises:
[0036] A traffic acquisition unit is configured to acquire unknown RDP traffic to be detected;
[0037] A feature extraction unit is configured to extract metadata of the unknown RDP traffic, aggregate metadata of 10 flows with the same source IP, destination IP and destination port into one basic unit, and then extract session features and interaction features from the basic unit;
[0038] A probability generation unit is configured to input the extracted features into a pre-trained RDP attack behavior detection model to obtain a probability prediction value output by the RDP attack behavior detection model;
[0039] A result generation unit is configured to determine that the unknown RDP traffic is dangerous traffic if the probability prediction value is greater than a preset probability value.
[0040] The RDP attack behavior detection model is obtained by training a pre-constructed machine learning network using sample traffic and corresponding probability labels.
[0041] The application further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the method described above when executing the program.
[0042] The application further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and the computer program is executable on a processor to implement the method described above.
[0043] The application further provides a computer program product including a computer program, and the computer program is executable on a processor to implement the method described above.
[0044] The application provides an RDP tunnel encrypted traffic detection method and device based on interaction behavior, which obtains unknown RDP traffic to be detected, extracts metadata of the unknown RDP traffic, aggregates metadata of 10 flows with the same source IP, destination IP and destination port into one basic unit, then extracts session features and interaction features of the basic unit, inputs the extracted features into a pre-trained RDP attack behavior detection model to obtain a probability prediction value output by the RDP attack behavior detection model, and determines that the unknown RDP traffic is dangerous traffic if the probability prediction value is greater than a preset probability value, wherein the RDP attack behavior detection model is obtained by training a pre-constructed machine learning network using sample traffic and corresponding probability labels.
[0045] In this way, the method and device provided by the application extract session features and interaction features of encrypted attack traffic under an RDP tunnel, input the features into a machine learning algorithm to generate an RDP attack behavior detection model, and use the trained RDP attack behavior detection model to accurately detect attack behavior under the RDP tunnel, thereby solving the problem that attack behavior under the RDP tunnel is difficult to be effectively detected in an early stage. BRIEF DESCRIPTION OF DRAWINGS
[0046] In order to more clearly illustrate the technical solutions in the application or prior art, the following will briefly introduce the drawings needed in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative effort.
[0047] Figure 1 is one of the flow schematic diagrams of the RDP tunnel encrypted traffic detection method based on interactive behavior provided by the application;
[0048] Figure 2 is the second flow schematic diagram of the RDP tunnel encrypted traffic detection method based on interactive behavior provided by the application;
[0049] Figure 3 is the structural block diagram of the RDP tunnel encrypted traffic detection device based on interactive behavior provided by the application;
[0050] Figure 4 is the structural schematic diagram of the electronic device provided by the application. DETAILED DESCRIPTION
[0051] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the present application will be described clearly and completely below in combination with the drawings in the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.
[0052] In one specific embodiment, the present application provides an RDP tunnel encrypted traffic detection method based on interactive behavior, as shown in Figure 1 The method comprises the following steps:
[0053] S110: obtaining unknown RDP traffic to be detected;
[0054] S120: extracting metadata of the unknown RDP traffic, aggregating metadata of 10 flows with the same source IP, destination IP and destination port into one basic unit, and then extracting session features and interactive features of the basic unit; flow aggregation aims to take 10 flows as a unit to facilitate analysis and comparison of features of different flows in the unit, thereby improving the accuracy and efficiency of feature extraction.
[0055] S130: inputting the extracted features into a pre-trained RDP attack behavior detection model to obtain a probability prediction value output by the RDP attack behavior detection model;
[0056] S140: if the probability prediction value is greater than a preset probability value, then determining that the unknown RDP traffic is dangerous traffic;
[0057] The RDP attack behavior detection model is obtained by training a pre-constructed machine learning network using sample traffic and corresponding probability labels.
[0058] In the detection process, the characteristics of the unknown RDP traffic are extracted, the characteristics are input into the RDP tunnel attack behavior detection model, and it is judged whether the probability of the unknown RDP traffic belonging to label 1 is greater than 0.6. If it is greater than 0.6, it is determined to be RDP tunnel attack behavior traffic.
[0059] Specifically, as shown in Figure 2 The sample traffic and the corresponding probability label are used to train the pre-constructed machine learning network to obtain the RDP attack behavior detection model, which specifically includes the following steps:
[0060] S210: Obtain a large amount of sample traffic, and divide the sample traffic into black traffic data set and white traffic data set; in a specific use scenario, an open source tool SocksOverRDP can be used to build an RDP encryption tunnel, forward the heartbeat traffic generated by CobaltStrike to generate a black traffic data set, and forward normal website access traffic to generate a white traffic data set.
[0061] S220: Extract target metadata for each RDP session in the sample traffic; the target metadata specifically includes session start time, session end time, client IP, server IP, server port, encrypted payload length list, ACK number list of the frame where the encrypted payload is located, and time list of the frame where the encrypted payload is located.
[0062] Specifically, a session is the complete process from establishing a connection to completing data transmission of a client and a server, and metadata as shown in Table 1 is extracted for each RDP session:
[0063] Table 1
[0064] Metadata Metadata English representation Session start time time_start Session end time time_stop Client IP ip_client Server IP ip_server Server port port_server Encrypted payload length list ENC_DATA_LEN Encrypted payload frame ACK number list ENC_DATA_ACK Encrypted payload frame time list ENC_DATA_TIME
[0065] S230: Extract the time feature and length feature of the payload in each RDP session, and construct a black traffic feature set and a white traffic feature set respectively, set the features in the black traffic feature set and the features in the white traffic feature set with labels respectively, and construct a feature set with the extracted features and the corresponding labels; when constructing the feature set, the time feature and the length feature of the payload in the session are calculated, and two different labels are used to identify the black traffic feature set and the white traffic feature set, for example, the black traffic feature set is set with label 1, and the white traffic feature set is set with label 0.
[0066] S240: Input the feature set into the pre-constructed machine learning network for training to obtain the RDP attack behavior detection model; input the extracted features into machine learning algorithms such as random forest, logistic regression, and support vector machine, train the detection model, select the best algorithm, and store the trained model into a file.
[0067] In S230, the constructing the feature set specifically includes the following steps:
[0068] S1: extracting field data from each RDP session;
[0069] S2: calculating the maximum value, the minimum value, the average value and the difference coefficient of each target list in the field data respectively; specifically, extracting the client first packet length feature in N interactions, the server first packet length feature in N interactions, the client tail packet length feature in N interactions, the server tail packet length feature in N interactions, the client total payload length feature in N interactions, the server total payload length feature in N interactions, the client total payload number feature in N interactions, the server total payload number feature in N interactions, the time interval feature between N interactions, and the interaction duration feature; N is a positive integer, for example, the value of N can be 10.
[0070] S3: calculating the transition matrix of the length list, the time list and the number list in the target list respectively; the target list specifically includes calculating the client packet length list, the client packet time interval list, the length list calculated by the client according to ACK, the server packet length list, the server packet time interval list, and the length list calculated by the server according to ACK;
[0071] S4: constructing the feature set based on the transition matrix of the length list, the time list and the number list of each session.
[0072] In order to facilitate understanding, the following takes a specific use scenario as an example to briefly describe the specific process of constructing the feature set.
[0073] The ENC_DATA_LEN, ENC_DATA_ACK and ENC_DATA_TIME of each RDP session in the black and white traffic set are taken as inputs to construct the feature set.
[0074] The data shown in Table 2 is extracted from each RDP session:
[0075] Table 2
[0076]
[0077]
[0078] The maximum, minimum, average, coefficient of variation and transition matrix of the client packet length list (uCLenList), the client packet time interval list (uCIntervalList), the client length list calculated according to ACK (uCACKList), the server packet length list (uSACKList), the server packet time interval list (uSIntervalList), the server length list calculated according to ACK (uSACKList).
[0079] In the interactive feature process, the first 10 interactions of each session are extracted, and the data shown in Table 3 is extracted for each interaction, the client sends data, the server responds to the data, and one bidirectional communication is defined as an interaction.
[0080] Table 3
[0081] Client first packet length uCFirstLen Client last packet length uCLastLen Client total packet count uCTotalCount Client total packet length uCTotalLen Interaction duration uDuration Server first packet length uSFirstLen Server last packet length uSLastLen Server total packet count uSTotalCount Server total packet length uSTotalLen
[0082] The client first packet length feature in 10 interactions is extracted, and the details are shown in Table 4:
[0083] Table 4
[0084] fInteractionCFirstLenMax Client first packet maximum value of 10 interactions fInteractionCFirstLenMin Client first packet minimum value of 10 interactions fInteractionCFirstLenMean Client first packet average value of 10 interactions fInteractionCFirstLenCoef Client first packet coefficient of variation of 10 interactions fInteractionCFirstLenTrans Client first packet transition matrix of 10 interactions
[0085] The server first packet length feature in 10 interactions is extracted, and the details are shown in Table 5:
[0086] Table 5
[0087] fInteractionSFirstLenMax Server first packet maximum value of 10 interactions fInteractionSFirstLenMin Server first packet minimum value of 10 interactions fInteractionSFirstLenMean Server first packet average value of 10 interactions fInteractionSFirstLenCoef Server first packet coefficient of variation of 10 interactions fInteractionSFirstLenTrans Server first packet transition matrix of 10 interactions
[0088] The client tail packet length feature in 10 interactions is extracted, and the details are shown in Table 6:
[0089] Table 6
[0090] fInteractionCLastLenMax Client last packet maximum value of 10 interactions fInteractionCLastLenMin Client last packet minimum value of 10 interactions fInteractionCLastLenMean Client last packet average value of 10 interactions fInteractionCLastLenCoef Client last packet coefficient of variation of 10 interactions fInteractionCLastLenTrans Client last packet transition matrix of 10 interactions
[0091] The server tail packet length feature in 10 interactions is extracted, and the details are shown in Table 7:
[0092] Table 7
[0093]
[0094]
[0095] The client total payload length feature in 10 interactions is extracted, and the details are shown in Table 8:
[0096] Table 8
[0097] fInteractionCTotalLenMax Client total payload length maximum value of 10 interactions fInteractionCTotalLenMin Client total payload length minimum value of 10 interactions fInteractionCTotalLenMean Mean of client total length of 10 interactions fInteractionCTotalLenCoef Coefficient of variation of client total length of 10 interactions fInteractionCTotalLenTrans Transition matrix of client total length of 10 interactions
[0098] Extract 10 features of the total length of the server in the interaction, as shown in Table 9:
[0099] Table 9
[0100] fInteractionSTotalLenMax Max of server total length of 10 interactions fInteractionSTotalLenMin Min of server total length of 10 interactions fInteractionSTotalLenMean Mean of server total length of 10 interactions fInteractionSTotalLenCoef Coefficient of variation of server total length of 10 interactions fInteractionSTotalLenTrans Transition matrix of server total length of 10 interactions
[0101] Extract 10 features of the total number of client payloads in the interaction, as shown in Table 10:
[0102] Table 10
[0103] fInteractionCTotalCountMax Max of client total count of 10 interactions fInteractionCTotalCountMin Min of client total count of 10 interactions fInteractionCTotalCountMean Mean of client total count of 10 interactions fInteractionCTotalCountCoef Coefficient of variation of client total count of 10 interactions fInteractionCTotalCountTrans Transition matrix of client total count of 10 interactions
[0104] Extract 10 features of the total number of server payloads in the interaction, as shown in Table 11:
[0105] Table 11
[0106]
[0107]
[0108] Extract 10 features of the time interval between interactions, as shown in Table 12:
[0109] Table 12
[0110] fInteractionIntervalMax Max of interval of 10 interactions fInteractionIntervalMin Min of interval of 10 interactions fInteractionIntervalMean Mean of interval of 10 interactions fInteractionIntervalCoef Coefficient of variation of interval of 10 interactions fInteractionIntervalTrans Transition matrix of interval of 10 interactions
[0111] Extract 10 features of the duration of the interaction, as shown in Table 13:
[0112] Table 13
[0113] fInteractionDurationMax Max of duration of 10 interactions fInteractionDurationMin Min of duration of 10 interactions fInteractionDurationMean Mean of duration of 10 interactions fInteractionDurationCoef Coefficient of variation of duration of 10 interactions fInteractionDurationTrans Transition matrix of duration of 10 interactions
[0114] In the transition matrix process, the data needed to calculate the transition matrix is divided into three categories: the first category is length, the second category is time, and the third category is number.
[0115] 1. Calculate the transition matrix of the length list
[0116] Take the calculation of the transition matrix of uCLenList (client packet length list) as an example, divide the packet length into 10 segments, which are [0, 128), [128, 256), [256, 512), [512, 1024), [1024, 2048), [2048, 4096), [4096, 8192), [8192, 16384), [16384, 32768), [32768, ∞). Different segments represent different values, as shown in Table 14:
[0117] Table 14
[0118]
[0119]
[0120] A length conversion relationship matrix between each data packet and adjacent data packet is constructed, a 10*10 transition relationship matrix is adopted, and is spliced as a 100-dimensional feature vector according to rows. The original data packet length is taken as a row, and the adjacent data packet length is taken as a column to generate a transition matrix of uCLenList. The transition matrix generation formula is:
[0121] M[i][i+1]=M[i][i+1]+1
[0122] M represents a transition matrix, i represents a value corresponding to the original data packet length, and i+1 represents a value corresponding to the adjacent data packet length.
[0123] Taking a packet length sequence [128, 166, 85, 885, 133, 469, 53, 37, 53, 53] as an example, the calculation process is as shown in Table 15:
[0124] Table 15
[0125]
[0126]
[0127] A sequence [0, 1, 0, 3, 1, 2, 0, 0, 0, 0] is generated:
[0128] The first value is 0, the adjacent value is 1, the element in the 0th row and the 1st column of the matrix is assigned as 1, and M[0][1]=1;
[0129] The second value is 1, the adjacent value is 0, the element in the 1st row and the 0th column of the matrix is assigned as 1, and M[1][0]=1;
[0130] The third value is 0, the adjacent value is 3, the element in the 0th row and the 3rd column of the matrix is assigned as 1, and M[0][3]=1;
[0131] The fourth value is 3, the adjacent value is 1, the element in the 3rd row and the 1st column of the matrix is assigned as 1, and M[3][1]=1;
[0132] The fifth value is 1, the adjacent value is 2, the element in the 1st row and the 2nd column of the matrix is assigned as 1, and M[1][2]=1;
[0133] The sixth value is 2, the adjacent value is 0, the element in the 2nd row and the 0th column of the matrix is assigned as 1, and M[2][0]=1;
[0134] The seventh value is 0, the adjacent value is 0, the element in the 0th row and the 0th column of the matrix is assigned as 1, and M[0][0]=1;
[0135] The eighth value is 0, and the adjacent value is 0, then the element value of the 0th row and 0th column in the matrix is added by 1, the value becomes 2, M[0][0] = 1 + 1 = 2;
[0136] The ninth value is 0, and the adjacent value is 0, then the element value of the 0th row and 0th column in the matrix is added by 1, the value becomes 3, M[0][0] = 2 + 1 = 3.
[0137] 2. Calculate the transition matrix of the time list
[0138] Taking the calculation of the transition matrix of uCIntervalList (client packet time interval list) as an example, the adjacent packet time interval sequence feature is constructed, and the time interval is divided into 10 segments, [0ms, 55ms), [55ms, 150ms), [150ms, 550ms), [550ms, 1500ms), [1500ms, 5500ms), [5500ms, 10500ms), [10500ms, 31000ms), [31000ms, 62000ms), [62000ms, 310000ms), [310000ms, ∞ms). As shown in Table 16, different segments represent different values.
[0139] Table 16
[0140] Interval range Corresponding value [0ms, 55ms) 0 [55ms, 150ms) 1 [150ms, 550ms) 2 [550ms, 1500ms) 3 [1500ms, 5500ms) 4 [5500ms, 10500ms) 5 [10500ms, 31000ms) 6 [31000ms, 62000ms) 7 [62000ms, 310000ms) 8 [310000ms, ∞ms) 9
[0141] The adjacent packet time interval sequence transition relationship matrix is constructed, a 10*10 transition relationship matrix is adopted, and is spliced as a 100-dimensional feature vector according to rows. The original time interval is taken as a row, and the adjacent time interval is taken as a column to generate a transition matrix. The transition matrix generation formula is
[0142] M[i][i+1] = M[i][i+1] + 1
[0143] M represents the transition matrix, i represents the value corresponding to the original time interval, and i+1 represents the value corresponding to the adjacent time interval.
[0144] 3. Calculate the transition matrix of the number list
[0145] Taking the calculation of the transition matrix of fInteractionCTotalCountTrans (10 interaction client total load count) as an example.
[0146] The adjacent interaction client total load count is divided into 10 segments, [0, 1), [1, 2), [2, 5), [5, 10), [10, 15), [15, 20), [20, 25), [25, 30), [30, 35), [35, ∞), as shown in Table 17, different segments represent different values.
[0147] Table 17
[0148] time interval range corresponding value [0,1) 0 [1,2) 1 [2,5) 2 [5,10) 3 [10,15) 4 [15,20) 5 [20,25) 6 [25,30) 7 [30,35) 8 [35,∞) 9
[0149] A transition relationship matrix of 10*10 is constructed for the number of adjacent interactive client total loads, and is spliced as a 100-dimensional feature vector according to rows. The transition matrix is generated by taking the original number of client total loads as rows and the number of adjacent client total loads as columns. The transition matrix generation formula is as follows:
[0150] M[i][i+1] = M[i][i+1] + 1
[0151] M represents the transition matrix, i represents the value corresponding to the original number of client total loads, and i+1 represents the value corresponding to the number of adjacent client total loads.
[0152] In the above specific embodiments, the RDP tunnel encrypted traffic detection method based on interaction behavior provided by the application can obtain unknown RDP traffic to be detected, extract metadata of the unknown RDP traffic, aggregate metadata of 10 flows with the same source IP, destination IP and destination port into a basic unit, and then extract session features and interaction features of the basic unit. The extracted features are input into a pre-trained RDP attack behavior detection model, and a probability prediction value output by the RDP attack behavior detection model can be obtained. If the probability prediction value is greater than a preset probability value, the unknown RDP traffic is determined as dangerous traffic. The RDP attack behavior detection model is obtained by training a pre-constructed machine learning network using sample traffic and corresponding probability labels.
[0153] In this way, the method provided by the application can extract session features and interaction features of encrypted attack traffic under the RDP tunnel, input the features into a machine learning algorithm, generate an RDP attack behavior detection model, and accurately detect RDP attack behavior under the RDP tunnel by using the trained RDP attack behavior detection model, thereby solving the problem that RDP attack behavior under the RDP tunnel is difficult to be effectively detected in the early stage.
[0154] The application further provides an RDP tunnel encrypted traffic detection device based on interaction behavior, as shown in Figure 3 The device comprises:
[0155] A traffic acquisition unit 310 is configured to acquire unknown RDP traffic to be detected.
[0156] The feature extraction unit 320 is configured to extract metadata of the unknown RDP traffic, aggregate metadata of 10 flows with the same source IP, destination IP and destination port into one basic unit, and then extract session features and interaction features of the basic unit;
[0157] The probability generation unit 330 is configured to input the extracted features into a pre-trained RDP attack behavior detection model to obtain a probability prediction value output by the RDP attack behavior detection model.
[0158] The result generation unit 340 is configured to determine that the unknown RDP traffic is dangerous traffic if the probability prediction value is greater than a preset probability value.
[0159] The RDP attack behavior detection model is obtained by training a pre-constructed machine learning network using sample traffic and corresponding probability labels.
[0160] In some embodiments, the RDP attack behavior detection model is obtained by training a pre-constructed machine learning network using sample traffic and corresponding probability labels, and specifically includes:
[0161] A large amount of sample traffic is obtained, and the sample traffic is divided into a black traffic data set and a white traffic data set.
[0162] Target metadata is extracted for each RDP session in the sample traffic.
[0163] Time features and length features of the payload in each RDP session are extracted, and a black traffic feature set and a white traffic feature set are constructed, respectively. Features in the black traffic feature set and features in the white traffic feature set are labeled, respectively, and a feature set is constructed from the extracted features and corresponding labels.
[0164] The feature set is input into a pre-constructed machine learning network for training to obtain the RDP attack behavior detection model.
[0165] In some embodiments, the target metadata specifically includes a session start time, a session end time, a client IP, a server IP, a server port, a list of encrypted payload lengths, a list of ACK numbers of frames where the encrypted payload is located, and a list of times of frames where the encrypted payload is located.
[0166] In some embodiments, the construction of the feature set specifically includes:
[0167] Field data is extracted from each RDP session.
[0168] The maximum value, the minimum value, the average value and the difference coefficient of each target list in the field data are calculated, respectively.
[0169] extracting target interaction data in each interaction;
[0170] calculating transition matrix of length list, time list and number list in the target list respectively;
[0171] constructing feature set based on transition matrix of length list, time list and number list of each session.
[0172] In some embodiments, the target list specifically includes client packet length list, client packet time interval list, client length list calculated according to ACK, server packet length list, server packet time interval list, and server length list calculated according to ACK.
[0173] In some embodiments, extracting target interaction data in each interaction specifically includes:
[0174] extracting client first packet length feature in N interactions;
[0175] extracting server first packet length feature in N interactions;
[0176] extracting client last packet length feature in N interactions;
[0177] extracting server last packet length feature in N interactions;
[0178] extracting client total payload length feature in N interactions;
[0179] extracting server total payload length feature in N interactions;
[0180] extracting client total payload number feature in N interactions;
[0181] extracting server total payload number feature in N interactions;
[0182] extracting time interval feature between N interactions;
[0183] extracting duration feature of N interactions.
[0184] In the foregoing specific embodiments, the RDP tunnel encrypted traffic detection device based on interaction behavior provided by the application can obtain unknown RDP traffic to be detected, extract metadata of the unknown RDP traffic, aggregate metadata of 10 flows with the same source IP, destination IP and destination port into one basic unit, and then extract session features and interaction features of the basic unit; the extracted features are input into a pre-trained RDP attack behavior detection model, and a probability prediction value output by the RDP attack behavior detection model can be obtained; if the probability prediction value is greater than a preset probability value, it is determined that the unknown RDP traffic is dangerous traffic; wherein the RDP attack behavior detection model is obtained by training a pre-constructed machine learning network using sample traffic and corresponding probability labels.
[0185] In this way, the device provided by the application can extract the session features and interaction features of the encrypted attack traffic under the RDP tunnel, input the features into the machine learning algorithm, generate the RDP attack behavior detection model, and use the trained RDP attack behavior detection model to accurately detect the attack behavior under the RDP tunnel, thereby solving the problem that the attack behavior under the RDP tunnel is difficult to be effectively detected in the early stage.
[0186] Figure 4 An example of a schematic diagram of the physical structure of an electronic device is shown in Figure 4 As shown, the electronic device can include a processor 410, a communications interface 420, a memory 430 and a communications bus 440, wherein the processor 410, the communications interface 420 and the memory 430 can communicate with each other through the communications bus 440. The processor 410 can invoke the logical instructions in the memory 430 to execute the method as described above.
[0187] In addition, the logic instructions in the memory 430 described above can be implemented in the form of software function units and sold or used as independent products, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.
[0188] In another aspect, the present application also provides a computer program product, which includes a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor to enable a computer to execute the above-mentioned methods.
[0189] In another aspect, the present application also provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the above-mentioned methods.
[0190] The device embodiments described above are only schematic, wherein the units illustrated as separate components can or can not be physically separated, and the components illustrated as units can or can not be physical units, that is, they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment according to actual needs. Those skilled in the art can understand and implement without creative labor.
[0191] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be implemented by means of software plus necessary universal hardware platforms, and of course can also be implemented by hardware. Based on such understanding, the above technical solutions essentially or the parts that contribute to the prior art can be embodied in the form of a software product. The computer software product can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0192] It should be pointed out finally that the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit the same; and although the present application has been described in detail with reference to the foregoing embodiments, it should be appreciated by those skilled in the art that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features thereof can be replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.
Claims
1. A method for detecting RDP tunneling encrypted traffic based on interactive behavior, characterized in that, The method comprises: acquiring unknown RDP traffic to be detected; extracting metadata of the unknown RDP traffic, aggregating metadata of 10 flows with the same source IP, destination IP and destination port into one basic unit, and then extracting session features and interaction features of the basic unit; inputting the extracted features into a pre-trained RDP attack behavior detection model to obtain a probability prediction value output by the RDP attack behavior detection model; if the probability prediction value is greater than a preset probability value, it is determined that the unknown RDP traffic is dangerous traffic; wherein the RDP attack behavior detection model is obtained by training a pre-constructed machine learning network using sample traffic and corresponding probability labels.
2. The RDP tunneling encryption traffic detection method based on interaction behavior according to claim 1, characterized in that, The RDP attack behavior detection model is obtained by training a pre-constructed machine learning network using sample traffic and corresponding probability labels, specifically comprising: acquiring a large amount of sample traffic and dividing the sample traffic into black traffic data set and white traffic data set; extracting target metadata for each RDP session in the sample traffic; extracting time features and length features of the payload in each RDP session, and constructing black traffic feature set and white traffic feature set respectively, setting labels for the features in the black traffic feature set and the features in the white traffic feature set respectively, and constructing a feature set from the extracted features and corresponding labels; inputting the feature set into the pre-constructed machine learning network for training to obtain the RDP attack behavior detection model.
3. The RDP tunneling encryption traffic detection method based on interaction behavior according to claim 2, characterized in that, The target metadata specifically includes session start time, session end time, client IP, server IP, server port, encrypted payload length list, ACK number list of the frame where the encrypted payload is located, and time list of the frame where the encrypted payload is located.
4. The RDP tunneling encryption traffic detection method based on interaction behavior according to claim 3, characterized in that, The construction of the feature set specifically comprises: extracting field data from each RDP session; calculating the maximum value, minimum value, average value and difference coefficient of each target list in the field data respectively; extracting the first N interactions of each session and extracting target interaction data in each interaction; calculating the transition matrix of the length list, time list and number list in the target list respectively; constructing a feature set based on the transition matrix of the length list, time list and number list of each session.
5. The RDP tunneling encryption traffic detection method based on interaction behavior according to claim 4, characterized in that, The target list specifically includes calculating the client packet length list, client packet time interval list, client length list calculated according to ACK, server packet length list, server packet time interval list, and server length list calculated according to ACK.
6. The RDP tunneling encryption traffic detection method based on interaction behavior according to claim 5, characterized in that, Extracting target interaction data in each interaction specifically comprises: extracting client first packet length features in N interactions; extracting server first packet length features in N interactions; extracting client tail packet length features in N interactions; extracting server tail packet length features in N interactions; extracting client total payload length features in N interactions; extracting server total payload length features in N interactions; extracting client total payload number features in N interactions; extracting server total payload number features in N interactions; extracting features of time intervals between N interactions; extracting features of durations of N interactions.
7. An RDP tunneling traffic detection apparatus based on interaction behavior, characterized by, The device comprises: a flow acquisition unit configured to acquire unknown RDP flow to be detected; a feature extraction unit configured to extract metadata of the unknown RDP flow, aggregate metadata of 10 flows with the same source IP, destination IP and destination port into one basic unit, and then extract session features and interaction features of the basic unit; a probability generation unit configured to input the extracted features into a pre-trained RDP attack behavior detection model to obtain a probability prediction value output by the RDP attack behavior detection model; a result generation unit configured to determine that the unknown RDP flow is dangerous flow if the probability prediction value is greater than a preset probability value. The RDP attack behavior detection model is obtained by training a pre-constructed machine learning network using sample flow and corresponding probability labels.
8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the method of any one of claims 1-6. 9.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1-6.
10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1-6.