Data link traceability detection method and system based on abnormal network behaviors

Abstract

The invention discloses a data link traceability detection method and system based on abnormal network behaviors, and the method comprises the steps: firstly extracting three features which are difficult to counterfeit at the same time, namely, TTL and TCP window sizes and TCP initial serial numbers, from network traffic, forming a sequence, and improving the reliability of a traceability result; analyzing the TTL value by using a clustering algorithm, and calculating the most possible initial network hop count of a data packet source; constructing a path topology model by fusing the hop count, the window size and the serial number sequence and adopting a particle swarm optimization algorithm and stability analysis; and then, on the basis of the path topology model, performing dual verification by combining graph analysis and variable coefficient statistical test, finally locking the specific position of an attack source in the network topology, and realizing accurate source tracing of the network attack.

Description

Technical Field

[0001] This invention relates to the field of network attack attribution, and in particular to a data link attribution detection method and system based on abnormal network behavior. Background Technology

[0002] With the increasing complexity and sophistication of cyberattacks, especially the proliferation of Advanced Persistent Threats (APTs), Distributed Denial-of-Service (DDoS) attacks, and network spoofing attacks, accurately and reliably tracing the source of attacks has become a core challenge in the field of cybersecurity. Traditional cyberattack attribution techniques largely rely on single-dimensional information, such as IP addresses, routing table looks, or simple TTL hop count estimations. However, these methods become significantly less effective and reliable when faced with attackers using anti-attribution techniques such as IP spoofing, botnet hosts, and packet tampering.

[0003] In existing technologies, researchers have attempted to extract multi-dimensional features from data packets for fusion analysis to improve the accuracy of attribution tracing. For example, analyzing TTL value sequences can estimate the approximate number of hops at the attack source, or using the differences in TCP window size and initial sequence number (ISN) can fingerprint the source operating system. These methods strengthen the evidence chain for attribution tracing to some extent, but still have significant technical limitations:

[0004] Existing technologies typically stop at feature extraction and simple comparison, lacking a unified computational framework capable of deeply integrating features from the network layer (such as TTL) and transport layer (such as TCP window, ISN). Each feature sequence is analyzed independently, failing to construct an enhanced topology model that describes the overall behavior and stability of the path. This results in incomplete tracing results, unable to counter attackers' deception based on single features.

[0005] While some advanced solutions attempt to reconstruct path topology using optimization algorithms (such as Particle Swarm Optimization, PSO), their optimization objectives often focus solely on making the reconstructed path characteristics numerically best match the observed data. This approach suffers from a fundamental flaw: the "optimal path" it reconstructs may be a mathematically perfect fit, but an invalid path that is fundamentally impossible in the physical network topology or has extremely poor stability. For example, a fitted path might skip real, essential routing nodes in its node sequence to match the observed TTL value, which clearly does not reflect the reality of network connectivity.

[0006] Current technologies lack a mechanism to quantify the coherence and rationality of a candidate path's structure. They cannot calculate metrics like the "path hop factor" to measure the drastic changes in packet characteristics between adjacent nodes. A genuine, stable path should have a TTL that decreases hop-by-hop, and TCP characteristics should change smoothly across similar devices. However, attack paths or paths resulting from reconstruction errors often exhibit abrupt changes in characteristic values. Because current technologies cannot quantify this "hop," they struggle to identify structurally flawed or potentially forged paths from among numerous candidate paths.

[0007] Similarly, existing technologies often perform isolated, snapshot-based analyses when evaluating nodes and paths. They lack analysis of node behavior fluctuations based on historical baselines (such as instantaneous fluctuation deviations), failing to determine whether a node's current behavior has significantly deviated from its normal historical state. More importantly, they lack global correlation analysis. They cannot identify which nodes are shared by a large number of suspicious paths (i.e., potentially critical attack springboards or controlled hosts) using metrics like network node attack contribution rate. Without this global correlation calibration, path confidence assessments are isolated, potentially overestimating some occasional anomalous paths while underestimating paths truly composed of critical attack nodes. Summary of the Invention

[0008] The purpose of this invention is to provide a data link source tracing and detection method based on abnormal network behavior, which solves the above-mentioned technical problems pointed out in the prior art.

[0009] This invention provides a data link source tracing and detection method based on abnormal network behavior, comprising the following steps:

[0010] Collect network data packets on the target data link and extract the TTL value, TCP window size, and TCP initial sequence number of each data packet to form a TTL value sequence, a TCP window size sequence, and a TCPISN sequence;

[0011] Based on the TTL value sequence, a preliminary hop count estimate of the data packet is calculated using clustering processing combined with pattern recognition methods;

[0012] By integrating the preliminary hop count estimate, the TCP window size sequence, and the TCP initial sequence number sequence, a path topology model is constructed using a particle swarm optimization algorithm combined with path node stability analysis.

[0013] The network node connection relationships in the abnormal state of the path topology model are analyzed, the path consistency is verified based on the coefficient of variation distribution, and the network location estimation result of the attack source is output.

[0014] Preferably, the process of fusing the preliminary hop count estimate, the TCP window size sequence, and the TCP initial sequence number sequence using a particle swarm optimization algorithm combined with path node stability analysis to construct a path topology model includes the following steps:

[0015] The preliminary hop count estimate, TCP window size sequence, and TCP initial sequence number sequence are standardized to obtain a preprocessed multidimensional feature vector.

[0016] Initialize particle swarm parameters, which include multiple candidate path topology models, particle positions, and particle velocities; iteration counter; the iteration count of the iteration counter is initially set to 0;

[0017] The fitness function value is obtained by analyzing and calculating the preprocessed multidimensional feature vector based on the position of each particle.

[0018] Increment the iteration count by 1 to obtain the current iteration count. Based on the current iteration count and the fitness function value, filter the results and output the topology model of the target path to be determined.

[0019] Perform path node stability analysis on the topology model of the target path to be determined, and output the target path topology model.

[0020] Preferably, the particle position is set as a high-dimensional vector, where each dimension of the high-dimensional vector represents the confidence of a connecting edge in each candidate path topology model; the particle velocity represents the magnitude of the direction of particle position adjustment when the candidate path topology model searches in the solution space.

[0021] Preferably, the step of filtering based on the current iteration number and fitness function value to output the topology model of the target path to be determined includes the following steps:

[0022] The algorithm determines whether the fitness function value corresponding to the current iteration number is greater than the fitness function value generated in the previous iteration. If so, it determines the candidate path topology model corresponding to the current fitness function value as the path topology model to be determined. If not, it retains the candidate path topology model corresponding to the fitness function value generated in the previous iteration as the path topology model to be determined. The algorithm further determines whether the current iteration number is greater than or equal to the preset maximum threshold for the number of iterations. If so, it outputs the current path topology model to be determined as the target path topology model to be determined. If not, it updates the particle position according to the particle velocity to obtain a new candidate path topology model and returns the new candidate path topology model to the particle swarm optimization process for re-iteration until the target path topology model to be determined is output.

[0023] Preferably, the step of performing path node stability analysis on the topology model of the target path to be determined, and outputting the target path topology model, includes the following steps:

[0024] Traverse each network node in the topology model of the target path to be determined, and extract the dataset of all source IP addresses that are considered to have passed through the network nodes for each network node; the dataset includes preprocessed multidimensional feature vectors.

[0025] Calculate the volatility factor for the dataset of each network node;

[0026] Obtain a representative dataset for each network node; calculate the path jump factor for each candidate path parsed from the topology model of the target path to be determined based on the representative dataset of each network node.

[0027] Based on the fluctuation factors of all network nodes and the path jump factors of all candidate paths, anomaly indicators are obtained through attack contribution rate analysis of network nodes and attack path confidence analysis of candidate paths.

[0028] Based on the abnormal element identifiers, the correction process is performed through comprehensive disbelief calculation and analysis, and the final target path topology model is output.

[0029] Preferably, the anomaly identifiers include network node anomaly identifiers and candidate path anomaly identifiers.

[0030] Preferably, the step of obtaining anomaly identifiers based on the fluctuation factors of all network nodes and the path jump factors of all candidate paths through attack contribution rate analysis of network nodes and attack path confidence analysis of candidate paths includes the following steps:

[0031] For each network node, obtain multiple historical fluctuation factors for multiple historical time nodes in a continuous historical time period, and calculate the instantaneous fluctuation deviation of the current fluctuation factor of each network node relative to the historical fluctuation factor based on the analysis of the historical fluctuation factors.

[0032] Obtain the connection topology of each network node, examine the path sequence of each candidate path based on the connection topology of the network nodes, and obtain the prior topology condition score; calculate the reasonable score of path jump based on the prior topology condition score and the path jump factor of the candidate path.

[0033] The first candidate path is obtained by filtering based on the prior topological condition score of each candidate path; the sum of abnormal behaviors of the first candidate path is calculated based on the instantaneous fluctuation deviation of all network nodes of the first candidate path; the unreasonableness score of the path is calculated based on the reasonableness score of the path jump; the attack path confidence is obtained by using the sum of abnormal behaviors and the unreasonableness score of the path.

[0034] Anomaly markers are obtained by combining attack path confidence with network node occurrence frequency analysis.

[0035] Preferably, the step of identifying anomalies based on attack path confidence combined with network node occurrence frequency analysis includes the following steps:

[0036] Calculate the median and interquartile range of the attack path confidence for all first candidate paths; then, select second candidate paths from the first candidate paths based on the attack path confidence, the median, and the interquartile range.

[0037] For each network node, the frequency of its appearance in all second candidate paths is counted to obtain the network node attack contribution rate; network nodes with an attack rate greater than N are selected and marked as network node anomalies; the attack path confidence is adjusted using the network node attack contribution rate to obtain the adjusted attack path confidence.

[0038] Select the second candidate path with a confidence level greater than M after adjustment and mark it as an anomaly.

[0039] Accordingly, the present invention also proposes a data link tracing and detection system based on abnormal network behavior, including a data acquisition module, a hop count estimation module, a path topology module and a verification output module;

[0040] The data acquisition module is used to collect network data packets on the target data link and extract the TTL value, TCP window size and TCP initial sequence number of each data packet to form a TTL value sequence, a TCP window size sequence and a TCPISN sequence.

[0041] The hop count estimation module is used to calculate a preliminary hop count estimate of the data packet based on the TTL value sequence by using clustering processing combined with pattern recognition methods.

[0042] The path topology module is used to integrate the preliminary hop count estimate, the TCP window size sequence, and the TCP initial sequence number sequence, and construct a path topology model by combining the particle swarm optimization algorithm with path node stability analysis.

[0043] The verification output module is used to analyze the network node connection relationships of abnormal states in the path topology model, perform path consistency verification based on the coefficient of variation distribution, and output the network location estimation result of the attack source.

[0044] In another aspect, the present invention also provides a storage medium storing a computer program, which, when executed by a processor, implements the aforementioned data link tracing and detection method based on abnormal network behavior.

[0045] Compared with the prior art, the embodiments of the present invention have at least the following technical advantages:

[0046] Analysis of the data link tracing and detection method and system based on abnormal network behavior provided by this invention reveals that, in practical applications, three features that are difficult to forge simultaneously—TTL (reflecting the number of transmission hops), TCP window size (reflecting device and network status), and TCP initial sequence number (reflecting the operating system fingerprint)—are first extracted from network traffic to form a sequence. Attackers find it extremely difficult to simultaneously and stably forge features from three different protocol layers. The processing method of this embodiment improves the reliability of the tracing results. Furthermore, this embodiment utilizes a clustering algorithm to analyze the TTL value, filter noise, calculate the most likely initial network hop count of the data packet source, and quantify the features. This method transforms abstract network data into specific network hop counts and topological locations, making the analysis results more accurate. By fusing hop counts, window sizes, and sequence numbers, and employing particle swarm optimization and stability analysis, an enhanced path topology model is constructed that not only displays connection relationships but also reflects path stability and behavioral characteristics. This ensures that the source tracing results include not only IP addresses but also the hierarchical location of the attack source within the network. Then, based on the path topology model, graph analysis (detecting abnormal connections) and coefficient of variation statistical tests (detecting abnormal behavioral fluctuations) are combined for dual verification, ultimately pinpointing the specific location of the attack source within the network topology and achieving accurate source tracing of network attacks. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the main process of a data link source tracing and detection method based on abnormal network behavior;

[0048] Figure 2 This is a schematic diagram simulating the operation process of constructing a path topology model in a data link tracing and detection method based on abnormal network behavior.

[0049] Figure 3 This is a schematic diagram of path simulation in the topology model of a data link source tracing and detection method based on abnormal network behavior.

[0050] Figure 4 This is a schematic diagram simulating the target path topology model in a data link tracing and detection method based on abnormal network behavior.

[0051] Figure 5This is a schematic diagram illustrating the analysis and calculation process of attack path confidence in a data link source tracing and detection method based on abnormal network behavior.

[0052] Figure 6 This is a schematic diagram of the overall architecture of a data link tracing and detection system based on abnormal network behavior.

[0053] Figure label: Data acquisition module 10, hop count estimation module 20, path topology module 30, verification output module 40. Detailed Implementation

[0054] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0055] The present invention will now be described in further detail with reference to specific embodiments and accompanying drawings.

[0056] Example 1

[0057] like Figure 1 As shown, Embodiment 1 of the present invention provides a data link source tracing and detection method based on abnormal network behavior, including the following operation steps:

[0058] Step S10: Collect network data packets on the target data link, and extract the TTL value, TCP window size, and TCP initial sequence number of each data packet to form a TTL value sequence, a TCP window size sequence, and a TCPISN sequence (the TCPISN sequence is the sequence of TCP initial sequence numbers).

[0059] It should be noted that the above-described embodiments of this application capture network data packets flowing through the monitored network data link (such as a critical egress gateway) in a bypass manner. For each captured TCP / IP data packet, its protocol header is parsed, and the TTL value (initially set by the attack source host, its value decreases by 1 for each routing node (hop) the data packet passes through, and is the core basis for estimating the number of transmission hops), TCP window size (reflecting the buffering capacity of the sending end or relay network device; different operating systems, device models, and even network path congestion conditions will cause characteristic differences in this value), and TCP initial sequence number (calculated by the operating system according to a specific formula when establishing a TCP connection) are precisely extracted. The method generates ISNs, and different operating systems have different ISN generation strategies (such as random increment and time dependence), which can be used as device fingerprint features. The values ​​of these three fields from a large number of data packets from the same data stream or the same source IP are arranged in chronological order to form three time series, providing a basis for subsequent pattern recognition and consistency analysis. By integrating multi-dimensional information from the network layer (TTL) and transport layer (TCP window, ISN), a richer and more comprehensive chain of evidence is provided for tracing the source of network attacks. At the same time, it is difficult for attackers to simultaneously forge or stably maintain the consistency of the three features of TTL, TCP window size and ISN change patterns, thereby improving the server's ability to resist network deception.

[0060] Step S20: Based on the TTL value sequence, a preliminary hop count estimate of the data packet is calculated using clustering processing combined with pattern recognition.

[0061] It should be noted that the above embodiments of this application use a clustering algorithm to find the points with the densest distribution of TTL values. This is because although the initial TTL values ​​may be different (e.g., 128 for Windows and 64 for Linux), data packets from the same path will have their TTL values ​​highly concentrated near the result after subtracting the hop count from the initial value when they arrive at the probe point. Furthermore, after identifying the main TTL clusters, the most likely number of network hops (preliminary hop count estimate) of the data packet from the source point to the current monitoring point is calculated in reverse by combining the initial TTL values ​​of common operating systems. For example, if a large number of TTL values ​​are detected to be concentrated around 117, then the most likely number of hops is 128-117=11 hops.

[0062] The processing method of this application embodiment transforms the abstract TTL value sequence into a specific network topology distance index of hop count, enabling the source tracing analysis to move from qualitative to quantitative. Through pattern recognition, abnormal and forged TTL data packets in the network are filtered out, resulting in a more reliable and statistically significant hop count estimate, thereby improving the reliability of the basic data.

[0063] Step S30: By integrating the preliminary hop count estimate, the TCP window size sequence, and the TCP initial sequence number sequence, a path topology model is constructed using a particle swarm optimization algorithm combined with path node stability analysis;

[0064] Step S40: Analyze the network node connection relationships in the abnormal state in the path topology model, perform path consistency verification based on the coefficient of variation distribution, and output the network location estimation result of the attack source.

[0065] It should be noted that, in the above embodiments of this application, a graph analysis algorithm is run on the path topology model generated in step S30 to find network nodes in abnormal states. For example, a node suddenly connects to multiple unrelated networks, or the behavioral characteristics of a certain connection (such as TTL jitter, window size) are significantly different from other parts of the topology. The above-mentioned path consistency verification based on the coefficient of variation distribution refers to calculating the coefficient of variation of key features (such as latency jitter per hop, window size change rate) in the entire topology model. The coefficient of variation distribution of a stable path should be relatively uniform and concentrated. By comparing the coefficient of variation distribution of suspicious paths with that of normal paths, a statistical significance test is performed. Then, nodes that simultaneously meet the conditions of being located on abnormal connections and whose coefficient of variation distribution deviates significantly from the normal are determined as the most likely attack source network locations. The output results include not only the IP address but also its hierarchical relationship in the topology.

[0066] The above-described embodiments of this application first extract three features from network traffic that are difficult to forge simultaneously: TTL (reflecting the number of hops), TCP window size (reflecting the device and network status), and TCP initial sequence number (reflecting the operating system fingerprint). These features are then formed into a sequence, making it extremely difficult for attackers to simultaneously and stably forge features from three different protocol layers. Through the processing method of this application embodiment, the reliability of the tracing results is improved.

[0067] Furthermore, clustering algorithms are used to analyze TTL values, filter noise, and calculate the most likely preliminary network hop count of the data packet source. This quantifies the features, transforming abstract network data into specific network hop counts and topological locations, making the analysis results more accurate. Simultaneously, by fusing hop counts, window size, and sequence number sequences, particle swarm optimization and stability analysis are employed to construct an enhanced path topology model that not only displays connection relationships but also reflects path stability and behavioral characteristics. This ensures that the tracing results include not only IP addresses but also the hierarchical location of the attack source within the network.

[0068] Finally, based on the path topology model, a dual verification is performed by combining graph analysis (to discover abnormal connections) and coefficient of variation statistical tests (to discover abnormal behavioral fluctuations), ultimately pinpointing the specific location of the attack source in the network topology and achieving accurate tracing of the network attack.

[0069] like Figure 2 As shown, specifically, in step S30, the preliminary hop count estimate, the TCP window size sequence, and the TCP initial sequence number sequence are fused together using a particle swarm optimization algorithm combined with path node stability analysis to construct a path topology model, including the following steps:

[0070] Step S31: Perform data standardization on the preliminary hop count estimate, TCP window size sequence, and TCP initial sequence number sequence to obtain a preprocessed multidimensional feature vector;

[0071] It should be noted that the above embodiments of this application are preprocessing operations that standardize the data of the above preliminary hop count estimate, TCP window size sequence and TCP initial sequence number sequence, so that they become dimensionless, fusionable multidimensional feature vectors.

[0072] Step S32: Initialize particle swarm parameters, which include multiple candidate path topology models, particle positions, and particle velocities; iteration counter; the iteration count of the iteration counter is initially set to 0;

[0073] Here, the particle position is set as a high-dimensional vector, and each dimension of the high-dimensional vector represents the confidence of a connecting edge (i.e., each possible path) in each candidate path topology model; the particle velocity represents the magnitude of the particle position in the set adjustment direction when the candidate path topology model is optimized and searched.

[0074] Step S33: Analyze and calculate the fitness function value based on the position of each particle and the preprocessed multidimensional feature vector;

[0075] It should be noted that in the above embodiments of this application, the candidate path topology model corresponding to the particle position is first obtained based on the particle position. Then, the candidate path topology model is used to back-infer the inferred multidimensional feature vector under the current data packet. Then, the fitness function value is calculated based on the actual obtained multidimensional feature vector (i.e. the multidimensional feature vector after preprocessing above) and the inferred multidimensional feature vector. The larger the fitness function value, the more it proves that the candidate path topology model should be used as the final path topology model.

[0076] Step S34: Increment the iteration count by 1 to obtain the current iteration count. Determine whether the fitness function value corresponding to the current iteration count is greater than the fitness function value generated in the previous iteration. If yes, determine the candidate path topology model corresponding to the current fitness function value as the path topology model to be determined. If no, retain the candidate path topology model corresponding to the fitness function value generated in the previous iteration as the path topology model to be determined. Further determine whether the current iteration count is greater than or equal to the preset maximum threshold for the number of iterations. If yes, output the current path topology model to be determined as the target path topology model to be determined. If no, update the particle position according to the particle velocity to obtain a new candidate path topology model, and return the new candidate path topology model to the above operation for re-iteration until the target path topology model to be determined is output.

[0077] Step S35: Perform path node stability analysis on the topology model of the target path to be determined, and output the target path topology model.

[0078] It should be noted that, based on the multidimensional feature vectors obtained from actual observation, the above-described embodiments of this application combine the optimization process of the particle swarm optimization algorithm with the analysis of node stability to reconstruct the hidden network attack path with high precision and accurately locate the attack source.

[0079] In this context, a path topology model is composed of multiple possible paths. The optimal model found by the PSO algorithm refers to the path topology model with the highest overall confidence. However, this model still contains inferences about multiple candidate paths and their confidence weights. The PSO algorithm (S34) is like inferring a complete set of most probable attack route maps (a topology model) based on various clues (feature sequences). This route map (model) contains multiple specific routes (paths), such as... Figure 3 As shown, for example, routes A, B, and C, each route has a probability score (or the confidence level represented by the particle vector in step S32). The task of stability analysis (S35) is to conduct a detailed review of each specific route (such as PA, PB, PC, etc.) in this route map, determine which route's description is more stable and reasonable, and ultimately select or confirm the most reliable route in this route map.

[0080] Specifically, in step S35, a path node stability analysis is performed on the target path topology model to be determined, and the target path topology model is output, including the following operation steps:

[0081] Step S351: Traverse each network node in the topology model of the target path to be determined, and extract the dataset of all source IP addresses that are considered to have passed through the network node for the network node; the dataset includes the preprocessed multidimensional feature vector (i.e., the preprocessed multidimensional feature vector after the preprocessing in step S31 above, which includes the standardized preliminary hop count estimate, the standardized TCP window size sequence, and the standardized TCP initial sequence number sequence); the dataset specifically includes the number of source IP addresses that have passed through the network node, the standardized feature value of the (k-1)th source IP address that has passed through the current network node in the multidimensional feature vector, and the mean of the first-order difference absolute value sequence of all standardized feature values ​​of the source IP addresses that have passed through the current network node in the multidimensional feature vector, etc., which will not be elaborated further.

[0082] Step S352: Calculate the fluctuation factor for the dataset of each network node;

[0083] The volatility factor is calculated as follows:

[0084] ;

[0085] In the formula, n is the nth network node in the topology model of the target path to be determined. The specific features in the dataset are (i.e., the standardized preliminary hop count estimate, the standardized TCP window size sequence, or the standardized TCP initial sequence number sequence mentioned above); L is the number of source IP addresses passing through this network node. This is the standardized feature value (or preprocessed multidimensional feature vector) of the k-th source IP address that passes through the current network node in the dataset. This refers to the standardized feature value of the (k-1)th source IP address that passes through the current network node in the dataset. It is the mean of the first-order difference absolute value sequence of the standardized feature values ​​of all source IP addresses passing through the current network node in the dataset;

[0086] Step S353: Obtain the representative dataset of each network node's dataset (the representative dataset is the median of the preprocessed multidimensional feature vectors of the network node, i.e., the median of the standardized preliminary hop count estimate, the median of the standardized TCP window size sequence, and the median of the standardized TCP initial sequence number sequence); calculate the path hop factor for each candidate path parsed from the topology model of the target path to be determined based on the representative dataset of each network node;

[0087] The path jump factor is calculated as follows:

[0088] ;

[0089] In the formula, Let p be the p-th candidate path, and i be the i-th network node on the candidate path. The number of candidate paths in the topology model of the target path to be determined. This is the median of the normalized TCP window size sequence in the representative dataset of the i-th network node in the candidate path. This represents the median of the standardized preliminary hop count estimate in the representative dataset of the i-th network node in the candidate path. The median of the normalized initial TCP sequence number in the representative dataset of the i-th network node in the candidate path. , and All are weighting coefficients, and ;

[0090] Step S354: Based on the fluctuation factors of all network nodes and the path jump factors of all candidate paths, through the attack contribution rate analysis of network nodes and the attack path confidence analysis of candidate paths, anomaly identifiers (i.e., network nodes and candidate paths with abnormal states) are obtained. The anomaly identifiers include network node anomaly identifiers and candidate path anomaly identifiers.

[0091] Step S355: Based on the abnormal element identifier, perform filtering processing through comprehensive disbelief calculation analysis, and output the final target path topology model;

[0092] It should be noted that in the above embodiments of this application, the comprehensive disbelief score is calculated by fusing the abnormal element identifiers (i.e., the number of unstable identifiers of network nodes and the number of unstable identifiers of candidate paths), that is:

[0093] ;

[0094] In the formula, Q is the stable label threshold. The maximum volatility factor among all network nodes. This represents the number of network node anomaly identifiers in the anomaly identifier list. and All are weighting coefficients;

[0095] After calculating the overall disconfidence score D, the higher the overall disconfidence score, the less stable the corresponding candidate path. Based on this, the path topology model formed by the candidate paths with the lowest overall disconfidence scores is selected as the target path topology model (e.g., ...). Figure 4 (As shown).

[0096] It should be noted that, in the above-described embodiments of this application, the data extraction and preparation in step S351 first constructs a unique time-series feature behavior profile for each node, analyzes the stability performance of the node itself over a period of time, and complements the path structure analysis in the subsequent step S353.

[0097] Furthermore, step S352 analyzes the behavioral stability of a single node over time and calculates a normalized stability metric based on the rate of change (i.e., the aforementioned volatility factor). This metric measures the degree to which the change in a certain characteristic value of a node deviates from the node's average change when processing continuous data packets. Traditional variance measures the degree to which a value deviates from the mean, while the volatility factor measures the degree to which the rate of change deviates from the average rate of change. This is extremely effective in detecting nodes whose characteristic values ​​are within the normal range but whose behavioral rhythm is abnormal (such as sudden, violent jitter). It accurately identifies nodes with unstable behavior. For example, if a router has a normal load, its forwarding delay (or derived TTL) changes smoothly (low DFF).

[0098] If congestion or an attack occurs, the changes will become drastic and disordered (high DFF). Similarly, traffic from a spoofed source IP is likely to have a simulated TCP characteristic sequence that cannot maintain a stable change rhythm, resulting in a high DFF. Further, in step S353, a characteristic representative value (median) is first calculated for each node, and then the change amplitude of these steady-state characteristics between adjacent nodes along the entire path (i.e., the path jump factor mentioned above) is calculated. The total amplitude of the change of the steady-state value of the key characteristics between adjacent network nodes is quantified when the data packet is transmitted along a presumed path. The median is used as the representative value of the node because the median is not sensitive to extreme values, can better represent the typical state of the node, and has stronger anti-interference ability.

[0099] A real and stable network path typically exhibits regular and smooth changes in characteristics between adjacent nodes (e.g., hop count strictly decreases by 1 with each hop, and TCP window size is similar across similar devices). An abnormally high path hop factor indicates that the path is structurally disjointed and unrealistic, which may be caused by route hijacking, IP spoofing, or topology reconstruction errors. Therefore, this application's embodiments identify unreasonable, unrealistic, or extremely unstable candidate paths from the perspective of path structure, serving as an important basis for judging whether a path is stable for data transmission.

[0100] Furthermore, in step S354, by utilizing the fluctuation factor of network nodes and the path jump factor of candidate paths, and through attack contribution rate analysis of network nodes and attack path confidence analysis of candidate paths, network node anomaly identifiers and candidate path anomaly identifiers are obtained. In step S355, using the identifier results from S354, a comprehensive disbelief score is calculated, and candidate paths are screened based on this score. The comprehensive disbelief score comprehensively considers whether a path itself is abnormal, how many of its contained nodes are abnormal, and how severe the abnormality of these nodes is, thereby achieving the final refined evaluation. Instead of simply discarding the marked paths, a continuous score is given. The paths with the lowest scores are those that are most stable at both the macro and micro levels, and are considered to be the most reliable and trustworthy paths. The final output target topology model is composed of these optimal paths, which greatly ensures the accuracy and robustness of its source tracing conclusions.

[0101] Specifically, in step S354, based on the fluctuation factors of all network nodes and the path jump factors of all candidate paths, anomaly identifiers are obtained through attack contribution rate analysis of network nodes and attack path confidence analysis of candidate paths. The anomaly identifiers include network node anomaly identifiers and candidate path anomaly identifiers, and include the following operation steps:

[0102] Step S3541: Obtain multiple historical fluctuation factors for each network node from multiple historical time nodes over a continuous historical time period; calculate the mean and standard deviation of the historical fluctuation factors based on the historical fluctuation factors; calculate the instantaneous fluctuation deviation of the current fluctuation factor of each network node relative to the historical fluctuation factors based on the fluctuation factor, the mean of the historical fluctuation factors, and the standard deviation of the historical fluctuation factors.

[0103] It should be noted that in the above embodiments of this application, the instantaneous fluctuation deviation of each network node measures the degree of deviation of the node's current behavior from its own normal level. The higher the instantaneous fluctuation deviation, the more significant the change in the network behavior of the corresponding network node.

[0104] Step S3542: Obtain the connection topology of each network node, check the path sequence of each candidate path according to the connection topology of the network node, and obtain the prior topology condition score; calculate the reasonable score of path jump based on the prior topology condition score and the path jump factor of the candidate path.

[0105] It should be noted that in the above embodiments of this application, the path sequence of candidate paths (i.e., the arrangement sequence of network nodes in the candidate path, i.e., the path order when network information is sent in the candidate path) is verified by the server connection topology of the network nodes in the real-world scenario. When the path sequence of a candidate path matches the server connection topology of the network nodes, it is marked as 1 (i.e., the prior topology condition score is 1). If the path sequence of a candidate path skips or adds network nodes compared to the server connection topology of the network nodes, its prior topology condition score is marked as 0. This embodiment of the application eliminates candidate paths that are physically or logically impossible by using prior knowledge (i.e., the connection topology of each network node mentioned above), which greatly reduces the search space and thus quantifies the credibility of the candidate paths. The higher the reasonable score of the path jump, the more reasonable the candidate path is in terms of node topology.

[0106] Step S3543: First candidate paths are selected based on their prior topology condition scores (the prior topology condition score of the first candidate path is 1, meaning candidate paths with a prior topology condition score of 0 are eliminated; that is, candidate paths with a prior topology condition score of 0 are deemed invalid and removed because they do not conform to the actual network connection structure and cannot be real attack paths); the instantaneous fluctuation deviations of all network nodes along the first candidate path are summed to obtain the total abnormal behavior value of the first candidate path; the path irrationality score is calculated based on the reasonableness score of path jumps (the path irrationality score is calculated by subtracting the reasonableness score of path jumps from a preset constant, such as 1 - reasonableness score of path jumps; the larger the value, the more suspicious and irrational the structure of the path itself); the attack path confidence is calculated by multiplying the total abnormal behavior value by the path irrationality score;

[0107] It should be noted that, as Figure 5 As shown in the above embodiment of this application, by checking the prior topology condition score of each candidate path, if the score of a certain path is zero, it is directly determined as an invalid path and removed, because it does not conform to the real connection structure of the network and cannot be a real attack path, thus obtaining the first candidate path.

[0108] Then, for each first candidate path, the instantaneous fluctuation deviation of all network nodes on that path is summed to obtain a total (i.e., the sum of the abnormal behaviors mentioned above). This total reflects the sum of the abnormal behaviors of all nodes on the entire path. Then, the reasonableness score of the path transition is subtracted from the number one to obtain a value (i.e., the unreasonableness score of the path mentioned above). The larger the unreasonableness score, the more suspicious and unreasonable the structure of the path itself is. Finally, the sum of the abnormal behaviors obtained above is multiplied by the unreasonableness score of the path. The product is the attack path confidence of the path. The higher the attack path confidence, the more likely the first candidate path is to meet the two conditions of a large sum of abnormal node behaviors and a suspicious structure of the path itself.

[0109] Step S3544: Calculate the median and interquartile range of the attack path confidence for all first candidate paths; determine all first candidate paths whose attack path confidence is greater than the median plus λ multiplied by the interquartile range as second candidate paths;

[0110] It should be noted that in the above embodiments of this application, by calculating the median and interquartile range of the attack path confidence of all valid paths, all attack path confidence values ​​exceeding the median plus a λ multiplied by the interquartile range are initially screened out to form a set of candidate attack paths (i.e. the set composed of the above-mentioned second candidate paths), and quickly focusing on a small number of paths that are most abnormal and suspicious.

[0111] Step S3545: Calculate the frequency of each network node appearing in all second candidate paths to obtain the network node attack contribution rate; select network nodes with an attack rate greater than N and mark them as network node anomalies; adjust the attack path confidence using the network node attack contribution rate to obtain the adjusted attack path confidence.

[0112] It should be noted that in the above embodiments of this application, the attack contribution of network nodes is used to calibrate the attack path confidence of the previous step. For each second candidate path, its original attack path confidence is multiplied by an adjustment coefficient (such as 1 plus the total contribution of all network nodes on the second candidate path). If a second candidate path contains many network nodes with high attack contribution (i.e., key network nodes shared by many suspicious paths), then the confidence of the second candidate path will be significantly amplified. Conversely, if the network nodes on a second candidate path rarely appear in other suspicious paths, its confidence remains basically unchanged. In other words, the processing of the above embodiments of this application strengthens the importance of paths composed of key abnormal network nodes.

[0113] Step S3546: Select the second candidate path with an adjusted attack path confidence greater than M and mark it as an anomaly.

[0114] It should be noted that the above-described embodiments of this application first calculate the instantaneous fluctuation deviation of each network node based on its current fluctuation factor and its historical fluctuation factor, quantifying the current state of the node into a comparable and standardized anomaly score, reflecting the degree of abrupt change in the node's own behavior, and generating an "anomaly score" for each node, providing basic data for subsequent path-level anomaly aggregation; then, using the prior knowledge of the known network connection topology, it verifies whether the node sequence of each candidate path conforms to logic. If the path sequence matches the real topology, the score is high (reasonable), and if "jump points" or "addition points" appear, the score is low (unreasonable). Combined with the path jump factor, a reasonable score for path jump is calculated, and the first layer of physical filtering is performed to exclude paths that are physically or logically impossible (such as paths that bypass necessary gateways), narrowing the scope of analysis and avoiding wasting computational resources on invalid data;

[0115] In the further processing, firstly, based on the results of S3542, all structurally unreasonable paths (with a priori topological condition score of 0) are screened out, resulting in a first candidate path set. For each first candidate path, two dimensions are fused: abnormal node behavior (sum of instantaneous fluctuation deviations of all nodes on the path) and suspicious path structure (1 - reasonable path jump score). By multiplying these dimensions, a comprehensive attack path confidence score is obtained, achieving cross-validation of behavioral and structural anomalies. Each reasonable candidate path is assigned a comprehensive anomaly score. Furthermore, by using statistical methods (median and interquartile range) to define the threshold for outliers, the confidence scores of all first candidate paths are treated as a dataset, and the median and interquartile range are calculated. Paths with confidence scores significantly higher than the overall level are selected as second candidate paths for a second round of focused filtering. This avoids the arbitrariness of setting fixed thresholds and can adaptively focus on a small subset of the most abnormal and noteworthy paths based on the current overall network situation, forming a candidate attack path set. This reduces the number of paths requiring final evaluation and improves the efficiency of subsequent analysis.

[0116] Furthermore, the attack contribution rate is determined by statistically analyzing the frequency of each node appearing in all second candidate paths. The attack contribution rate of a node is used as an adjustment coefficient to weight and amplify the confidence of the path. The more high contribution rate nodes a path contains, the higher its final confidence. By introducing global correlation analysis, key abnormal nodes (which may be public jump boards or controlled hosts) shared by multiple suspicious paths are identified, and the confidence of the path is calibrated accordingly, thus elevating the analysis from single path analysis to global network correlation analysis.

[0117] Finally, based on the calibrated final confidence level, the path is marked with an anomaly flag.

[0118] Example 2

[0119] like Figure 6 As shown, Embodiment 2 of the present invention provides a data link tracing and detection system based on abnormal network behavior, including a data acquisition module 10, a hop count estimation module 20, a path topology module 30, and a verification output module 40;

[0120] The data acquisition module 10 is used to collect network data packets on the target data link and extract the TTL value, TCP window size and TCP initial sequence number of each data packet to form a TTL value sequence, a TCP window size sequence and a TCPISN sequence.

[0121] The hop count estimation module 20 is used to calculate a preliminary hop count estimate of the data packet based on the TTL value sequence by using clustering processing combined with pattern recognition methods.

[0122] The path topology module 30 is used to integrate the preliminary hop count estimate, the TCP window size sequence, and the TCP initial sequence number sequence, and construct a path topology model by combining the particle swarm optimization algorithm with path node stability analysis.

[0123] The verification output module 40 is used to analyze the network node connection relationship of abnormal states in the path topology model, perform path consistency verification based on the coefficient of variation distribution, and output the network location estimation result of the attack source.

[0124] In summary, the data link tracing and detection method and system based on abnormal network behavior proposed in this invention first extracts three features from network traffic that are difficult to forge simultaneously: TTL (reflecting the number of hops), TCP window size (reflecting device and network status), and TCP initial sequence number (reflecting the operating system fingerprint). These features form a sequence, making it extremely difficult for attackers to simultaneously and stably forge features from three different protocol layers. The processing method in this application improves the reliability of the tracing results. Furthermore, a clustering algorithm is used to analyze the TTL value, filter noise, and calculate the most likely preliminary network hop count of the data packet's origin, quantifying and abstracting the features. The network data is transformed into specific network hop counts and topological locations, making the analysis results more accurate. By fusing hop counts, window sizes, and sequence numbers, and employing particle swarm optimization and stability analysis, an enhanced path topology model is constructed that not only displays connection relationships but also reflects path stability and behavioral characteristics. This ensures that the tracing results include not only IP addresses but also the hierarchical location of the attack source within the network. Then, based on the path topology model, graph analysis (detecting abnormal connections) and coefficient of variation statistical tests (detecting abnormal behavioral fluctuations) are combined for dual verification, ultimately pinpointing the specific location of the attack source within the network topology and achieving accurate tracing of network attacks.

[0125] In the specific execution process, the stability of a single network node is quantified by calculating the fluctuation factor, and the change amplitude of each characteristic information of the network nodes on the entire path is quantified by the path jump factor.

[0126] Then, in further processing, by combining fluctuation factors and path jump factors with historical and physical factors, and by analyzing the frequency of occurrence of network nodes, network node anomaly indicators and candidate path anomaly indicators are obtained from global network correlation analysis.

[0127] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; those skilled in the art can modify the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting data link provenance based on abnormal network behavior, characterized in that, The method comprises the following steps: Collecting network data packets on a target data link and extracting TTL value, TCP window size and TCP initial sequence number of each data packet to form TTL value sequence, TCP window size sequence and TCP ISN sequence; Based on the TTL value sequence, the preliminary hop count estimation value of the data packet is calculated by using clustering processing combined with pattern recognition method; Fusing the preliminary hop count estimation value, the TCP window size sequence and the TCP initial sequence number sequence to construct a path topology model by using particle swarm optimization algorithm combined with path node stability analysis; Analyzing the connection relationship of the abnormal state network nodes in the path topology model, verifying the path consistency based on the coefficient of variation distribution, and outputting the attack source network position estimation result.

2. The method of claim 1, wherein, The fusion of the preliminary hop count estimation value, the TCP window size sequence and the TCP initial sequence number sequence to construct a path topology model by using particle swarm optimization algorithm combined with path node stability analysis comprises the following steps: Performing data standardization processing on the preliminary hop count estimation value, the TCP window size sequence and the TCP initial sequence number sequence to obtain a preprocessed multi-dimensional feature vector; Initializing particle swarm parameters, including multiple candidate path topology models, particle positions and particle velocities; Iterating a counter; the iteration number of the iteration counter is initially 0; Analyzing and calculating the fitness function value according to each particle position combined with the preprocessed multi-dimensional feature vector; Adding 1 to the iteration number to obtain the current iteration number, and outputting the to-be-determined target path topology model by judging and screening according to the current iteration number and the fitness function value; Performing path node stability analysis on the to-be-determined target path topology model to obtain the target path topology model.

3. The method of claim 2, wherein, The particle position is set as a high-dimensional vector, and each dimension in the high-dimensional vector represents the confidence of a connection edge in each candidate path topology model; the particle velocity represents the amplitude of the particle position adjustment in the direction of the search of the candidate path topology model in the solution space.

4. The method of claim 3, wherein, The to-be-determined target path topology model is outputted by judging and screening according to the current iteration number and the fitness function value, which comprises the following steps: Judging whether the fitness function value corresponding to the current iteration number is greater than the fitness function value generated in the last iteration, if yes, determining that the candidate path topology model corresponding to the current fitness function value is the to-be-determined path topology model; if not, retaining the candidate path topology model corresponding to the fitness function value generated in the last iteration as the to-be-determined path topology model; further judging whether the current iteration number is greater than or equal to the preset maximum threshold of the iteration number; if yes, outputting the current to-be-determined path topology model as the to-be-determined target path topology model, if not, updating the particle position according to the particle velocity to obtain a new candidate path topology model, and returning the new candidate path topology model to the particle swarm optimization processing for reiteration until the to-be-determined target path topology model is outputted.

5. The method of claim 4, wherein, The path node stability analysis on the to-be-determined target path topology model is performed, and a target path topology model is output, including the following operation steps: Each network node in the to-be-determined target path topology model is traversed, and a data set in which all source IP addresses are considered to pass through the network node is extracted for the network node; the data set includes a preprocessed multi-dimensional feature vector; A fluctuation factor is calculated for the data set of each network node; A representative data set of the data set of each network node is obtained; A path jump factor of each candidate path is calculated according to the representative data set of each network node for each candidate path parsed in the to-be-determined target path topology model; According to the fluctuation factor of all network nodes and the path jump factor of all candidate paths, an abnormality identifier is obtained through attack contribution rate analysis of the network nodes and attack path confidence analysis of the candidate paths. The abnormality identifier is modified through comprehensive unconfidence calculation analysis based on the abnormal element identifier, and a final target path topology model is output.

6. The method of claim 5, wherein, The abnormality identifier includes network node abnormality identifier and candidate path abnormality identifier.

7. The method of claim 1, wherein, The abnormality identifier is obtained according to the fluctuation factor of all network nodes and the path jump factor of all candidate paths through attack contribution rate analysis of the network nodes and attack path confidence analysis of the candidate paths, including the following operation steps: A plurality of historical fluctuation factors of a plurality of historical time nodes in a continuous historical time period are obtained for each network node, and a current fluctuation factor of each network node is calculated according to the historical fluctuation factor analysis to obtain a transient fluctuation deviation degree relative to the historical fluctuation factor; The connection topology structure of the current network nodes is obtained, the path sequence of each candidate path is checked according to the connection topology structure of the network nodes, and a prior topological condition score is obtained; A path jump reasonable score is calculated according to the prior topological condition score and the path jump factor of the candidate path; A first candidate path is selected according to the prior topological condition score of each candidate path; an abnormal behavior total value of the first candidate path is calculated according to the transient fluctuation deviation degree of all network nodes of the first candidate path; a path unreasonable degree score is calculated according to the path jump reasonable score; and an attack path confidence is obtained by calculation of the abnormal behavior total value and the path unreasonable degree score. The abnormality identifier is obtained by combining the attack path confidence with the network node frequency analysis.

8. The method of claim 7, wherein, The abnormality identifier is obtained by combining the attack path confidence with the network node frequency analysis, including the following operation steps: The confidence median and the confidence quartile range of the attack path confidence of all first candidate paths are calculated; the second candidate path is selected from the first candidate path according to the attack path confidence and the confidence median and the confidence quartile range; The frequency of each network node appearing in all second candidate paths is counted to obtain a network node attack contribution rate; a network node abnormality identifier is marked for a network node with an attack rate greater than N network nodes; and the attack path confidence is adjusted by using the network node attack contribution rate to obtain an adjusted attack path confidence. Select a second candidate path with an adjusted attack path confidence greater than M to mark a candidate path anomaly identification.

9. A data link provenance detection system based on abnormal network behavior, characterized in that, It comprises a data collection module, a hop estimation module, a path topology module and a verification output module. The data collection module is configured to collect network data packets on a target data link and extract TTL values, TCP window sizes and TCP initial sequence numbers of each data packet to form TTL value sequences, TCP window size sequences and TCP ISN sequences. The hop estimation module is configured to calculate a preliminary hop estimation value of the data packet based on the TTL value sequences by using clustering processing combined with a pattern recognition method. The path topology module is configured to fuse the preliminary hop estimation value, the TCP window size sequence and the TCP initial sequence number sequence to construct a path topology model by using a particle swarm optimization algorithm combined with path node stability analysis. The verification output module is configured to analyze abnormal state network node connection relationships in the path topology model, perform path consistency verification based on a coefficient of variation distribution and output an attack source network position estimation result.

10. A storage medium, characterized by The storage medium stores a computer program, and the computer program is executed by the processor to implement the data link tracing detection method based on abnormal network behavior in any one of claims 1-8.

Images