A data link trace detection method and system based on abnormal network behavior

Abstract

The application discloses a data link tracing detection method and system based on abnormal network behaviors, which comprises the following steps: firstly, three features difficult to be forged simultaneously, TTL, TCP window size and TCP initial sequence number, are extracted from network traffic to form a sequence, so as to improve the reliability of the tracing result; a clustering algorithm is used to analyze the TTL value, and the most possible initial network hop number of the data packet source is calculated; a path topology model is constructed by fusing the hop number, window size and sequence number sequence, adopting a particle swarm optimization algorithm and stability analysis; then, on the basis of the path topology model, double verification is carried out by combining graph analysis and coefficient of variation statistical test, so that the specific position of the attack source in the network topology is locked, and accurate tracing of the network attack is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network attack tracing, and in particular to a data link tracing detection method and system based on abnormal network behavior. BACKGROUND

[0002] With the increasing complexity and concealment of network attack means, especially the prevalence of advanced persistent threats (APT), distributed denial of service (DDoS) and network deception attacks, how to accurately and reliably trace the attack source has become a core challenge in the field of network security. Traditional network attack tracing techniques largely rely on single-dimensional information such as IP addresses, routing table queries or simple TTL hop count estimates. However, these methods significantly decrease in effectiveness and reliability when faced with attacker counter-tracing methods such as IP spoofing, hop-by-hop hosts (hoppers), and packet tampering.

[0003] In the prior art, in order to improve the accuracy of tracing, researchers have tried to extract multi-dimensional features from packets for fusion analysis. For example, by analyzing the TTL value sequence to estimate the approximate hop count of the attack source, or using the feature difference of TCP window size and initial sequence number (ISN) to identify the source operating system fingerprint. These methods have enhanced the evidence chain of tracing to some extent, but still have obvious technical defects:

[0004] Existing technologies usually stop at feature extraction and simple comparison, lacking a unified computing framework that can deeply integrate network layer (such as TTL), transport layer (such as TCP window, ISN) features. Each feature sequence is analyzed independently, and an enhanced topology model that can describe the overall behavior and stability of the path is not constructed, resulting in a one-sided tracing result that cannot cope with attacker deception against a single feature.

[0005] Although some advanced schemes attempt to use optimization algorithms (such as particle swarm optimization PSO) for path topology reconstruction, the optimization objective often only focuses on how to make the reconstructed path features and observed data numerically match. This method has a fundamental flaw: the "optimal path" it reconstructs may be a mathematically highly fitted but physically impossible or extremely unstable invalid path. For example, a fitted path may skip the real mandatory routing nodes in order to match the observed TTL values, which obviously does not conform to the reality of network connections.

[0006] The prior art lacks a mechanism to quantify the consistency and rationality of the structure of a candidate path itself. It cannot calculate indicators such as a "path jump factor" to measure the degree of change in the characteristics of a data packet between adjacent nodes of a path. A real and stable path should have a TTL that decreases hop by hop, and the TCP characteristics should change smoothly between similar devices. The characteristic values of a path generated by an attack or reconstruction error often have abnormal mutations. The prior art cannot quantify this "jump", so it is difficult to identify those paths that are structurally unreasonable and suspected to be fake from among numerous candidate paths.

[0007] Similarly, the prior art often performs isolated, current snapshot-based analysis when evaluating nodes and paths. It lacks historical baseline-based node behavior fluctuation analysis (such as instantaneous fluctuation deviation), and cannot determine whether a node's current behavior has deviated significantly from its normal historical state. More importantly, they lack global perspective correlation analysis. It cannot identify which nodes are shared by a large number of suspicious paths (i.e. may be key attack stepping stones or controlled hosts) through indicators such as network node attack contribution rate. Without such global correlation calibration, the confidence evaluation of the path is isolated, and it is likely to overestimate some accidentally abnormal paths and underestimate paths that are actually composed of key attack nodes. SUMMARY

[0008] The purpose of the present application is to provide a data link trace detection method based on abnormal network behavior, which solves the above technical problems pointed out in the prior art.

[0009] The present application provides a data link trace detection method based on abnormal network behavior, comprising the following operation steps:

[0010] Collect network data packets on the target data link, and extract the TTL value, TCP window size and TCP initial sequence number of each data packet from them to form a TTL value sequence, a TCP window size sequence and a TCP ISN sequence;

[0011] Based on the TTL value sequence, a preliminary hop count estimate value of the data packet is calculated by using clustering processing combined with a pattern recognition method;

[0012] The preliminary hop count estimate value, the TCP window size sequence and the TCP initial sequence number sequence are fused to construct a path topology model by using a particle swarm optimization algorithm combined with path node stability analysis;

[0013] The abnormal state network node connection relationship in the path topology model is analyzed, the path consistency is verified based on the coefficient of variation distribution, and the attack source network position estimation result is output.

[0014] Preferably, the fusion of the preliminary hop count estimate, the TCP window size sequence and the TCP initial sequence number sequence is combined with path node stability analysis by a particle swarm optimization algorithm to construct a path topology model, including the following operation steps:

[0015] The preliminary hop count estimate, the TCP window size sequence and the TCP initial sequence number sequence are subjected to data standardization processing to obtain a pre-processed multi-dimensional feature vector;

[0016] The particle swarm parameters are initialized, including a plurality of candidate path topology models, particle positions and particle velocities; an iteration counter; the iteration number of the iteration counter is initially 0;

[0017] The fitness function value is obtained by analyzing and calculating each particle position in combination with the pre-processed multi-dimensional feature vector;

[0018] The iteration number is incremented by 1 to obtain the current iteration number, and the current iteration number and the fitness function value are selected by judgment to output the target path topology model to be determined;

[0019] The target path topology model to be determined is subjected to path node stability analysis to output the target path topology model.

[0020] Preferably, the particle position is set as a high-dimensional vector, and each dimension in the high-dimensional vector represents the confidence of a connection edge in each candidate path topology model; the particle velocity represents the amplitude of the particle position adjustment in the direction of the search of the candidate path topology model in the solution space.

[0021] Preferably, the output of the target path topology model to be determined by selecting and judging the current iteration number and the fitness function value includes the following operation steps:

[0022] It is determined whether the fitness function value corresponding to the current iteration number is greater than the fitness function value generated by the last iteration, if so, the candidate path topology model corresponding to the current fitness function value is determined as the path topology model to be determined; if not, the candidate path topology model corresponding to the fitness function value generated by the last iteration is retained as the path topology model to be determined; it is further determined whether the current iteration number is greater than or equal to the preset maximum threshold of the iteration number; if so, the current path topology model to be determined is output as the target path topology model to be determined, if not, the particle position is updated according to the particle velocity to obtain a new candidate path topology model, and the new candidate path topology model is returned to the particle swarm optimization processing for re-iteration until the target path topology model to be determined is output.

[0023] Preferably, the path node stability analysis on the target path topology model to be determined is performed to output a target path topology model, including the following operation steps:

[0024] Each network node in the target path topology model to be determined is traversed, and a data set in which all source IP addresses are considered to pass through the network node is extracted for the network node; the data set includes a preprocessed multi-dimensional feature vector;

[0025] A fluctuation factor is calculated for the data set of each network node;

[0026] A representative data set of the data set of each network node is obtained; a path jump factor of each candidate path is calculated according to the representative data set of each network node based on the parsed candidate path in the target path topology model to be determined;

[0027] Based on the fluctuation factor of all network nodes and the path jump factor of all candidate paths, an abnormality identifier is obtained through attack contribution rate analysis of the network nodes and attack path confidence analysis of the candidate paths.

[0028] The abnormality identifier is corrected through comprehensive unconfidence calculation analysis, and a final target path topology model is output.

[0029] Preferably, the abnormality identifier includes a network node abnormality identifier and a candidate path abnormality identifier.

[0030] Preferably, the abnormality identifier is obtained based on the fluctuation factor of all network nodes and the path jump factor of all candidate paths through attack contribution rate analysis of the network nodes and attack path confidence analysis of the candidate paths, including the following operation steps:

[0031] A plurality of historical fluctuation factors of a plurality of historical time nodes in a continuous historical time period are obtained for each network node, and a current fluctuation factor of each network node is calculated relative to a historical fluctuation factor based on historical fluctuation factor analysis to obtain an instantaneous fluctuation deviation degree;

[0032] A connection topology structure of each network node is obtained, a path sequence of each candidate path is checked based on the connection topology structure of the network nodes to obtain a priori topology condition score, and a path jump reasonable score is calculated based on the priori topology condition score and the path jump factor of the candidate path;

[0033] A first candidate path is selected based on the priori topology condition score of each candidate path, an abnormal behavior total value of the first candidate path is calculated based on the instantaneous fluctuation deviation degree of all network nodes of the first candidate path, a path unreasonable degree score is calculated based on the path jump reasonable score, and an attack path confidence is calculated based on the abnormal behavior total value and the path unreasonable degree score.

[0034] According to the attack path confidence and the network node frequency analysis, the abnormal identification is identified.

[0035] Preferably, the abnormal identification is identified according to the attack path confidence and the network node frequency analysis, and the operation steps include the following steps:

[0036] The confidence median and the confidence quartile range of the attack path confidence of all the first candidate paths are calculated, and the second candidate paths are screened from the first candidate paths according to the attack path confidence and the confidence median and the confidence quartile range;

[0037] The frequency of appearing in all the second candidate paths is counted for each network node, and the network node attack contribution rate is obtained, the network node whose attack rate is greater than N is selected and marked as an abnormal network node, and the attack path confidence is adjusted by using the network node attack contribution rate to obtain the adjusted attack path confidence;

[0038] The second candidate path whose adjusted attack path confidence is greater than M is selected and marked as an abnormal candidate path.

[0039] Correspondingly, the application further provides a data link traceability detection system based on abnormal network behavior, which comprises a data acquisition module, a hop number estimation module, a path topology module and a verification output module.

[0040] The data acquisition module is used for collecting network data packets on a target data link, and extracting TTL value, TCP window size and TCP initial sequence number of each data packet from the network data packets to form TTL value sequence, TCP window size sequence and TCP ISN sequence.

[0041] The hop number estimation module is used for calculating a preliminary hop number estimation value of the data packet based on the TTL value sequence by using clustering processing combined with a pattern recognition method.

[0042] The path topology module is used for fusing the preliminary hop number estimation value, the TCP window size sequence and the TCP initial sequence number sequence to construct a path topology model by using a particle swarm optimization algorithm combined with path node stability analysis.

[0043] The verification output module is used for analyzing abnormal state network node connection relationship in the path topology model, performing path consistency verification based on a coefficient of variation distribution, and outputting an attack source network position estimation result.

[0044] Another aspect of the present application also provides a storage medium, the storage medium stores a computer program, the computer program is executed by a processor to realize the above-mentioned data link tracing detection method based on abnormal network behavior.

[0045] Compared with the prior art, the embodiment of the present application has at least the following technical advantages:

[0046] It can be known from the above-mentioned data link tracing detection method based on abnormal network behavior and the system that, in specific application, three characteristics which are difficult to counterfeit simultaneously, TTL (reflecting the number of transmission hops), TCP window size (reflecting the device and network state) and TCP initial sequence number (reflecting the operating system fingerprint) are extracted from network traffic to form a sequence, and it is extremely difficult for an attacker to counterfeit the characteristics of three different protocol layers simultaneously and stably, so that the reliability of the tracing result is improved through the processing mode of the embodiment; further, the TTL value is analyzed by using a clustering algorithm, noise is filtered, the most possible preliminary network hop number of the packet source is calculated, the characteristics are quantized, the abstract network data is converted into specific network hop number and topology position, so that the analysis result is more accurate; through the fusion of hop number, window size and sequence number sequence, a particle swarm optimization algorithm and stability analysis are used to construct an enhanced path topology model which can not only display the connection relationship but also reflect the path stability and behavior characteristics, so that the tracing result not only includes the IP address but also contains the hierarchical position of the attack source in the network; then, on the basis of the path topology model, double verification is carried out by combining graph analysis (discovering abnormal connection) and coefficient of variation statistical test (discovering abnormal behavior fluctuation), so that the specific position of the attack source in the network topology is finally locked, and accurate tracing of network attack is realized. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 It is a main flow diagram of a data link tracing detection method based on abnormal network behavior;

[0048] Figure 2 It is an operation flow simulation diagram of constructing a path topology model in a data link tracing detection method based on abnormal network behavior;

[0049] Figure 3 It is a path simulation diagram in a topology model in a data link tracing detection method based on abnormal network behavior;

[0050] Figure 4 It is a target path topology model simulation diagram in a data link tracing detection method based on abnormal network behavior;

[0051] Figure 5It is an abnormal network behavior based data link traceability detection method for attack path confidence analysis and calculation flowchart;

[0052] Figure 6 It is an abnormal network behavior based data link traceability detection system for the overall architecture diagram.

[0053] Reference signs: data acquisition module 10, hop estimation module 20, path topology module 30, verification output module 40. DETAILED DESCRIPTION

[0054] The technical solutions of the present application will be described clearly and completely below in combination with the drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0055] The present application will be described in further detail below through specific embodiments and in combination with the drawings.

[0056] Embodiment one

[0057] As shown in the figure, the present application embodiment one provides an abnormal network behavior based data link traceability detection method, including the following operation steps: Figure 1 Step S10: Collect network data packets on the target data link, and extract TTL value, TCP window size and TCP initial sequence number of each data packet from it to form TTL value sequence, TCP window size sequence and TCP ISN sequence (TCP ISN sequence is the sequence of TCP initial sequence number);

[0058]

[0059] ​It should be noted that the above embodiment of the application captures the network data packets flowing through the network data link (such as a key export gateway) to be monitored in a bypass manner, parses the protocol header of each captured TCP / IP data packet, and accurately extracts the TTL value (initially set by the attack source host, the value is reduced by 1 for each routing node (hop), which is the core basis for estimating the transmission hop count), the TCP window size (reflecting the cache capability of the sending end or the transit network device, different operating systems, device models, and network path congestion conditions will cause characteristic differences in the value), and the TCP initial sequence number (the operating system generates an ISN according to a specific algorithm when establishing a TCP connection, and the ISN generation strategy (such as random increment, time dependence) of different OSs is different, which can be used as a device fingerprint feature). The three field values of a large number of data packets from the same data stream or the same source IP are arranged in time sequence respectively to form three time sequences, which provide a basis for subsequent pattern recognition and consistency analysis; by fusing the multi-dimensional information of the network layer (TTL), the transport layer (TCP window, ISN), more rich and three-dimensional evidence chain is provided for network attack tracing, and at the same time, it is difficult for an attacker to simultaneously fake or stably maintain the consistency of the three characteristics of TTL, TCP window size, and ISN change rule, thereby improving the ability of the server to resist network fraud behavior.

[0060] Step S20: based on the TTL value sequence, a preliminary hop count estimation value of the data packet is calculated by using a clustering processing combined with a pattern recognition method;

[0061] It should be noted that the above embodiment of the application uses a clustering algorithm to find several points with the most dense TTL value distribution. Although the initial TTL value may be different (such as 128 for Windows and 64 for Linux), the TTL values of data packets from the same path arriving at the detection point will be highly concentrated around the result after the initial value minus the hop count. Further, after identifying the main TTL cluster, the initial TTL value of the common operating system is combined to reversely calculate the most possible network hop count (preliminary hop count estimation value) of the data packet from the source point to the current monitoring point. For example, if the TTL values are concentrated around 117, the most possible hop count is 128-117=11 hops.

[0062] The processing mode of the embodiment of the application converts the abstract TTL value sequence into the specific hop count, a network topology distance index, so that the tracing analysis goes from qualitative to quantitative. Through pattern recognition, abnormal and fake TTL data packets in the network are filtered out to obtain a more reliable, statistically significant hop count estimation value, thereby improving the reliability of the basic data.

[0063] Step S30: fusing the preliminary hop count estimation value, the TCP window size sequence and the TCP initial sequence number sequence, combining path node stability analysis through a particle swarm optimization algorithm to construct a path topology model;

[0064] Step S40: analyzing the connection relationship of network nodes in an abnormal state in the path topology model, verifying path consistency based on a coefficient of variation distribution, and outputting an attack source network location estimation result.

[0065] It should be noted that the above embodiment of the present application runs a graph analysis algorithm on the path topology model generated in step S30 to find network nodes in an abnormal state, for example, a node suddenly connects multiple unrelated networks, and the behavior characteristics (such as TTL jitter and window size) of a connection are significantly different from other parts of the topology. The above path consistency verification based on the coefficient of variation distribution means that the coefficient of variation of key features (such as per-hop delay jitter and window size change rate) in the entire topology model should be relatively uniform and concentrated. By comparing the coefficient of variation distribution of the suspicious path with that of the normal path, a statistical significance test is performed. Then, the nodes that meet the conditions of being located on an abnormal connection and having a coefficient of variation distribution significantly deviating from the normal are determined as the most likely attack source network location, and the output result includes not only the IP but also its hierarchical relationship in the topology.

[0066] The above embodiment of the present application first extracts three characteristics that are difficult to forge simultaneously, namely TTL (reflecting the number of transmission hops), TCP window size (reflecting device and network status) and TCP initial sequence number (reflecting the operating system fingerprint) from network traffic to form a sequence. It is extremely difficult for an attacker to forge the characteristics of three different protocol layers simultaneously and stably. Through the processing manner of the embodiment of the present application, the reliability of the tracing result is improved.

[0067] Further, a clustering algorithm is used to analyze TTL values and filter noise, calculate the most likely preliminary network hop count of a packet source, quantify the characteristics, convert abstract network data into specific network hop counts and topology positions, and make the analysis result more accurate. At the same time, by fusing the hop count, window size and sequence number sequence, a particle swarm optimization algorithm and stability analysis are used to construct an enhanced path topology model that can not only display the connection relationship but also reflect the path stability and behavior characteristics, so that the tracing result is not only an IP address but also contains the hierarchical position of the attack source in the network.

[0068] Finally, based on the path topology model, combined with graph analysis (finding abnormal connections) and coefficient of variation statistical test (finding abnormal behavior fluctuations), double verification is performed to finally lock the specific position of the attack source in the network topology, and accurate tracing of network attacks is realized.

[0069] AsFigure 2 As shown, specifically, in step S30, the preliminary hop count estimate, the TCP window size sequence, and the TCP initial sequence number sequence are fused together using a particle swarm optimization algorithm combined with path node stability analysis to construct a path topology model, including the following steps:

[0070] Step S31: Perform data standardization on the preliminary hop count estimate, TCP window size sequence, and TCP initial sequence number sequence to obtain a preprocessed multidimensional feature vector;

[0071] It should be noted that the above embodiments of this application are preprocessing operations that standardize the data of the above preliminary hop count estimate, TCP window size sequence and TCP initial sequence number sequence, so that they become dimensionless, fusionable multidimensional feature vectors.

[0072] Step S32: Initialize particle swarm parameters, which include multiple candidate path topology models, particle positions, and particle velocities; iteration counter; the iteration count of the iteration counter is initially set to 0;

[0073] Here, the particle position is set as a high-dimensional vector, and each dimension of the high-dimensional vector represents the confidence of a connecting edge (i.e., each possible path) in each candidate path topology model; the particle velocity represents the magnitude of the particle position in the set adjustment direction when the candidate path topology model is optimized and searched.

[0074] Step S33: Analyze and calculate the fitness function value based on the position of each particle and the preprocessed multidimensional feature vector;

[0075] It should be noted that in the above embodiments of this application, the candidate path topology model corresponding to the particle position is first obtained based on the particle position. Then, the candidate path topology model is used to back-infer the inferred multidimensional feature vector under the current data packet. Then, the fitness function value is calculated based on the actual obtained multidimensional feature vector (i.e. the multidimensional feature vector after preprocessing above) and the inferred multidimensional feature vector. The larger the fitness function value, the more it proves that the candidate path topology model should be used as the final path topology model.

[0076] Step S34: add 1 to the iteration number to obtain a current iteration number, determine whether the fitness function value corresponding to the current iteration number is greater than the fitness function value generated by the last iteration, if yes, determine that the candidate path topology model corresponding to the current fitness function value is the to-be-determined path topology model; if no, retain the candidate path topology model corresponding to the fitness function value generated by the last iteration as the to-be-determined path topology model; further determine whether the current iteration number is greater than or equal to a preset maximum iteration threshold; if yes, output the current to-be-determined path topology model as the to-be-determined target path topology model, if no, update the particle position according to the particle velocity to obtain a new candidate path topology model, and return the new candidate path topology model to the above operation for reiteration until the to-be-determined target path topology model is obtained.

[0077] Step S35: perform path node stability analysis on the to-be-determined target path topology model to obtain a target path topology model.

[0078] It should be noted that the above embodiment of the present application is based on the actually observed multi-dimensional feature vector, combined with the optimization processing of the particle swarm optimization algorithm, and through the analysis of node stability, the hidden network attack path is reconstructed with high precision, and the attack source is accurately located.

[0079] Wherein, one path topology model itself is composed of multiple possible paths, and the optimal model found by the PSO algorithm refers to the path topology model with the highest overall confidence, but this model still contains the inference of multiple candidate paths and their confidence weights, and the PSO algorithm (S34) is like inferring a complete set of most likely attack route maps (a topology model) according to various clues (feature sequences), and this set of route maps (models) contains multiple specific routes (paths), such as Figure 3 As shown in the figure, for example, route A, route B, route C, each route has a possibility score (or the confidence represented by the particle vector in step S32), and the task of stability analysis (S35) is to conduct detailed review on each specific route (such as PA, PB, PC...) in this set of route maps, determine which route is more stable and reasonable, and finally filter out or confirm the most reliable route in this set of route maps.

[0080] Specifically, in step S35, the to-be-determined target path topology model is subjected to path node stability analysis, and a target path topology model is output, including the following operation steps:

[0081] Step S351: traversing each network node in the target path topology model to be determined, extracting a data set of all source IP addresses considered to pass through the network node for the network node; the data set includes the preprocessed multi-dimensional feature vector (i.e., the preprocessed multi-dimensional feature vector after preprocessing in step S31 described above, which includes the standardized preliminary hop count estimate, the standardized TCP window size sequence, and the standardized TCP initial sequence number sequence); the data set specifically includes the number of source IP addresses passing through the network node, the standardized feature value of the k-1th source IP address passing through the current network node in the multi-dimensional feature vector, and the mean of the first-order difference absolute value sequence of the standardized feature values of all source IP addresses passing through the current network node in the multi-dimensional feature vector, and the like, which will not be described again.

[0082] Step S352: calculating the fluctuation factor for the data set of each network node;

[0083] The calculation method of the fluctuation factor is:

[0084] ;

[0085] In the formula, n is the nth network node in the target path topology model to be determined, is a specific feature (i.e., the standardized preliminary hop count estimate or the standardized TCP window size sequence or the standardized TCP initial sequence number sequence described above) in the data set; L is the number of source IP addresses passing through the network node, is the standardized feature value of the kth source IP address passing through the current network node in the specific feature in the data set (the standardized feature value or the preprocessed multi-dimensional feature vector), is the standardized feature value of the k-1th source IP address passing through the current network node in the specific feature in the data set, is the mean of the first-order difference absolute value sequence of the standardized feature values of all source IP addresses passing through the current network node in the data set;

[0086] Step S353: obtaining the representative data set of the data set of each network node (the representative data set is the median of the preprocessed multi-dimensional feature vector of the network node, i.e., the median of the standardized preliminary hop count estimate, the median of the standardized TCP window size sequence, and the median of the standardized TCP initial sequence number sequence); calculating the path jump factor of each candidate path according to the representative data set of each network node for each candidate path analyzed in the target path topology model to be determined;

[0087] The calculation method of the path jump factor is:

[0088] ;

[0089] wherein, is the pth candidate path, i is the ith network node on the candidate path, is the number of candidate paths to be determined in the target path topology model, is the median of the normalized TCP window size sequence in the representative data set of the ith network node in the candidate path, is the median of the normalized preliminary hop count estimate in the representative data set of the ith network node in the candidate path, is the median of the normalized TCP initial sequence number sequence in the representative data set of the ith network node in the candidate path, and are weight coefficients, and ;

[0090] Step S354: According to the fluctuation factors of all network nodes and the path jump factors of all candidate paths, the abnormal identification (i.e., the network nodes and the abnormal candidate paths in the abnormal state are determined) is obtained through the attack contribution rate analysis of the network nodes and the attack path confidence analysis of the candidate paths, and the abnormal identification includes the network node abnormal identification and the candidate path abnormal identification.

[0091] Step S355: The final target path topology model is output through the filtering processing based on the comprehensive unconfidence calculation analysis according to the abnormal element identification.

[0092] It should be noted that in the above embodiments of the present application, the comprehensive unconfidence score is obtained by calculating the abnormal element identification (i.e., the number of unstable identifications of the network nodes and the number of unstable identifications of the candidate paths), that is:

[0093] ;

[0094] wherein, Q is a stable mark threshold, is the maximum fluctuation factor in all network nodes, is the number of network node abnormal identifications in the abnormal identification, and are weight coefficients.

[0095] After the comprehensive unconfidence score D is calculated, the higher the comprehensive unconfidence score is, the more unstable the corresponding candidate path is. Based on this, the path topology model composed of the candidate path corresponding to the lowest comprehensive unconfidence score is filtered as the target path topology model (as shown in FIG. 8). Figure 4

[0096] ​​It should be noted that the above embodiment of the present application firstly extracts and prepares data through step S351 to construct a unique feature behavior profile of each node on a time sequence, analyze the stability performance of the node itself in the past period of time, and complement the path structure analysis of step S353;

[0097] Further, the behavior stability of a single node on a time sequence is analyzed through step S352, a normalized stability metric based on a change rate (i.e., the above fluctuation factor) is calculated, and the deviation degree of the change amplitude of a feature value of a node when processing continuous data packets relative to the average change amplitude of the node itself is measured. The traditional variance measures the deviation degree of a value from the mean value, while the fluctuation factor measures the deviation degree of the change rate from the average change rate. It is extremely effective for detecting nodes whose feature values are within the normal range but have abnormal behavior rhythm (such as sudden and severe jitter), and accurately identifies nodes with unstable behavior. For example, if a router is normally loaded, the change of its forwarding delay (or derived TTL) is smooth (low DFF);

[0098] If congestion or attack occurs, the change will become violent and disordered (high DFF). Similarly, the simulated TCP feature sequence of a fake source IP flow is likely to fail to maintain a stable change rhythm, resulting in a high DFF. Further, in step S353, a feature representative value (median) is first calculated for each node, and then the change amplitude of these stable features between adjacent nodes on the entire path (i.e., the above path jump factor) is calculated. The total amplitude of the change of the key feature stable value between adjacent network nodes when a data packet is transmitted along a presumed path is quantified. Moreover, the median is used as the representative value of the node because the median is not sensitive to extreme values and can better represent the typical state of the node, and has stronger anti-interference performance.

[0099] The feature change between adjacent nodes of a real and stable network path is usually regular and smooth (for example, the hop number is strictly reduced by 1 hop by hop, and the TCP window size is similar between similar devices). An abnormally high path jump factor means that the path is not coherent and real in structure, and may be caused by route hijacking, IP spoofing, or topology reconstruction error. Therefore, the embodiment of the present application identifies unreasonable, unreal, or extremely unstable candidate paths from the perspective of path structure, as an important basis for judging whether a path is stable for data transmission.

[0100] Further, in step S354, by using the fluctuation factor of the network node and the path jump factor of the candidate path, through the attack contribution rate analysis of the network node and the attack path confidence analysis of the candidate path, the network node anomaly identification and the candidate path anomaly identification are obtained; in step S355, the identification results of S354 are used to calculate the comprehensive unconfidence score, and the candidate path is screened based on the score; the comprehensive unconfidence score comprehensively considers whether a path itself is abnormal, how many of the nodes contained in the path are abnormal, and how serious the abnormality of these nodes is, so as to realize the final fine evaluation, not simply discarding the marked path, but giving a continuous score, the path with the lowest score is the path that performs most stably in the macro and micro aspects, and is considered as the path with the highest reliability and the most credible path, and the final output target topology model is composed of these optimal paths, so that the accuracy and robustness of the traceability conclusion are greatly guaranteed.

[0101] Specifically, in step S354, according to the fluctuation factor of all network nodes and the path jump factor of all candidate paths, through the attack contribution rate analysis of the network node and the attack path confidence analysis of the candidate path, the abnormal identification is obtained, the abnormal identification includes the network node abnormal identification and the candidate path abnormal identification, including the following operation steps:

[0102] Step S3541: Obtain a plurality of historical fluctuation factors of a plurality of historical time nodes in a continuous historical time period for each network node, calculate the historical fluctuation factor mean and the historical fluctuation factor standard deviation according to the historical fluctuation factors; calculate the instantaneous fluctuation deviation of the current fluctuation factor of each network node with respect to the historical fluctuation factor according to the fluctuation factor of each network node, the historical fluctuation factor mean and the historical fluctuation factor standard deviation;

[0103] It should be noted that in the above embodiment of the present application, the instantaneous fluctuation deviation of each network node quantifies the deviation degree of the current behavior of the node with respect to its own normal level, and the higher the instantaneous fluctuation deviation, the more significant the change in the network behavior of the corresponding network node;

[0104] Step S3542: Obtain the connection topology structure of each network node at present, check the path sequence of each candidate path according to the connection topology structure of the network node, and obtain the prior topology condition score; calculate the path jump reasonable score according to the prior topology condition score and the path jump factor of the candidate path;

[0105] It should be noted that, in the above embodiment of the present application, the path sequence of the verification candidate path (the path sequence is the arrangement sequence of the network nodes in the candidate path, that is, the path order when the network information is transmitted in the candidate path) is verified according to the server connection topology of the real scene of the network node, and when the path sequence of the candidate path is consistent with the server connection topology of the network node, it is marked as 1 (that is, the priori topology condition score is 1), and if the path sequence of the candidate path is compared with the server connection topology of the network node, the network node is skipped or increased, then the priori topology condition score is marked as 0; the embodiment of the present application excludes the candidate path that is not physically or logically possible by using priori knowledge (that is, the connection topology of each network node), greatly reduces the search space, and quantifies the credibility of the candidate path, and the higher the reasonable score of the path jump is, the more reasonable the candidate path is on the node topology.

[0106] Step S3543: filtering according to the priori topology condition score of each candidate path to obtain a first candidate path (the priori topology condition score of the first candidate path is 1, that is, the candidate path with a priori topology condition score of 0 is excluded, that is, the candidate path with a priori topology condition score of 0 is determined as an invalid path and removed, because it does not conform to the real connection structure of the network, and it is impossible to be a real attack path); adding the instantaneous fluctuation deviation of all network nodes of the first candidate path to obtain the abnormal behavior total value of the first candidate path; calculating the path unreasonable degree score according to the path jump reasonable score (the path unreasonable degree score is obtained by subtracting the path jump reasonable score from the preset constant, such as 1-path jump reasonable score, the greater the value is, the more suspicious and unreasonable the structure of the path is); multiplying the abnormal behavior total value and the path unreasonable degree score to obtain the attack path confidence;

[0107] It should be noted that, as shown in Figure 5 , in the above embodiment of the present application, the priori topology condition score of each candidate path is checked, if the score of a certain path is zero, it is directly determined as an invalid path and removed, because it does not conform to the real connection structure of the network, and it is impossible to be a real attack path, to obtain a first candidate path;

[0108] Then, for each first candidate path, the instantaneous fluctuation deviation of all network nodes on the path is added to obtain a total sum (i.e., the abnormal behavior total value), which reflects the total sum of abnormal behaviors of all nodes on the path; then, one is subtracted from the path jump rationality score of the path to obtain a value (i.e., the path irrationality score), and the greater the path irrationality score, the more suspicious and irrational the structure of the path itself; finally, the abnormal behavior total value and the path irrationality score are multiplied to obtain a product, which is the attack path confidence of the path, and the higher the attack path confidence, the greater the possibility that the first candidate path satisfies the two conditions of large node behavior abnormality total and suspicious path structure, and determines that it is an attack path.

[0109] Step S3544: calculating the confidence median and the confidence interquartile range of the attack path confidence of all first candidate paths; determining the first candidate paths with attack path confidence greater than the confidence median plus λ times the confidence interquartile range as second candidate paths.

[0110] It should be noted that in the above embodiment of the present application, the paths with attack path confidence greater than the median plus λ times the interquartile range are preliminarily screened out to form a candidate attack path set (i.e., the set of the second candidate paths), which quickly focuses on a small number of paths that are most abnormal and most suspicious.

[0111] Step S3545: counting the frequency of each network node appearing in all second candidate paths to obtain a network node attack contribution rate; selecting network nodes with attack rate greater than N to mark the network node abnormal identifier; and adjusting the attack path confidence using the network node attack contribution rate to obtain an adjusted attack path confidence.

[0112] It should be noted that in the above embodiment of the present application, the attack path confidence of the previous step is calibrated using the attack contribution of the network node, and by multiplying the original attack path confidence of each second candidate path by an adjustment coefficient (such as 1 plus the total sum of the contribution of all network nodes on the second candidate path); if a second candidate path contains many network nodes with high attack contribution (i.e., key network nodes shared by many suspicious paths), the confidence of the second candidate path will be significantly magnified, and vice versa, if the network nodes on a second candidate path rarely appear in other suspicious paths, the confidence of the second candidate path remains basically unchanged, that is, the processing process of the above embodiment of the present application strengthens the importance of paths composed of key abnormal network nodes.

[0113] Step S3546: select the second candidate path with the adjusted attack path confidence greater than M to mark the candidate path anomaly identification;

[0114] It should be noted that the above embodiment of the present application first calculates the instantaneous fluctuation deviation of each network node based on the current fluctuation factor and the historical fluctuation factor of each network node, quantizes the current state of the node into a comparable and standardized abnormal score, reflects the mutation degree of the node behavior, generates an "abnormal score" for each node, and provides basic data for subsequent abnormal aggregation of path level; Then, using the prior knowledge of the known network connection topology, verify whether the node sequence of each candidate path conforms to the logic, the path sequence is consistent with the real topology structure, the score is high (reasonable), the "jump point" or "increment point" appears, the score is low (unreasonable), and the path jump reasonable score is calculated in combination with the path jump factor, the first layer of physical filtering is performed to exclude the paths that are impossible to exist in physical or logical (such as paths bypassing the necessary gateway), narrow the analysis range, and avoid wasting computing resources on invalid data;

[0115] Further in the processing process, first, according to the result of S3542, all unreasonable paths (prior topology condition score is 0) are screened out to obtain a first candidate path set, and for each first candidate path, the node behavior anomaly (the sum of the instantaneous fluctuation deviation of all nodes on the path) and the path structure suspiciousness (1-path jump reasonable score) are fused from two dimensions to obtain a comprehensive attack path confidence by multiplication, realizing cross verification of behavior anomaly and structure anomaly, and giving each reasonable candidate path a comprehensive abnormal score; Further, by using statistical methods (median and interquartile range) to define the threshold of abnormal value, the confidence of all first candidate paths is taken as a data set, the median and interquartile range are calculated, and the paths with confidence much higher than the overall level are screened out to determine the second candidate path, for the second round of focused filtering, to avoid the arbitrariness of setting a fixed threshold, and to adaptively focus on a small part of the most abnormal and most worthy of attention paths according to the current overall network situation, form a candidate attack path set, reduce the number of paths that need to be finally judged, and improve the efficiency of subsequent analysis;

[0116] Further, the attack contribution rate is determined by counting the frequency of each node appearing in all second candidate paths, and the attack contribution rate of the node is used as an adjustment coefficient to weight and amplify the confidence of the path, the more high-contribution-rate nodes a path contains, the higher the final confidence of the path is, through such introduction of global correlation analysis processing, the key abnormal nodes (may be common jump boards or controlled hosts) shared by multiple suspicious paths are identified, and the confidence of the path is calibrated accordingly, so that the analysis is upgraded from single path analysis to global network correlation analysis;

[0117] Finally, the candidate path anomaly is marked for the path by the calibrated final confidence.

[0118] Embodiment Two

[0119] As Figure 6 shown, the embodiment two of the present application provides a data link traceability detection system based on abnormal network behavior, which comprises a data acquisition module 10, a hop number estimation module 20, a path topology module 30 and a verification output module 40.

[0120] The data acquisition module 10 is configured to collect network data packets on a target data link, and extract TTL value, TCP window size and TCP initial sequence number of each data packet from the network data packets to form TTL value sequence, TCP window size sequence and TCP ISN sequence.

[0121] The hop number estimation module 20 is configured to calculate a preliminary hop number estimation value of the data packet based on the TTL value sequence by using clustering processing combined with a pattern recognition method.

[0122] The path topology module 30 is configured to fuse the preliminary hop number estimation value, the TCP window size sequence and the TCP initial sequence number sequence to construct a path topology model by using a particle swarm optimization algorithm combined with path node stability analysis.

[0123] The verification output module 40 is configured to analyze abnormal state network node connection relationship in the path topology model, perform path consistency verification based on coefficient of variation distribution, and output attack source network position estimation result.

[0124] To sum up, the data link tracing detection method and system based on abnormal network behavior proposed by the example of the application, by first extracting TTL (reflecting the number of transmission hops), TCP window size (reflecting the device and network state) and TCP initial sequence number (reflecting the operating system fingerprint) from network traffic, three characteristics difficult to counterfeit simultaneously, form a sequence, it is extremely difficult for attackers to counterfeit the characteristics of three different protocol layers simultaneously and stably, through the processing mode of the application embodiment, improve the reliability of the tracing result; further, the TTL value is analyzed by using the clustering algorithm, the noise is filtered, the most possible preliminary network hop number of the data packet source is calculated, the characteristics are quantified, the abstract network data is converted into specific network hop number and topology position, the analysis result is more accurate; by fusing the hop number, the window size and the sequence number sequence, the particle swarm optimization algorithm and the stability analysis are adopted, an enhanced path topology model capable of not only displaying the connection relationship but also reflecting the path stability and behavior characteristics is constructed, so that the tracing result not only contains the IP address, but also contains the hierarchical position of the attack source in the network; then, on the basis of the path topology model, combining graph analysis (finding abnormal connection) and coefficient of variation statistical test (finding abnormal behavior fluctuation), double verification is carried out, the specific position of the attack source in the network topology is finally locked, and accurate tracing of network attack is realized.

[0125] In the specific execution process, the stability of a single network node is quantified by calculating the fluctuation factor, and the change range of each characteristic information of the network nodes on the whole path is quantified by the path jump factor.

[0126] Then, in the further processing, the fluctuation factor and the path jump factor are combined with historical factors and physical factors, and the appearance frequency of the network nodes is analyzed, the network node abnormal identification and the candidate path abnormal identification are obtained by global network correlation analysis.

[0127] Finally, it should be pointed out that: the above embodiments are only used to illustrate the technical solutions of the application, but not to limit them; the ordinary skilled in the art can modify the technical solutions recorded in the above embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solution deviate from the scope of the technical solutions of the embodiments of the application.

Claims

1. A method for detecting data link provenance based on abnormal network behavior, characterized in that, The method comprises the following steps: Collecting network data packets on a target data link, and extracting TTL value, TCP window size and TCP initial sequence number of each data packet to form TTL value sequence, TCP window size sequence and TCP ISN sequence; Based on the TTL value sequence, the preliminary hop count estimation value of the data packet is calculated by using clustering processing combined with pattern recognition method; Fusing the preliminary hop count estimation value, the TCP window size sequence and the TCP initial sequence number sequence, a path topology model is constructed by using particle swarm optimization algorithm combined with path node stability analysis; Analyzing the connection relationship of the abnormal state network nodes in the path topology model, verifying the path consistency based on the coefficient of variation distribution, and outputting the attack source network position estimation result; Fusing the preliminary hop count estimation value, the TCP window size sequence and the TCP initial sequence number sequence, a path topology model is constructed by using particle swarm optimization algorithm combined with path node stability analysis, comprising the following steps: Performing data standardization processing on the preliminary hop count estimation value, the TCP window size sequence and the TCP initial sequence number sequence to obtain a preprocessed multi-dimensional feature vector; Initializing particle swarm parameters, including a plurality of candidate path topology models, particle positions and particle velocities; Iterating the counter; the iteration number of the iteration counter is initially 0; According to each particle position combined with the preprocessed multi-dimensional feature vector, an adaptive function value is calculated and analyzed; Adding 1 to the iteration number to obtain the current iteration number, and outputting the target path topology model to be determined by judging and screening according to the current iteration number and the adaptive function value; Performing path node stability analysis on the target path topology model to be determined, and outputting the target path topology model; The path node stability analysis on the target path topology model to be determined, and outputting the target path topology model, comprises the following steps: Traversing each network node in the target path topology model to be determined, extracting a data set of all source IP addresses considered to pass through the network node for the network node; the data set comprises a preprocessed multi-dimensional feature vector; Calculating the fluctuation factor of the data set of each network node; Obtaining the representative data set of the data set of each network node; According to the representative data set of each network node, the path jump factor of each candidate path is calculated by analyzing the parsed each candidate path in the target path topology model to be determined; According to the fluctuation factor of all network nodes and the path jump factor of all candidate paths, the abnormal identifier is obtained by analyzing the attack contribution rate of the network node and the attack path confidence of the candidate path; According to the abnormal element identifier, the final target path topology model is output by modifying the analysis based on the comprehensive unconfidence calculation; The abnormal identifier is obtained by analyzing the attack contribution rate of the network node and the attack path confidence of the candidate path according to the fluctuation factor of all network nodes and the path jump factor of all candidate paths, comprising the following steps: For each network node, obtain multiple historical fluctuation factors for multiple historical time nodes in a continuous historical time period, and calculate the instantaneous fluctuation deviation of the current fluctuation factor of each network node relative to the historical fluctuation factor based on the analysis of the historical fluctuation factors. Obtain the current connection topology of each network node, check the path sequence of each candidate path based on the connection topology of the network nodes, and obtain the prior topology condition score. The reasonable score for path jump is calculated based on the prior topological condition score and the path jump factor of the candidate path. The first candidate path is obtained by filtering based on the prior topological condition score of each candidate path; the sum of abnormal behaviors of the first candidate path is calculated based on the instantaneous fluctuation deviation of all network nodes of the first candidate path; the unreasonableness score of the path is calculated based on the reasonableness score of the path jump; the attack path confidence is obtained by using the sum of abnormal behaviors and the unreasonableness score of the path. Anomalies are identified by combining attack path confidence with network node frequency analysis. The process of identifying anomalies based on attack path confidence and network node frequency analysis includes the following steps: Calculate the median and interquartile range of the attack path confidence for all first candidate paths; then, select second candidate paths from the first candidate paths based on the attack path confidence, the median, and the interquartile range. For each network node, the frequency of its appearance in all second candidate paths is counted to obtain the network node attack contribution rate; network nodes with an attack rate greater than N are selected and marked as network node anomalies; the attack path confidence is adjusted using the network node attack contribution rate to obtain the adjusted attack path confidence. Select the second candidate path with a confidence level greater than M after adjustment and mark it as an anomaly.

2. The method of claim 1, wherein, The particle position is set as a high-dimensional vector, where each dimension of the high-dimensional vector represents the confidence of a connecting edge in each candidate path topology model; the particle velocity represents the magnitude of the particle position adjustment direction when the candidate path topology model searches in the solution space.

3. The method of claim 2, wherein, The process of filtering based on the current iteration number and fitness function value to output the topology model of the target path to be determined includes the following steps: The algorithm determines whether the fitness function value corresponding to the current iteration number is greater than the fitness function value generated in the previous iteration. If so, it determines the candidate path topology model corresponding to the current fitness function value as the path topology model to be determined. If not, it retains the candidate path topology model corresponding to the fitness function value generated in the previous iteration as the path topology model to be determined. The algorithm further determines whether the current iteration number is greater than or equal to the preset maximum threshold for the number of iterations. If so, it outputs the current path topology model to be determined as the target path topology model to be determined. If not, it updates the particle position according to the particle velocity to obtain a new candidate path topology model and returns the new candidate path topology model to the particle swarm optimization process for re-iteration until the target path topology model to be determined is output.

4. The method of claim 3, wherein, The anomaly identifiers include network node anomaly identifiers and candidate path anomaly identifiers.

5. A storage medium, characterized by The storage medium stores a computer program, which, when executed by a processor, implements the data link tracing and detection method based on abnormal network behavior as described in any one of claims 1-4.

Images