A deep learning-based network encryption attack detection method

Abstract

The application discloses a network encryption attack detection method based on deep learning, which comprises the following steps: collecting encrypted network traffic to generate a target communication channel; constructing a set of micro-perturbation incentives to generate micro-perturbation incentive records; collecting response indicators of each protocol layer to generate cross-layer perturbation response time sequence; constructing a cross-protocol layer associated perturbation trajectory graph; calculating a cross-layer coupling matrix and a perturbation response topology fingerprint; inputting the cross-protocol layer associated perturbation trajectory graph and the cross-layer coupling matrix into a cross-layer topology constraint Neural ODE for numerical integral evolution to generate a perturbation response continuous time hidden state trajectory; and calculating an encryption attack risk score to generate an encryption attack detection result. The application adopts active micro-perturbation and cross-layer topology constraint Neural ODE modeling, realizes encryption channel dynamic fingerprint extraction, and has high-precision, high-sensitivity and strong-explanation attack detection capability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network encryption attack detection, and in particular to a network encryption attack detection method based on deep learning. BACKGROUND

[0002] With the full encryption of network communication, the traditional attack detection method relying on plaintext analysis has been difficult to apply to the encrypted channel environment, and the existing technology generally adopts statistical feature modeling, traffic pattern recognition or single protocol layer behavior analysis, etc. Only based on passive observation to build detection basis, it cannot actively apply external stimulation to obtain higher discriminant response characteristics, at the same time, the existing method is limited to single layer protocol perspective, lacks the ability of collaborative correlation modeling between cross-link layer, network layer, transmission layer and encryption protocol layer, and is easy to appear detection delay and misjudgment when facing strong concealment and cross-layer interpenetration type encryption attack.

[0003] The existing technology cannot actively drive the encrypted communication channel to produce distinguishable disturbance response by using multi-frequency, multi-scale disturbance mode, and cannot uniformly map the disturbance response of different protocol layers to continuous time domain to build cross-layer associated dynamic structure characteristics, and lacks a comprehensive analysis mechanism combining graph structure characteristics, cross-layer coupling relationship and continuous time neural ordinary differential equation, so that the topological disturbance pattern of the encrypted channel and the evolution of the continuous time hidden state cannot be effectively presented. Therefore, the existing method cannot accurately identify the weak trigger signs of encryption attack, cannot obtain high reliability risk score, and leads to obvious deficiencies in accuracy, stability and interpretability of encryption attack detection. SUMMARY

[0004] One object of the present application is to provide a network encryption attack detection method based on deep learning. The present application adopts active micro-disturbance and cross-layer topological constraint Neural ODE modeling to realize encrypted channel dynamic fingerprint extraction, and has high-precision, high-sensitivity and strong-explanation attack detection capability.

[0005] According to the network encryption attack detection method based on deep learning of the present application, the following steps are included:

[0006] Collecting encrypted network traffic, reorganizing according to session identification and time sequence, screening according to session duration condition and packet number condition, and generating target communication channel;

[0007] For the target communication channel, a micro-disturbance excitation set is constructed, the disturbance frequency, disturbance time scale, disturbance amplitude and data packet selection rule are set for each micro-disturbance mode, the corresponding micro-disturbance is applied and the micro-disturbance mode identification, disturbance parameter and time index are recorded, and the micro-disturbance excitation record is generated;

[0008] Collecting each protocol layer response index in the corresponding time interval of the perturbation excitation record, performing time alignment and value normalization processing on the response index, associating with the perturbation excitation record, and generating a cross-layer perturbation response time sequence;

[0009] According to the cross-layer perturbation response time sequence and the perturbation excitation record, defining a state point determined by a protocol layer identifier and a time index as a graph node, defining a state point pair triggered by the same perturbation mode and satisfying a response correlation condition as a graph edge, and constructing a cross-protocol layer associated perturbation trajectory graph;

[0010] Based on the cross-protocol layer associated perturbation trajectory graph, calculating a cross-layer coupling matrix and a perturbation response topology fingerprint, inputting the cross-protocol layer associated perturbation trajectory graph and the cross-layer coupling matrix into a cross-layer topology constraint Neural ODE for numerical integral evolution, and generating a perturbation response continuous time hidden state trajectory;

[0011] According to the perturbation response continuous time hidden state trajectory and the perturbation response topology fingerprint, calculating an encryption attack risk score, comparing the score with a threshold value, and generating an encryption attack detection result.

[0012] Optionally, the generation of the target communication channel specifically includes:

[0013] Collecting encrypted network traffic, recording the timestamp, source address, destination address, source port, destination port and transmission layer protocol type of each data packet, arranging them in the order of collection, and generating an encrypted network traffic original data sequence;

[0014] Reading each data packet from the encrypted network traffic original data sequence, generating a session identifier, merging data packets with the same session identifier and sorting them by timestamp, and generating an encrypted session sequence set;

[0015] For each encrypted session sequence in the encrypted session sequence set, calculating the session duration and the number of data packets, and generating a session duration and data packet number statistical result set;

[0016] Comparing the session duration and data packet number statistical result with the preset session duration condition and the preset data packet number condition, eliminating encrypted session sequences that do not meet the conditions, and retaining encrypted session sequences that meet the conditions;

[0017] Confirming all retained encrypted session sequences as target communication channels according to their session identifiers, and generating a target communication channel set.

[0018] Optionally, the generation of the perturbation excitation record specifically includes:

[0019] constructing a micro-disturbance excitation set for the target communication channel, setting a disturbance frequency, a disturbance time scale, a disturbance amplitude and a data packet selection rule for each micro-disturbance mode in the micro-disturbance excitation set, and recording the micro-disturbance mode parameter set in a unified structure to generate the micro-disturbance mode parameter set;

[0020] reading data packets from the target communication channel in chronological order, determining data packet indexes for each micro-disturbance mode according to the data packet selection rule corresponding to each micro-disturbance mode in the micro-disturbance mode parameter set, and generating a micro-disturbance data packet index set;

[0021] For each data packet in the micro-disturbance data packet index set, generating a sending time offset according to the disturbance frequency, the disturbance time scale and the disturbance amplitude of the corresponding micro-disturbance mode, and recording the sending time offset, the micro-disturbance mode identifier and the data packet index in combination to generate a time disturbance record set;

[0022] For each data packet in the micro-disturbance data packet index set, generating a queue scheduling priority change according to the disturbance frequency, the disturbance time scale and the disturbance amplitude of the corresponding micro-disturbance mode, and recording the queue scheduling priority change, the micro-disturbance mode identifier and the data packet index in combination to generate a queue disturbance record set;

[0023] merging the time disturbance record set and the queue disturbance record set according to the time index, and integrating the time offset, the queue scheduling priority change, the micro-disturbance mode identifier and the data packet index into a disturbance record item to generate a disturbance record set;

[0024] sorting the disturbance record set according to the time index, and removing time index duplicates to generate a micro-disturbance excitation record.

[0025] Optionally, the generation of the cross-layer disturbance response time sequence specifically includes:

[0026] collecting link layer response indicators, protocol layer response indicators, transmission layer response indicators and encryption protocol layer response indicators from the target communication channel in chronological order within the time interval corresponding to the micro-disturbance excitation record, and collecting them in the order of collection to generate a cross-layer response indicator raw data set;

[0027] mapping the cross-layer response indicator raw data set to a unified time axis according to the time index in the micro-disturbance excitation record, and reordering them according to the mapped time index to generate an initial cross-layer response time sequence set;

[0028] performing interpolation processing or truncation processing with a fixed time step on the initial cross-layer response time sequence set to generate an aligned cross-layer response time sequence set;

[0029] The normalization coefficients are calculated for each protocol layer response time sequence in the aligned cross-layer response time sequence set according to the maximum value, the minimum value and the average value, and the values of the response time sequence at each time point are processed according to the normalization coefficients, to generate a normalized cross-layer response time sequence set;

[0030] According to the micro-perturbation mode identifier and the corresponding time index in the micro-perturbation excitation record, the response data of each protocol layer at each time point in the normalized cross-layer response time sequence set is combined with the corresponding micro-perturbation mode identifier, to generate a cross-layer response record sequence;

[0031] The cross-layer response record sequence is sorted according to the time index and the repeated time index record is removed, to generate a cross-layer perturbation response time sequence.

[0032] Optionally, the generation of the cross-protocol layer associated perturbation trajectory graph specifically includes:

[0033] All response records with time indexes are read from the cross-layer perturbation response time sequence, the protocol layer identifier of each response record is combined with the corresponding time index, to generate a state point set;

[0034] The state point set is grouped according to the protocol layer identifier, and arranged in order of the time index within each group, to generate a hierarchical state point sequence set;

[0035] According to the micro-perturbation mode identifier in the micro-perturbation excitation record, the state points belonging to the same perturbation mode are extracted from the hierarchical state point sequence set, and arranged in order of the time index to generate a perturbation mode state point sequence set;

[0036] For the state points in the perturbation mode state point sequence set, the state point pairs that meet the response correlation condition are combined according to the time index adjacent relationship or other fixed time distance, to generate a state point pair set;

[0037] Each pair of state points in the state point pair set is determined as two graph nodes respectively, and the state point pair is written as a connection relationship in the graph edge set, to generate a node edge association set;

[0038] All graph nodes and graph edges in the node edge association set are integrated according to the graph structure organization form, to generate a cross-protocol layer associated perturbation trajectory graph.

[0039] Optionally, the generation of the perturbation response continuous time hidden state trajectory specifically includes:

[0040] All graph nodes and graph edges are extracted from the cross-protocol layer associated perturbation trajectory graph, and are structured and arranged according to the protocol layer identifier and the time index of the nodes, to generate a cross-layer graph structure data set;

[0041] Performing inter-layer coupling degree calculation on the protocol layer combination relationship and the adjacent connection relationship of any graph node pair in the cross-layer graph structure data set, writing the calculated cross-layer coupling degree into the corresponding matrix position according to the protocol layer combination mode, and generating a cross-layer coupling matrix;

[0042] Performing cross-layer topology structure analysis based on the cross-protocol layer association disturbance trajectory graph, recording the protocol layer identification, time index, cross-layer connection relationship and local connection mode of the graph node in the order of graph traversal, and generating a topology structure feature set;

[0043] Performing topology coding operation on the topology structure feature set, combining the features reflecting node connection mode, cross-layer connection quantity, path connection structure and local topology change in the set according to the preset topology feature coding rule, and generating a disturbance response topology fingerprint;

[0044] Structurally combining the matrix element values of the cross-layer coupling matrix in time index order with the topology coding records in the disturbance response topology fingerprint, and constructing an initial state sequence of the cross-layer topology constrained Neural ODE;

[0045] Performing numerical integration operation on the initial state sequence of the cross-layer topology constrained Neural ODE in the time continuous domain, writing the hidden state vectors generated in the integration process into the hidden state vector sequence, and generating a disturbance response continuous time hidden state trajectory.

[0046] Optionally, the generation of the encryption attack detection result specifically includes:

[0047] Performing continuous time dynamic analysis operation on the disturbance response continuous time hidden state trajectory, extracting the amplitude change amount, gradient change amount, cross-protocol layer association change amount and cross-layer coupling change trend of the hidden state vector on the time axis item by item, and generating a disturbance response dynamic feature set;

[0048] Structurally combining the disturbance response dynamic feature set according to the time index, writing the amplitude change amount, gradient change amount and cross-layer coupling change item corresponding to each time point into the encryption attack feature item according to the preset coding rule, and generating an encryption attack feature sequence;

[0049] Performing continuous time window aggregation operation on the encryption attack feature sequence, aggregating the attack feature items in the continuous time window according to the feature amplitude, change rate and cross-layer association strength to form aggregated attack feature items, and generating an aggregated attack feature set;

[0050] Performing risk score calculation operation according to the aggregated attack feature items in the aggregated attack feature set, mapping each aggregated attack feature item to a risk score value, arranging them according to the time index, and generating a risk score sequence;

[0051] The risk scores in the risk score sequence are compared with a preset risk threshold, time indexes exceeding the preset risk threshold are extracted, an encrypted attack risk trigger sequence is generated in chronological order, and an encrypted attack detection result is obtained.

[0052] The present application has the following advantages:

[0053] The present application actively applies micro-perturbation in multiple frequencies, multiple time scales and multiple amplitudes to make the target communication channel produce observable cross-layer perturbation response in the link layer, network layer, transmission layer and encryption protocol layer, thereby breaking through the limitations of traditional passive flow statistical characteristics, recording the perturbation mode, perturbation parameters and action time index, constructing a micro-perturbation excitation record that can completely track the perturbation driving effect, and collecting response indicators of each protocol layer based on this, forming a cross-layer perturbation response time sequence after time alignment, numerical normalization and correlation mapping, realizing the structured, multi-dimensional and continuous expression of the response behavior of the encrypted communication channel in different protocol layers, and compared with the traditional method based on static flow characteristics or single-layer parameters, the present application can actively obtain more discriminative dynamic response information in the encrypted state, providing high-quality input for subsequent cross-layer correlation modeling.

[0054] Further, the present application combines the cross-layer perturbation response time sequence with the micro-perturbation excitation record to construct a cross-protocol layer associated perturbation trajectory graph, describes the associated structural features of the encrypted communication channel between multiple protocol layers by extracting protocol layer identifiers, time indexes and cross-layer related state point pairs, and simultaneously, through inter-layer coupling degree calculation, topology structure analysis and topology feature coding, the present application generates a cross-layer coupling matrix and a perturbation response topology fingerprint, inputs both into the cross-layer topology constrained Neural ODE, realizes the joint modeling of the cross-layer topology structure, perturbation evolution law and hidden state change trend in the continuous time domain, this modeling method not only presents the continuous time dynamic change of the perturbation response, but also preserves the structural constraints of the cross-layer topology, so that the generated perturbation response continuous time hidden state trajectory has stronger physical meaning and attack explainability, on this basis, the present application uses the hidden state trajectory to construct dynamic attack features, aggregates the attack features and generates a risk score sequence, so that the detection result not only has high accuracy and high sensitivity, but also has the ability to explain the attack trigger process, cross-layer evolution path and risk change law, therefore, the present application realizes the organic integration of active feature acquisition, cross-layer topology constraint modeling and continuous time deep learning in the field of encrypted channel attack detection, significantly improves the detection precision, response speed and robustness, and solves the technical bottleneck that the existing technology cannot obtain high-quality attack recognition basis in the encrypted communication environment. BRIEF DESCRIPTION OF DRAWINGS

[0055] The accompanying drawings are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and are meant to explain the application without limiting the application to the exact embodiments shown. In the drawings:

[0056] Fig. 1 A flow chart of a network encryption attack detection method based on deep learning proposed by the application;

[0057] Fig. 2 A cross-protocol layer associated disturbance trajectory graph construction schematic diagram of a network encryption attack detection method based on deep learning proposed by the application;

[0058] Fig. 3 A cross-layer topology constraint Neural ODE numerical integral evolution schematic diagram of a network encryption attack detection method based on deep learning proposed by the application. DETAILED DESCRIPTION

[0059] The application will now be described in further detail with reference to the drawings. These drawings show only the essential features of the application and are therefore to be regarded only as a schematic representation of the basic structure of the application.

[0060] REFERENCE Figs. 1-3 A network encryption attack detection method based on deep learning, comprising the following steps:

[0061] Collecting encrypted network traffic, reorganizing according to session identification and time sequence, screening according to session duration conditions and packet quantity conditions, and generating target communication channels;

[0062] For the target communication channel, a set of micro-disturbance excitations is constructed, the disturbance frequency, disturbance time scale, disturbance amplitude and data packet selection rule are set for each micro-disturbance mode, the corresponding micro-disturbance is applied and the micro-disturbance mode identification, disturbance parameter and time index are recorded, and the micro-disturbance excitation record is generated;

[0063] In the time interval corresponding to the micro-disturbance excitation record, each protocol layer response index is collected, the response index is subjected to time alignment and numerical normalization processing, and is associated with the micro-disturbance excitation record to generate a cross-layer disturbance response time sequence;

[0064] According to the cross-layer disturbance response time sequence and the micro-disturbance excitation record, the state points determined by the protocol layer identification and the time index are defined as graph nodes, and the state point pairs triggered by the same micro-disturbance mode and satisfying the response correlation condition are defined as graph edges, and a cross-protocol layer associated disturbance trajectory graph is constructed;

[0065] The cross-protocol layer associated disturbance trajectory graph is input into a cross-layer topology constraint Neural ODE together with the cross-layer coupling matrix to perform numerical integral evolution, and a disturbance response continuous-time hidden state trajectory is generated.

[0066] A risk score of the encryption attack is calculated according to the disturbance response continuous-time hidden state trajectory and the disturbance response topology fingerprint, the score is compared with a threshold value, and an encryption attack detection result is generated.

[0067] In the embodiment, the generation of the target communication channel specifically includes:

[0068] The encrypted network traffic is collected, and a timestamp, a source address, a destination address, a source port, a destination port and a transmission layer protocol type of each data packet are recorded in sequence, and an encrypted network traffic original data sequence is generated;

[0069] Each data packet is read from the encrypted network traffic original data sequence, a session identifier is generated, data packets with the same session identifier are merged and sorted according to the timestamp, and an encrypted session sequence set is generated;

[0070] The generation of the encrypted session sequence set specifically includes:

[0071] Each data packet is read from the encrypted network traffic original data sequence, the source address, the destination address, the source port, the destination port and the transmission layer protocol type in the data packet are sequentially obtained, the five fields are combined in a fixed splicing order to form a session identifier, data packets with the same session identifier are arranged in ascending order of the timestamp, and all the arranged data packets are written into an encrypted session sequence according to the corresponding session identifier, and all the encrypted session sequences are continuously written to generate the encrypted session sequence set;

[0072] For each encrypted session sequence in the encrypted session sequence set, a session duration and a data packet quantity are calculated, and a session duration and data packet quantity statistical result set is generated;

[0073] The generation of the session duration and data packet quantity statistical result set specifically includes:

[0074] The encrypted session sequences are read from the encrypted session sequence set one by one, the timestamp of the first data packet of the encrypted session sequence is obtained and subtracted from the timestamp of the last data packet, and the difference is written into a session duration value; the number of data packets in the encrypted session sequence is counted, and the counted number is written into a data packet quantity value; the session duration value and the data packet quantity value are combined according to the session identifier corresponding to the encrypted session sequence and written into a statistical record, and all the continuously generated statistical records generate the session duration and data packet quantity statistical result set;

[0075] The session duration and the packet quantity statistics are compared with preset session duration conditions and preset packet quantity conditions, and the encrypted session sequences that do not satisfy the conditions are removed, and the encrypted session sequences that satisfy the conditions are retained;

[0076] The comparison specifically includes:

[0077] A statistical record is read from the session duration and packet quantity statistics set, and the session duration value in the statistical record is compared with the preset session duration condition, and the packet quantity value in the statistical record is compared with the preset packet quantity condition; if both comparisons satisfy the corresponding conditions, the encrypted session sequence corresponding to the statistical record is retained, otherwise, the encrypted session sequence is removed;

[0078] All the retained encrypted session sequences are confirmed as target communication channels according to their session identifiers, and a target communication channel set is generated.

[0079] In the embodiment, the generation of the micro-perturbation excitation record specifically includes:

[0080] A micro-perturbation excitation set is constructed for the target communication channel, each micro-perturbation mode in the micro-perturbation excitation set is set with a perturbation frequency, a perturbation time scale, a perturbation amplitude and a data packet selection rule, and a micro-perturbation mode parameter set is generated in a unified structure record;

[0081] The generation of the micro-perturbation mode parameter set specifically includes:

[0082] All data packet structures to be processed are read from the target communication channel; micro-perturbation mode record items are sequentially created according to a preset micro-perturbation mode list, and the corresponding perturbation frequency, perturbation time scale, perturbation amplitude and data packet selection rule are written in each micro-perturbation mode record item, four types of parameters are combined to form a mode parameter field group in a fixed field order; all mode parameter field groups are sequentially written in a set record structure according to the micro-perturbation mode identifier, to generate a micro-perturbation excitation set; the mode parameter field groups corresponding to each micro-perturbation mode in the micro-perturbation excitation set are sequentially summarized according to the record order, to generate a micro-perturbation mode parameter set;

[0083] Data packets are read from the target communication channel in time sequence, and the data packet indexes on which each micro-perturbation mode acts are determined according to the data packet selection rule corresponding to each micro-perturbation mode in the micro-perturbation mode parameter set, to generate a micro-perturbation data packet index set;

[0084] The generation of the micro-perturbation data packet index set specifically includes:

[0085] reading each data packet from the target communication channel in time sequence, generating a corresponding data packet index for each data packet and writing the index record item, judging whether the index record item meets the selection condition according to the data packet selection rule of each micro-perturbation mode in the micro-perturbation mode parameter set, writing the data packet index meeting the condition into the mode index record of the corresponding micro-perturbation mode, and arranging all the mode index records according to the micro-perturbation mode identification to generate a micro-perturbation data packet index set;

[0086] For each data packet in the micro-perturbation data packet index set, a sending time offset is generated according to the perturbation frequency, perturbation time scale and perturbation amplitude of the corresponding micro-perturbation mode, and the sending time offset, the micro-perturbation mode identification and the data packet index are recorded to generate a time perturbation record set;

[0087] The generation of the time perturbation record set specifically includes:

[0088] reading each data packet from the micro-perturbation data packet index set in index sequence, obtaining the perturbation frequency, perturbation time scale and perturbation amplitude of the corresponding micro-perturbation mode, generating a sending time offset according to the fixed combination order of the three types of perturbation parameters, writing the sending time offset, the micro-perturbation mode identification and the data packet index into a time perturbation record item, and sequentially writing all the time perturbation record items into the record structure to generate the time perturbation record set;

[0089] For each data packet in the micro-perturbation data packet index set, a queue scheduling priority change amount is generated according to the perturbation frequency, perturbation time scale and perturbation amplitude of the corresponding micro-perturbation mode, and the queue scheduling priority change amount, the micro-perturbation mode identification and the data packet index are recorded to generate a queue perturbation record set;

[0090] The generation of the queue perturbation record set specifically includes:

[0091] reading each data packet from the micro-perturbation data packet index set in index sequence, obtaining the perturbation frequency, perturbation time scale and perturbation amplitude of the corresponding micro-perturbation mode, calculating a queue scheduling priority change amount according to the preset parameter combination method of the three types of perturbation parameters, writing the queue scheduling priority change amount, the micro-perturbation mode identification and the data packet index into a queue perturbation record item, and arranging all the queue perturbation record items according to the time index to generate the queue perturbation record set;

[0092] The time perturbation record set and the queue perturbation record set are merged according to the time index, and the time offset, the queue scheduling priority change amount, the micro-perturbation mode identification and the data packet index are integrated and written into a perturbation record item to generate a perturbation record set;

[0093] The perturbation record set is sorted according to the time index, and the time index duplicates are removed to generate a micro-perturbation excitation record.

[0094] In this embodiment, the generation of the cross-layer disturbance response time sequence specifically includes:

[0095] In the time interval corresponding to the micro-disturbance excitation record, link layer response indicators, protocol layer response indicators, transmission layer response indicators and encryption protocol layer response indicators are collected in time sequence from the target communication channel, and are collected in the order of collection to generate a cross-layer response indicator original data set;

[0096] The generation of the cross-layer response indicator original data set specifically includes:

[0097] In the time interval corresponding to the micro-disturbance excitation record, link layer response indicators, protocol layer response indicators, transmission layer response indicators and encryption protocol layer response indicators corresponding to each data packet are read in time sequence from the target communication channel, and the four types of response indicators are written in the order of fixed fields to cross-layer response record items; all cross-layer response record items are continuously written to the record structure in the order of reading to generate a cross-layer response indicator original data set;

[0098] According to the time index in the micro-disturbance excitation record, the cross-layer response indicator original data set is mapped to a unified time axis, and is reordered according to the mapped time index to generate an initial cross-layer response time sequence set;

[0099] The generation of the initial cross-layer response time sequence set specifically includes:

[0100] According to the time index in the micro-disturbance excitation record, the collection time of each cross-layer response record item is read in sequence from the cross-layer response indicator original data set, and the collection time is converted into a target time index on the unified time axis according to a preset mapping rule; all cross-layer response record items are sorted according to the converted time index and continuously written to the time sequence structure to generate an initial cross-layer response time sequence set;

[0101] The initial cross-layer response time sequence set is subjected to interpolation processing or truncation processing with a fixed time step to generate an aligned cross-layer response time sequence set;

[0102] The normalization coefficients of each protocol layer response time sequence in the aligned cross-layer response time sequence set are calculated according to the maximum value, the minimum value and the average value, and the values of the response time sequence at each time point are processed according to the normalization coefficients to generate a normalized cross-layer response time sequence set;

[0103] According to the micro-disturbance mode identifier and the corresponding time index in the micro-disturbance excitation record, the response data of each protocol layer at each time point in the normalized cross-layer response time sequence set is combined with the corresponding micro-disturbance mode identifier to generate a cross-layer response record sequence;

[0104] The generation of the cross-layer response record sequence specifically includes:

[0105] According to the micro-perturbation mode identifier and the time index in the micro-perturbation excitation record, read the normalized response value of each protocol layer at the corresponding time index from the normalized cross-layer response time sequence set, and write the response value and the micro-perturbation mode identifier in the fixed field order into the cross-layer response record item; record all cross-layer response record items in sequence according to the writing order to generate a cross-layer response record sequence;

[0106] Sort the cross-layer response record sequence according to the time index and remove the repeated time index records to generate a cross-layer perturbation response time sequence.

[0107] In the embodiment, the generation of the cross-protocol layer associated perturbation trajectory graph specifically includes:

[0108] Read all response records with time indexes from the cross-layer perturbation response time sequence, combine the protocol layer identifier of each response record with its corresponding time index, and generate a state point set;

[0109] Group the state point set according to the protocol layer identifier, and arrange the state points in each group in time index order to generate a hierarchical state point sequence set;

[0110] According to the micro-perturbation mode identifier in the micro-perturbation excitation record, extract the state points belonging to the same perturbation mode from the hierarchical state point sequence set, and arrange them in time index order to generate a perturbation mode state point sequence set;

[0111] According to the time index adjacent relationship or other fixed time distance, combine the state point pairs in the perturbation mode state point sequence set that meet the response correlation condition to generate a state point pair set;

[0112] The generation of the state point pair set specifically includes:

[0113] Read two adjacent state points in the perturbation mode state point sequence set in time index order; extract the response data of the adjacent state points at the corresponding time index from the cross-layer perturbation response time sequence; perform correlation verification on the two response data according to the preset response difference threshold, change trend threshold, or cross-layer synchronization condition to obtain a verification result of whether the response correlation condition is met; write the two state points that meet the response correlation condition into a state point pair record item in a fixed field order; write all state point pair record items into a record structure in sequence to generate a state point pair set;

[0114] Determine each pair of state points in the state point pair set as two graph nodes, and write the state point pair as a connection relationship into a graph edge set to generate a node-edge associated set;

[0115] Integrate all graph nodes in the node edge association set and graph edges according to the graph structure organization form to generate a cross-protocol layer association disturbance trajectory graph.

[0116] In the embodiment, the generation of the disturbance response continuous time hidden state trajectory specifically includes:

[0117] Extract all graph nodes and graph edges from the cross-protocol layer association disturbance trajectory graph, and structure them according to the protocol layer identifier and time index of the nodes to generate a cross-layer graph structure dataset;

[0118] Perform interlayer coupling degree calculation on the protocol layer combination relationship and adjacent connection relationship of any graph node pair in the cross-layer graph structure dataset, write the calculated cross-layer coupling degree into the corresponding matrix position according to the protocol layer combination mode, and generate a cross-layer coupling matrix;

[0119] The generation of the cross-layer coupling matrix specifically includes:

[0120] Read the protocol layer combination relationship and adjacent connection relationship of any two graph nodes from the cross-layer graph structure dataset according to the protocol layer identifier; perform difference calculation, change trend comparison or cross-layer synchronization verification on the response data of the two graph nodes at the corresponding time index in the cross-layer disturbance response time sequence to obtain a coupling degree value representing the cross-layer association strength of the two nodes; write the coupling degree value into the corresponding matrix element position of the cross-layer coupling matrix according to the protocol layer combination relationship; and perform the operation on all graph node pairs in the cross-layer graph structure dataset to generate the cross-layer coupling matrix.

[0121] Perform cross-layer topology structure analysis based on the cross-protocol layer association disturbance trajectory graph, record the protocol layer identifier, time index, cross-layer connection relationship and local connection mode of the graph nodes in the graph traversal order to generate a topology structure feature set;

[0122] Perform topology encoding operation on the topology structure feature set, combine the features reflecting the node connection mode, cross-layer connection quantity, path connection structure and local topology change in the set according to the preset topology feature encoding rule to generate a disturbance response topology fingerprint.

[0123] Structure the matrix element values of the cross-layer coupling matrix according to the time index order and the topology encoding records in the disturbance response topology fingerprint to construct an initial state sequence of the cross-layer topology constraint Neural ODE.

[0124] The cross-layer topology constraint Neural ODE specifically includes:

[0125] The topology constraint input constituent part, the topology constraint application part and the topology constraint evolution output part, the topology constraint input constituent part combines the cross-layer coupling matrix and the perturbation response topology fingerprint according to the time index to generate an initial state sequence, which is used to provide the cross-protocol layer topology connection strength and topology change characteristics to the Neural ODE, the topology constraint application part takes the cross-layer coupling information, the topology connection mode and the local topology change in the initial state sequence as the evolution constraint parameters in the continuous time evolution process of the Neural ODE, so that the evolution of the hidden state vector is driven by the topology structure, and the topology constraint evolution output part performs time continuous domain evolution on the hidden state vector under the action of the topology constraint to generate a perturbation response continuous time hidden state trajectory reflecting the dynamic change of the cross-layer perturbation response;

[0126] The construction of the initial state sequence specifically includes:

[0127] The coupling degree value of the corresponding time index is read from the cross-layer coupling matrix in the time index order; the topology encoding record of the same time index is read from the perturbation response topology fingerprint, the topology encoding record is spliced with the coupling degree value in the preset field order to form an initial state record item, and all initial state record items are continuously written into the record structure in the time index order to generate the initial state sequence of the cross-layer topology constraint Neural ODE.

[0128] The numerical integration operation in the time continuous domain is performed on the initial state sequence of the cross-layer topology constraint Neural ODE, and each time step hidden state vector generated in the integration process is written into the hidden state vector sequence to generate the perturbation response continuous time hidden state trajectory.

[0129] In the embodiment, the generation of the encryption attack detection result specifically includes:

[0130] The continuous time dynamic analysis operation is performed on the perturbation response continuous time hidden state trajectory, and the amplitude change amount, the gradient change amount, the cross-protocol layer correlation change amount and the cross-layer coupling change trend of the hidden state vector on the time axis are extracted item by item to generate a perturbation response dynamic feature set;

[0131] The generation of the perturbation response dynamic feature set specifically includes:

[0132] read the hidden state vectors in time index order from the continuous-time hidden state trajectory of the disturbance response; perform a difference operation on the hidden state vectors of adjacent time indexes to obtain a magnitude change quantity; perform a continuous difference operation on the change of the hidden state vectors with the time index to obtain a gradient change quantity; perform a comparison of adjacent times on the numerical items in the hidden state vectors that reflect the cross-protocol layer association relationship to obtain a cross-protocol layer association change quantity; perform a time trend analysis on the numerical items in the hidden state vectors that reflect the cross-layer coupling relationship to obtain a cross-layer coupling change trend; write the four types of change values into the dynamic feature record item in time index, and generate a disturbance response dynamic feature set;

[0133] structurally combine the disturbance response dynamic feature set according to the time index, write the magnitude change quantity, the gradient change quantity and the cross-layer coupling change item corresponding to each time point into the encryption attack feature item according to a preset encoding rule, and generate an encryption attack feature sequence;

[0134] perform a continuous time window aggregation operation on the encryption attack feature sequence, aggregate the attack feature items in the continuous time window according to the feature magnitude, the change rate and the cross-layer association strength to form an aggregated attack feature item, and generate an aggregated attack feature set;

[0135] The generation of the aggregated attack feature set specifically includes:

[0136] read a plurality of continuous encryption attack feature record items in the encryption attack feature sequence according to a preset time window length; perform an average calculation on the magnitude change quantities in the window to obtain a window magnitude aggregation value; perform an extreme value or average calculation on the gradient change quantities in the window to obtain a window gradient aggregation value; perform a weighted summary on the cross-layer coupling change items in the window to obtain a window coupling aggregation value; write the three types of aggregation values into the aggregated attack feature record item according to the starting index of the time window, and generate the aggregated attack feature set;

[0137] perform a risk score calculation operation on the aggregated attack feature items in the aggregated attack feature set, map each aggregated attack feature item to a risk score value, arrange the risk score values in time index order, and generate a risk score sequence;

[0138] The generation of the risk score sequence specifically includes:

[0139] read the aggregated attack feature items from the aggregated attack feature set according to the time index, perform numerical conversion on the magnitude aggregation value, the gradient aggregation value and the coupling aggregation value in the aggregated attack feature item according to a preset mapping rule to obtain a risk score value corresponding to the time index, and combine all the risk score values in time index order to generate the risk score sequence;

[0140] compare the risk score in the risk score sequence with a preset risk threshold, extract the time indexes that exceed the preset risk threshold, generate an encryption attack risk trigger sequence in time order, and obtain an encryption attack detection result.

[0141] Example 1:

[0142] In order to verify the feasibility of the application in implementation, the application is applied to the encrypted communication environment of a certain city Internet backbone node, which is located in the internal network of the communication service operation center, covering office buildings, commercial networks and part of the public access area. The local operation center has multiple cases of abnormal growth of SSL encrypted traffic, connection establishment delay and encrypted data burst transmission across network segments in the afternoon of weekdays. Since all data in the channel are in end-to-end encryption state, traditional clear content-based inspection techniques cannot work at all, and existing statistical pattern recognition-based detection engines cannot make a clear judgment. This scenario exactly reflects the problem that existing technologies cannot obtain deep features for attack recognition from the inside of the encrypted channel.

[0143] In order to verify the detection ability of the application, the encrypted communication link of the operation center is taken as the test channel, which is composed of a large number of TLS, QUIC, SSH and various enterprise self-defined encryption protocols. There is no clear information available for analysis in the channel. The application first continuously collects all encrypted data packets in the link, and then divides the sessions according to the source address, destination address and transmission layer protocol type. Then the communication process is reconstructed in time sequence, and a number of encrypted communication channels with high activity are selected through the duration and packet number. Subsequently, without affecting the quality of service, a small disturbance of multiple frequencies, multiple time scales and multiple amplitudes is applied to the selected channel, and through the adjustment of the transmission time offset and the queue scheduling priority with extremely small amplitude, the channel produces a weakly observable disturbance response at different protocol layers.

[0144] During the action of the micro-disturbance, the system synchronously collects the retransmission and congestion characteristics of the link layer, the routing reply signal of the network layer, the handshake and maintenance state change of the transmission layer, and the handshake round and encryption state fluctuation of the encryption protocol layer. All the collected response data are aligned and normalized according to the micro-disturbance action time, and then a cross-layer disturbance response time sequence is formed. Through this sequence, the system can observe the response mode of the encrypted data stream at different protocol layers, even if the response change is only a very small offset, the application can effectively capture it.

[0145] The present application combines the cross-layer disturbance response sequence with the micro-disturbance excitation record to construct a cross-protocol layer associated disturbance trajectory graph, which clearly describes the propagation path and response association of micro-disturbance between different protocol layers, lays a data foundation for subsequent generation of cross-layer coupling matrix and disturbance response topology fingerprint, and obtains node connection mode, cross-layer connection quantity, local topology change and other characteristics through graph structure traversal, and constructs the initial state sequence of cross-layer topology constrained Neural ODE together with the interlayer coupling degree between nodes, thereafter, the system inputs the initial state sequence to the cross-layer topology constrained Neural ODE for continuous time evolution, and obtains the disturbance response continuous time hidden state trajectory.

[0146] The hidden state trajectory reflects the continuous dynamic change trend of the encrypted channel when affected by the micro-disturbance, and by further analyzing the change law of the hidden state vector on the time axis, high-value features such as amplitude change, gradient change and cross-layer coupling change trend can be extracted, in the field environment of the operation center, the hidden state trajectory shows a significant increase in coupling correlation change in several time periods, and its cross-layer response mode has suddenness, synchronicity and repeatability, which is obviously different from the smooth mode of normal traffic, by performing time window aggregation on the hidden state change, the present application obtains several time segments with sudden increase of attack characteristics, and forms a risk score sequence.

[0147] In several continuous monitoring periods, the risk score sequence of the present application breaks through the preset risk threshold in multiple time periods, and these time periods are highly consistent with the abnormal period of encrypted traffic observed by the network administrator of the operation center, although the administrator cannot locate the attack source through traditional methods, the present application gives the interlayer propagation path of risk triggering through the cross-layer topology association structure and the continuous time hidden state trajectory, so that the administrator can infer the potential encrypted attack behavior from the associated evolution of the encrypted protocol layer, the transmission layer and the link layer, such as encrypted tunnel penetration, hidden C2 communication, cross-layer hybrid attack and other modes.

[0148] Table 1 Performance comparison of the present application method and existing encrypted attack detection methods

[0149]

[0150] As can be seen from Table 1, in terms of overall detection performance, the application is still obviously superior to the traditional threshold detection method and the method based on statistical pattern recognition, but the numerical value is closer to the actual performance in the real network environment. The traditional threshold method relies on a single parameter mutation, so the accuracy is less than 80%, and the recall rate is lower, indicating that its ability to capture weak attack behavior in the encrypted channel is poor. The statistical pattern recognition method has improved in feature fusion, but it is still limited to passive observation. When facing high noise and high randomness of encrypted data streams, its upper limit of effect is limited. The application actively applies a small disturbance, so that the channel presents a higher recognition dynamic response feature at different protocol layers. Combined with the continuous time modeling of the cross-layer topology constraint Neural ODE, the detection accuracy is improved to more than 90%, the recall rate and F1-score are both about 88%, and a clear advantage is formed.

[0151] In terms of detection sensitivity, the recognition rate of the application to weak attacks reaches 82.6%, which is significantly higher than that of the traditional method. This is because the traditional method only observes passive features naturally generated, while the application actively causes small changes in the encrypted protocol stack at the link layer, network layer, transport layer and encryption protocol layer through active micro-disturbance, so that weak attack behavior forms a detectable associated track in the cross-layer response. Similarly, the encryption tunnel mutation response recognition rate is also improved to 85.1%, indicating that the application can effectively identify hidden communication behaviors that are difficult to capture by traditional methods.

[0152] In terms of early warning lead time, the application uses active disturbance to induce potential anomalies, so that the system can observe abnormal changes in the cross-layer topology structure before the attack fully breaks out, thus being able to output risk prompts earlier than the traditional method. The traditional threshold method only relies on changes in traffic statistics, and usually triggers a warning only after the attack has significantly affected the link. The statistical method is slightly improved, but it is still difficult to break through the natural limitations of the encrypted environment. The application can improve the lead time to more than 3 seconds, significantly enhancing the protection capability.

[0153] In terms of stability, the application constructs a cross-layer coupling matrix and constrains the topology features, so that non-real disturbances caused by random noise cannot form stable associations in the graph structure, thus reducing the false positive rate to 6.5%. At the same time, the detection result jitter coefficient is 0.21, showing a clear stability advantage. In contrast, the false positive rate of the traditional threshold method soared to 14% due to insufficient sensitivity and serious noise influence, and the statistical pattern recognition method remained at about 10%.

[0154] In summary, the application actively applies a small disturbance, constructs a cross-layer association model, and performs continuous time dynamic analysis based on Neural ODE, achieving significant improvements in accuracy, sensitivity, early warning lead time and stability. The above numerical values are within a reasonable engineering range, reflecting a real and reliable performance advantage.

[0155] The above merely describes preferred specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art, according to the technical solution and inventive concept of the present application, makes equivalent replacement or change within the technical range disclosed by the present application, which should be covered within the protection scope of the present application.

Claims

1. A network encryption attack detection method based on deep learning, characterized in that, Includes the following steps: Collect encrypted network traffic, reassemble it according to session identifier and time sequence, filter it based on session duration and data packet quantity conditions, and generate target communication channels; A set of micro-perturbation excitations is constructed for the target communication channel. Perturbation frequency, perturbation time scale, perturbation amplitude and data packet selection rules are set for each micro-perturbation mode. The corresponding micro-perturbation is applied and the micro-perturbation mode identifier, perturbation parameters and time index are recorded to generate a micro-perturbation excitation record. Within the time interval corresponding to the micro-perturbation excitation record, the response indicators of each protocol layer are collected, and the response indicators are processed by time alignment and numerical normalization. They are then associated with the micro-perturbation excitation record to generate a cross-layer perturbation response time series. Based on the cross-layer disturbance response time sequence and micro-disturbance excitation record, state points determined by protocol layer identifiers and time indices are defined as graph nodes, and state point pairs triggered by the same micro-disturbance mode and satisfying the response correlation condition are defined as graph edges, thus constructing a cross-protocol layer associated disturbance trajectory graph. Based on the cross-protocol layer associated perturbation trajectory map, the cross-layer coupling matrix and perturbation response topological fingerprint are calculated. The cross-protocol layer associated perturbation trajectory map and the cross-layer coupling matrix are fed into the cross-layer topological constraint Neural ODE for numerical integration evolution to generate the continuous-time hidden state trajectory of the perturbation response. The encryption attack risk score is calculated based on the continuous-time hidden state trajectory of the disturbance response and the topological fingerprint of the disturbance response. The score is then compared with a threshold to generate the encryption attack detection result. The generation of the continuous-time hidden state trajectory of the disturbance response specifically includes: All graph nodes and edges are extracted from the cross-protocol layer associated perturbation trajectory graph, and then structured according to the protocol layer identifier and time index of the nodes to generate a cross-layer graph structure dataset. Perform inter-layer coupling degree calculation on the protocol layer combination relationship and adjacency connection relationship of any graph node pair in the cross-layer graph structure dataset, and write the calculated cross-layer coupling degree into the corresponding matrix position according to the protocol layer combination method to generate a cross-layer coupling matrix. Based on the cross-protocol layer associated perturbation trajectory graph, cross-layer topology analysis is performed. The protocol layer identifier, time index, cross-layer connection relationship and local connection mode of the graph node are recorded in the graph traversal order to generate a set of topology features. Perform topology coding on the set of topology features, and combine the features in the set that reflect node connection patterns, number of cross-layer connections, path connection structure and local topology changes according to the preset topology feature coding rules to generate a disturbance response topology fingerprint. The matrix element values ​​of the cross-layer coupling matrix are combined in time index order with the topologically encoded records in the perturbation response topological fingerprint to construct the initial state sequence of the cross-layer topological constraint Neural ODE. Perform a time-continuous domain numerical integration operation on the initial state sequence of the cross-layer topological constraint Neural ODE, and write the hidden state vectors generated at each time step during the integration process into the hidden state vector sequence to generate the continuous-time hidden state trajectory of the disturbance response.

2. The network encryption attack detection method based on deep learning according to claim 1, characterized in that, The generation of the target communication channel specifically includes: Collect encrypted network traffic, record the timestamp, source address, destination address, source port, destination port, and transport layer protocol type for each data packet, arrange them in the collection order, and generate the original data sequence of encrypted network traffic; Each data packet is read from the raw data sequence of encrypted network traffic, a session identifier is generated, and data packets with the same session identifier are merged and sorted by timestamp to generate a set of encrypted session sequences. For each encrypted session sequence in the encrypted session sequence set, calculate the session duration statistics packet count and generate a set of session duration and packet count statistics results; The session duration and data packet count statistics are compared with the preset session duration and data packet count conditions. Encrypted session sequences that do not meet the conditions are removed, and encrypted session sequences that meet the conditions are retained. All preserved encrypted session sequences are identified as target communication channels according to their session identifiers, and a set of target communication channels is generated.

3. The network encryption attack detection method based on deep learning according to claim 1, characterized in that, The generation of the micro-perturbation excitation record specifically includes: A set of micro-perturbation excitations is constructed for the target communication channel. Perturbation frequency, perturbation time scale, perturbation amplitude and data packet selection rules are set for each micro-perturbation mode in the set of micro-perturbation excitations. The set of micro-perturbation mode parameters is generated and recorded in a unified structure. Data packets are read sequentially from the target communication channel. Based on the data packet selection rules corresponding to each micro-perturbation mode in the micro-perturbation mode parameter set, the data packet index of each micro-perturbation mode is determined, and a micro-perturbation data packet index set is generated. For each data packet in the micro-perturbation data packet index set, a transmission time offset is generated based on the perturbation frequency, perturbation time scale, and perturbation amplitude of the corresponding micro-perturbation mode. The transmission time offset is then combined with the micro-perturbation mode identifier and data packet index and recorded to generate a time perturbation record set. For each data packet in the micro-disturbance data packet index set, a queue scheduling priority change amount is generated based on the disturbance frequency, disturbance time scale, and disturbance amplitude of the corresponding micro-disturbance mode. The queue scheduling priority change amount is then combined with the micro-disturbance mode identifier and data packet index and recorded to generate a queue disturbance record set. The time disturbance record set and the queue disturbance record set are merged according to the time index. The time offset, queue scheduling priority change, micro-disturbance mode identifier and data packet index are integrated and written into the disturbance record item to generate the disturbance record set. Sort the disturbance record set by time index, remove duplicate time index entries, and generate micro-disturbance excitation records.

4. The network encryption attack detection method based on deep learning according to claim 1, characterized in that, The generation of the cross-layer disturbance response time series specifically includes: Within the time interval corresponding to the micro-perturbation excitation record, link layer response indicators, protocol layer response indicators, transport layer response indicators and encryption protocol layer response indicators are collected from the target communication channel in chronological order, and then aggregated in the collection order to generate a cross-layer response indicator raw data set. Based on the time index in the micro-perturbation excitation record, the original data set of cross-layer response indicators is mapped to a unified time axis, and then reordered according to the mapped time index to generate an initial cross-layer response time series set. Perform fixed-time-step interpolation or truncation on the initial cross-layer response time series set to generate an aligned cross-layer response time series set. For each protocol layer response time series in the aligned cross-layer response time series set, calculate the normalization coefficient based on the maximum, minimum, and average values, and process the values ​​of the response time series at each time point according to the normalization coefficient to generate a normalized cross-layer response time series set. Based on the micro-perturbation mode identifier and corresponding time index in the micro-perturbation excitation record, the response data of each protocol layer at each time point in the normalized cross-layer response time sequence set is combined with the corresponding micro-perturbation mode identifier to generate a cross-layer response record sequence. The cross-layer response record sequence is sorted by time index and duplicate time index records are removed to generate a cross-layer disturbance response time series sequence.

5. The network encryption attack detection method based on deep learning according to claim 1, characterized in that, The generation of the cross-protocol layer associated perturbation trajectory map specifically includes: Read all time-indexed response records from the cross-layer disturbance response time sequence, and combine the protocol layer identifier of each response record with its corresponding time index to generate a set of state points; The set of state points is grouped according to the protocol layer identifier, and then arranged in time index order within each group to generate a hierarchical set of state point sequences. Based on the micro-perturbation mode identifier in the micro-perturbation excitation record, state points belonging to the same perturbation mode are extracted from the hierarchical state point sequence set and arranged by time index to generate a perturbation mode state point sequence set; For the state points in the set of state point sequences of the disturbance mode, state point pairs that meet the response correlation conditions are combined according to the adjacency relationship of time index or other fixed time distances to generate a set of state point pairs; Each pair of state points in the state point pair set is determined as two graph nodes, and the state point pair is written into the graph edge set as the connection relationship to generate a node edge association set. Integrate all graph nodes and edges in the node-edge association set according to the graph structure to generate a cross-protocol layer associated perturbation trajectory graph.

6. The network encryption attack detection method based on deep learning according to claim 1, characterized in that, The generation of the encryption attack detection result specifically includes: A continuous-time dynamic analysis operation is performed on the continuous-time hidden state trajectory of the disturbance response, and the magnitude change, gradient change, cross-protocol layer correlation change and cross-layer coupling change trend of the hidden state vector on the time axis are extracted one by one to generate a set of dynamic features of the disturbance response. The set of dynamic features of the disturbance response is structured and combined according to the time index. The magnitude change, gradient change and cross-layer coupling change terms corresponding to each time point are written into the encryption attack feature terms according to the preset coding rules to generate the encryption attack feature sequence. A continuous time window aggregation operation is performed on the encryption attack feature sequence. The attack feature items within the continuous time window are aggregated according to feature amplitude, rate of change and cross-layer correlation strength to form aggregated attack feature items, and an aggregated attack feature set is generated. Based on the aggregated attack feature items in the aggregated attack feature set, a risk score calculation operation is performed, mapping each aggregated attack feature item to a risk score value, arranging them by time index, and generating a risk score sequence. The risk scores in the risk scoring sequence are compared with the preset risk thresholds. The time indexes that exceed the preset risk thresholds are extracted, and the encryption attack risk trigger sequence is generated in chronological order to obtain the encryption attack detection results.

Images