Multi-layer heterogeneous graph construction method based on TCP session

Abstract

The invention provides a multi-layer heterogeneous graph construction method based on a TCP session, and relates to the technical field of network security. The method comprises the following steps: reading original network flow data in a PCAP form and splitting the original network flow data into TCP sessions; sorting the data packets in the TCP session according to the timestamps, and generating data packet nodes; constructing a data packet time sequence edge according to the sequence of the timestamps, and associating each data packet node to construct a data packet sequence diagram; constructing an initial server-side state node and an initial client-side state node; traversing the data packet nodes of the data packet sequence diagram in sequence, and judging whether the states of the server-side state nodes and the client-side state nodes are changed or not; if so, newly establishing a server-side state node and a client-side state node, and constructing a corresponding state transition edge and a corresponding mapping association edge; and if not, constructing a corresponding mapping association edge. According to the method, the key information of the TCP session can be completely described, staged accurate extraction of subsequent features can be conveniently realized, and cross-stage feature dilution can be avoided.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for constructing a multi-layer heterogeneous graph based on TCP (Transmission Control Protocol) sessions. Background Technology

[0002] As the core transport layer protocol of the Internet, TCP operates between two ends (client and server). Its session state transition and data packet interaction logic are the foundation of network communication reliability. Accurately expressing the characteristics of a TCP session is a key prerequisite for anomaly detection, protocol analysis, and network fault diagnosis.

[0003] Existing TCP session feature representation techniques are mainly based on statistical feature representation. They characterize session features by extracting session-level statistics (such as average packet size, total traffic, connection duration, etc.). This method treats the entire session as a sequence of data packets, losing the state information that naturally exists at both ends of the communication. Furthermore, because it does not distinguish the state stage to which the data packets belong, the features of different stages are diluted with each other (such as the handshake packets without load lowering the overall average packet size).

[0004] In recent years, graph structures have been introduced into network analysis because they can depict complex relationships. However, existing methods mostly use isomorphic graphs or simple bipartite graphs, which are difficult to fully express key information such as the states of both ends of a TCP session, the packet sequence, and the relationship between state transitions and packets. Summary of the Invention

[0005] To address the aforementioned technical problems in the existing technology, this invention provides a method for constructing a multi-layer heterogeneous graph based on TCP sessions.

[0006] Specifically, the technical solution is as follows: a multi-layer heterogeneous graph construction method based on TCP sessions, wherein the multi-layer heterogeneous graph includes a packet sequence graph, a server-side state transition graph, and a client-side state transition graph;

[0007] The construction methods include:

[0008] Read raw network traffic data in PCAP format and split it into TCP sessions;

[0009] Sort the packets within the TCP session according to their timestamps to generate packet nodes; construct packet sequence edges according to the order of the timestamps of the packet nodes, and associate each packet node according to the packet sequence edges to construct a packet sequence graph;

[0010] Construct the initial server-side state node and client-side state node;

[0011] Iterate through each data packet node in the data packet sequence diagram and determine whether the state of the server-side state node and the client-side state node has changed.

[0012] Construct the server-side state transition graph: If the state of a server-side state node changes, create a new server-side state node and construct the corresponding state transition edge and mapping association edge; if it does not change, construct the corresponding mapping association edge.

[0013] Construct the client state transition graph: If the state of a client state node changes, create a new client state node and construct the corresponding state transition edge and mapping association edge; if it does not change, construct the corresponding mapping association edge.

[0014] Preferably, the states of the server-side state nodes include:

[0015] S_CLOSED, S_SYN_RCVD, S_ESTABLISHED, S_CLOSE_WAIT, S_LAST_ACK, S_CLOSING, S_TIME_WAIT, S_FIN_WAIT_1, S_FIN_WAIT_2 and S_RST_RECV.

[0016] Preferably, the states of the client state node include:

[0017] C_CLOSED, C_SYN_RCVD, C_ESTABLISHED, C_CLOSE_WAIT, C_LAST_ACK, C_CLOSING, C_TIME_WAIT, C_FIN_WAIT_1, C_FIN_WAIT_2 and C_RST_RECV.

[0018] Furthermore, it also includes storing multi-layer heterogeneous graphs through graph visualization.

[0019] Furthermore, it also includes storing multi-layered heterogeneous graphs through graph data structures.

[0020] Compared to existing technologies, the technical solution provided by this invention can fully express the states at both ends of a TCP session, the data packet sequence, and the correlation between state transitions at both ends and data packets, solving the technical problem of incomplete characterization of TCP session behavior in existing technologies. Furthermore, this invention constructs a heterogeneous graph including a data packet sequence diagram, a server-side state transition diagram, and a client-side state transition diagram, establishing an expression paradigm for the correlation between the states at both ends, the data packet sequence, state transitions at both ends, and data packets. This facilitates the precise extraction of subsequent features in stages and avoids the problem of feature dilution across stages. Attached Figure Description

[0021] Figure 1This is a schematic diagram of the structure of the multi-layer heterogeneous graph based on TCP sessions in this invention.

[0022] Figure 2 This is a schematic diagram of the process for constructing a multilayer heterogeneous graph in this invention.

[0023] Figure 3 This is a schematic diagram of the complete state transition diagram and the key data packets that trigger state transitions in this invention. Detailed Implementation

[0024] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0025] The present invention provides a multi-layer heterogeneous graph based on TCP sessions, as shown below. Figure 1 As shown. Here, P1 to Pn represent the 1st to nth data packet nodes. The core execution steps of its construction method are:

[0026] Step S1: Preprocessing of raw traffic files

[0027] The system reads and parses raw network traffic data (input in PCAP file format), and extracts TCP sessions.

[0028] Step S2: Construct a multi-layer heterogeneous graph.

[0029] Each TCP session is processed to construct a multi-layered heterogeneous graph. This multi-layered heterogeneous graph includes a packet sequence diagram, a server-side state transition diagram, and a client-side state transition diagram. Figure 3 The layer consists of two node types: packet nodes and state nodes (the core attributes of packet nodes include timestamp, packet direction, flag combination, and payload length). Edge types include packet sequence edges (used to associate packet nodes), state transition edges (used to associate state nodes), and mapping edges (used to associate packet nodes and state nodes). This multi-layered heterogeneous graph innovatively associates each packet with different states on the client and server sides, facilitating more granular representation of the session.

[0030] (1) Constructing a packet sequence graph

[0031] Read raw network traffic data in PCAP format and break it down into TCP sessions. Sort the packets within the TCP session according to their timestamps, and generate a corresponding packet node for each packet. The core attributes of the packet node include timestamp, packet direction, flag combination, and payload length. Construct packet sequence edges to associate the packet nodes according to their timestamps (structure: packet node 1 - packet sequence edge - packet node 2), thus building a packet sequence graph.

[0032] (2) Construct the server-side state transition diagram

[0033] Construct the initial server-side state node S_CLOSED. Iterate through each node in the packet sequence diagram, determining whether the server-side state has changed based on the current server-side state node, the packet direction of the packet node, and the combination of flag bits.

[0034] If it changes, then:

[0035] Create a new server-side status node;

[0036] Construct a state transition edge, from the original server-side state node to the newly created server-side state node (the structure is: server-side state node 1 - state transition edge - server-side state node 2).

[0037] Construct a mapping association edge, from the data packet node that triggers the server-side state transition to the original server-side state node (the structure is: data packet node - mapping association edge - original server-side state node).

[0038] If it does not change, then:

[0039] Construct a mapping association edge, from the data packet node that has not triggered a server-side state transition to the server-side state node (the structure is: data packet node - mapping association edge - server-side state node).

[0040] Specifically, the conditions for determining a server-side state transition are as follows:

[0041] The original state was S_CLOSED, the packet node flag was S, the direction was C2S, and the state changed to S_SYN_SENT;

[0042] The original state is S_CLOSED, the packet node flag is S, the direction is S2C, and the next packet node flag is SA, the direction is C2S, and the state changes to S_SYN_RCVD;

[0043] The original state is S_SYN_SENT, the packet node flag is S, the direction is S2C, and the next packet node flag is SA, the direction is C2S, and the state changes to S_SYN_RCVD;

[0044] The original state is S_SYN_SENT, the packet node flag is SA, the direction is S2C, and the next packet node flag is A, the direction is C2S, and the state changes to S_ESTABLISHED.

[0045] The original state was S_SYN_RCVD, the packet node flag was R, the direction was S2C, and the state changed to S_CLOSED;

[0046] The original state was S_SYN_RCVD, the packet node flag was A, the direction was S2C, and the state changed to S_ESTABLISHED;

[0047] The original state was S_SYN_RCVD, the packet node flag was F, the direction was C2S, and the state changed to S_FIN_WAIT_1;

[0048] The original state is S_ESTABLISHED, the packet node flag is F, the direction is S2C, and the next packet node flag is A, the direction is C2S. The state changes to S_CLOSE_WAIT.

[0049] The original state was S_ESTABLISHED, the packet node flag was F, the direction was C2S, and the state changed to S_FIN_WAIT_1;

[0050] The original state was S_CLOSE_WAIT, the packet node flag was F, the direction was C2S, and the state changed to S_LAST_ACK;

[0051] The original state was S_LAST_ACK, the packet node flag was A, the direction was S2C, and the state changed to S_CLOSED;

[0052] The original state is S_FIN_WAIT_1, the packet node flag is F, the direction is S2C, and the next packet node flag is A, the direction is C2S, and the state changes to S_CLOSING;

[0053] The original state is S_FIN_WAIT_1, the data packet node flag is FA, the direction is S2C, and the next data packet node flag is A, the direction is C2S, and the state changes to S_TIME_WAIT;

[0054] The original state was S_FIN_WAIT_1, the data packet node flag was A, the direction was S2C, and the state changed to S_FIN_WAIT_2;

[0055] The original state is S_FIN_WAIT_2, the packet node flag is F, the direction is S2C, and the next packet node flag is A, the direction is C2S, and the state changes to S_TIME_WAIT;

[0056] The original state was S_CLOSING, the packet node flag was A, the direction was S2C, and the state changed to S_TIME_WAIT.

[0057] (3) Construct the client state transition diagram

[0058] Construct the client's initial state node C_CLOSED. Iterate through each node of the packet sequence diagram, determining whether the client state has changed based on the current client state node, the packet direction of the packet node, and the combination of flag bits.

[0059] If it changes, then:

[0060] Create a new client status node;

[0061] Construct a state transition edge, pointing from the original client state node to the newly created client state node (structure: client state node 1 - state transition edge - client state node 2).

[0062] Construct a mapping association edge, from the data packet node that triggers the client state transition to the original client state node (the structure is: data packet node - mapping association edge - original client state node).

[0063] If it does not change, then:

[0064] Construct a mapping association edge, from the data packet node that has not triggered a client state transition to the client state node (the structure is: data packet node - mapping association edge - client state node).

[0065] Specifically, the conditions for determining a client state transition are as follows:

[0066] The original state was C_CLOSED, the packet node flag was S, the direction was C2S, and the state changed to C_SYN_SENT;

[0067] The original state is C_CLOSED, the packet node flag is S, the direction is S2C, and the next packet node flag is SA, the direction is C2S, and the state changes to C_SYN_RCVD;

[0068] The original state is C_SYN_SENT, the packet node flag is S, the direction is S2C, and the next packet node flag is SA, the direction is C2S, and the state changes to C_SYN_RCVD;

[0069] The original state is C_SYN_SENT, the packet node flag is SA, the direction is S2C, and the next packet node flag is A, the direction is C2S, and the state changes to C_ESTABLISHED;

[0070] The original state was C_SYN_RCVD, the packet node flag was R, the direction was S2C, and the state changed to C_CLOSED;

[0071] The original state was C_SYN_RCVD, the packet node flag was A, the direction was S2C, and the state changed to C_ESTABLISHED;

[0072] The original state was C_SYN_RCVD, the packet node flag was F, the direction was C2S, and the state changed to C_FIN_WAIT_1;

[0073] The original state is C_ESTABLISHED, the packet node flag is F, the direction is S2C, and the next packet node flag is A, the direction is C2S. The state changes to C_CLOSE_WAIT.

[0074] The original state was C_ESTABLISHED, the packet node flag was F, the direction was C2S, and the state changed to C_FIN_WAIT_1;

[0075] The original state was C_CLOSE_WAIT, the packet node flag was F, the direction was C2S, and the state changed to C_LAST_ACK;

[0076] The original state was C_LAST_ACK, the packet node flag was A, the direction was S2C, and the state changed to C_CLOSED;

[0077] The original state is C_FIN_WAIT_1, the packet node flag is F, the direction is S2C, and the next packet node flag is A, the direction is C2S, and the state changes to C_CLOSING;

[0078] The original state is C_FIN_WAIT_1, the data packet node flag is FA, the direction is S2C, and the next data packet node flag is A, the direction is C2S, and the state changes to C_TIME_WAIT;

[0079] The original state was C_FIN_WAIT_1, the data packet node flag was A, the direction was S2C, and the state changed to C_FIN_WAIT_2;

[0080] The original state is C_FIN_WAIT_2, the packet node flag is F, the direction is S2C, and the next packet node flag is A, the direction is C2S, and the state changes to C_TIME_WAIT;

[0081] The original state was C_CLOSING, the packet node flag was A, the direction was S2C, and the state changed to C_TIME_WAIT.

[0082] Step S3: Store the multi-layer heterogeneous graph.

[0083] Multi-layered heterogeneous graphs are constructed through graph visualization or graph data structure storage.

[0084] The flowchart for constructing a multi-layer heterogeneous graph is shown below. Figure 2The diagram illustrates the detailed construction process of a multi-layer heterogeneous graph, with the following steps:

[0085] (1) Initialize the state node.

[0086] Based on the initial state of the TCP session, create the server-side initial node (S_CLOSED) and the client-side initial node (C_CLOSED) respectively.

[0087] (2) Data packet layer graph construction.

[0088] The data packets within the session are sorted by timestamp, generating data packet nodes, core attributes are extracted, and data packet nodes are associated with time sequence edges.

[0089] The core attributes include: timestamp, flag combination (such as S for SYN, FA for ACK+FIN), and payload length.

[0090] (3) Construction of state transition graph and mapping associated edges.

[0091] For each data packet node, if the data packet is a critical packet that triggers a state transition at both ends, new state nodes for both ends are constructed and associated with them through state transition edges. Simultaneously, the associated edges are mapped to point the data packet node to the original server state node and the original client state node, respectively. If the data packet does not trigger a state transition at both ends, the associated edges are mapped to point the data packet node to the current server state node and the client state node, respectively. The above steps are repeated for each node in the data packet layer graph until all data packet nodes have been traversed, forming a multi-layered heterogeneous graph.

[0092] The server status node categories include: S_CLOSED, S_SYN_RCVD, S_ESTABLISHED, S_CLOSE_WAIT, S_LAST_ACK, S_CLOSING, S_TIME_WAIT, S_FIN_WAIT_1, S_FIN_WAIT_2, and S_RST_RECV.

[0093] The client status node categories include: C_CLOSED, C_SYN_RCVD, C_ESTABLISHED, C_CLOSE_WAIT, C_LAST_ACK, C_CLOSING, C_TIME_WAIT, C_FIN_WAIT_1, C_FIN_WAIT_2, and C_RST_RECV.

[0094] The diagram illustrating the triggering conditions for state transitions is as follows: Figure 3 As shown.

[0095] Through the above steps, a multi-layered heterogeneous graph containing a server state layer, a data packet layer, and a client state layer is finally constructed. The server state layer and the client state layer form a closed loop through state transition edges, and the data packet layer forms an ordered sequence through time sequence. The three layers achieve precise binding of data packets and states through mapping association edges, providing an intuitive, complete, and semantically clear data structure for the structured expression of TCP session communication characteristics, fine-grained analysis, and subsequent anomaly detection.

[0096] Compared to existing technologies, the technical solution provided by this invention can fully express the states of both ends of a TCP session, the data packet sequence, and the correlation between state transitions and data packets, thus solving the technical problem of incomplete characterization of TCP session behavior in existing technologies. Furthermore, the multi-layer heterogeneous graph provided by this invention facilitates the precise extraction of subsequent features in stages, avoiding feature dilution across stages.

Claims

1. A method for constructing a multi-layer heterogeneous graph based on TCP sessions, characterized in that, The multi-layer heterogeneous graph includes a data packet sequence graph, a server-side state transition graph, and a client-side state transition graph; The construction method includes: Read raw network traffic data in PCAP format and split it into TCP sessions; Sort the packets within the TCP session according to their timestamps to generate packet nodes; construct packet sequence edges according to the order of the timestamps of the packet nodes, and associate each packet node according to the packet sequence edges to construct a packet sequence graph; Construct the initial server-side state node and client-side state node; Iterate through each data packet node in the data packet sequence diagram and determine whether the state of the server-side state node and the client-side state node has changed. Construct the server-side state transition graph: If the state of a server-side state node changes, create a new server-side state node and construct the corresponding state transition edge and mapping association edge; if it does not change, construct the corresponding mapping association edge. Construct the client state transition graph: If the state of a client state node changes, create a new client state node and construct the corresponding state transition edge and mapping association edge; if it does not change, construct the corresponding mapping association edge.

2. The method for constructing a multi-layer heterogeneous graph based on TCP sessions as described in claim 1, characterized in that, The status of the server-side status node includes: S_CLOSED, S_SYN_RCVD, S_ESTABLISHED, S_CLOSE_WAIT, S_LAST_ACK, S_CLOSING, S_TIME_WAIT, S_FIN_WAIT_1, S_FIN_WAIT_2 and S_RST_RECV.

3. The method for constructing a multi-layer heterogeneous graph based on TCP sessions as described in claim 1, characterized in that, The states of the client state node include: C_CLOSED, C_SYN_RCVD, C_ESTABLISHED, C_CLOSE_WAIT, C_LAST_ACK, C_CLOSING, C_TIME_WAIT, C_FIN_WAIT_1, C_FIN_WAIT_2 and C_RST_RECV.

4. The method for constructing a multi-layer heterogeneous graph based on TCP sessions as described in claim 1, characterized in that, It also includes storing multi-layer heterogeneous graphs through graph visualization.

5. The method for constructing a multi-layer heterogeneous graph based on TCP sessions as described in claim 1, characterized in that, It also includes storing multi-layered heterogeneous graphs using graph data structures.

Images