Intranet network attack homologous analysis method and system based on flow multi-feature fusion

Abstract

The invention belongs to the field of network security, and particularly relates to a network attack homologous analysis method based on traffic multi-feature fusion, which comprises the following steps: acquiring network traffic in an intranet environment and aggregating the network traffic into complete call traffic A and known attack complete call traffic B stored by a system; extracting multi-dimensional features of the two groups of traffic, and calculating traffic feature similarity; speech feature similarity, PHMM model similarity and image feature similarity of the two groups of traffic; extracting a transport layer effective load of each data packet in the two kinds of traffic, and calculating the image feature similarity of the effective load; and fusing the plurality of obtained similarities, and judging whether the complete call traffic A to be analyzed and the known attack traffic B are homologous or not. Through comprehensive consideration of multi-dimensional characteristics of network traffic, homology of network attacks from multiple systems is deeply analyzed, so that an attack source is accurately positioned, the accuracy of attack detection is improved, complex and changeable attack means are effectively coped, and the maintenance efficiency of an administrator in facing the network attacks is further improved.

Description

Technical Field

[0001] This invention patent belongs to the field of network attack origin analysis in the field of network security. It is a network attack origin analysis method and system based on multi-feature fusion of traffic, which is applicable to the origin analysis of various types of network attacks. Background Technology

[0002] Homology analysis of cyberattacks refers to determining the inherent connection and similarity in attack methods among different cyberattack events, clarifying whether they originate from the same entity, and whether the hacking tools and attack payloads used are from the same author or team. Currently, homology analysis is mainly divided into two analysis models: sample-based and traffic-based.

[0003] Sample-based homology analysis uses malicious code employed by attackers as a target, employing reverse engineering, dynamic monitoring, and other techniques to uncover the underlying logic of attacks and extract the attacker's unique coding style and personalized characteristics. In recent years, law enforcement agencies, security vendors, and research institutions have accumulated a massive amount of attack cases and attack code, and have conducted numerous studies. However, sample-based homology analysis methods have significant limitations. Features in samples are easily detected by attackers and subsequently removed or forged. Furthermore, malicious code is often reused, making it difficult for sample-based homology analysis to ensure sufficient reliability in analyzing the true source of attacks.

[0004] Traffic-based common origin analysis focuses on attacker traffic. Because attack traffic is influenced by various potential factors such as the attacker's intent and attack habits, it exhibits inherent covert behavioral patterns. This characteristic makes it difficult for attackers to deliberately disguise, thus significantly improving the reliability of network attack common origin analysis. Network traffic-based common origin analysis is a relatively new research field and is still under development. The paper "Research on Attack Common Origin Analysis Methods Based on Network Behavior" proposes a network behavior-based attack common origin analysis method that extracts 14 features from 4 categories of IP attack traffic, constructs a traffic feature matrix, and calculates matrix similarity to achieve common origin analysis of attack organizations. However, the feature set used in this method is not comprehensive enough to cover the diversity of network attack behaviors. In actual network attack scenarios, the information contained in network traffic is extremely rich and complex. Some covert and deceptive attack behaviors may be misjudged or missed due to a lack of identification of key features, thereby reducing the accuracy of the common origin analysis results. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a method for analyzing the common origin of intranet network attacks based on multi-feature fusion of traffic, comprising the following steps:

[0006] Obtain network traffic in the intranet environment and aggregate it into complete call traffic A and complete call traffic B containing known attacks stored in the system;

[0007] Extract multi-dimensional features from two sets of complete traffic and calculate the traffic feature similarity between the two sets of traffic;

[0008] Extract the TCP packet length and direction sequences of two complete traffic sets, and calculate the similarity of morphology-sensitive dynamic time-warped speech features, PHMM model similarity, and wavelet-texture image feature similarity.

[0009] Extract the transport layer payload of each data packet in the two sets of complete traffic A and B, and calculate the similarity of the payload image features;

[0010] The calculated similarities are fused together, and the fusion result is used to determine whether the complete call traffic A to be analyzed and the known attack traffic are from the same source.

[0011] Furthermore, the calculation of the similarity of the degree flow characteristics is specifically as follows:

[0012] CICFlowMeter is used for feature parsing to extract 84-dimensional traffic feature vectors from traffic sets A and B, and then a feature matrix is ​​constructed to achieve multi-dimensional traffic feature extraction, thus obtaining the extracted traffic features.

[0013] Calculate traffic feature weights based on extracted traffic features, specifically including...

[0014] (1) Calculation of mutual information between features:

[0015]

[0016] (2) Mutual information matrix construction: The mutual information values ​​between each feature are placed in the matrix.

[0017]

[0018] (3) Calculation of correlation threshold

[0019]

[0020] in, It is the average of the mutual information of all feature pairs, used to determine whether feature pairs are highly correlated. If Greater than If so, it is considered highly correlated and redundant.

[0021] (4) Hierarchical clustering grouping

[0022] like Greater than ,Will and grouped into the same cluster Finally, K feature clusters are obtained: .

[0023] (5) Intra-class representative feature selection: Select one feature from each feature cluster as the representative feature.

[0024]

[0025] in, It is a feature The information gain value. It is a cluster The representative feature in the selection criterion is information gain. The most prominent feature.

[0026] (6) Design of weighted penalty terms

[0027]

[0028] in, It is a feature It's the penalty coefficient. If If it is a representative feature, then the penalty coefficient is 1, and there is no penalty. If not, then an exponentially decaying penalty is applied based on its maximum mutual information value with other features in the cluster. This is the penalty intensity parameter, set to 0.5.

[0029] (7) Final weight calculation

[0030]

[0031] in, It is a feature The information gain value. It is a feature It is the penalty coefficient. It is a feature Weights after normalization;

[0032] The weighted cosine similarity between two flow feature vectors is calculated using the aforementioned flow feature weights, where,

[0033] (1) Calculation of weighted cosine similarity

[0034]

[0035] in, These are two flow characteristic matrices and The weighted cosine similarity.

[0036] Furthermore, the TCP packet length and direction sequences of the two complete traffic sets are extracted, and the morphology-sensitive dynamic time-warped speech feature similarity is calculated, including:

[0037] Extract the TCP packet length sequences of two complete traffic sets A and B and convert them into relatively variable sequences;

[0038] An improved dynamic time warping algorithm incorporating a temporal penalty factor is used to calculate the speech feature similarity between two relatively changing sequences. Specifically,

[0039] (1) Extract the TCP packet length sequences of two complete traffic sets A and B, convert the original packet length sequences into relative variation sequences, focus on capturing the attacker's operational behavior patterns rather than the specific payload size, eliminate the difference in absolute packet length, and finally use it as the speech curve for calculation:

[0040]

[0041]

[0042]

[0043]

[0044] (2) Improved DTW algorithm for calculating the distance between two sets of phasors:

[0045]

[0046] in, It is the time-series penalty factor, which is 0.5.

[0047] (3) Normalization process:

[0048]

[0049] in, Normalized DTW similarity, yes and Improved DTW distance; It is the maximum length of the sequence. It is the maximum absolute value of the sequence elements.

[0050] Furthermore, the TCP packet length and direction sequences of the two complete traffic sets are extracted, and the PHMM model similarity is calculated, including:

[0051] The TCP packet length sequence is converted into a symbol sequence using the equal-frequency binning method;

[0052] Perform multi-sequence alignment on the symbol sequence;

[0053] Calculate the similarity of the symbol sequence under a preset PHMM model. Specifically,

[0054] (1) Divide the intervals according to the distribution frequency of TCP packet lengths to ensure that the number of packets in each interval is similar. Sort all packet lengths in ascending order. If the target number of symbols is K, then each interval contains N / K packets. Assign a unique symbol to each interval.

[0055] (2) Align the symbol sequences corresponding to each group of lengths using a multi-sequence alignment algorithm; perform alignment operations on the symbolized character sequences using the Clustal Omega tool;

[0056] (3) Construct a PHMM model for each attack and use symbolic sequences to calculate the similarity under the constructed PHMM model. .

[0057] Furthermore, the TCP packet length and direction sequences of the two complete traffic sets are extracted, and the wavelet-texture image feature similarity is calculated. Specifically:

[0058] Generate a time-frequency plot by performing continuous wavelet transform on a TCP-length sequence;

[0059] Extract the texture features from the time-frequency map;

[0060] An improved SSIM is used to calculate the structural similarity between texture features of two time-frequency maps. The global similarity is obtained by averaging multiple local SSIM values ​​and serving as the image feature similarity between two complete flows A and B. Specifically,

[0061]

[0062] in, and It is a local mean. and For local standard deviation, For local covariance, and It is the stability constant.

[0063] (1) Global similarity calculation

[0064]

[0065] The global similarity is obtained by averaging the local SSIM values.

[0066] Furthermore, the calculation of the similarity of the payload image features is as follows:

[0067] Extract the transport layer payload of each packet from the complete traffic sets A and B and generate hash values ​​using the Nilsimsa algorithm;

[0068] Map the hash value to a grayscale image;

[0069] Extract the texture features of the grayscale image and calculate the similarity of payload image features between the two images.

[0070] Specifically, the improved SSIM calculation formula is as follows;

[0071]

[0072] in, and It is a local mean. and For local standard deviation, For local covariance, and It is the stability constant;

[0073] Global similarity calculation:

[0074]

[0075] The global similarity is obtained by averaging the local SSIM values.

[0076] Furthermore, the multi-feature fusion determination includes combining traffic feature similarity, dynamic time-warped speech feature similarity, PHMM model similarity, wavelet-texture image feature similarity, and payload image feature similarity into a feature vector, predicting the final similarity based on the SVM model, and determining whether the two attack traffic flows are from the same source based on the multi-feature fusion result.

[0077] According to another aspect of the present invention, an intranet network attack homogeneity analysis system based on traffic multi-feature fusion is also provided, comprising: a traffic acquisition unit, which acquires network traffic in the intranet environment and aggregates it into complete call traffic A and known attack complete call traffic B stored in the system;

[0078] The first similarity calculation unit extracts multi-dimensional features of two sets of complete call traffic and calculates the traffic feature similarity between the two sets of traffic.

[0079] The second similarity calculation unit extracts the TCP packet length and direction sequence of the two sets of complete traffic, and calculates the similarity of morphology-sensitive dynamic time-warped speech features, PHMM model similarity, and wavelet-texture image feature similarity.

[0080] The third similarity calculation unit extracts the transport layer payload of each data packet in the two sets of complete traffic A and B, and calculates the similarity of the payload image features.

[0081] The similarity fusion analysis unit fuses the calculated similarities and determines, based on the fusion result, whether the complete call traffic A to be analyzed and the known attack traffic B are from the same source.

[0082] Furthermore, the first similarity calculation unit,

[0083] CICFlowMeter is used for feature parsing to extract 84-dimensional traffic feature vectors from traffic sets A and B, and then a feature matrix is ​​constructed to achieve multi-dimensional traffic feature extraction, thus obtaining the extracted traffic features.

[0084] Calculate the flow feature weights based on the extracted flow features;

[0085] The similarity between two traffic feature vectors is calculated using the traffic feature weights.

[0086] The network attack homology analysis method based on multi-feature fusion of traffic proposed in this invention has the following significant advantages:

[0087] 1. This paper innovatively proposes a traffic-based common-origin analysis method. Compared with traditional sample-based analysis methods, it fundamentally solves the problems of sample features being easily erased or forged by attackers, and the unreliability of analysis results due to malicious code reuse. By directly analyzing attack traffic and utilizing its inherent covert behavior patterns influenced by various potential factors, it effectively avoids human interference, thereby significantly improving the accuracy and reliability of network attack common-origin analysis.

[0088] 2. All features of CicFlowmeter were selected to calculate the similarity between two attack traffic streams, and a specific similarity algorithm was designed for these features. This algorithm can deeply explore the intrinsic relationships between traffic data, accurately quantify the similarity of different attack traffic streams at the feature level, and provide a solid data foundation and accurate measurement standard for subsequent comprehensive analysis.

[0089] 3. Utilizing a speech similarity calculation scheme, an improved DTW algorithm was designed to calculate the similarity between two curves, enabling analysis of attack traffic from a novel perspective of speech features. This method captures the features of the curve formed by changes in TCP packet length within the attack traffic, extracting the attacker's operational behavior patterns and successfully eliminating interference caused by absolute packet length differences.

[0090] 4. Using a gene similarity calculation scheme, the sequence is symbolized by the equal frequency binning method, and the multi-gene sequences are aligned to calculate the PHMM model similarity.

[0091] 5. The lengths of TCP packets in the attack traffic are formed into curves and cleverly converted into images using continuous wavelet transform (CWT), leading to the design of an image similarity calculation algorithm. This innovative conversion from traffic to images introduces image analysis technology into the field of network attack source analysis, utilizing the rich texture and structural features of images to provide novel ideas and methods for in-depth analysis of attack behavior.

[0092] 6. Visualize the payload, generate hash values ​​using the Nilsimsa algorithm, convert it into a grayscale image, calculate similarity, and provide a new solution.

[0093] 7. This innovative approach organically combines traffic feature similarity calculation, voice feature similarity calculation, gene feature similarity calculation, and image feature similarity calculation, and performs similarity evaluation and multi-feature fusion based on SVM. This comprehensive and multi-layered fusion analysis fully leverages the advantages of different feature analyses and utilizes the powerful classification and prediction capabilities of SVM to achieve intelligent and accurate judgment of the origin of attack traffic, significantly improving the efficiency and accuracy of network attack origin analysis. Attached Figure Description

[0094] Figure 1 This is a flowchart illustrating the present invention. Detailed Implementation

[0095] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0096] refer to Figure 1 This invention provides a method for analyzing the common origin of intranet network attacks based on multi-feature fusion of traffic. The specific steps are as follows:

[0097] Step 1: Traffic Acquisition

[0098] (1) This solution is carried out under the intranet. All intranet traffic needs to pass through the intranet firewall. The intranet firewall will mirror each traffic to the same source analysis system in real time.

[0099] (2) After receiving each traffic, the same source analysis system aggregates each traffic into a complete call traffic.

[0100] (3) Given that the same source analysis system has complete call traffic with many attack types, the complete traffic A collected from the internal network firewall will be compared with the traffic stored in the same source analysis system. In the following, a complete traffic in the traffic stored in the same source analysis system will be called B.

[0101] Step 2: Multi-dimensional traffic feature extraction

[0102] (1) CICFlowMeter v3.0 was used for feature parsing to extract 84-dimensional flow feature vectors of flow sets A and B.

[0103] (2) Construct the feature matrix:

[0104]

[0105]

[0106] Step 3: Calculation of Traffic Feature Weights

[0107] (1) Calculation of mutual information between features:

[0108]

[0109] (2) Mutual information matrix construction: The mutual information values ​​between each feature are placed in the matrix.

[0110]

[0111] (3) Calculation of correlation threshold

[0112]

[0113] in, It is the average of the mutual information of all feature pairs, used to determine whether feature pairs are highly correlated. If Greater than If so, it is considered highly correlated and redundant.

[0114] (4) Hierarchical clustering grouping

[0115] like Greater than ,Will and grouped into the same cluster Finally obtained

[0116] K feature clusters: .

[0117] (5) Intra-class representative feature selection: Select one feature from each feature cluster as the representative feature.

[0118]

[0119] in, It is a feature The information gain value. It is a cluster The representative feature in the selection criterion is information gain. The most prominent feature.

[0120] (6) Design of weighted penalty terms

[0121]

[0122] in, It is a feature It's the penalty coefficient. If If it is a representative feature, then the penalty coefficient is 1, and there is no penalty. If not, then an exponentially decaying penalty is applied based on its maximum mutual information value with other features in the cluster. This is the penalty intensity parameter, set to 0.5.

[0123] (7) Final weight calculation

[0124]

[0125] in, It is a feature The information gain value. It is a feature It is the penalty coefficient. It is a feature Weights after normalization.

[0126] Step 4: Calculate the similarity of multi-dimensional traffic features

[0127] (1) Calculation of weighted cosine similarity

[0128]

[0129] in, These are two flow characteristic matrices and The weighted cosine similarity.

[0130] (2) Assess the similarity between two complete traffic streams A and B. save.

[0131] Step 5: Extract the TCP packet length sequences of the two complete traffic streams, and convert them into relative change sequences.

[0132] The TCP packet length sequences of two complete traffic sets A and B are extracted, and the original packet length sequences are converted into relative change sequences. The focus is on capturing the attacker's operational behavior patterns rather than the specific payload size, eliminating the difference in absolute packet length, and finally using it as the speech curve for calculation.

[0133]

[0134]

[0135]

[0136]

[0137] Step 6: Morphology-sensitive dynamic time-warped speech feature similarity calculation

[0138] (1) Improve the DTW algorithm for calculating distance

[0139]

[0140] in, It is the time-series penalty factor, which is 0.5.

[0141] (2) Normalization

[0142]

[0143] in, Normalized DTW similarity, yes and Improved DTW distance. It is the maximum length of the sequence. It is the maximum absolute value of the sequence elements.

[0144] (3) Assess the similarity between two complete traffic streams A and B. save.

[0145] Step 7: Calculate the similarity of the PHMM model converted into gene sequences.

[0146] (1) Equal-frequency binning sequence symbolization

[0147] Divide the TCP packet length distribution into intervals to ensure that each interval contains a similar number of packets. Sort all packet lengths in ascending order, and with a target symbol count of K, each interval contains N / K packets. Assign a unique symbol to each interval.

[0148] (2) Multi-sequence alignment

[0149] A multi-sequence alignment algorithm is used to align the symbol sequences corresponding to each group of lengths. The Clustal Omega tool is then used to perform the alignment operation on the symbolized character sequences.

[0150] (3) Calculate the similarity of the PHMM model

[0151] A PHMM model for each type of attack is pre-built, and the similarity under the previously built PHMM model is calculated using symbol sequences. .

[0152] (4) Assess the similarity between two complete traffic streams A and B. save.

[0153] Step 8: Wavelet-texture image feature similarity calculation

[0154] (1) Perform continuous wavelet transform on the TCP length sequence

[0155]

[0156] (2) Extract image features after generating time-frequency graphs

[0157] A time-frequency image is generated, local texture features are calculated for the time-frequency image in blocks, and contrast, correlation, and energy features are extracted using the gray-level co-occurrence matrix (GLCM).

[0158] (3) Improved SSIM calculation

[0159]

[0160] in, and It is a local mean. and For local standard deviation, For local covariance, and It is the stability constant.

[0161] (4) Global similarity calculation

[0162]

[0163] The global similarity is obtained by averaging the local SSIM values.

[0164] (5) Assess the similarity between two complete traffic streams A and B. save.

[0165] Step 9: Calculate the similarity of the image features of the effective load

[0166] (1) Use the Scapy tool to extract the transport layer payload of each data packet in the two sets of complete traffic A and B.

[0167] (2) Use the Nilsimsa algorithm to generate hash values

[0168] The Nilsimsa algorithm has the mathematical property of generating similar hash values ​​for similar content. It processes payload data into hexadecimal hash values ​​with small intra-class differences and large inter-class differences.

[0169] (3) Map the hash value to a grayscale image

[0170] The Pillow library is used to map the 160-bit hexadecimal hash values ​​generated by the Nilsimsa algorithm to a high-resolution grayscale image. 0x00 corresponds to pure black, and 0xFF corresponds to pure white. Each pixel represents two hexadecimal data points, and the pixels are arranged from left to right to generate the grayscale image. The grayscale images generated from multiple payloads are arranged from top to bottom to form a final grayscale image.

[0171] (4) Extracting image features using gray-level co-occurrence matrix

[0172] The local texture features are calculated by dividing the grayscale image into blocks, and the contrast, correlation and energy features are extracted using the gray-level co-occurrence matrix (GLCM, which was used above).

[0173] (5) Improved SSIM calculation (used above)

[0174]

[0175] in, and It is a local mean. and For local standard deviation, For local covariance, and It is the stability constant.

[0176] (6) Global similarity calculation

[0177]

[0178] The global similarity is obtained by averaging the local SSIM values.

[0179] (7) Assess the similarity between two complete traffic flows A and B. save.

[0180] Step 10: Multi-feature fusion similarity calculation

[0181] (1) Construction of feature vectors

[0182] The five similarity values ​​are combined into a feature vector.

[0183]

[0184] (2) Multi-feature fusion algorithm based on SVM

[0185] In the initial stage of the same-origin analysis system, when classifying attack types from complete data, an SVM model is constructed. The SVM is used to predict the final similarity, and based on the multi-feature fusion results, it is determined whether two attack flows originate from the same source.

[0186] According to another aspect of the present invention, an intranet network attack homology analysis system based on multi-feature fusion of traffic is also provided, comprising:

[0187] The traffic acquisition unit acquires network traffic in the intranet environment and aggregates it into complete call traffic A and complete call traffic B containing known attacks stored in the system.

[0188] The first similarity calculation unit extracts multi-dimensional features of two sets of complete call traffic and calculates the traffic feature similarity between the two sets of traffic.

[0189] The second similarity calculation unit extracts the TCP packet length and direction sequence of the two sets of complete traffic, and calculates the similarity of morphology-sensitive dynamic time-warped speech features, PHMM model similarity, and wavelet-texture image feature similarity.

[0190] The third similarity calculation unit extracts the transport layer payload of each data packet in the two sets of complete traffic A and B, and calculates the similarity of the payload image features.

[0191] The similarity fusion analysis unit fuses the calculated similarities and determines, based on the fusion result, whether the complete call traffic A to be analyzed and the known attack traffic B are from the same source.

[0192] The first similarity calculation unit

[0193] CICFlowMeter is used for feature parsing to extract 84-dimensional traffic feature vectors from traffic sets A and B, and then a feature matrix is ​​constructed to achieve multi-dimensional traffic feature extraction, thus obtaining the extracted traffic features.

[0194] Calculate the flow feature weights based on the extracted flow features;

[0195] The similarity between two traffic feature vectors is calculated using the traffic feature weights.

[0196] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present invention can be implemented using various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0197] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 The device may contain one or more boxes specifying functions. These computer program instructions may also be stored in a way that can guide a computer or other programmable data processing.

Claims

1. A method for analyzing the origin of intranet network attacks based on multi-feature fusion of traffic, characterized in that, include: Obtain network traffic in the intranet environment and aggregate it into complete call traffic A and complete call traffic B containing known attacks stored in the system; Extract multi-dimensional features from two sets of complete call traffic and calculate the traffic feature similarity between the two sets of traffic. Extract the TCP packet length and direction sequences of two complete traffic sets, and calculate the similarity of morphology-sensitive dynamic time-warped speech features, PHMM model similarity, and wavelet-texture image feature similarity. Extract the transport layer payload of each data packet in the two sets of complete traffic A and B, and calculate the similarity of the payload image features; The calculated similarity scores are fused together, and the fusion result is used to determine whether the complete call traffic A to be analyzed and the known attack traffic B are from the same source.

2. The method according to claim 1, characterized in that, The calculation of the traffic feature similarity is as follows: CICFlowMeter is used for feature parsing to extract 84-dimensional traffic feature vectors from traffic sets A and B, and then a feature matrix is ​​constructed to achieve multi-dimensional traffic feature extraction, thus obtaining the extracted traffic features. Calculate the flow feature weights based on the extracted flow features; The similarity between two traffic feature vectors is calculated using the traffic feature weights.

3. The method according to claim 1, characterized in that, Extract the TCP packet length and direction sequences from two sets of complete traffic, and calculate the morphology-sensitive dynamic time-warped speech feature similarity, including: Extract the TCP packet length sequences of two complete traffic sets A and B and convert them into relatively variable sequences; An improved dynamic time warping algorithm with an introduced temporal penalty factor is used to calculate the similarity of speech features between two relatively changing sequences.

4. The method according to claim 1, characterized in that, The similarity of the PHMM model is calculated by extracting the TCP packet length and direction sequences of the two sets of complete traffic, including: The TCP packet length sequence is converted into a symbol sequence using the equal-frequency binning method; Perform multi-sequence alignment on the symbol sequence; Calculate the similarity of the symbol sequence under the preset PHMM model, specifically, (1) Divide the intervals according to the distribution frequency of TCP packet length to ensure that the number of packets in each interval is similar; arrange all packet lengths in ascending order, and the target symbol number is K, then each interval contains N / K packets, and assign a unique symbol to each interval; (2) Align the symbol sequences corresponding to each group of lengths using a multi-sequence alignment algorithm; perform alignment operations on the symbolized character sequences using the Clustal Omega tool; (3) Construct a PHMM model for each attack and use symbolic sequences to calculate the similarity under the constructed PHMM model. .

5. The method according to claim 1, characterized in that, Extract the TCP packet length and direction sequences from two sets of complete traffic, and calculate the wavelet-texture image feature similarity. Specifically: Generate a time-frequency plot by performing continuous wavelet transform on a TCP-length sequence; Extract the texture features from the time-frequency map; An improved SSIM is used to calculate the structural similarity between two time-frequency map texture features. The global similarity is obtained by averaging multiple local SSIM values ​​as the image feature similarity between two complete flows A and B.

6. The method according to claim 1, characterized in that, The calculation of the similarity of the payload image features is as follows: Extract the transport layer payload of each packet from the complete traffic sets A and B and generate hash values ​​using the Nilsimsa algorithm; Map the hash value to a grayscale image; Extract the texture features of the grayscale image and calculate the similarity of payload image features between the two images.

7. The method according to claim 1, characterized in that, The multi-feature fusion determination includes combining traffic feature similarity, dynamic time-warped speech feature similarity, PHMM model similarity, wavelet-texture image feature similarity, and payload image feature similarity into a feature vector, predicting the final similarity based on the SVM model, and determining whether the two attack traffic flows are from the same source based on the multi-feature fusion result.

8. A system for analyzing the origin of intranet attacks based on multi-feature fusion of traffic patterns, characterized in that: This includes a traffic acquisition unit, which acquires network traffic in the intranet environment and aggregates it into complete call traffic A and complete call traffic B containing known attacks stored in the system; The first similarity calculation unit extracts multi-dimensional features of two sets of complete call traffic and calculates the traffic feature similarity between the two sets of traffic. The second similarity calculation unit extracts the TCP packet length and direction sequence of the two sets of complete traffic, and calculates the similarity of morphology-sensitive dynamic time-warped speech features, PHMM model similarity, and wavelet-texture image feature similarity. The third similarity calculation unit extracts the transport layer payload of each data packet in the two sets of complete traffic A and B, and calculates the similarity of the payload image features. The similarity fusion analysis unit fuses the calculated similarities and determines, based on the fusion result, whether the complete call traffic A to be analyzed and the known attack traffic B are from the same source.

9. The system according to claim 8, characterized in that, The first similarity calculation unit, CICFlowMeter is used for feature parsing to extract 84-dimensional traffic feature vectors from traffic sets A and B, and then a feature matrix is ​​constructed to achieve multi-dimensional traffic feature extraction, thus obtaining the extracted traffic features. Calculate the flow feature weights based on the extracted flow features; The similarity between two traffic feature vectors is calculated using the traffic feature weights.

Images