An abnormal traffic cooperative detection method and system

Abstract

The application discloses an abnormal flow cooperative detection method and system, relates to the field of network communication, and comprises the following steps: protocol adaptive identification and dynamic attack detection are carried out on a north-south WAF layer, attack fingerprints are generated, and global session IDs are bound; the application behavior is monitored in a whole link on an east-west RASP layer, context association and threat analysis are realized through the session IDs; WAF and RASP data are aggregated based on the session IDs, an attack feature propagation graph is constructed, and attack chain confidence is evaluated; when the confidence exceeds a threshold value, attack features are extracted by the RASP layer, virtual patch rules are generated, and feedback is fed back to the WAF layer for real-time updating; finally, bidirectional confidence fusion decision is realized through the WAF and the RASP, and cooperative blocking is realized. The application solves the problem that the north-south and east-west detection are split in the prior art, and cross-layer attack chains cannot be effectively blocked, realizes accurate and dynamic protection on complex attacks, especially encrypted flow and horizontal penetration.

Description

Technical Field

[0001] This invention belongs to the field of network communication, and in particular relates to a collaborative method for detecting abnormal traffic. Background Technology

[0002] In the network management and control process of telecommunications transmission networks, the external interface of the management and control system is called the north-south interface, while the interface within the system or between systems at the same level is called the east-west interface. At the network boundary, the management and control system primarily deploys a Web Application Firewall (WAF) to identify abnormal traffic attacks through rule matching; while within the management and control system, a Reactive Online Utilization (RASP) is used to monitor abnormal traffic on individual service nodes.

[0003] The main problems with existing technologies are as follows:

[0004] 1. Limitations of North-South Flow Detection (WAF Technology):

[0005] It only supports HTTP / HTTPS protocol parsing and has no detection capability for non-Web traffic (such as RPC and private protocols); the proportion of encrypted traffic from operators exceeds 90%, and the WAF's forced decryption detection results in a performance loss of over 40%; the detection mechanism based on static rules has a false positive rate of >15% and a false negative rate of >20% for polymorphic attacks (such as Obfuscated SQLi) and AI-driven adaptive attacks.

[0006] 2. Limitations of East-West Flow Detection (RASP technology):

[0007] Single-node instrumentation monitoring cannot correlate cross-service attack paths (such as API chain penetration); it lacks the ability to block lateral traffic between services in real time, resulting in a lateral spread success rate of up to 35%.

[0008] In summary, existing technologies suffer from severe gaps in north-south and east-west detection, making it impossible to coordinate and block cross-level attack chains (such as "WAF bypass → lateral movement" combined attacks), which poses certain risks to network security. Summary of the Invention

[0009] The purpose of this invention is to solve the technical problem that existing technologies have serious gaps in the detection of north-south and east-west directions, and cannot coordinately block cross-level attack chains, and to provide a method for collaborative detection of abnormal traffic.

[0010] To achieve the above-mentioned objectives, the present invention adopts the following technical solution: an abnormal traffic collaborative detection method, comprising the following steps:

[0011] S1. At the north-south WAF layer, the traffic is subjected to protocol adaptive identification and dynamic attack detection. When an attack session is detected, an attack fingerprint is generated, and a globally unique session ID is generated and bound to the attack session. The attack fingerprint is associated with the session ID and stored.

[0012] S2. In the east-west RASP layer, by deploying a probe cluster on the application node, the application behavior is monitored through the entire link, and the session ID is extracted from the traffic and transmitted through the penetration, so that the monitored behavior data is associated with the session ID to form behavior data with context tagging.

[0013] S3. Using the session ID as the key index, aggregate the attack fingerprint generated in the first step and the behavioral data with context markers generated in the second step to construct a cross-layer attack feature propagation map, and analyze the map based on preset rules to dynamically evaluate the confidence of the attack chain.

[0014] S4. When the confidence of the evaluated attack chain exceeds the first threshold, based on the attack chain and associated behavioral context identified in step 3, key attack features are extracted and transformed into virtual patch rules executable by the WAF layer, which are then injected into the WAF layer rule base in real time.

[0015] S5. Between the WAF layer and the RASP layer, a bidirectional confidence fusion calculation is performed based on the attack fingerprint, behavioral context threat score, and attack chain confidence. When the final confidence after fusion exceeds the second threshold, a blocking action is jointly executed in the WAF layer and the RASP layer.

[0016] An abnormal traffic collaborative detection system includes:

[0017] The north-south detection module is deployed at the network boundary to perform protocol adaptive identification and dynamic attack detection on traffic. When an attack session is detected, an attack fingerprint is generated and a globally unique session ID is generated and bound to the attack session. The attack fingerprint and the session ID are associated and stored.

[0018] The east-west detection module is deployed in the application node cluster to perform full-link instrumentation monitoring of application behavior. It extracts and transmits the session ID from the traffic in a penetrating manner, associates the monitored behavior data with the session ID, forms behavior data with context tags, and calculates the node threat score based on taint tracking technology.

[0019] The attack graph construction and analysis module is connected to the north-south detection module and the east-west detection module. It is used to aggregate attack fingerprints and context-tagged behavioral data with the session ID as the key index, construct a cross-layer attack feature propagation graph, and analyze the graph based on preset rules to dynamically evaluate the confidence of the attack chain.

[0020] The virtual patch generation and injection module is connected to the attack graph construction and analysis module. When the attack chain confidence exceeds the first threshold, it extracts key attack features based on the identified attack chain and related behavioral context, converts them into WAF executable rules, and injects them into the rule base of the north-south detection module in real time.

[0021] The collaborative blocking decision and execution module is connected to the north-south detection module, the east-west detection module, and the attack graph construction and analysis module, respectively. It is used to perform bidirectional confidence fusion calculation based on attack fingerprint, node threat score, and attack chain confidence. When the final confidence after fusion exceeds the second threshold, the north-south detection module and the east-west detection module are coordinated to execute blocking actions synchronously.

[0022] The present invention has the following beneficial effects:

[0023] 1. Protocol Independence Detection Capability: Lightweight protocol identification is performed through traffic metadata (such as packet header features, packet length distribution, and session frequency). It not only supports HTTP / HTTPS, but also effectively covers non-Web protocols such as gRPC and private protocol traffic, eliminating the protocol blind spots of traditional WAF.

[0024] 2. Significant performance optimization: Adopting the TLS traffic "on-demand decryption" strategy, associated decryption is only performed after a high-risk alarm is triggered at the RASP layer, avoiding the huge performance loss caused by the traditional WAF's forced decryption of all encrypted traffic (which can reduce unnecessary decryption overhead by more than 90%).

[0025] 3. Closed-loop attack chain defense: It breaks down the information silos between perimeter defense (WAF) and internal runtime protection (RASP), and realizes cross-layer tracking of attack behavior through session ID (WAF provides initial attack fingerprint → RASP tracks lateral penetration path), forming a closed loop of "detection-analysis-hardening", that is, RASP converts the discovered internal attack characteristics into virtual patches, and enhances the WAF detection rules in real time.

[0026] 4. Dynamic Adaptive Protection: Threat assessment and decision-making are based on real-time constructed attack propagation maps. Rules can be dynamically injected and eliminated, and weights are adaptively adjusted according to attack confidence. This effectively addresses new threats such as polymorphic attacks and low-frequency slow attacks, significantly reducing false positives (down to below 5%) and false negatives.

[0027] 5. Precise and coordinated blocking: By integrating the rule matching confidence of WAF and the runtime threat score of RASP, a weighted joint decision is made, and blocking is triggered only when there is sufficient evidence across layers. It is executed synchronously at the network layer (packet loss, IP blocking) and the application layer (thread termination, transaction rollback) to achieve precise interception and avoid mistakenly killing normal business. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart illustrating the method of the present invention;

[0030] Figure 2 This is a system architecture diagram. Detailed Implementation

[0031] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0032] Example 1

[0033] Please see Figure 1 As shown, this invention is a collaborative detection method for abnormal traffic, comprising the following steps:

[0034] S1. At the north-south WAF layer, the traffic is subjected to protocol adaptive identification and dynamic attack detection. When an attack session is detected, an attack fingerprint is generated, and a globally unique session ID is generated and bound to the attack session. The attack fingerprint is associated with the session ID and stored.

[0035] It should be noted that step S1 is as follows:

[0036] S11. Deploy a protocol parsing plugin to achieve adaptive identification of HTTP / HTTPS and non-HTTP protocols by parsing traffic packet header features, the protocol identifier in the first preset bytes, or extracting traffic element statistical features.

[0037] Specifically, a protocol parsing plugin is deployed at the WAF layer to extract traffic packet header features (such as Content-Type and Payload length distribution); the first 64 bytes of the traffic are parsed to extract protocol features (such as HTTP GET / POST headers and gRPC magic number 00 0000); and a metadata detection mode is enabled to extract statistical features (packet length and frequency only); the above data constitutes traffic feature metadata.

[0038] S12. Dynamic attack detection of identified traffic: For unencrypted traffic, a combination of rule matching and abstract syntax tree analysis is used to detect polymorphic attacks; for encrypted traffic, only its extended fields are extracted for preliminary judgment and marked as a session to be observed.

[0039] Specifically, for unencrypted traffic, regular expression rules plus AST syntax tree analysis are used to detect polymorphic attacks;

[0040] For encrypted traffic, only the SNI / ALPN extended fields are extracted, skipping payload decryption. Decryption of encrypted traffic is only performed as needed when an alarm is triggered by the subsequent RASP layer (avoiding the overhead of 90% full decryption). When an attack is detected, an attack fingerprint <attack type>_<traffic feature metadata hash> is generated.

[0041] S13. When an attack is detected or a target is marked for observation, a globally unique session ID is generated, inserted into the protocol header or metadata field of the traffic, and the attack fingerprint or target mark is associated with the session ID and stored in a distributed cache.

[0042] Specifically, this invention generates a globally unique identifier (<source IP port>_<destination IP port>_<timestamp hash>) for each session, inserts the session ID into the corresponding field of the protocol (such as HTTP Header X-Session-ID or gRPCMetadata session_id field), and stores the attack fingerprint in a distributed cache (RedisCluster) in association with the session ID, and sets TTL = session lifecycle.

[0043] S2. In the east-west RASP layer, by deploying a probe cluster on the application node, the application behavior is monitored through the entire link, and the session ID is extracted from the traffic and transmitted through the penetration, so that the monitored behavior data is associated with the session ID to form behavior data with context tagging.

[0044] It should be noted that step S2 is as follows:

[0045] S21. Instrument the application's key classes using bytecode enhancement technology to monitor application behavior, including SQL execution, file operations, and RPC calls, and capture the specific parameters and context of the behavior.

[0046] Specifically, this invention applies end-to-end instrumentation monitoring of application behavior. By rewriting the bytecode of key classes (such as java.net.HttpURLConnection and java.sql.PreparedStatement) through JavaAgent, it monitors the following behaviors:

[0047] SQL execution: Capture PreparedStatement parameter binding values ​​to prevent SQL injection and polymorphic attacks;

[0048] File operations: Record file paths and read / write patterns, and detect path traversal or sensitive file tampering;

[0049] RPC calls: Extract metadata of RPC calls (such as caller, callee, RPC name, etc.) to trace cross-service attack chains.

[0050] S22. When the application node processes an inbound request, the session ID is parsed from the protocol header or metadata and bound to the context of the current processing thread; when making cross-service calls, the session ID is automatically injected into the outbound request to achieve the pass-through transmission of the session ID between service links.

[0051] Specifically, the session ID pass-through and context tagging enable S21 monitoring behavior data to have cross-service correlation capabilities. Perform the following operations in sequence:

[0052] Inbound extraction: Parse the session ID generated by S13 from the protocol header (such as HTTP Header or gRPC Metadata);

[0053] Thread binding: Inject the session ID into the ThreadLocal context to ensure traceability of a single request chain;

[0054] Outbound injection: Automatically appends the session ID to the outbound request during cross-service calls, enabling cross-node pass-through;

[0055] Data association: Mark the monitoring behavior data in S21 as {session ID, behavior type, behavior details}.

[0056] S23. Based on taint tracking technology, user input is marked and its propagation is monitored. When tainted data triggers a preset high-risk operation, the threat score of the current node is calculated by combining the vulnerability base score and the controllability of the input.

[0057] Specifically, dynamic analysis of abnormal behavior based on taint tracking relies on the session ID from step S22 to achieve cross-service taint tracking. The following operations are performed sequentially:

[0058] Tainting: Identify user input sources (such as HttpServletRequest.getParameter()) and mark them as tainted data;

[0059] Propagation monitoring: Track the propagation path of contaminated data within the application (e.g., through parameter parsing → business processing → database operations).

[0060] Threat Assessment: When contaminated data triggers high-risk operations (such as Runtime.exec() or unauthorized file access), the compute node threat score is:

[0061] Threat Score = Vulnerability CVSS Score × Input Controllability Coefficient (where, Input Controllability: 0.8 = Fully Controllable by the User, 0.3 = Partially Filtered).

[0062] S3. Using the session ID as the key index, aggregate the attack fingerprint generated in the first step and the behavioral data with context markers generated in the second step to construct a cross-layer attack feature propagation map, and analyze the map based on preset rules to dynamically evaluate the confidence of the attack chain.

[0063] It should be noted that step S3 specifically includes:

[0064] S31. Using the session ID as the primary key, aggregate the attack fingerprint reported by the WAF layer with the node threat score and behavioral context reported by the RASP layer that are marked with the session ID, and construct structured data with network nodes as vertices and attack propagation relationships as edges.

[0065] Specifically, step S31 involves cross-layer attack chain data aggregation to provide a structured attack chain data foundation for step S32. Furthermore, using the global session ID generated in S13 as the primary key, two types of data sources are aggregated:

[0066] North-South Data: WAF attack fingerprint detected by S12;

[0067] East-West Data: RASP node threat scores and behavioral context output by S23;

[0068] Establish the relationship between attack propagation nodes:

[0069] 1) WAF entry node → Edge service node (relationship type: INITIATE_ATTACK);

[0070] 2) Service Node A → Service Node B (Relationship type: PROPAGATE, weight = API call frequency per unit time).

[0071] S32. Import the aggregated data into the graph database, dynamically construct and update the attack feature propagation graph; based on the preset graph rules, identify the attack propagation path and key attack nodes;

[0072] It should be noted that the attack feature propagation map constructed in step S32 is used to dynamically execute the following judgment rules:

[0073] Rule 1: If the threat score of a node in the graph exceeds the third threshold and there is a high-risk operation originating from user input that points to that node, then that node is marked as an attack node.

[0074] Rule 2: If there is a path in the graph that starts from the WAF entry node and propagates through at least one service node, and the average threat score of all nodes on that path exceeds the fourth threshold, then a cross-layer attack chain is determined to exist.

[0075] Specifically, the dynamic attack graph modeling and rule determination rely on the node relationship data aggregated in S31 to generate a graph and output the attack chain path for quantitative evaluation in step S33.

[0076] A real-time topology is built based on the graph database (JanusGraph), and nodes and relationships are dynamically updated; the attack propagation rules are defined as follows:

[0077] Rule 1: If a node's threat score is greater than 0.7 and a high-risk data stream exists, mark it as ATTACK_NODE;

[0078] Rule 2: When the average threat score on the WAF→ServiceA→ServiceB link is greater than 0.8, it is determined to be a cross-layer attack chain.

[0079] S33. Quantify and evaluate the confidence level of the identified attack propagation path. The evaluation factors include at least the average threat score of the nodes in the path and the attack propagation depth. Normalization is then used to obtain the confidence level of the attack chain.

[0080] Specifically, by inputting the attack chain path identified by S32, the following parameters are extracted:

[0081] 1) The average threat score of all nodes in the path (from the node threat score calculated in step S23);

[0082] 2) Attack propagation depth (i.e., the number of hops across services, such as the depth of WAF→A→B = 2);

[0083] Calculate the attack chain confidence:

[0084] Confidence = (average node threat score) × (0.9)^(propagation depth-1), where the attenuation factor design reflects the entropy increase principle of attack propagation (confidence decreases by 10% for each additional hop).

[0085] Output normalized confidence (range 0~1.0) to trigger S5's blocking decision.

[0086] Confidence scores are normalized using the maximum path correlation value:

[0087] Normalized confidence score = Confidence score / (maximum node threat) × (0.9)^(propagation depth - 1);

[0088] When the confidence level is greater than 0.85, the virtual patch generation in step S4 is activated.

[0089] S4. When the confidence of the evaluated attack chain exceeds the first threshold, based on the attack chain and associated behavioral context identified in step 3, key attack features are extracted and transformed into virtual patch rules executable by the WAF layer, which are then injected into the WAF layer rule base in real time.

[0090] It should be noted that step S4 specifically includes:

[0091] S41. When the confidence of the attack chain exceeds the first threshold, extract the attack feature patterns that frequently appear on the attack propagation path from the RASP behavior data that triggers the attack chain to form a minimum attack feature set.

[0092] Specifically, based on the high-confidence attack chain and behavioral context output in step S3, key attack feature patterns are extracted.

[0093] When step S33 determines that the attack chain confidence is >0.85, the minimum attack feature set is extracted from the abnormal behavior captured by the RASP probe cluster (output of S23).

[0094] Feature filtering is performed based on the attack propagation map constructed in step S32: only high-frequency feature patterns that appear more than 5 times in the attack chain are retained to eliminate noise interference.

[0095] S42. The minimum attack feature set is transformed into a WAF-compatible defense rule, and the defense rule is dynamically assigned weights based on the attack chain confidence of the rule.

[0096] Specifically, this step mainly realizes the transformation and weight binding of virtual patch rules, achieving accurate mapping from attack characteristics to defense rules.

[0097] The features extracted in step S41 are converted into WAF-compatible regular expressions;

[0098] The rule weights are dynamically set based on the attack chain confidence calculated in step S33, as follows:

[0099] Rule weight = confidence level × 100 (confidence level 0.9 → weight 90, higher weight rules are matched first).

[0100] S43. Push the weighted defense rules to the north-south WAF engine through the real-time communication channel, trigger the WAF rule hot loading mechanism to make it effective, and set the automatic elimination policy for rules without matching.

[0101] Specifically, this step enables real-time rule injection and activation, and binds rule weights to confidence levels to ensure that high-risk attacks are blocked first. The main steps are as follows:

[0102] Rules are pushed to the north-south WAF engine in real time via gRPC Streaming; the WAF hot reloading mechanism is triggered: new rules are dynamically loaded without restarting the service; and a rule self-elimination policy is enabled: if no traffic matches within 72 hours, the rule is automatically deactivated.

[0103] S5. Between the WAF layer and the RASP layer, a bidirectional confidence fusion calculation is performed based on the attack fingerprint, behavioral context threat score, and attack chain confidence. When the final confidence after fusion exceeds the second threshold, a blocking action is jointly executed in the WAF layer and the RASP layer.

[0104] It should be noted that step S5 specifically includes:

[0105] S51. Obtain the WAF confidence score calculated by the WAF layer based on the rule matching degree and the RASP confidence score calculated by the RASP layer based on the node threat score, respectively, and calculate the final joint confidence score through the weighted fusion formula.

[0106] Specifically, input: WAF confidence level W score (Based on rule matching degree), RASP confidence R score (Based on threat score);

[0107] Calculate the final confidence level: Final Conf = 0.6× W score + 0.4×log10(10× R score );

[0108] S52. When the final joint confidence exceeds the second threshold, the blocking actions of the WAF layer and the RASP layer are triggered simultaneously; the WAF layer performs network layer blocking and records the attack source, and the RASP layer terminates the malicious operation thread and rolls back the dangerous transaction within the application.

[0109] Specifically, only when Final Conf Blocking is triggered when the value is greater than 0.85.

[0110] WAF layer action: Discard current session packets and block the source IP for 300 seconds;

[0111] RASP layer actions:

[0112] 1) Terminate a malicious thread: Call Thread.currentThread().interrupt();

[0113] 2) Rollback dangerous operations: Perform a ROLLBACK on the database operation;

[0114] Graph layer action: Mark the BLOCKED state in the attack propagation graph;

[0115] S53. Record the execution results of collaborative blocking, and dynamically adjust the weight coefficients of the confidence fusion formula in S51 according to whether the blocking is successful or a misjudgment occurs.

[0116] It should be noted that the strategy for dynamically adjusting the weight coefficients in step S53 is as follows:

[0117] If the coordinated blocking is confirmed to be a false positive, the weight of WAF confidence in the fusion formula will be reduced by a predetermined step size.

[0118] If the coordinated blocking fails to stop the attack, the weight of the RASP confidence in the fusion formula will be increased by a predetermined step.

[0119] Specifically, the blocking result (success / false positive) is recorded, and the weights of the confidence formula are dynamically adjusted:

[0120] 1) If a false positive occurs: reduce the WAF weight (0.6 → 0.55);

[0121] 2) If the attack is successful: Increase the RASP weight (0.4 → 0.45).

[0122] Example 2

[0123] Taking a provincial OTN transmission network management system as an example, before implementing this invention, the system environment must first be deployed.

[0124] Management and control system architecture: A provincial OTN transmission network management and control system, including a north-south OpenAPI interface (HTTPS traffic accounts for 95%) and an east-west microservice cluster (Spring Cloud + gRPC).

[0125] The hardware configuration is as follows: North-South WAF nodes: Intel Xeon Gold 6338N ×2, 40Gbps network cards; East-West RASP probes: deployed on a K8s cluster (20 Pods / Java services); Attack graph engine: JanusGraph graph database (SSD storage cluster).

[0126] Next, we will simulate an attack scenario. We will take an API chain attack suffered by the OTN transmission network management system of a certain province as an example. Attacker: Malicious user accessing via VPN; Attack target: Obtaining the OTN device configuration database; Attack chain: Polymorphic SQL injection → Unauthorized API call → Sensitive file reading → Database credential theft;

[0127] The defense process of this invention is implemented as follows:

[0128] Step S1: Identify the attack fingerprint and associate it with the session ID in the north-south WAF layer;

[0129] S11. Protocol Identification: The WAF parses the first 64 bytes of gRPC traffic and identifies the magic number 00 00 00 (identifying the gRPC protocol); it extracts metadata: Content-Type=application / grpc+proto, with a peak packet length distribution of 1280±200 bytes, and the packet length distribution conforms to the OTN configuration update characteristics.

[0130] S12. Dynamic detection: The traffic was not encrypted. AST syntax tree analysis revealed an unconventional space injection, generating an attack fingerprint: SQLi_89a3e7f.

[0131] S13, Session Binding: Generate Session ID: src=192.168.1.100:55324_dst=10.1.1.10:50051_tshash=7d3f8c; Inject gRPC Metadata: session_id: 7d3f8c; Redis Storage: SETEX sess:7d3f8c 600 "SQLi_89a3e7f";

[0132] Step S2: The east-west RASP probe cluster captures the behavioral context of application nodes.

[0133] S21. Behavior Monitoring: Device Management Service Probe Captures SQL Execution: PreparedStatement.bind(1, "uNiOn / / sElEcT..."); Configure service probes to detect file access: FileInputStream.open(" / etc / otn-credentials");

[0134] S22, Session Penetration:

[0135] Specifically, the pass-through of session IDs is achieved as follows: When an application service makes a cross-service call (e.g., calling a configuration service to retrieve a file), the caller obtains the bound global session ID from the context of the current processing thread (e.g., stored via ThreadLocal). This session ID is then appended as metadata (e.g., placed in the Metadata header of a gRPC call, with the key being a predefined session identifier key) to the outgoing request. In this way, the receiving service can parse the same session ID from the corresponding header of the incoming request, thus achieving seamless transmission and association of the session identifier throughout the entire service call chain.

[0136] S23. Stain Analysis:

[0137] The results are shown in Table 1:

[0138] Table 1. Schematic diagram of stain analysis results

[0139]

[0140] Step S3: Construct a cross-layer attack feature propagation map based on session ID and behavioral context.

[0141] Specifically, the example results are as follows:

[0142] S31. Data aggregation: Aggregate data using session ID 7d3f8c: WAF fingerprint SQLi_89a3e7f; RASP threat score (Device Management Service: 7.2, Configuration Service: 9.0).

[0143] Establish the relationship: WAF → Device Management Service (INITIATE_ATTACK);

[0144] Device Management Service → Configuration Service (PROPAGATE, weight = 85 times / minute);

[0145] S32, Graph Determination: The average threat value of the path WAF→DeviceSvc→ConfigSvc is (7.2+9.0) / 2=8.1>0.8; triggering rule 2 → determined to be a cross-layer attack chain;

[0146] S33. Confidence Calculation: Node Threat Mean = 8.1; Propagation Depth = 2; Confidence = 8.1 × 0.9^(2-1) = 7.29;

[0147] Normalized confidence level = 7.29 / (10 × 0.9^(2-1)) = 0.81 < 0.85, S4 will not be activated for now;

[0148] The attack has not yet reached a critical stage. The system is being monitored, and session ID 7d3f8c is marked as a high-concern session.

[0149] S33. Continuous monitoring until a critical attack (database access) occurs:

[0150] The attacker attempted: JDBC.connect("mysql: / / db.otn", "root:pass123");

[0151] Capture and update:

[0152] A new high-risk operation reportThreat("DB_ACCESS", CVSS_10, 1.0); is added, where the threat score is 10.0;

[0153] At this stage, S4 is finally activated (confidence level 0.92):

[0154] Mean node threat = (7.2 + 9.5 + 10.0) / 3 = 8.9;

[0155] Propagation depth = 3 (WAF→DeviceSvc→ConfigSvc→DB);

[0156] Confidence level = 8.9 × 0.9^(3-1) = 8.9 × 0.81 = 7.209;

[0157] Normalized confidence level = 7.209 / (10 × 0.9^(3-1)) = 0.89 > 0.85, triggering S4;

[0158] Step S4: When the graph shows a cross-layer attack chain, the RASP layer generates a virtual patch and feeds it back to the WAF layer to update the rule base.

[0159] S41. Feature Extraction: RASP captures abnormal behavior of the configuration service: JDBC.connect("mysql: / / db.otn"); This pattern appears 15 times (>5) in the attack chain and is retained as a key feature;

[0160] S42. Rule Transformation: Generate regular expression rule: (?i) / etc / passwd; Bind weight: Confidence 0.89 × 100 = 89; Generate WAF rule;

[0161] S43, Rule Injection:

[0162] Pushed to WAF via gRPC stream, hot reloading takes effect (takes 217 milliseconds); New rule ID: RASP_PATCH_230; ADD RULE id=OTN_ALERT_15 regex="(...)" weight=89;

[0163] Step S5: The WAF and RASP layers jointly trigger blocking through bidirectional confidence assessment.

[0164] S51, Confidence Fusion: When an attacker launches a similar attack a second time, the WAF matches the new rule RASP_PATCH_230 ( W score =0.89); RASP threat score R score =0.9; weighting coefficients (α=0.6, β=0.4); final confidence level: 0.6×0.89 +0.4×log10(10×0.9) = 0.53 + 0.38 = 0.91>0.85.

[0165] S52, Coordinated Blocking: WAF drops packets + blocks IP for 300 seconds; RASP terminates JDBC threads + rolls back transactions; Graph Engine marks the attack chain status as BLOCKED;

[0166] S53. Effect Optimization: This blocking was successful, maintaining the weighting coefficients (α=0.6, β=0.4).

[0167] Example 3

[0168] Please refer to Figure 2 , Figure 2 This is a schematic diagram of the system architecture of the present invention.

[0169] An abnormal traffic collaborative detection system includes:

[0170] The north-south detection module is deployed at the network boundary to perform protocol adaptive identification and dynamic attack detection on traffic. When an attack session is detected, an attack fingerprint is generated and a globally unique session ID is generated and bound to the attack session. The attack fingerprint and the session ID are associated and stored.

[0171] The east-west detection module is deployed in the application node cluster to perform full-link instrumentation monitoring of application behavior. It extracts and transmits the session ID from the traffic in a penetrating manner, associates the monitored behavior data with the session ID, forms behavior data with context tags, and calculates the node threat score based on taint tracking technology.

[0172] The attack graph construction and analysis module is connected to the north-south detection module and the east-west detection module. It is used to aggregate attack fingerprints and context-tagged behavioral data with the session ID as the key index, construct a cross-layer attack feature propagation graph, and analyze the graph based on preset rules to dynamically evaluate the confidence of the attack chain.

[0173] The virtual patch generation and injection module is connected to the attack graph construction and analysis module. When the attack chain confidence exceeds the first threshold, it extracts key attack features based on the identified attack chain and related behavioral context, converts them into WAF executable rules, and injects them into the rule base of the north-south detection module in real time.

[0174] The collaborative blocking decision and execution module is connected to the north-south detection module, the east-west detection module, and the attack graph construction and analysis module, respectively. It is used to perform bidirectional confidence fusion calculation based on attack fingerprint, node threat score, and attack chain confidence. When the final confidence after fusion exceeds the second threshold, the north-south detection module and the east-west detection module are coordinated to execute blocking actions synchronously.

[0175] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0176] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A collaborative method for detecting abnormal traffic, characterized in that: Includes the following steps: S1. At the north-south WAF layer, the traffic is subjected to protocol adaptive identification and dynamic attack detection. When an attack session is detected, an attack fingerprint is generated, and a globally unique session ID is generated and bound to the attack session. The attack fingerprint is associated with the session ID and stored. S2. In the east-west RASP layer, by deploying a probe cluster on the application node, the application behavior is monitored through the entire link, and the session ID is extracted from the traffic and transmitted through the penetration, so that the monitored behavior data is associated with the session ID to form behavior data with context tagging. S3. Using the session ID as the key index, aggregate the attack fingerprint generated in S1 and the behavior data with context markers generated in S2 to construct a cross-layer attack feature propagation map, and analyze the map based on preset rules to dynamically evaluate the confidence of the attack chain. Step S3 specifically includes: S31. Using the session ID as the primary key, aggregate the attack fingerprint reported by the WAF layer with the node threat score and behavioral context reported by the RASP layer that are marked with the session ID, and construct structured data with network nodes as vertices and attack propagation relationships as edges. S32. Import the aggregated data into the graph database, dynamically construct and update the attack feature propagation graph; based on the preset graph rules, identify the attack propagation path and key attack nodes; S33. Quantify and evaluate the confidence of the identified attack propagation path. The evaluation factors include at least the average threat score of the nodes in the path and the attack propagation depth. Normalization is then used to obtain the confidence of the attack chain. S4. When the confidence of the evaluated attack chain exceeds the first threshold, based on the attack chain and associated behavioral context identified in S3, key attack features are extracted and transformed into virtual patch rules executable by the WAF layer, which are then injected into the WAF layer rule base in real time. S5. Between the WAF layer and the RASP layer, the final joint confidence is calculated based on the WAF confidence and the RASP confidence. When the final joint confidence exceeds the second threshold, the blocking action is executed jointly by the WAF layer and the RASP layer. Step S5 specifically includes: S51. Obtain the WAF confidence score calculated by the WAF layer based on the rule matching degree and the RASP confidence score calculated by the RASP layer based on the node threat score, respectively, and calculate the final joint confidence score through the weighted fusion formula. S52. When the final joint confidence exceeds the second threshold, the blocking actions of the WAF layer and the RASP layer are triggered simultaneously; the WAF layer performs network layer blocking and records the attack source, and the RASP layer terminates the malicious operation thread and rolls back the dangerous transaction within the application. S53. Record the execution results of collaborative blocking, and dynamically adjust the weight coefficients of the confidence fusion formula in S51 according to whether the blocking is successful or a misjudgment occurs.

2. The abnormal traffic collaborative detection method as described in claim 1, characterized in that: Step S1 is as follows: S11. Deploy a protocol parsing plugin to achieve adaptive identification of HTTP / HTTPS and non-HTTP protocols by parsing traffic packet header features, the protocol identifier in the first preset bytes, or extracting traffic element statistical features. S12. Dynamic attack detection of identified traffic: For unencrypted traffic, a combination of rule matching and abstract syntax tree analysis is used to detect polymorphic attacks. For encrypted traffic, only its extended fields are extracted for preliminary judgment, and it is marked as a session to be observed; S13. When an attack is detected or a target is marked for observation, a globally unique session ID is generated, inserted into the protocol header or metadata field of the traffic, and the attack fingerprint or target mark is associated with the session ID and stored in a distributed cache.

3. The abnormal traffic collaborative detection method as described in claim 1, characterized in that: Step S2 is as follows: S21. Instrument the application's key classes using bytecode enhancement technology to monitor application behavior, including SQL execution, file operations, and RPC calls, and capture the specific parameters and context of the behavior. S22. When the application node processes an incoming request, it parses the session ID from the protocol header or metadata and binds it to the context of the current processing thread. When making cross-service calls, the session ID is automatically injected into the outgoing request, enabling the session ID to be passed through service links. S23. Based on taint tracking technology, user input is marked and its propagation is monitored. When tainted data triggers a preset high-risk operation, the threat score of the current node is calculated by combining the vulnerability base score and the controllability of the input.

4. The abnormal traffic collaborative detection method as described in claim 1, characterized in that: Step S4 specifically includes: S41. When the confidence of the attack chain exceeds the first threshold, extract the attack feature patterns that frequently appear on the attack propagation path from the RASP behavior data that triggers the attack chain to form a minimum attack feature set. S42. The minimum attack feature set is transformed into a WAF-compatible defense rule, and the defense rule is dynamically assigned weights based on the attack chain confidence of the rule. S43. Push the weighted defense rules to the north-south WAF engine through the real-time communication channel, trigger the WAF rule hot loading mechanism to make it effective, and set the automatic elimination policy for rules without matching.

5. The abnormal traffic collaborative detection method as described in claim 1, characterized in that: The attack feature propagation map constructed in step S32 is used to dynamically execute the following judgment rules: Rule 1: If the threat score of a node in the graph exceeds the third threshold and there is a high-risk operation originating from user input that points to that node, then that node is marked as an attack node. Rule 2: If there is a path in the graph that starts from the WAF entry node and propagates through at least one service node, and the average threat score of all nodes on that path exceeds the fourth threshold, then a cross-layer attack chain is determined to exist.

6. The abnormal traffic collaborative detection method as described in claim 1, characterized in that: In step S53, the strategy for dynamically adjusting the weight coefficients is as follows: If the coordinated blocking is confirmed to be a false positive, the weight of WAF confidence in the fusion formula will be reduced by a predetermined step size. If the coordinated blocking fails to stop the attack, the weight of the RASP confidence in the fusion formula will be increased by a predetermined step.

7. An abnormal traffic collaborative detection system, characterized in that, include: The north-south detection module is deployed at the network boundary to perform protocol adaptive identification and dynamic attack detection on traffic. When an attack session is detected, an attack fingerprint is generated and a globally unique session ID is generated and bound to the attack session. The attack fingerprint and the session ID are associated and stored. The east-west detection module is deployed in the application node cluster to perform full-link instrumentation monitoring of application behavior. It extracts and transmits the session ID from the traffic in a penetrating manner, associates the monitored behavior data with the session ID, forms behavior data with context tags, and calculates the node threat score based on taint tracking technology. The attack graph construction and analysis module is connected to the north-south detection module and the east-west detection module. It is used to aggregate attack fingerprints and context-tagged behavioral data with the session ID as the key index, construct a cross-layer attack feature propagation graph, and analyze the graph based on preset rules to dynamically evaluate the confidence of the attack chain. The attack graph construction and analysis module specifically includes: Using the session ID as the primary key, the attack fingerprint reported by the WAF layer is aggregated with the node threat score and behavioral context marked with the session ID reported by the RASP layer to construct structured data with network nodes as vertices and attack propagation relationships as edges. The aggregated data is imported into a graph database to dynamically construct and update attack feature propagation graphs; based on preset graph rules, attack propagation paths and key attack nodes are identified. The identified attack propagation paths are quantitatively evaluated using confidence metrics. The evaluation factors include at least the average threat score of the nodes in the path and the attack propagation depth. The confidence level of the attack chain is obtained by normalization. The virtual patch generation and injection module is connected to the attack graph construction and analysis module. When the attack chain confidence exceeds the first threshold, it extracts key attack features based on the identified attack chain and related behavioral context, converts them into WAF executable rules, and injects them into the rule base of the north-south detection module in real time. The collaborative blocking decision and execution module is connected to the north-south detection module, the east-west detection module, and the attack graph construction and analysis module, respectively. It is used to calculate the final joint confidence based on the WAF confidence and RASP confidence. When the final joint confidence exceeds the second threshold, the north-south detection module and the east-west detection module coordinate to execute blocking actions synchronously. The collaborative blocking decision-making and execution module specifically includes: The WAF confidence score calculated based on rule matching degree at the WAF layer and the RASP confidence score calculated based on node threat score at the RASP layer are obtained respectively. The final joint confidence score is then calculated using a weighted fusion formula. When the final joint confidence exceeds the second threshold, the blocking actions of the WAF layer and the RASP layer are triggered simultaneously; the WAF layer performs network layer blocking and records the attack source, and the RASP layer terminates the malicious operation thread and rolls back the dangerous transaction within the application. Record the execution results of collaborative blocking, and dynamically adjust the weight coefficients of the confidence fusion formula in S51 according to whether the blocking is successful or a misjudgment occurs.

Images