Intranet traffic-oriented security detection method, device, equipment and medium

Abstract

The present disclosure provides an intranet traffic-oriented security detection method, device, equipment and medium, comprising: reassembling interactive traffic packets into complete network session flows; deeply analyzing the network session flows to obtain unstructured data; structuring and converting the unstructured data to obtain structured feature data; extracting network flow features, application layer semantic features and entity behavior sequence features from the structured feature data; performing anomaly detection on the network flow features, application layer semantic features and entity behavior sequence features according to an unsupervised anomaly detection model to obtain an anomaly representation score; if it is determined that the intranet interactive behavior belongs to an abnormal event, performing context enhancement analysis on the intranet interactive behavior according to interactive correlation information to obtain context enhancement analysis data; adjusting the anomaly representation score according to the context enhancement analysis data; and determining an intranet traffic detection result according to the anomaly representation score. Thus, the security detection accuracy of intranet traffic is effectively improved.

Description

Technical Field

[0001] The embodiments disclosed herein relate to the field of network information security technology, and more specifically, to a security detection method, apparatus, device, and medium applicable to intranet traffic. Background Technology

[0002] As enterprises deepen their digital transformation, internal networks (internal networks) have become the core carriers of enterprise operations, carrying a large amount of sensitive data, critical business processes, and application services. Traditional network security defense systems, such as firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS), mainly focus on network perimeter protection, blocking external attacks based on known signature and rule bases.

[0003] However, with existing technology, the accuracy of security detection of intranet traffic is low. Summary of the Invention

[0004] The embodiments described herein provide a security detection method, apparatus, device, and medium for intranet traffic that overcomes the aforementioned problems.

[0005] Firstly, based on the content of this disclosure, a security detection method for intranet traffic is provided, including: Deploy traffic acquisition probes in the core nodes of the intranet and forward the traffic data collected by the traffic acquisition probes to the mirror port in the core nodes of the intranet, so as to monitor the traffic of the core nodes of the intranet through the mirror port in the core nodes of the intranet; The interaction traffic packets corresponding to the internal network core node are obtained through the mirror port in the internal network core node; the interaction traffic packets are reassembled into a complete network session stream; the network session stream is deeply parsed to obtain unstructured data containing protocol-specific fields; and the unstructured data is structured and semantically transformed to obtain structured feature data. A first feature dimension extraction strategy is used to extract network flow features from the structured feature data; a second feature dimension extraction strategy is used to extract application layer semantic features from the structured feature data; and a third feature dimension extraction strategy is used to extract entity behavior sequence features from the structured feature data. Anomaly detection is performed on the network flow features, application layer semantic features, and entity behavior sequence features using a pre-trained unsupervised anomaly detection model to obtain anomaly representation scores for intranet interaction behavior. The anomaly representation score of the intranet interaction behavior is used to determine whether the intranet interaction behavior is an abnormal event. If the intranet interaction behavior is determined to be an abnormal event, the interaction association information corresponding to the intranet interaction behavior is obtained from the preset threat intelligence center. Based on the interaction association information corresponding to the intranet interaction behavior, context enhancement analysis is performed on the intranet interaction behavior to obtain context enhancement analysis data. The anomaly representation score of the intranet interaction behavior is adjusted based on the context-enhanced analysis data; and the intranet traffic detection result is determined based on the anomaly representation score of the intranet interaction behavior.

[0006] Secondly, according to the content of this disclosure, a security detection device for intranet traffic is provided, comprising: The deployment module is used to deploy traffic acquisition probes in the core nodes of the intranet and forward the traffic data collected by the traffic acquisition probes to the mirror port in the core nodes of the intranet, so as to monitor the traffic of the core nodes of the intranet through the mirror port in the core nodes of the intranet. The conversion module is used to obtain the interactive traffic packets corresponding to the internal network core node through the mirror port in the internal network core node; reassemble the interactive traffic packets into a complete network session stream; perform deep parsing on the network session stream to obtain unstructured data containing protocol-specific fields; and perform structuring and semantic feature conversion on the unstructured data to obtain structured feature data. The extraction module is used to extract network flow features from the structured feature data using a first feature dimension extraction strategy; extract application layer semantic features from the structured feature data using a second feature dimension extraction strategy; and extract entity behavior sequence features from the structured feature data using a third feature dimension extraction strategy. The detection module is used to perform anomaly detection on the network flow features, the application layer semantic features and the entity behavior sequence features based on a pre-trained unsupervised anomaly detection model, and obtain anomaly representation scores for intranet interaction behavior. The determination module is used to determine whether the intranet interaction behavior belongs to an abnormal event based on the abnormal representation score of the intranet interaction behavior. If it is determined that the intranet interaction behavior belongs to an abnormal event, the interaction association information corresponding to the intranet interaction behavior is obtained from the preset threat intelligence center. The analysis module is used to perform context-enhanced analysis on the intranet interaction behavior based on the interaction association information corresponding to the intranet interaction behavior, and obtain context-enhanced analysis data. The determination module is used to adjust the anomaly representation score of the intranet interaction behavior based on the context enhancement analysis data; and to determine the intranet traffic detection result based on the anomaly representation score of the intranet interaction behavior.

[0007] Thirdly, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the security detection method for intranet traffic as described in any of the above embodiments.

[0008] Fourthly, a computer-readable storage medium is provided, on which a computer program is stored, and when executed by a processor, the computer program implements the steps of the security detection method for intranet traffic as described in any of the above embodiments.

[0009] The security detection method for intranet traffic provided in this application deploys traffic acquisition probes in the core intranet node and forwards the traffic data collected by the probes to a mirror port in the core intranet node to monitor the traffic of the core intranet node through the mirror port. The method obtains the corresponding interactive traffic packets of the core intranet node through the mirror port; reassembles the interactive traffic packets into a complete network session stream; performs deep parsing on the network session stream to obtain unstructured data containing protocol-specific fields; performs structuring and semantic feature transformation on the unstructured data to obtain structured feature data; extracts network flow features from the structured feature data using a first feature dimension extraction strategy; and extracts application layer semantic features from the structured feature data using a second feature dimension extraction strategy. The method employs a third-dimensional feature extraction strategy to extract entity behavior sequence features from structured feature data. Anomalies are detected in network flow features, application layer semantic features, and entity behavior sequence features using a pre-trained unsupervised anomaly detection model, resulting in anomaly representation scores for intranet interaction behaviors. These scores determine whether the intranet interaction behavior constitutes an abnormal event. If it is determined to be an abnormal event, the corresponding interaction association information is retrieved from a pre-defined threat intelligence center. Context-enhanced analysis is performed on the intranet interaction behavior based on this interaction association information, yielding context-enhanced analysis data. The anomaly representation scores for the intranet interaction behavior are adjusted based on this data, and the intranet traffic detection result is determined based on these scores. Thus, by obtaining multidimensional features of intranet traffic through a multidimensional feature extraction mechanism, performing traffic anomaly detection, and adjusting the anomaly score in conjunction with the traffic context, efficient identification of abnormal traffic can be achieved, significantly reducing the false alarm rate and effectively improving the security detection accuracy of intranet traffic.

[0010] The above description is merely an overview of the technical solutions of the embodiments of this application. In order to better understand the technical means of the embodiments of this application and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the embodiments of this application more obvious and understandable, specific implementation methods of this application are described below. Attached Figure Description

[0011] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings of the embodiments will be briefly described below. It should be understood that the drawings described below only relate to some embodiments of this disclosure and are not intended to limit this disclosure, wherein: Figure 1 This is a flowchart illustrating a security detection method for intranet traffic provided in this publication.

[0012] Figure 2 This is a schematic diagram of the structure of a security detection device for intranet traffic provided in this disclosure.

[0013] Figure 3 This is a schematic diagram of the structure of a computer device provided in this disclosure.

[0014] It should be noted that the elements in the attached diagram are schematic and not drawn to scale. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the described embodiments of this disclosure without creative effort are also within the scope of protection of this disclosure.

[0016] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this subject matter pertains. It will be further understood that terms such as those defined in commonly used dictionaries shall be interpreted as having the meaning consistent with their meaning in the context of the specification and in the relevant art, and shall not be interpreted in an idealized or overly formal form unless otherwise explicitly defined herein. As used herein, the statement of “connecting” or “coupling” two or more parts together shall mean that these parts are directly joined together or joined through one or more intermediate components.

[0017] The term "embodiment" as used herein means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of the phrase "embodiment" in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0018] In this document, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists, A and B exist simultaneously, or B exists. Additionally, the character " / " generally indicates that the preceding and following related objects have an "or" relationship. Terms such as "first" and "second" are only used to distinguish one component (or part of a component) from another component (or another part of a component).

[0019] In the description of this application, unless otherwise stated, "multiple" means two or more (including two), and similarly, "multiple groups" means two or more (including two groups).

[0020] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0021] Figure 1 This is a flowchart illustrating a security detection method for intranet traffic provided in an embodiment of this disclosure, as shown below. Figure 1 As shown, the specific process of the security detection method for internal network traffic includes: S110. Deploy traffic acquisition probes in the core nodes of the intranet and forward the traffic data collected by the traffic acquisition probes to the mirror port in the core nodes of the intranet, so as to monitor the traffic of the core nodes of the intranet through the mirror port in the core nodes of the intranet.

[0022] This involves deploying traffic acquisition probes at core intranet nodes (such as core intranet switches or critical network segments) and collecting full traffic data losslessly through port mirroring. This allows for traffic monitoring of the core intranet nodes via the mirrored ports within those nodes. S120. Obtain the interactive traffic packets corresponding to the internal network core node through the mirror port in the internal network core node; reassemble the interactive traffic packets into a complete network session stream; perform deep parsing on the network session stream to obtain unstructured data containing protocol-specific fields; and perform structuring and semantic feature transformation on the unstructured data to obtain structured feature data.

[0023] The interactive traffic packet includes metadata and necessary payload data. Metadata includes information such as timestamps, source addresses, destination addresses, and protocol types; necessary payload data includes specific content fragments of the interaction between the communicating parties, which can reflect the characteristics of the data packet at the application layer.

[0024] Network session streams can be such as TCP (Transmission Control Protocol) sessions or UDP (User Datagram Protocol) streams. When performing deep analysis on network session streams, common application layer protocols can be analyzed, such as HTTP (Hypertext Transfer Protocol), DNS (Domain Name System), DHCP (Dynamic Host Configuration Protocol), SMB (Server Message Block), RDP (Remote Display Protocol), and TLS (Transport Layer Security), extracting protocol-specific fields such as HTTP URI and User-Agent, DNS query domain name and record type, and TLS SNI and certificate information.

[0025] When performing structuring and semantic feature transformation on unstructured data, unstructured traffic data can be transformed into structured, semantically rich feature logs. Each log entry is associated with a specific communication pair (source IP, destination IP, source port, destination port, protocol) and a timestamp to obtain structured feature data.

[0026] Therefore, after obtaining the interactive traffic packets corresponding to the internal network core nodes through the mirror port in the internal network core nodes, the interactive traffic packets are subjected to preprocessing operations such as session reassembly, deep parsing, and structured and semantic feature conversion, which effectively improves the data availability of the interactive traffic packets.

[0027] S130. The first feature dimension extraction strategy is used to extract network flow features from the structured feature data; the second feature dimension extraction strategy is used to extract application layer semantic features from the structured feature data; and the third feature dimension extraction strategy is used to extract entity behavior sequence features from the structured feature data.

[0028] Among them, the first feature dimension extraction strategy is used to describe the extraction system in the network flow feature dimension; the second feature dimension extraction strategy is used to describe the extraction system in the application layer semantic feature dimension; and the third feature dimension extraction strategy is used to describe the extraction system in the entity behavior sequence feature dimension.

[0029] In some embodiments, a first feature dimension extraction strategy is used to extract network flow features from structured feature data, including: obtaining network flow extraction indicators and extracting network flow features from structured feature data according to the network flow extraction indicators; the network flow features include: session duration, number of bytes transmitted, number of packets, average packet size, traffic rate, and TCP flag combination.

[0030] Among them, network flow extraction metrics are used to describe session duration, number of bytes transmitted, number of packets, average packet size, traffic rate, and TCP flag combinations. Session duration reflects the interaction time between the communicating parties, the number of bytes transmitted and the number of packets reflect the scale of data transmission, average packet size and traffic rate can be used to analyze the stability and burstiness of traffic, and TCP flag combinations help identify specific network behavior patterns. By complementing each other in the structured feature data—session duration, number of bytes transmitted, number of packets, average packet size, traffic rate, and TCP flag combinations—a comprehensive description of network flow characteristics is formed, ensuring the comprehensiveness of network flow characteristics.

[0031] In some embodiments, a second feature dimension extraction strategy is used to extract application layer semantic features from structured feature data, including: extracting semantic information from application layer protocols from structured feature data; and encoding the semantic information in the application layer protocols to obtain application layer semantic features; the application layer protocols include: Hypertext Transfer Protocol, Domain Name System Protocol and Transport Layer Security Protocol.

[0032] The semantic information of the Hypertext Transfer Protocol (HTTP) includes: URL (Uniform Resource Locator) path depth, number of parameters, whether rare URLs are accessed, and User-Agent anomalies. The semantic information of the Domain Name System (DNS) includes: domain name length, character distribution, number of subdomains, number of NXDOMAIN responses, and rare domain names requested. The semantic information of transport layer security protocols includes: certificate validity period, certificate issuer / subject anomalies, rarity of SNI (Server Name Indicator), and whether weak cipher suites are used. These features allow for the extraction of highly complete application layer semantic characteristics.

[0033] In some embodiments, a third feature dimension extraction strategy is used to extract entity behavior sequence features from structured feature data, including: constructing a corresponding behavior baseline with internal network entities as units; and extracting entity behavior sequence features from the behavior baselines corresponding to internal network entities according to a preset time window.

[0034] This approach focuses on "entities" within the intranet (such as a host or a user account) to establish their behavioral baseline. It then extracts the behavioral sequence characteristics of these entities within specific time windows (e.g., 1 hour or 1 day). These behavioral sequence characteristics include: the set of communication peers (which internal / external IPs they communicate with), the set of service ports accessed, the sequence of operations performed, and the temporal patterns of their activities. The sequence of operations might include, for example, first performing a DNS query for a domain, then establishing a TLS connection to an IP, and finally accessing a file share via SMB. The temporal patterns of their activities include working hours and non-working hours. This process extracts highly complete entity behavioral sequence characteristics.

[0035] S140. Based on the pre-trained unsupervised anomaly detection model, anomaly detection is performed on network flow features, application layer semantic features, and entity behavior sequence features to obtain anomaly representation scores for intranet interaction behavior.

[0036] Intranet interaction behaviors can correspond to network sessions or entity behaviors. Network flow features, application layer semantic features, and entity behavior sequence features can be input into the unsupervised anomaly detection model to obtain an anomaly representation score for each intranet interaction behavior.

[0037] Using an unsupervised learning algorithm, the normal patterns of intranet traffic can be learned automatically without the need for pre-labeling malicious samples. During the offline training phase, "clean" traffic data from a historical period (e.g., 2-4 weeks) is used to train the anomaly detection model based on extracted multi-dimensional features (i.e., network flow features, application layer semantic features, and entity behavior sequence features).

[0038] Unsupervised learning algorithms can employ either Isolation Forest or Autoencoder algorithms. Isolation Forest is suitable for high-dimensional data and can efficiently isolate outliers; the model learns the feature distribution of normal traffic and identifies samples with sparse features that differ from the mainstream distribution as outliers. Autoencoders learn an efficient representation of the data through encoding and decoding processes (encoding); after training, new traffic features are input, and their reconstruction error is calculated; normal traffic has a low reconstruction error, while outlier traffic has a high reconstruction error, thus identifying outliers.

[0039] S150. Determine whether the internal network interaction behavior is an abnormal event based on the abnormal representation score of the internal network interaction behavior. If it is determined that the internal network interaction behavior is an abnormal event, obtain the interaction association information corresponding to the internal network interaction behavior from the preset threat intelligence center.

[0040] This can be achieved by correlating the abnormal events output by the model with external or internal threat intelligence, thereby improving the credibility and severity level of alerts. The interaction correlation information corresponding to internal network interaction behavior includes: IP reputation database, malicious domain database, malicious file hash value, and vulnerability correlation information (such as whether the communication peer IP is associated with a known vulnerability).

[0041] S160. Perform context enhancement analysis on the intranet interaction behavior based on the interaction association information corresponding to the intranet interaction behavior to obtain context enhancement analysis data; adjust the anomaly representation score of the intranet interaction behavior based on the context enhancement analysis data; and determine the intranet traffic detection result based on the anomaly representation score of the intranet interaction behavior.

[0042] The context-enhanced analysis data is used to describe the improvement / deterioration of the anomaly representation score of intranet interaction behavior, facilitating data correction of the anomaly representation score output by the model. If the anomaly representation score of intranet interaction behavior exceeds a set threshold, the intranet traffic detection result is determined to indicate that there is a security risk in the intranet traffic; if the anomaly representation score of intranet interaction behavior does not exceed the set threshold, the intranet traffic detection result is determined to indicate that there is no security risk in the intranet traffic.

[0043] In some embodiments, the interaction association information corresponding to intranet interaction behavior includes: IP reputation database, malicious domain name database, malicious file hash value and vulnerability association information.

[0044] Context-enhanced analysis is performed on intranet interaction behaviors based on the interaction association information corresponding to those behaviors, resulting in context-enhanced analysis data, including: If the IP reputation corresponding to the intranet interaction behavior does not match the IP reputation database, then the context enhancement analysis data is used to describe and improve the anomaly representation score of the intranet interaction behavior; if the IP reputation corresponding to the intranet interaction behavior matches the IP reputation database, then the context enhancement analysis data is used to describe and reduce the anomaly representation score of the intranet interaction behavior; if the domain name corresponding to the intranet interaction behavior matches the malicious domain name database, then the context enhancement analysis data is used to describe and improve the anomaly representation score of the intranet interaction behavior; if the domain name corresponding to the intranet interaction behavior does not match the malicious domain name database, then the context enhancement analysis data is used to describe and reduce the anomaly representation score of the intranet interaction behavior; if ... If the hash value corresponding to the interaction matches the hash value of the malicious file, then the context enhancement analysis data is determined to be used to improve the anomaly representation score of the internal network interaction behavior; if the hash value corresponding to the internal network interaction behavior does not match the hash value of the malicious file, then the context enhancement analysis data is determined to be used to reduce the anomaly representation score of the internal network interaction behavior; if the communication peer IP of the internal network interaction behavior corresponds to vulnerability-related information, then the context enhancement analysis data is determined to be used to improve the anomaly representation score of the internal network interaction behavior; if the communication peer IP of the internal network interaction behavior does not correspond to vulnerability-related information, then the context enhancement analysis data is determined to be used to reduce the anomaly representation score of the internal network interaction behavior.

[0045] For example, a DNS query with a moderate anomaly score would have its threat level immediately upgraded to "high risk" if the domain it queries is identified as a C2 (command and control) server domain by the threat intelligence database. This allows for contextual analysis to be used to correct the anomaly score and improve its reliability.

[0046] In this embodiment, traffic acquisition probes are deployed in the core intranet node, and the traffic data collected by the probes is forwarded to the mirror port in the core intranet node to monitor the traffic of the core intranet node through the mirror port. Interactive traffic packets corresponding to the core intranet node are obtained through the mirror port. These interactive traffic packets are reassembled into a complete network session stream. The network session stream is deeply parsed to obtain unstructured data containing protocol-specific fields. The unstructured data is then structured and semantically transformed to obtain structured feature data. A first feature dimension extraction strategy is used to extract network flow features from the structured feature data. A second feature dimension extraction strategy is used to extract application layer semantic features from the structured feature data. A third feature dimension extraction strategy is used. The dimensionality extraction strategy extracts entity behavior sequence features from structured feature data. Anomalies are detected in network flow features, application layer semantic features, and entity behavior sequence features using a pre-trained unsupervised anomaly detection model, resulting in anomaly representation scores for intranet interaction behaviors. These scores determine whether the intranet interaction behavior constitutes an anomalous event. If it is determined to be an anomalous event, the corresponding interaction association information is retrieved from a pre-defined threat intelligence center. Context-enhanced analysis is then performed on the intranet interaction behavior based on this interaction association information, yielding context-enhanced analysis data. The anomaly representation scores are adjusted based on this data, and the intranet traffic detection result is determined based on these scores. Thus, by obtaining multidimensional features of intranet traffic through a multidimensional feature extraction mechanism, performing traffic anomaly detection, and adjusting anomaly scores in conjunction with traffic context, efficient identification of anomalous traffic can be achieved, significantly reducing false alarm rates and effectively improving the security detection accuracy of intranet traffic.

[0047] In some embodiments, the method further includes: aggregating multiple related abnormal events from the same source entity or pointing to the same destination within a preset time period into a single security event alarm; statistically analyzing the attack chain context corresponding to the security event alarm; and visually displaying the security event alarm and the attack chain context corresponding to the security event alarm.

[0048] For example, if a host performs a port scan on a large number of internal network IPs within one minute, it will be aggregated into a single "lateral movement scan" event, rather than thousands of "abnormal connection" alerts. This alert event is then displayed to security analysts through a graphical user interface (GUI). The display includes not only the alert itself but also the complete attack chain context, such as a baseline change graph of the affected entity's behavior and a sequence graph of all network activities of that entity before and after the alert time. The associated raw traffic packets (PCAP) are available for download for in-depth analysis. This facilitates the visualization of alert event information and context, improving the efficiency and decision-making accuracy of security analysts.

[0049] In some embodiments, the method further includes: if the intranet traffic detection result is used to describe the existence of security risks in the intranet traffic, then obtaining the behavior baseline change map of the affected entity; and statistically analyzing the network activity sequence map of the affected entity before and after the alarm; generating the intranet traffic security risk level based on the behavior baseline change map of the affected entity and the network activity sequence map of the affected entity before and after the alarm; and pushing the intranet traffic security risk level to the risk management center.

[0050] The baseline change graph of the affected entity includes the entity's behavior patterns under normal conditions and the degree of deviation under abnormal conditions. The network activity sequence graph of the affected entity before and after the alarm includes all key network interaction records of the affected entity before and after the alarm time point, such as its communication frequency with other nodes in the internal and external networks, data transmission volume, and connection duration.

[0051] Internal network traffic security risk levels can be categorized as: Alert, Low, Medium, High, and Severe. Once the internal network traffic security risk level is determined, it can be pushed to the SOC (Security Operation Center) platform or SIEM (Security Information and Event Management) system. Through interaction with the SOC platform or SIEM system, automated response mechanisms can be further triggered, such as isolating affected entities, restricting their network access permissions, or initiating deep traffic analysis tasks, facilitating centralized management and response.

[0052] In addition, this embodiment also provides a system architecture for implementation and specific scenario detection examples, mainly including: a traffic acquisition layer, a data processing layer, an AI analysis layer, and a decision presentation layer. Implementation environment: This system is deployed in the intranet of a large enterprise. Traffic acquisition: Traffic probes are deployed on the core network switch to mirror traffic between all VLANs; historical data collected over a period of one month is used for training, followed by real-time detection. Data processing: Traffic data is session-based, and protocols such as HTTP, DNS, TLS, and SMB are deeply parsed; for example, an RDP connection is parsed and information such as the source user, target host, and whether login was successful is recorded. Feature extraction and profiling: Using a server in the R&D department (IP: 10.10.1.100) as an entity, the system constructs its behavioral baseline: it typically only communicates with a few specific build machines and repository servers during working hours, mainly using SSH and NFS protocols. Anomaly Detection: At 2 AM one day, the server suddenly initiated a large number of SMB connection attempts to other intranet segments (such as the finance segment). This behavior showed significant anomalies in three dimensions: network flow characteristics (non-working hours, high number of connections), application layer semantic characteristics (using the SMB protocol), and entity behavior characteristics (deviating from its baseline of communicating only with specific hosts). Unsupervised models (such as Isolation Forest) calculated an extremely high anomaly score. Intelligence Correlation: The system queried the internal threat intelligence database and found that a certain IP address it attempted to connect to had been marked as having a weak password vulnerability; this correlation further increased the risk level of the incident. Aggregated Alert: The system aggregated thousands of failed SMB connection attempts into a high-risk alert for "Internal Lateral Movement Attack (SMB Brute Force)," and labeled the source IP as 10.10.1.100. In the visualization interface, analysts can clearly see the inflection point of the server's behavior from normal to abnormal, as well as its attack path diagram. Response: The security team immediately received the alert and quickly isolated the server. Investigation revealed that it had been infected with ransomware exploiting a recent vulnerability, and the team promptly prevented the ransomware from spreading further within the internal network. This demonstrates the effectiveness and sophistication of this implementation method in detecting lateral movement and unknown threats within the internal network.

[0053] In summary, this embodiment, through application layer protocol parsing and semantic feature extraction, can gain insight into anomalies in encrypted traffic (TLS SNI, certificate information) and complex application protocols (SMB, RDP), effectively addressing the challenges of encrypted traffic. Employing unsupervised machine learning, independent of known attack signatures, it can discover previously unseen, latent APT attacks and internal threats, achieving a leap from "known threat detection" to "unknown anomaly discovery." Through "entity behavior profiling" modeling and multi-event aggregation attribution, it can accurately pinpoint the true threat source (which host, which user) from massive amounts of noise and generate high-value, actionable alerts, significantly reducing false positive rates and security operation and maintenance costs. Dynamic threat intelligence correlation and contextual visualization provide security analysts with a complete attack chain perspective, rather than isolated alert points, greatly accelerating the incident investigation and response (IR) process. The system can automatically learn normal internal network behavior patterns and automatically update the baseline as the network environment changes (such as the launch of new services), exhibiting good adaptability and reducing tedious manual rule maintenance work.

[0054] Figure 2 This embodiment provides a structural diagram of a security detection device for intranet traffic. The security detection device for intranet traffic may include: Deployment module 210 is used to deploy traffic acquisition probes in the core nodes of the intranet and forward the traffic data collected by the traffic acquisition probes to the mirror port in the core nodes of the intranet, so as to monitor the traffic of the core nodes of the intranet through the mirror port in the core nodes of the intranet.

[0055] The conversion module 220 is used to obtain the interactive traffic packets corresponding to the internal network core node through the mirror port in the internal network core node; reassemble the interactive traffic packets into a complete network session stream; perform deep parsing on the network session stream to obtain unstructured data containing protocol-specific fields; and perform structuring and semantic feature conversion on the unstructured data to obtain structured feature data.

[0056] The extraction module 230 is used to extract network flow features from structured feature data using a first feature dimension extraction strategy; extract application layer semantic features from structured feature data using a second feature dimension extraction strategy; and extract entity behavior sequence features from structured feature data using a third feature dimension extraction strategy.

[0057] The detection module 240 is used to perform anomaly detection on network flow features, application layer semantic features and entity behavior sequence features based on a pre-trained unsupervised anomaly detection model, and obtain anomaly representation scores for intranet interaction behavior.

[0058] The judgment module 250 is used to determine whether the internal network interaction behavior belongs to an abnormal event based on the abnormal representation score of the internal network interaction behavior. If it is determined that the internal network interaction behavior belongs to an abnormal event, the interaction association information corresponding to the internal network interaction behavior is obtained from the preset threat intelligence center.

[0059] Analysis module 260 is used to perform context-enhanced analysis on intranet interaction behavior based on the interaction association information corresponding to the intranet interaction behavior, and obtain context-enhanced analysis data.

[0060] The determination module 270 is used to adjust the anomaly representation score of intranet interaction behavior based on context-enhanced analysis data; and to determine the intranet traffic detection result based on the anomaly representation score of intranet interaction behavior.

[0061] In this embodiment, optionally, the extraction module 230 is specifically used for: Obtain network flow extraction metrics and extract network flow features from structured feature data according to the network flow extraction metrics; network flow features include: session duration, number of bytes transmitted, number of packets, average packet size, traffic rate, and TCP flag combination.

[0062] In this embodiment, optionally, the extraction module 230 is specifically used for: Semantic information from application layer protocols is extracted from structured feature data; and the semantic information in the application layer protocols is encoded to obtain application layer semantic features; application layer protocols include: Hypertext Transfer Protocol, Domain Name System Protocol and Transport Layer Security Protocol.

[0063] In this embodiment, optionally, the extraction module 230 is specifically used for: Using intranet entities as units, construct corresponding behavioral baselines; and extract entity behavioral sequence features from the behavioral baselines corresponding to the intranet entities according to a preset time window; entity behavioral sequence features include: communication peer set, accessed service port set, executed operation sequence, and activity time pattern.

[0064] In this embodiment, optionally, the interaction association information corresponding to intranet interaction behavior includes: IP reputation database, malicious domain name database, malicious file hash value and vulnerability association information.

[0065] Analysis module 260 is specifically used for: If the IP reputation corresponding to the intranet interaction behavior does not match the IP reputation database, then the context enhancement analysis data is used to describe and improve the anomaly representation score of the intranet interaction behavior; if the IP reputation corresponding to the intranet interaction behavior matches the IP reputation database, then the context enhancement analysis data is used to describe and reduce the anomaly representation score of the intranet interaction behavior; if the domain name corresponding to the intranet interaction behavior matches the malicious domain name database, then the context enhancement analysis data is used to describe and improve the anomaly representation score of the intranet interaction behavior; if the domain name corresponding to the intranet interaction behavior does not match the malicious domain name database, then the context enhancement analysis data is used to describe and reduce the anomaly representation score of the intranet interaction behavior; if ... If the hash value corresponding to the interaction matches the hash value of the malicious file, then the context enhancement analysis data is determined to be used to improve the anomaly representation score of the internal network interaction behavior; if the hash value corresponding to the internal network interaction behavior does not match the hash value of the malicious file, then the context enhancement analysis data is determined to be used to reduce the anomaly representation score of the internal network interaction behavior; if the communication peer IP of the internal network interaction behavior corresponds to vulnerability-related information, then the context enhancement analysis data is determined to be used to improve the anomaly representation score of the internal network interaction behavior; if the communication peer IP of the internal network interaction behavior does not correspond to vulnerability-related information, then the context enhancement analysis data is determined to be used to reduce the anomaly representation score of the internal network interaction behavior.

[0066] In this embodiment, optionally, a first processing module may also be included.

[0067] The first processing module is used to aggregate multiple related abnormal events from the same source entity or pointing to the same destination within a preset time period into a single security event alarm; to statistically analyze the attack chain context corresponding to the security event alarm; and to visually display the security event alarm and the attack chain context corresponding to the security event alarm.

[0068] In this embodiment, optionally, a second processing module may also be included.

[0069] The second processing module is used to obtain the behavior baseline change map of the affected entity if the internal network traffic detection result is used to describe the security risks of the internal network traffic; and to count the network activity sequence map of the affected entity before and after the alarm; to generate the internal network traffic security risk level based on the behavior baseline change map and the network activity sequence map of the affected entity before and after the alarm; and to push the internal network traffic security risk level to the risk management center.

[0070] The security detection device for intranet traffic provided in this disclosure can execute the above-described method embodiments. Its specific implementation principle and technical effects can be found in the above-described method embodiments, and will not be repeated here.

[0071] This application also provides a computer device. Please refer to the following for details. Figure 3 , Figure 3This is a basic structural block diagram of the computer device in this embodiment.

[0072] The computer device includes a memory 310 and a processor 320 that are interconnected via a system bus. It should be noted that only a computer device with memory 310 and processor 320 is shown in the figure; however, it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented alternatively. Those skilled in the art will understand that the computer device described herein is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0073] Computer devices can include desktop computers, laptops, handheld computers, and cloud servers. These devices allow for human-computer interaction with users through keyboards, mice, remote controls, touchpads, or voice-activated devices.

[0074] The memory 310 includes at least one type of readable storage medium, including non-volatile memory or volatile memory, such as flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. RAM may include static RAM or dynamic RAM. In some embodiments, the memory 310 may be an internal storage unit of a computer device, such as the hard disk or memory of the computer device. In other embodiments, the memory 310 may also be an external storage device of the computer device, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, or flash card equipped on the computer device. Of course, the memory 310 may include both internal storage units and external storage devices of the computer device. In this embodiment, the memory 310 is typically used to store the operating system and various application software installed on the computer device, such as the program code of the method described above. In addition, the memory 310 can also be used to temporarily store various types of data that have been output or will be output.

[0075] Processor 320 is typically used to perform overall operations of a computer device. In this embodiment, memory 310 is used to store program code or instructions, including computer operation instructions, and processor 320 is used to execute the program code or instructions stored in memory 310 or process data, such as program code that runs the methods described above.

[0076] In this article, the bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus system can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0077] Another embodiment of this application also provides a computer-readable medium, which may be a computer-readable signal medium or a computer-readable medium. A processor in a computer reads computer-readable program code stored in the computer-readable medium, enabling the processor to execute the functional actions specified in each step or combination of steps in the above method; and to generate means for implementing the functional actions specified in each block or combination of blocks in the block diagram.

[0078] Computer-readable media include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared memory or semiconductor systems, devices or apparatuses, or any suitable combination thereof, wherein the memory is used to store program code or instructions, the program code including computer operation instructions, and the processor is used to execute the program code or instructions of the above-described methods stored in the memory.

[0079] The definitions of memory and processor can be found in the description of the foregoing computer device embodiments, and will not be repeated here.

[0080] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0081] In the various embodiments of this application, the functional units or modules can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0082] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0083] In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" as described in this application does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. This application can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims listing several means, several units of these means may be embodied by the same item of hardware. The use of "first," "second," and "third," etc., does not indicate any order and these words should be interpreted as names. Unless otherwise specified, the steps in the above embodiments should not be construed as limiting the order of execution.

[0084] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A security detection method for intranet traffic, characterized in that, include: Deploy traffic acquisition probes in the core nodes of the intranet and forward the traffic data collected by the traffic acquisition probes to the mirror port in the core nodes of the intranet, so as to monitor the traffic of the core nodes of the intranet through the mirror port in the core nodes of the intranet; The interactive traffic packets corresponding to the internal network core node are obtained through the mirror port in the internal network core node; the interactive traffic packets are then reassembled into a complete network session stream. The network session stream is deeply parsed to obtain unstructured data containing protocol-specific fields; and the unstructured data is then subjected to structuring and semantic feature transformation to obtain structured feature data. A first feature dimension extraction strategy is used to extract network flow features from the structured feature data; a second feature dimension extraction strategy is used to extract application layer semantic features from the structured feature data; and a third feature dimension extraction strategy is used to extract entity behavior sequence features from the structured feature data. Anomaly detection is performed on the network flow features, application layer semantic features, and entity behavior sequence features using a pre-trained unsupervised anomaly detection model to obtain anomaly representation scores for intranet interaction behavior. The anomaly representation score of the intranet interaction behavior is used to determine whether the intranet interaction behavior is an abnormal event. If the intranet interaction behavior is determined to be an abnormal event, the interaction association information corresponding to the intranet interaction behavior is obtained from the preset threat intelligence center. Based on the interaction association information corresponding to the intranet interaction behavior, context enhancement analysis is performed on the intranet interaction behavior to obtain context enhancement analysis data. Adjust the anomaly representation score of the intranet interaction behavior based on the context-enhanced analysis data; The intranet traffic detection result is determined based on the abnormal characterization score of the intranet interaction behavior.

2. The method according to claim 1, characterized in that, The step of extracting network flow features from the structured feature data using the first feature dimension extraction strategy includes: Obtain network flow extraction metrics, and extract network flow features from the structured feature data according to the network flow extraction metrics; the network flow features include: session duration, number of bytes transmitted, number of packets, average packet size, traffic rate, and TCP flag combination.

3. The method according to claim 1, characterized in that, The second feature dimension extraction strategy is used to extract application-layer semantic features from the structured feature data, including: Semantic information from application layer protocols is extracted from the structured feature data; and the semantic information from the application layer protocols is encoded to obtain the application layer semantic features; the application layer protocols include: Hypertext Transfer Protocol, Domain Name System Protocol, and Transport Layer Security Protocol.

4. The method according to claim 1, characterized in that, The method of extracting entity behavior sequence features from the structured feature data using a third feature dimension extraction strategy includes: Using intranet entities as units, construct corresponding behavioral baselines; and extract entity behavioral sequence features from the behavioral baselines corresponding to the intranet entities according to a preset time window; the entity behavioral sequence features include: communication peer set, accessed service port set, executed operation sequence, and activity time pattern.

5. The method according to claim 1, characterized in that, The interaction-related information corresponding to the intranet interaction behavior includes: IP reputation database, malicious domain name database, malicious file hash value and vulnerability association information; The step of performing context-enhanced analysis on the intranet interaction behavior based on the interaction association information corresponding to the intranet interaction behavior to obtain context-enhanced analysis data includes: If the IP reputation corresponding to the intranet interaction behavior does not match the IP reputation database, then the context enhancement analysis data is determined to be used to describe improving the anomaly representation score of the intranet interaction behavior; if the IP reputation corresponding to the intranet interaction behavior matches the IP reputation database, then the context enhancement analysis data is determined to be used to describe reducing the anomaly representation score of the intranet interaction behavior. If the domain name corresponding to the intranet interaction behavior matches the malicious domain name database, then the context enhancement analysis data is determined to be used to describe and improve the anomaly representation score of the intranet interaction behavior; if the domain name corresponding to the intranet interaction behavior does not match the malicious domain name database, then the context enhancement analysis data is determined to be used to describe and reduce the anomaly representation score of the intranet interaction behavior. If the hash value corresponding to the intranet interaction behavior matches the hash value of the malicious file, then the context enhancement analysis data is determined to be used to describe and improve the anomaly representation score of the intranet interaction behavior; if the hash value corresponding to the intranet interaction behavior does not match the hash value of the malicious file, then the context enhancement analysis data is determined to be used to describe and reduce the anomaly representation score of the intranet interaction behavior. If the communication peer IP of the intranet interaction behavior corresponds to vulnerability association information, then the context enhancement analysis data is determined to be used to describe and improve the anomaly representation score of the intranet interaction behavior; if the communication peer IP of the intranet interaction behavior does not correspond to vulnerability association information, then the context enhancement analysis data is determined to be used to describe and reduce the anomaly representation score of the intranet interaction behavior.

6. The method according to claim 1, characterized in that, Also includes: Multiple related abnormal events originating from the same source entity or pointing to the same destination within a preset time period are aggregated into a single security event alert. Statistics on the attack chain context corresponding to the security event alerts; The system also visualizes the security event alerts and the corresponding attack chain context.

7. The method according to claim 6, characterized in that, Also includes: If the intranet traffic detection results are used to describe the existence of security risks in the intranet traffic, then obtain the baseline change map of the behavior of the affected entities; And statistically analyze the network activity sequence diagram of the affected entities before and after the alarm; Based on the behavioral baseline change graph of the affected entity and the network activity sequence graph of the affected entity before and after the alarm, an internal network traffic security risk level is generated. The internal network traffic security risk level is then pushed to the risk management center.

8. A security detection device for intranet traffic, characterized in that, include: The deployment module is used to deploy traffic acquisition probes in the core nodes of the intranet and forward the traffic data collected by the traffic acquisition probes to the mirror port in the core nodes of the intranet, so as to monitor the traffic of the core nodes of the intranet through the mirror port in the core nodes of the intranet. The conversion module is used to obtain the interactive traffic packets corresponding to the internal network core node through the mirror port in the internal network core node; and reassemble the interactive traffic packets into a complete network session stream. The network session stream is deeply parsed to obtain unstructured data containing protocol-specific fields; and the unstructured data is then subjected to structuring and semantic feature transformation to obtain structured feature data. The extraction module is used to extract network flow features from the structured feature data using a first feature dimension extraction strategy; extract application layer semantic features from the structured feature data using a second feature dimension extraction strategy; and extract entity behavior sequence features from the structured feature data using a third feature dimension extraction strategy. The detection module is used to perform anomaly detection on the network flow features, the application layer semantic features and the entity behavior sequence features based on a pre-trained unsupervised anomaly detection model, and obtain anomaly representation scores for intranet interaction behavior. The determination module is used to determine whether the intranet interaction behavior belongs to an abnormal event based on the abnormal representation score of the intranet interaction behavior. If it is determined that the intranet interaction behavior belongs to an abnormal event, the interaction association information corresponding to the intranet interaction behavior is obtained from the preset threat intelligence center. The analysis module is used to perform context-enhanced analysis on the intranet interaction behavior based on the interaction association information corresponding to the intranet interaction behavior, and obtain context-enhanced analysis data. A determination module is used to adjust the anomaly representation score of the intranet interaction behavior based on the context enhancement analysis data; The intranet traffic detection result is determined based on the abnormal characterization score of the intranet interaction behavior.

9. A computer device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the security detection method for intranet traffic as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the security detection method for intranet traffic as described in any one of claims 1 to 7.

Images