A method for automatic inventory and monitoring of botnet assets

Abstract

This invention relates to the field of network behavior analysis technology, specifically a method for automatically inventorying and monitoring botnet assets. The method includes the following steps: extracting traffic and analyzing the five-tuple order to generate communication trajectories; identifying abnormal communication and time differences; dividing state sequences to analyze interruption relationships and determine botnet assets; and associating abnormal ports to update asset status. In this invention, by constructing continuous interaction trajectories around communication five-tuples combined with process and interface information, and introducing time intervals and adjacency relationships to characterize communication evolution paths, it integrates time interval sequence differences and position offset consistency to identify abnormal behavior characteristics, possessing stronger dynamic correlation capabilities. Through communication state sequence division and extraction of interruption intervals and attenuation relationships to characterize state evolution, and combining with associated communication records and trajectory existence for multi-dimensional correlation verification, it enables the identification of hidden control links and intermittent communication characteristics, improving the level of abnormal asset judgment and the stability of status updates.

Description

Technical Field

[0001] This invention relates to the field of network behavior analysis technology, and in particular to a method for automatically inventorying and monitoring botnet assets. Background Technology

[0002] The field of network behavior analysis technology involves methods for data collection, parsing, association, and serialization processing of network communication processes. This process involves acquiring network connection data records from hosts and network nodes, including source IP address, source port, destination IP address, destination port, protocol type, access time, and access frequency. These records are then arranged chronologically to form time-series data. A set of access relationships is established based on the communicating parties, and statistical processing is performed on access intervals, access frequency, connection duration, and the distribution of communication objects to characterize the interaction relationships and communication behavior patterns between various assets in the network. Simultaneously, communication data is divided and categorized based on peak access times during business operation cycles and service dependencies. A traditional method for automatically inventorying and monitoring botnet assets involves identifying and recording assets that have not been maintained for a long time or whose status is unclear. This is achieved by maintaining an asset registration information table to obtain IP address, device identifier, and allocation status; combining this with periodic port scanning to obtain open port information; sending connection requests to target addresses to determine port response status; and simultaneously collecting network connection logs within a fixed time window to record access time and connection frequency. Assets are marked based on the presence of connection records, whether the access frequency is lower than a preset value, and the time interval of the last access. A list of assets is then generated through periodic scanning and log comparison.

[0003] Relying on asset registration information tables and periodic scan results combined with fixed-time window logs for status marking makes it difficult to reflect the real interaction process in scenarios where network communication exhibits intermittent changes or multi-stage control behaviors exist. This is because the recording method focuses on the number of single accesses and the time interval between the last access, lacking continuous trajectory and temporal correlation expression. For example, a situation where there is a short period of concentrated communication followed by a long period of inactivity may still be judged as normal or inactive. Furthermore, the time lag between port scanning and log comparison cycles leads to untimely status updates, resulting in insufficient identification of hidden communication relationships, decreased accuracy of asset lists, and impact on the effectiveness of subsequent monitoring and judgment. Summary of the Invention

[0004] To address the technical problems existing in the prior art, embodiments of the present invention provide a method for automatic inventory and monitoring of botnet assets; To achieve the above objectives, the present invention adopts the following technical solution: a method for automatic inventory and monitoring of botnet assets, comprising the following steps: S1: Obtain host network interface and mirror traffic records, extract the quintuple and time, process, and interface information, sort the access time and determine the interval, analyze the adjacency relationship, and obtain the asset communication interaction trajectory set; S2: Based on the asset communication interaction trajectory set, identify the communication pairs between the command control server and the intranet terminal, compare the order and position differences in continuous time intervals, locate the access concentration time interval, analyze the offset relationship and compare the consistency to obtain the abnormal communication behavior identifier set. S3: Based on the asset communication interaction trajectory set and the abnormal communication behavior identifier set, extract the most recent access records and time intervals, divide the intervals in order, and obtain the asset communication state sequence set; S4: Based on the asset communication state sequence set and the abnormal communication behavior identifier set, identify the communication pair state relationship, extract the attenuation position, interruption interval and number of times, analyze the corresponding relationship, and obtain the zombie asset judgment identifier set; S5: Based on the set of zombie asset identification identifiers, match zombie host communication with associated communication records, analyze the existence of associated communication pairs and trajectories, update the status of interrupted and abnormal asset features, and obtain a set of asset status update records.

[0005] As a further embodiment of the present invention, the asset communication interaction trajectory set includes a communication pair identifier list, time interval label, five-tuple mapping entry, positive and negative relationship marker, and trajectory segment index; the abnormal communication behavior identifier set includes an abnormal time interval label, position offset metric, sequence consistency identifier, control server association pair, and intranet terminal association pair; the asset communication state sequence set includes a continuous communication segment identifier, communication attenuation segment identifier, communication interruption segment identifier, recent access timestamp, and sequence interval division label; the zombie asset determination identifier set includes attenuation position index, interruption interval count, asset association pair group, abnormal association mapping, and zombie determination label; and the asset status update record set includes an asset status label, abnormal port association item, communication trajectory existence identifier, update version number, and disposal priority identifier.

[0006] As a further aspect of the present invention, the adjacency relationship refers to the association formed by the temporal adjacent occurrence of forward and reverse communication pairs in a time series. The access concentration time interval refers to the time segment within a continuous time range in which communication access records exceed a preset threshold.

[0007] As a further aspect of the present invention, the communication pair state relationship refers to the correlation and change relationship between the states of multiple communication pairs under the same asset in a time series; The existence of the trajectory refers to the determination result of whether the corresponding communication path of the communication pair actually exists in the asset communication interaction trajectory set.

[0008] As a further aspect of the present invention, the specific steps of S1 are as follows: S101: Obtain host network interface capture records and mirrored traffic records, extract source IP address, source port, destination IP address, destination port, protocol field, access time, process identifier, and interface identifier, sort the records in ascending order of access time, and perform difference processing on the time difference between adjacent records to obtain the access time interval sequence; S102: Based on the access time interval sequence, call the five-tuple record, match the time interval with the corresponding source IP address, destination IP address, port, and protocol field, pair them according to the source IP address and destination IP address combination rules and assign access pair identifiers to obtain the access pair identifier sequence; S103: Based on the access pair identifier sequence, perform source IP address and destination IP address position swapping on the access pair identifier to obtain the reverse access pair identifier, analyze the adjacency relationship between the access pair identifier and the reverse access pair identifier according to the access time sequence, and aggregate the communication path according to the time sequence to obtain the asset communication interaction trajectory set.

[0009] As a further aspect of the present invention, the specific steps of S2 are as follows: S201: Based on the asset communication interaction trajectory set, identify the command control server address communication pair and the intranet terminal address communication pair, divide the trajectory data according to the communication pair identifier, extract the access order of the communication pair in a continuous time interval, and obtain the communication pair time series; S202: Based on the time series of the communication pair, compare the order of the same communication pair in continuous time intervals, extract the access location index in the difference time interval, select the time interval of access records according to the density of location distribution and locate the corresponding position to obtain the location sequence of the concentrated interval. S203: Based on the centralized interval position sequence, call the current time position in the communication pair time sequence, analyze the relationship between the current time position and the centralized interval position offset and determine the position consistency, and obtain a set of abnormal communication behavior identifiers.

[0010] As a further embodiment of the present invention, in the process of identifying the command control server address communication pair and the intranet terminal address communication pair: the source address and destination address in the asset communication interaction trajectory set are extracted in pairs, and filtered according to the frequency of communication occurrence; In the process of extracting the access order of communication pairs in a continuous time interval: the time sequence of the communication pairs is divided into fixed time windows, and the pairs are sorted according to the access order within each time window.

[0011] As a further aspect of the present invention, the specific steps of S3 are as follows: S301: Based on the asset communication interaction trajectory set and the abnormal communication behavior identifier set, extract the access time points of the communication pair in a continuous time interval, select the access time point closest to the current time and determine the time interval between the current time and the time point to obtain the communication time interval sequence; S302: Based on the communication time interval sequence, call the order of the time points when the communication pairs appear in the continuous time interval, compare the order of the time of the appearance of the communication pairs, and divide the continuous occurrence interval and the intermittent occurrence interval to obtain the communication interval division sequence. S303: Based on the communication interval division sequence, assign a continuous communication state to intervals that appear consecutively, assign a communication attenuation state to intervals that appear in progressively decreasing segments, assign a communication interruption state to intervals that do not appear, and associate the states with the communication pairs in chronological order to obtain a set of asset communication state sequences.

[0012] As a further aspect of the present invention, the specific steps of S4 are as follows: S401: Based on the asset communication state sequence set and the abnormal communication behavior identifier set, identify the state of the communication pair corresponding to the same asset, classify the communication pair according to the asset identifier, extract the state change sequence of the communication pair in a continuous time interval, and obtain the communication state association sequence. S402: Based on the communication state association sequence, extract the position index of the communication attenuation state in a continuous time interval, and at the same time, retrieve the communication interruption state interval and count the number of times the interval appears, to obtain the attenuation position index sequence and the interruption interval count sequence. S403: Based on the attenuation position index sequence and the interruption interval count sequence, call the corresponding communication pair identifier in the abnormal communication behavior identifier set, analyze the correspondence between the attenuation position and the abnormal identifier position, and make a judgment in combination with the interruption interval count to obtain the zombie asset judgment identifier set.

[0013] As a further aspect of the present invention, the specific steps of S5 are as follows: S501: Based on the zombie asset identification identifier set, retrieve the communication records and abnormal communication port records corresponding to the zombie host address, match the host address and port fields, extract the communication pair and corresponding port association relationship, and obtain the port association sequence; S502: Based on the port association sequence, call the communication pair identifier in the zombie asset determination identifier set, retrieve the existence of the corresponding communication path in the asset communication interaction trajectory set, and compare the existence of the communication path item by item to obtain the trajectory existence sequence; S503: Based on the trajectory existence sequence, call the abnormal communication behavior identifier set and the communication interruption status identifier in the communication status sequence, update the communication pair status that simultaneously has interruption status and abnormal identifier, and identify it according to the asset identifier to obtain the asset status update record set.

[0014] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, a continuous interactive trajectory is constructed by combining process and interface information around the communication quintuple, and time intervals and adjacency relationships are introduced to characterize the communication evolution path. The abnormal behavior characteristics are identified by integrating the time interval sequence differences and position offset consistency, which has a stronger dynamic correlation capability. The state evolution is characterized by dividing the communication state sequence and extracting the interruption interval and attenuation relationship. Multi-dimensional correlation verification is performed by combining the existence of associated communication records and trajectories, so as to identify the hidden control link and intermittent communication characteristics, improve the level of abnormal asset judgment and the stability of state update. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a schematic diagram of the steps of the present invention; Figure 2 This is a detailed schematic diagram of S1 of the present invention; Figure 3 This is a detailed schematic diagram of S2 of the present invention; Figure 4 This is a detailed schematic diagram of S3 of the present invention; Figure 5 This is a detailed schematic diagram of S4 of the present invention; Figure 6 This is a detailed schematic diagram of S5 of the present invention. Detailed Implementation

[0017] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0018] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0019] Please see Figure 1 This invention provides a method for automatically inventorying and monitoring botnet assets, comprising the following steps: S1: Obtain host network interface capture records and mirror traffic records, extract source IP address, source port, destination IP address, destination port, protocol fields, access time, process identifier, and interface identifier, sort access times and obtain adjacent access time intervals, bind corresponding time intervals and 5-tuple records, perform pairing on source IP and destination IP and determine access pair identifiers, perform forward and reverse swaps on access pair identifiers and determine reverse access pairs, analyze the adjacency relationship between access pair identifiers and reverse access pairs in the access time series, and obtain the asset communication interaction trajectory set; S2: Based on the asset communication interaction trajectory set, identify command and control server address communication pairs and intranet terminal address communication pairs, compare the order of occurrence of the same communication pair in continuous time intervals, compare the location of communication occurrence in different time intervals, locate the time interval in the access record set and locate the corresponding location, analyze the offset relationship between the current time location and the time interval in the access record set, compare the consistency between the current occurrence location of the communication pair and the time interval location in the access record set, and obtain the abnormal communication behavior identifier set. S3: Based on the set of asset communication interaction trajectories and the set of abnormal communication behavior identifiers, extract the most recent access record of the communication pair within a continuous time interval, obtain the time interval between the current time and the most recent access record, sort the order of appearance of the communication pair within the continuous time interval, divide the time interval and the order of appearance of the communication pair into intervals, set the interval with continuous appearance as continuous communication state, set the interval with progressively decreasing appearance as communication attenuation state, and set the interval with no appearance as communication interruption state, thus obtaining the set of asset communication state sequence. S4: Based on the asset communication status sequence set and the abnormal communication behavior identifier set, identify the status of the communication pair associated with the same asset, extract the position of the communication attenuation status in a continuous time interval, identify the communication interruption status interval, analyze the correspondence between the communication attenuation status position and the abnormal communication behavior identifier set, extract the number of communication interruption status intervals, and obtain the zombie asset judgment identifier set. S5: Based on the zombie asset identification identifier set, match the zombie host address communication records and abnormal communication port records, compare the existence of asset communication interaction trajectories in the zombie asset identification identifier set, associate abnormal communication port records with communication pairs, update the asset status that simultaneously has the characteristics of communication interruption status and abnormal communication behavior identifier set, and obtain the asset status update record set.

[0020] The asset communication interaction trajectory set includes a communication pair identifier list, time interval label, five-tuple mapping entries, forward and reverse relationship markers, and trajectory segment index. The abnormal communication behavior identifier set includes abnormal time interval label, location offset metric, sequence consistency identifier, control server association pair, and intranet terminal association pair. The asset communication status sequence set includes continuous communication segment identifier, communication attenuation segment identifier, communication interruption segment identifier, most recent access timestamp, and sequence interval division label. The zombie asset determination identifier set includes attenuation location index, interruption interval count, asset association pair group, abnormal association mapping, and zombie determination label. The asset status update record set includes asset status label, abnormal port association item, communication trajectory existence identifier, update version number, and disposal priority identifier.

[0021] Please see Figure 2 The specific steps of S1 are as follows: S101: Obtain host network interface capture records and mirrored traffic records, extract source IP address, source port, destination IP address, destination port, protocol field, access time, process identifier, and interface identifier, sort the records in ascending order of access time, and perform difference processing on the time difference between adjacent records to obtain the access time interval sequence; First, through the network driver interface at the host operating system kernel level, using optical splitting or network driver interface specification technology, raw network packet data is intercepted and acquired in real time. This data directly originates from the traffic mirroring port of the core switch in the server cluster and the lightweight traffic monitoring plugin pre-installed on each host node. Its physical carrier is a standard offline capture file or real-time online streaming data. After acquiring the raw packets, deep packet inspection is performed. By unpacking the Ethernet frame header, Internet Protocol (IP) header, and transport layer header layer by layer, the source IP address, source port, destination IP address, destination port, and protocol fields of each communication record are accurately extracted. These fields together constitute the basic five-tuple for identifying network sessions. Simultaneously with data acquisition, a high-precision clock in kernel mode is invoked to mark the precise access time of each captured record to the network interface. The time precision is forcibly set to milliseconds, and the process identifier and physical or virtual network interface identifier of this network activity are synchronously generated. In the preprocessing stage, all captured records are aggregated into a high-speed cache buffer based on a circular queue. A global sorting operation is performed on the access time field of these records, using ascending order to ensure that all network records are presented in chronological order. After sorting, the access time values ​​of two adjacent communication records are retrieved sequentially. The access time of the next record is subtracted from the access time of the previous record. The result of this difference operation is the single access time interval. By performing this set operation of subtraction on all captured records, the originally discrete time point data is transformed into a sequence of access time intervals that can characterize the frequency and rhythm of communication. For example, for a controlled host, three records sent to an external server are captured within a continuous time window. Their access timestamps are 1000 milliseconds, 1050 milliseconds, and 1120 milliseconds after numerical processing. By performing difference processing on adjacent records, the first group interval is calculated to be 50 milliseconds, the second group interval is 70 milliseconds, and the access time interval sequence is obtained.

[0022] S102: Based on the access time interval sequence, call the five-tuple record, match the time interval with the corresponding source IP address, destination IP address, port, and protocol fields, pair them according to the source IP address and destination IP address combination rules and assign access pair identifiers to obtain the access pair identifier sequence; First, the access time interval sequence is invoked, and simultaneously, the corresponding five-tuple records are retrieved from the memory retrieval space. A step-by-step matching operation is performed, logically binding each access time interval to its source Internet Protocol address, destination Internet Protocol address, port, and protocol field. This ensures that each dynamic time feature can be accurately traced back to its spatial topology path. During this process, pairing is performed according to preset source and destination address combination rules. Communication behaviors with the same source and destination Internet Protocol addresses are considered interactions between the same pair of nodes. A unique access pair identifier is assigned to each specific bidirectional or unidirectional communication path. This applies to non-numeric address strings and protocol names. The process involves performing a quantitative mapping, where address and other long string fields are converted into fixed-length 64-bit integer values ​​using a secure hash algorithm or hash calculation logic. Protocol fields are mapped according to a standard protocol numbering system, such as protocol number 6 for Transmission Control Protocol and protocol number 17 for User Datagram Protocol, to achieve a unified numerical representation and improve the retrieval efficiency of subsequent comparisons. Then, these assigned access pair identifiers are rearranged according to the original chronological order of the access time interval sequence. This process transforms the originally fragmented network packets into a logical sequence with business path attributes, thus laying the data structure foundation for subsequent analysis of the correlation trajectory between assets, and finally obtaining the access pair identifier sequence.

[0023] S103: Based on the access pair identifier sequence, perform source IP address and destination IP address position swapping on the access pair identifier to obtain the reverse access pair identifier, analyze the adjacency relationship between the access pair identifier and the reverse access pair identifier according to the access time order, and aggregate the communication path according to the time sequence to obtain the asset communication interaction trajectory set. First, after obtaining the access pair identifier sequence, for each access pair identifier in the sequence, a position swap operation is performed between the source Internet Protocol address and the destination Internet Protocol address to derive the corresponding reverse access pair identifier. This operation is used to detect whether there is a symmetrical relationship between requests and responses in the network. Subsequently, based on the global access time sequence, the adjacency relationship between each access pair identifier and its adjacent or reverse access pair identifiers appearing within a preset sliding time window is analyzed in depth. By determining the temporal closeness and protocol logic consistency between the two, session pairs with interactive attributes are identified. According to the time sequence, these logically related communication records are aggregated, and communication paths belonging to the same session period, having continuous interaction characteristics, or the same business logic are merged into a complete trajectory. For example, when it is detected that identifier 1 represents an internal network host accessing a public domain name resolution server, and then within 20 milliseconds, a corresponding reverse identifier appears representing the server returning the resolution result, this process aggregates these two records into a complete domain name resolution interaction trajectory. By summarizing the full trajectories, a baseline trajectory library describing the interaction behavior between all active assets in the network is formed, resulting in a set of asset communication interaction trajectories.

[0024] Please see Figure 3 The specific steps of S2 are as follows: S201: Based on the asset communication interaction trajectory set, identify command and control server address communication pairs and intranet terminal address communication pairs, divide trajectory data according to communication pair identifiers, extract the access order of communication pairs in continuous time intervals, and obtain the communication pair time series; First, the full trajectory data is retrieved from the asset communication interaction trajectory set, and the communication object feature identification operation is performed. By comparing the destination Internet Protocol address with the preset command and control server address database, threat intelligence geolocation database, and enterprise internal asset whitelist, command and control server address communication pairs and internal network terminal address communication pairs are identified. The identification standard is based on address attribute definition. If the destination address matches the known malicious domain name blacklist or belongs to an unregistered and extremely low-reputation overseas address, it is determined to be the command and control server direction. The full trajectory data is physically isolated and classified according to the communication pair identifier. For each specific communication pair, the access sequence within a continuous time interval is extracted. For example, the access actions of a specific terminal within the continuous time interval of 2:00 AM to 4:00 AM are extracted at 1-second intervals, thereby generating a record chain containing precise timestamps and access location indexes, thus obtaining the communication pair time sequence.

[0025] S202: Based on the time series of communication pairs, compare the order of the same communication pair in continuous time intervals, extract the access location index in the difference time interval, select the time interval of access records according to the density of location distribution, and locate the corresponding position to obtain the location sequence of the concentrated interval. First, the communication pair time series is invoked, and the performance of the same communication pair in different but continuous time intervals is compared. By calculating the overlap of the same position index in different intervals, the access position index in the time intervals with differences is extracted. The position distribution density analysis is performed to calculate the access frequency value per unit time and compare it with the preset position distribution density threshold. The position distribution density threshold is set to 10 accesses per minute. The threshold is set based on the historical benchmark test of the heartbeat frequency of normal business. Experimental data shows that the median web browsing frequency of ordinary office terminals is 2.4 times per minute. Therefore, 10 times is set as the boundary for judging access concentration. According to the density of position distribution, the time interval with highly concentrated access records is selected, and its corresponding position in the time series is accurately located. For example, in a 10-minute observation period, if a communication pair has 12, 15, and 11 accesses in the 3rd, 4th, and 5th minutes respectively, since all exceed the threshold of 10 times, the position indices 3, 4, and 5 are recorded as concentrated intervals, and the concentrated interval position sequence is obtained.

[0026] S203: Based on the centralized interval position sequence, call the current time position in the communication pair time series, analyze the relationship between the current time position and the centralized interval position offset and determine the position consistency, and obtain a set of abnormal communication behavior identifiers; First, after obtaining the location sequence of the centralized interval, the current time location parameter in the communication pair time series is called in real time to analyze the offset relationship between the communication behavior occurring at the current moment and the historical centralized interval location. A position consistency judgment is performed by calculating the offset value of the current time point relative to the starting position of the centralized interval and judging whether the value falls within the preset tolerance range. This tolerance range is calculated based on the variance of the historical distribution and is set to ±2 seconds. If the offset of the current access position from the historical centralized interval is less than the tolerance value, the position is judged to be consistent, indicating that the current communication behavior has a high degree of periodic repetition characteristics, which is consistent with the typical pattern of botnet timed retrieval instructions. Based on the judgment result, an abnormal communication behavior identifier is assigned to the communication pair, and all the identified identifiers are summarized to obtain an abnormal communication behavior identifier set.

[0027] Please see Figure 4 The specific steps of S3 are as follows: S301: Based on the asset communication interaction trajectory set and the abnormal communication behavior identifier set, extract the access time points of the communication pair in a continuous time interval, select the access time point closest to the current time and determine the time interval between the current time and the time point to obtain the communication time interval sequence; First, based on the asset communication interaction trajectory set and the abnormal communication behavior identifier set, all access time points of the communication pair within a continuous time interval are extracted from the trajectory data. The historical access time point closest to the current time is selected, and the difference is calculated to determine the time interval between the current time and the closest time point. This value can reflect the real-time activity of the link. For example, if the current time is 15:00:00 and the most recent access is 14:59:58, the recorded time interval is 2 seconds. By accumulating and recording the difference within a continuous monitoring period, time series data that can quantify the changing trend of communication activity frequency is formed, resulting in a communication time interval sequence.

[0028] S302: Based on the communication time interval sequence, call the order of the time points when the communication pair appears in the continuous time interval, compare the order of the time of the appearance of the communication pair, and divide the continuous occurrence interval and the intermittent occurrence interval to obtain the communication interval division sequence. First, the order of the time points in which the communication pairs appear within a continuous time interval is called. A time-dimensional comparison operation is performed on the order of the appearance of the communication pairs. Based on the density of the time point distribution, the intervals are divided into continuous and intermittent occurrence intervals. The interval division time threshold is set to 120 seconds. This threshold is set based on the common command acquisition cycle of botnets. If the interval between two adjacent time points is less than 120 seconds, the interval in which they are located is marked as a continuous occurrence interval. If the interval is greater than or equal to 120 seconds, it is marked as an intermittent occurrence interval. This forms a distribution sequence that reflects the duty cycle characteristics of the communication flow on the time axis, resulting in the communication interval division sequence.

[0029] S303: Based on the communication interval division sequence, assign a continuous communication state to the intervals that appear consecutively, assign a communication attenuation state to the intervals that decrease in appearance segment by segment, assign a communication interruption state to the intervals that do not appear, and associate the states with the communication pairs in chronological order to obtain a set of asset communication state sequences. First, based on the communication interval division sequence, state mapping operations are performed on intervals of different natures. Communication pairs in consecutive intervals are assigned a continuous communication state, representing that the link is in a high-frequency interaction or command transmission stage. For intervals where the access frequency shows a monotonically decreasing trend and the interval gradually widens, a communication attenuation state is assigned. This usually corresponds to the command execution exit or resource release process after the controlled end completes the task. For intervals with no access records within the observation window, a communication interruption state is assigned. These state attributes are associated and mapped with the corresponding communication pair identifiers in chronological order to obtain a set of asset communication state sequences.

[0030] Please see Figure 5 The specific steps of S4 are as follows: S401: Based on the set of asset communication status sequences and the set of abnormal communication behavior identifiers, identify the status of communication pairs corresponding to the same asset, classify the communication pairs according to asset identifiers, extract the status change sequence of the communication pairs in a continuous time interval, and obtain the communication status association sequence. First, the asset communication state sequence set and the abnormal communication behavior identifier set are called. Using the asset identifier as the primary key, the states of all communication pairs belonging to the same physical asset or logical host are classified and processed. The state change trajectory of each communication pair in a continuous time interval is extracted. By performing intersection or union operations on the states of multiple communication links, it is analyzed whether there are multiple abnormal external connection points of the asset that are simultaneously in an active or decaying state. For example, when a host establishes connections with three different command and control server addresses at the same time, and all of them enter a decaying state in the same time period, this provides strong controlled evidence and provides a basis for risk assessment from single point of failure to host level, thus obtaining the communication state association sequence.

[0031] S402: Based on the communication state association sequence, extract the position index of the communication attenuation state in the continuous time interval, and at the same time, retrieve the communication interruption state interval and count the number of times the interval appears, to obtain the attenuation position index sequence and the interruption interval count sequence. First, based on the communication status association sequence, the position index values ​​of the communication attenuation status within a continuous time interval are retrieved and extracted. At the same time, the intervals in which the communication interruption status occurs are retrieved, and the statistical calculation of the number of occurrences of the intervals is performed to calculate the distribution pattern of the attenuation position on the time axis. For example, if the attenuation status occurs at the 10th, 20th, and 30th monitoring points, the index sequence is recorded as 10, 20, and 30. If there are 5 obvious communication disconnections in the entire monitoring period, the interruption frequency value is recorded as 5. This process aims to quantify the retreat and intermittent characteristics of asset communication behavior and obtain the attenuation position index sequence and the interruption interval frequency sequence.

[0032] S403: Based on the attenuation position index sequence and the interruption interval count sequence, call the corresponding communication pair identifier in the abnormal communication behavior identifier set, analyze the correspondence between the attenuation position and the abnormal identifier position, and make a judgment in combination with the interruption interval count to obtain the zombie asset judgment identifier set. First, after obtaining the attenuation position index sequence and the interruption interval count sequence, the corresponding communication pair identifiers in the abnormal communication behavior identifier set are synchronously called. The overlap and lag correspondence between the attenuation position and the abnormal behavior identifier occurrence position on the time axis are analyzed, and a comprehensive judgment is made in combination with the frequency of the interruption interval. The judgment logic operation is executed, and the attenuation consistency coefficient is set to 0.75. If the overlap ratio between the attenuation position and the abnormal identifier position is greater than 0.75, and the interruption count sequence value exceeds the preset benchmark value of 3 times, then the asset is determined to be in a zombie controlled state. For example, if the overlap ratio of an asset is 0.82 and the interruption count is 4 times, since 0.82 is greater than 0.75 and 4 is greater than 3, both parameters exceed the set benchmark. Thus, a risk judgment result is generated, and a zombie asset judgment identifier set is obtained.

[0033] Please see Figure 6 The specific steps of S5 are as follows: S501: Based on the zombie asset identification identifier set, retrieve the communication records and abnormal communication port records corresponding to the zombie host address, match the host address and port fields, extract the communication pair and corresponding port association relationship, and obtain the port association sequence; First, based on the set of zombie asset identification identifiers, the full communication history and abnormal communication port records corresponding to the zombie host address are retrieved in reverse. Field matching operations are performed to extract the correlation between the zombie host address and port number. The asymmetric port distribution characteristics used during the controlled period are analyzed. For example, it is found that when the asset is under control, it always initiates a fake handshake through port 443, and then transmits encrypted data back through high-order random ports above 49152. This port usage pattern will be stored in a structured manner so that precise blocking can be implemented at the security gateway to obtain the port association sequence.

[0034] S502: Based on the port association sequence, call the communication pair identifier in the zombie asset judgment identifier set, retrieve the existence of the corresponding communication path in the asset communication interaction trajectory set, compare the existence of the communication path item by item, and obtain the trajectory existence sequence; First, the communication pair identifiers in the zombie asset identification identifier set are called, and the real-time existence of the corresponding communication path is retrieved in the asset communication interaction trajectory set. Item-by-item comparison is performed to determine whether the expected communication trajectory actually occurs within a specific attack window. By recording the life cycle of each suspicious path, the duration from the first connection to the most recent active period is calculated to identify historical legacy threats and ongoing real-time attacks, thus obtaining the trajectory existence sequence.

[0035] S503: Based on the existence sequence of the trajectory, call the abnormal communication behavior identifier set and the communication interruption status identifier in the communication status sequence, update the communication pair status that has both interruption status and abnormal identifier, and identify it according to the asset identifier to obtain the asset status update record set. First, based on the existence sequence of the trajectory, the abnormal communication behavior identifier set and the communication interruption status identifier in the communication status sequence are called. For those communication pairs that have both interruption status and have been assigned abnormal identifiers, the status update is performed. The current real-time detection results are merged with the historical status, the asset status record is updated, and the final record is encapsulated according to the asset identifier. For example, the status of a server is updated from normal to zombie controlled interruption and lurking, and the corresponding abnormal feature index and risk score are attached to obtain the asset status update record set.

[0036] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for automatically inventorying and monitoring botnet assets, characterized in that, Includes the following steps: S1: Obtain host network interface and mirror traffic records, extract the quintuple and time, process, and interface information, sort the access time and determine the interval, analyze the adjacency relationship, and obtain the asset communication interaction trajectory set; S2: Based on the asset communication interaction trajectory set, identify the communication pairs between the command control server and the intranet terminal, compare the order and position differences in continuous time intervals, locate the access concentration time interval, analyze the offset relationship and compare the consistency to obtain the abnormal communication behavior identifier set. S3: Based on the asset communication interaction trajectory set and the abnormal communication behavior identifier set, extract the most recent access records and time intervals, divide the intervals in order, and obtain the asset communication state sequence set; S4: Based on the asset communication state sequence set and the abnormal communication behavior identifier set, identify the communication pair state relationship, extract the attenuation position, interruption interval and number of times, analyze the corresponding relationship, and obtain the zombie asset judgment identifier set; S5: Based on the set of zombie asset identification identifiers, match zombie host communication with associated communication records, analyze the existence of associated communication pairs and trajectories, update the status of interrupted and abnormal asset features, and obtain a set of asset status update records.

2. The method for automatic inventory and monitoring of botnet assets according to claim 1, characterized in that, The asset communication interaction trajectory set includes a communication pair identifier list, time interval label, five-tuple mapping entry, forward and reverse relationship marker, and trajectory segment index. The abnormal communication behavior identifier set includes abnormal time interval label, position offset metric, sequence consistency identifier, control server association pair, and intranet terminal association pair. The asset communication state sequence set includes continuous communication segment identifier, communication attenuation segment identifier, communication interruption segment identifier, most recent access timestamp, and sequence interval division label. The zombie asset determination identifier set includes attenuation position index, interruption interval count, asset association pair group, abnormal association mapping, and zombie determination label. The asset status update record set includes asset status label, abnormal port association item, communication trajectory existence identifier, update version number, and disposal priority identifier.

3. The method for automatic inventory and monitoring of botnet assets according to claim 1, characterized in that, The adjacency relationship refers to the association formed when forward and reverse communication pairs occur adjacently in time in a time series; The access concentration time interval refers to the time segment within a continuous time range in which communication access records exceed a preset threshold.

4. The method for automatic inventory and monitoring of botnet assets according to claim 1, characterized in that, The communication pair state relationship refers to the association and change relationship between the states of multiple communication pairs under the same asset in a time series; The existence of the trajectory refers to the determination result of whether the corresponding communication path of the communication pair actually exists in the asset communication interaction trajectory set.

5. The method for automatic inventory and monitoring of botnet assets according to claim 1, characterized in that, The specific steps of S1 are as follows: S101: Obtain host network interface capture records and mirrored traffic records, extract source IP address, source port, destination IP address, destination port, protocol field, access time, process identifier, and interface identifier, sort the records in ascending order of access time, and perform difference processing on the time difference between adjacent records to obtain the access time interval sequence; S102: Based on the access time interval sequence, call the five-tuple record, match the time interval with the corresponding source IP address, destination IP address, port, and protocol field, pair them according to the source IP address and destination IP address combination rules and assign access pair identifiers to obtain the access pair identifier sequence; S103: Based on the access pair identifier sequence, perform source IP address and destination IP address position swapping on the access pair identifier to obtain the reverse access pair identifier, analyze the adjacency relationship between the access pair identifier and the reverse access pair identifier according to the access time sequence, and aggregate the communication path according to the time sequence to obtain the asset communication interaction trajectory set.

6. The method for automatic inventory and monitoring of botnet assets according to claim 1, characterized in that, The specific steps of S2 are as follows: S201: Based on the asset communication interaction trajectory set, identify the command control server address communication pair and the intranet terminal address communication pair, divide the trajectory data according to the communication pair identifier, extract the access order of the communication pair in a continuous time interval, and obtain the communication pair time series; S202: Based on the time series of the communication pair, compare the order of the same communication pair in continuous time intervals, extract the access location index in the difference time interval, select the time interval of access records according to the density of location distribution and locate the corresponding position to obtain the location sequence of the concentrated interval. S203: Based on the centralized interval position sequence, call the current time position in the communication pair time sequence, analyze the relationship between the current time position and the centralized interval position offset and determine the position consistency, and obtain a set of abnormal communication behavior identifiers.

7. The method for automatic inventory and monitoring of botnet assets according to claim 6, characterized in that, During the process of identifying the command control server address communication pair and the intranet terminal address communication pair: the source address and destination address in the asset communication interaction trajectory set are extracted in pairs and filtered according to the frequency of communication occurrence; In the process of extracting the access order of communication pairs in a continuous time interval: the time sequence of the communication pairs is divided into fixed time windows, and the pairs are sorted according to the access order within each time window.

8. The method for automatic inventory and monitoring of botnet assets according to claim 1, characterized in that, The specific steps for S3 are as follows: S301: Based on the asset communication interaction trajectory set and the abnormal communication behavior identifier set, extract the access time points of the communication pair in a continuous time interval, select the access time point closest to the current time and determine the time interval between the current time and the time point to obtain the communication time interval sequence; S302: Based on the communication time interval sequence, call the order of the time points when the communication pairs appear in the continuous time interval, compare the order of the time of the appearance of the communication pairs, and divide the continuous occurrence interval and the intermittent occurrence interval to obtain the communication interval division sequence. S303: Based on the communication interval division sequence, assign a continuous communication state to intervals that appear consecutively, assign a communication attenuation state to intervals that appear in progressively decreasing segments, assign a communication interruption state to intervals that do not appear, and associate the states with the communication pairs in chronological order to obtain a set of asset communication state sequences.

9. The method for automatic inventory and monitoring of botnet assets according to claim 1, characterized in that, The specific steps of S4 are as follows: S401: Based on the asset communication state sequence set and the abnormal communication behavior identifier set, identify the state of the communication pair corresponding to the same asset, classify the communication pair according to the asset identifier, extract the state change sequence of the communication pair in a continuous time interval, and obtain the communication state association sequence. S402: Based on the communication state association sequence, extract the position index of the communication attenuation state in a continuous time interval, and at the same time, retrieve the communication interruption state interval and count the number of times the interval appears, to obtain the attenuation position index sequence and the interruption interval count sequence. S403: Based on the attenuation position index sequence and the interruption interval count sequence, call the corresponding communication pair identifier in the abnormal communication behavior identifier set, analyze the correspondence between the attenuation position and the abnormal identifier position, and make a judgment in combination with the interruption interval count to obtain the zombie asset judgment identifier set.

10. The method for automatic inventory and monitoring of botnet assets according to claim 1, characterized in that, The specific steps of S5 are as follows: S501: Based on the zombie asset identification identifier set, retrieve the communication records and abnormal communication port records corresponding to the zombie host address, match the host address and port fields, extract the communication pair and corresponding port association relationship, and obtain the port association sequence; S502: Based on the port association sequence, call the communication pair identifier in the zombie asset determination identifier set, retrieve the existence of the corresponding communication path in the asset communication interaction trajectory set, and compare the existence of the communication path item by item to obtain the trajectory existence sequence; S503: Based on the trajectory existence sequence, call the abnormal communication behavior identifier set and the communication interruption status identifier in the communication status sequence, update the communication pair status that simultaneously has interruption status and abnormal identifier, and identify it according to the asset identifier to obtain the asset status update record set.

Images