An FPGA-based encrypted traffic randomness detection operator generation method and system
By establishing an operator knowledge model and setting static and dynamic regions in the FPGA, and dynamically adjusting the operator configuration parameters, the real-time and accuracy problems of encrypted traffic detection in high-speed network environments are solved, and efficient encrypted traffic detection is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- QITIAN ANXIN (TIANJIN) TECHNOLOGY CO LTD
- Filing Date
- 2026-03-11
- Publication Date
- 2026-07-14
AI Technical Summary
Existing technologies struggle to achieve line-speed detection of encrypted traffic in high-speed network environments, and their detection accuracy is low, failing to meet real-time and processing speed requirements.
By establishing an operator knowledge model in the FPGA and dynamically adjusting the operator configuration parameters, parallel detection can be achieved. Furthermore, by setting static and dynamic regions, hardware resources can be flexibly shared and efficiently reused, reducing the reconstruction time and resource overhead of the detection operators.
It enables rapid response and high-precision detection of encrypted traffic, meets real-time detection requirements, and improves detection efficiency and resource utilization.
Smart Images
Figure CN122394769A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of encrypted traffic detection technology, and in particular to a method and system for generating encrypted traffic randomness detection operators based on FPGA. Background Technology
[0002] With the widespread adoption of network encryption technology, encrypted traffic is accounting for an increasingly larger proportion of network activity. Timely and accurate identification of encrypted traffic is crucial for network security management, traffic monitoring, and anomaly behavior analysis.
[0003] Randomness detection is one of the core methods for distinguishing encrypted and unencrypted traffic. It determines whether data streams possess encryption characteristics by analyzing their statistical properties (such as entropy and frequency checks). Currently, this type of detection mainly relies on running detection algorithms on general-purpose CPUs or software platforms. However, in high-speed network environments and with massive data streams, software processing methods are limited by serial execution architectures and operating system scheduling overhead, resulting in low processing speeds, poor real-time performance, and difficulty in achieving line-speed detection, easily becoming a bottleneck for network performance. Summary of the Invention
[0004] The purpose of this application is to provide a method and system for generating encrypted traffic randomness detection operators based on FPGA to solve the above-mentioned technical problems, aiming to meet the needs of encrypted traffic detection in high-speed network environments and improve detection accuracy.
[0005] In some embodiments of this application, by establishing an operator knowledge model, the characteristic parameters of encrypted traffic are perceived in real time, thereby dynamically adjusting the operator configuration parameters in the FPGA to achieve parallel detection of different encrypted traffic, realize rapid response to real-time detection needs, and improve the detection accuracy of encrypted traffic.
[0006] In some embodiments of this application, by setting static regions and multiple dynamic regions in the FPGA, flexible sharing and efficient reuse of hardware resources can be achieved. Only loading or switching operations are needed in the dynamic regions, and they can be combined with the static regions to form a complete detection operator, reducing the reconstruction time and resource overhead of different detection operators, and realizing on-demand assembly and fast switching of hardware logic.
[0007] In some embodiments of this application, a method for generating an encrypted traffic randomness detection operator based on FPGA is provided, including: Knowledge model for generating operators based on historical traffic detection; The static region and multiple dynamic auxiliary regions of the FPGA are defined based on the operator knowledge model; Acquire the characteristic data of real-time encrypted traffic, and set the operator configuration parameters of the FPGA based on the characteristic data; Obtain detection feedback data and determine whether to correct the FPGA operator configuration parameters based on the detection feedback data.
[0008] In some embodiments of this application, the generator operator knowledge model includes: Establish an operator element library, which includes multiple operator elements; Each operator element includes an operator category and a bit stream packet; Historical detection data is aggregated, and various typical traffic patterns are generated based on the aggregation results. Establish a typical flow pattern sequence A, A=(a1, a2…a…) i …a n ), where a i Let be the i-th typical traffic pattern; n is the number of typical traffic patterns; Based on the typical flow pattern sequence A, a is set sequentially. i Typical traffic patterns for the target; Generate a first-level detection operator for the target typical flow pattern based on the operator component library; First-level detection operators for each typical traffic pattern are generated sequentially; Generate operator knowledge models; The operator knowledge model includes all first-level detection operators and a library of operator elements.
[0009] In some embodiments of this application, a first-level detection operator for generating a target typical traffic pattern includes: Establish the operator element sequence B based on the operator element library; B = (b1, b2, ..., bb) i …b m ), where b i Let be the i-th operator element; m is the number of operator elements; Based on historical detected traffic, generate detection correlation values for each operator element according to the typical traffic pattern of the target. Based on all detected correlation values, select correlation operator elements for multiple target typical flow patterns; Construct multiple initial detection operators for the target typical flow pattern based on all associated operator elements; Generate the detection efficiency values for each initial detection operator; The first-level detection operator for the target typical flow pattern is set based on all detection efficiency values.
[0010] In some embodiments of this application, a static region and multiple dynamic auxiliary regions are defined for the FPGA, including: Multiple sets of detection operators are generated based on the aggregation results of all first-level detection operators; Select the target detection operator set sequentially from the entire set of detection operators; Construct a shared operator structure for the target detection operator set; Generate auxiliary operator structures for each first-level detection operator in the target detection operator set based on the shared operator structure; Generate the common operator structure for each set of detection operators in sequence; Generate the construction evaluation value of each detection operator set, and set the number of common operator structures to be arranged based on the total construction evaluation value; The identification structure is set based on the typical flow pattern sequence A; The static region of the FPGA is defined based on the identification structure and all shared operator structures; Multiple dynamic auxiliary regions are set based on the static region, and the allocation structure is set based on all dynamic auxiliary regions; The allocation structure is arranged in the static area of the FPGA.
[0011] In some embodiments of this application, the operator configuration parameters of the FPGA are set according to feature data, including: Multiple traffic sets are generated based on real-time encrypted traffic; Establish a sequence of flow sets W, W = (w1, w2, ..., w) i …w r ), where w i Let r be the i-th type of traffic set; r is the number of traffic sets; Based on the flow set sequence W, w is set sequentially. i For the target traffic set; The identification structure sets the operation detection operator for the target traffic set based on the characteristic data of the target traffic set; The operation detection operators for each traffic set are generated sequentially; Configure the FPGA operator configuration parameters based on all running detection operators.
[0012] In some embodiments of this application, the runtime detection operator for setting the target traffic set includes: The structure is identified to generate a matching evaluation value between the target traffic set and each typical traffic pattern; Establish a sequence of matching evaluation values C, C=(c1,c2…c i …c n ), where c i denoted as the matching evaluation value between the target traffic set and the i-th typical traffic pattern; n is the number of typical traffic patterns. Find the maximum value c in the sequence of matching evaluation values C. max ; Preset matching threshold C1; If c max >C1, set c amxThe first-level detection operator for the corresponding typical traffic pattern is the operation detection operator of the target traffic set; If c max <C1, generate c amx The correction instruction for the first-level detection operator of the corresponding typical traffic pattern, and generate the operation detection operator of the target traffic set according to the correction result.
[0013] In some embodiments of the present application, the operator configuration parameters of the FPGA are set according to all the operation detection operators, including: Set the detection operator to be executed in sequence among all the operation detection operators; Obtain the real-time operation parameters of the FPGA; Judge whether to generate a construction instruction according to the real-time operation parameters and the detection operator to be executed; If no construction instruction is generated, set the operation path of the detection operator to be executed; If a first-level construction instruction is generated, select the layout area of the detection operator to be executed in all the dynamic auxiliary areas; Set the operation path of the detection operator to be executed according to the layout area; Generate the operation paths of each detection operator to be executed in sequence; Set the operator configuration parameters of the FPGA according to all the operation paths.
[0014] In some embodiments of the present application, judging whether to correct the operator configuration parameters of the FPGA includes: Set w in sequence according to the traffic set sequence W i Is the traffic set to be monitored; Obtain the detection feedback data of the traffic set to be monitored; Generate the correction evaluation value f of the traffic set to be monitored according to the detection feedback data; f = β i s i ; Among them, θ1 is the number of correction indicators; β i Is the influence factor of the i-th correction indicator; si Is the reference value of the i-th correction indicator generated according to the detection feedback data; Preset the correction evaluation value threshold F1; If f > F1, generate the operator correction instruction for the traffic set to be monitored; Judge in sequence whether to generate the operator correction instruction for each traffic set.
[0015] In some embodiments of the present application, a system for generating an encrypted traffic randomness detection operator based on FPGA is provided, including: The central control unit is used to generate operator knowledge models based on historical traffic data. The device unit is used to set the static region and multiple dynamic auxiliary regions of the FPGA according to the operator knowledge model; The central control unit includes: The sensing module is used to acquire real-time encrypted traffic; The first processing module is used to set the operator configuration parameters of the FPGA based on the characteristic data of the real-time encrypted traffic; The second processing module is used to acquire detection feedback data and determine whether to correct the FPGA operator configuration parameters based on the detection feedback data.
[0016] In some embodiments of this application, the central control unit further includes: The third processing module is used to establish an operator element library, which includes multiple operator elements; Each operator element includes an operator category and a bit stream packet; Historical detection data is aggregated, and various typical traffic patterns are generated based on the aggregation results. Establish a typical flow pattern sequence A, A=(a1, a2…a…) i …a n ), where a i Let be the i-th typical traffic pattern; n is the number of typical traffic patterns; Based on the typical flow pattern sequence A, a is set sequentially. i Typical traffic patterns for the target; Generate a first-level detection operator for the target typical flow pattern based on the operator component library; First-level detection operators for each typical traffic pattern are generated sequentially; Generate operator knowledge models; The operator knowledge model includes all first-level detection operators and a library of operator elements.
[0017] Compared with existing technologies, the FPGA-based method and system for generating randomness detection operators for encrypted traffic disclosed in this application have the following advantages: By establishing an operator knowledge model, the characteristic parameters of encrypted traffic can be perceived in real time, thereby dynamically adjusting the operator configuration parameters in the FPGA to achieve parallel detection of different encrypted traffic, enabling rapid response to real-time detection needs and improving the detection accuracy of encrypted traffic.
[0018] By setting static regions and multiple dynamic regions in the FPGA, flexible sharing and efficient reuse of hardware resources can be achieved. Only loading or switching operations are needed in the dynamic region, and it can be combined with the static region to form a complete detection operator. This reduces the reconstruction time and resource overhead of different detection operators, and enables on-demand assembly and rapid switching of hardware logic. Attached Figure Description
[0019] Figure 1 This is a flowchart illustrating a method for generating an FPGA-based encrypted traffic randomness detection operator in a preferred embodiment of this application. Detailed Implementation
[0020] The specific embodiments of this application will be described in further detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate this application, but are not intended to limit the scope of this application.
[0021] In the description of this application, it should be understood that the terms "center", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.
[0022] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.
[0023] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.
[0024] like Figure 1 As shown in the preferred embodiment of this application, a method for generating an FPGA-based encrypted traffic randomness detection operator includes: S101: Knowledge model for generating operators based on historical traffic detection; S102: Define the static region and multiple dynamic auxiliary regions of the FPGA based on the operator knowledge model; S103: Obtain the characteristic data of real-time encrypted traffic and set the operator configuration parameters of the FPGA based on the characteristic data; S104: Obtain detection feedback data and determine whether to correct the FPGA operator configuration parameters based on the detection feedback data.
[0025] Specifically, the generative operator knowledge model includes: Establish an operator element library, which includes multiple operator elements; Each operator element includes an operator category and a bit stream packet; Historical detection data is aggregated, and various typical traffic patterns are generated based on the aggregation results. Establish a typical flow pattern sequence A, A=(a1, a2…a…) i …a n ), where a i Let be the i-th typical traffic pattern; n is the number of typical traffic patterns; Based on the typical flow pattern sequence A, a is set sequentially. i Typical traffic patterns for the target; Generate a first-level detection operator for the target typical flow pattern based on the operator component library; First-level detection operators for each typical traffic pattern are generated sequentially; Generate operator knowledge models; The operator knowledge model includes all first-level detection operators and operator element libraries.
[0026] Specifically, all random detection operators in the encrypted traffic are collected (e.g., chi-square test operator, entropy calculation operator, Monte Carlo π value operator, run-length test operator, Lempel-Ziv complexity approximation operator, autocorrelation operator, cross-correlation operator, and fast Fourier transform operator). Based on the collected results, an operator element library is constructed, where each operator element represents a type of random detection operator. The corresponding bit stream packet is generated according to the type of random detection operator corresponding to each operator element (i.e., the dynamic reprogramming parameters of the hardware circuit of a specific area of the FPGA are written into the operator element).
[0027] Specifically, by building an operator component library, it is possible to assemble and quickly switch between various random detection operators on the FPGA as needed.
[0028] Specifically, various typical traffic patterns are generated based on the aggregation results of historical detection data (i.e., historical encrypted data that has been detected).
[0029] Specifically, the aggregation process of historical detection data refers to classifying all historical detection data by setting multiple traffic characteristic indicators. These traffic characteristic indicators include, but are not limited to, parameters that affect the traffic randomness detection strategy, such as: packet length sequence, packet time interval, traffic direction, traffic symmetry, metadata characteristic parameters, total number of bytes in a single flow, information entropy, and duration of a single flow.
[0030] Specifically, by quantifying various traffic characteristic indicators, the value ranges of each indicator are made to fall within the same range. Multiple value intervals for each traffic characteristic indicator are then established sequentially.
[0031] Specifically, historical detection data is filtered and aggregated using all traffic characteristic indicators, grouping historical detection data with the same characteristics into a single traffic package. Multiple traffic packages are generated based on the aggregation results, along with the historical detection volume (i.e., the total number of all historical detection traffic aggregated within each package) for each package. If the historical detection volume exceeds a preset historical detection volume threshold, the value ranges of each traffic characteristic indicator corresponding to that traffic package are obtained and combined to construct a typical traffic pattern. If the historical detection volume is less than the preset historical detection threshold, no corresponding typical traffic pattern is generated. This process is repeated to determine whether each traffic package can construct a typical traffic pattern.
[0032] Specifically, the historical detection threshold can be set based on historical parameters.
[0033] Specifically, the first-level detection operator for generating typical target traffic patterns includes: Establish the operator element sequence B based on the operator element library; B = (b1, b2, ..., bb) i …b m ), where b i Let be the i-th operator element; m is the number of operator elements; Based on historical detected traffic, generate detection correlation values for each operator element according to the typical traffic pattern of the target. Based on all detected correlation values, select correlation operator elements for multiple target typical flow patterns; Construct multiple initial detection operators for the target typical flow pattern based on all associated operator elements; Generate the detection efficiency values for each initial detection operator; The first-level detection operator for the target typical flow pattern is set based on all detection efficiency values.
[0034] Specifically, based on whether each operator element can detect the encrypted traffic corresponding to the target typical traffic pattern and generate the corresponding association value, if detection is possible, the association value is preferably set to 1; if detection is not possible, the association value is preferably set to 0. All operator elements with an association value of 1 are selected as the association operator elements of the target typical traffic pattern.
[0035] Specifically, some or all of the associated operator elements are randomly selected and combined to generate multiple initial detection operators from the prank. Among them, the number and order of associated operator elements included in any two initial detection operators are not exactly the same. (That is, some of the associated operator elements are exactly the same, but multiple initial detection operators can be constructed according to different combination orders).
[0036] Specifically, based on the traffic set packet corresponding to the target typical traffic pattern, the simulation detection results in each initial detection operator are used to generate the detection accuracy and detection efficiency of each initial detection operator. The corresponding detection efficiency value is generated based on the weighted processing result of the detection accuracy and detection efficiency. The higher the detection accuracy and detection efficiency, the larger the corresponding detection efficiency value.
[0037] Specifically, the initial detection operator corresponding to the maximum value among all detection efficiency values is set as the first-level detection operator.
[0038] It is understood that in the above embodiments, by establishing an operator knowledge model, the characteristic parameters of encrypted traffic are perceived in real time, thereby dynamically adjusting the operator configuration parameters in the FPGA, realizing parallel detection of different encrypted traffic, achieving rapid response to real-time detection needs, and improving the detection accuracy of encrypted traffic.
[0039] In a preferred embodiment of this application, a static region and multiple dynamic auxiliary regions are defined for the FPGA, including: Multiple sets of detection operators are generated based on the aggregation results of all first-level detection operators; Select the target detection operator set sequentially from the entire set of detection operators; Construct a shared operator structure for the target detection operator set; Generate auxiliary operator structures for each first-level detection operator in the target detection operator set based on the shared operator structure; Generate the common operator structure for each set of detection operators in sequence; Generate the construction evaluation value of each detection operator set, and set the number of common operator structures to be arranged based on the total construction evaluation value; The identification structure is set based on the typical flow pattern sequence A; The static region of the FPGA is defined based on the identification structure and all shared operator structures; Multiple dynamic auxiliary regions are set based on the static region, and the allocation structure is set based on all dynamic auxiliary regions; The allocation structure is located in the static area of the FPGA.
[0040] Specifically, by analyzing and aggregating the construction parameters of all first-level detection operators, multiple sets of detection operators are generated. In each set of detection operators, there are some operator elements with the same order.
[0041] Specifically, the aggregation process includes: sequentially selecting detection operators to be aggregated from all first-level detection operators; generating overlapping portions (i.e., operator elements with the same order) between the detection operator to be aggregated and each first-level detection operator; the positions of these overlapping portions in the detection operators to be aggregated and the first-level detection operators can be different (i.e., if the first three operator elements of the detection operator to be aggregated are the same in category and order as the first three operator elements of the current first-level detection operator, then this portion is an overlapping portion; if they are the same in order and category as the middle three operator elements of the current detection operator, then these three operator elements are also overlapping portions). The first-level detection operator with the longest overlapping portion (which may be one or more; if multiple, it must be ensured that the overlapping portion of each first-level detection operator and the detection operator to be aggregated is the same) is selected and aggregated with the detection operator to be aggregated, generating a detection operator set. This process is repeated for the remaining unaggregated first-level detection operators until the aggregation of all first-level detection operators is completed, and multiple detection operator sets are generated based on the aggregation results.
[0042] Specifically, the overlapping parts of each detection operator set are defined as a shared operator structure. The non-overlapping parts of each first-level detection operator are defined as the auxiliary operator structure of that first-level detection operator.
[0043] Specifically, the corresponding construction evaluation value is set according to the total historical detection volume of each detection operator set. The larger the total historical detection volume, the larger the corresponding construction evaluation value. The mapping relationship between the two can be set according to historical parameters.
[0044] Specifically, the higher the evaluation value, the more common the number of shared operator structures can be arranged, and the mapping relationship between the two can be set according to historical parameters.
[0045] Specifically, the identification structure includes identification sub-models for all typical traffic patterns.
[0046] Specifically, each shared operator structure is set into the static area according to the set number of arrangements.
[0047] Specifically, an allocation structure is constructed based on the connection paths between each dynamic auxiliary region and the static region, and parallel detection of different encrypted traffic is achieved through the allocation structure.
[0048] It can be understood that in the above embodiments, by setting static regions and multiple dynamic regions in the FPGA, flexible sharing and efficient reuse of hardware resources are achieved. Only by loading or switching operations in the dynamic regions and combining them with the static regions can a complete detection operator be formed, reducing the reconstruction time and resource overhead of different detection operators, and realizing on-demand assembly and rapid switching of hardware logic.
[0049] In the preferred embodiment of the present application, operator configuration parameters of the FPGA are set according to the feature data, including: Generating multiple traffic sets according to the real-time encrypted traffic; Establishing a traffic set sequence W, W = (w1, w2... w i …w r ), where w i is the i-th traffic set; r is the number of traffic sets; Setting w i as the target traffic set in sequence according to the traffic set sequence W; The recognition structure sets the running detection operator of the target traffic set according to the feature data of the target traffic set; Generating the running detection operators of each traffic set in sequence; Setting the operator configuration parameters of the FPGA according to all the running detection operators.
[0050] Specifically, multiple traffic sets are generated by sensing the real-time encrypted traffic, where the encrypted traffic within a single traffic set is of the same type.
[0051] Specifically, setting the running detection operator of the target traffic set includes: The recognition structure generates the fitting evaluation values of the target traffic set and each typical traffic pattern; Establishing a fitting evaluation value sequence C, C = (c1, c2... c i …c n ), where c i is the fitting evaluation value of the target traffic set and the i-th typical traffic pattern; n is the number of typical traffic patterns; Obtaining the maximum value c max in the fitting evaluation value sequence C; Presetting a fitting value threshold C1; If c max > C1, setting the primary detection operator of the typical traffic pattern corresponding to c amx as the running detection operator of the target traffic set; If c max < C1, generating a correction instruction for the primary detection operator of the typical traffic pattern corresponding to c amx , and generating the running detection operator of the target traffic set according to the correction result.
[0052] Specifically, the matching value threshold can be set based on historical parameters. When the real-time matching value is greater than the preset matching value threshold, it indicates that the traffic pattern of the target traffic set is the typical traffic pattern corresponding to the maximum value, and the first-level detection operator of this typical traffic pattern can be directly called as the running detection operator of the target traffic set.
[0053] Specifically, the first-level correction instruction refers to adjusting and optimizing the auxiliary operator structure of the currently selected first-level detection operator to construct the corresponding running detection operator, thereby better adapting to the detection requirements of encrypted traffic within the current target traffic set.
[0054] Specifically, the FPGA operator configuration parameters are set based on all running detection operators, including: Set the detection operators to be executed sequentially among all running detection operators; Obtain the real-time operating parameters of the FPGA; Determine whether to generate a build instruction based on real-time running parameters and the detection operators to be executed; If no setup instructions are generated, set the execution path for the detection operator to be executed; If a first-level construction instruction is generated, select the layout area of the detection operator to be executed in the entire dynamic auxiliary area; The execution path of the detection operator to be executed is set according to the layout area; The execution paths of each detection operator to be executed are generated sequentially; Configure the FPGA operator configuration parameters according to all running paths.
[0055] Specifically, based on real-time operating parameters, all existing first-level detection operators on the FPGA are obtained. It is then determined whether there is a first-level detection operator that is identical to the detection operator to be executed and is in an idle state. If such an operator exists, no setup instruction is generated; instead, the first-level detection operator is directly invoked to perform random detection on the traffic set corresponding to the detection operator to be executed. The running path of this first-level detection operator is then set as the running path of the detection operator to be executed.
[0056] Specifically, if no such structure exists, a common operator structure that conforms to the detection operator to be executed should be selected in the static region, and an idle dynamic auxiliary region should be selected. The bit stream packet corresponding to the auxiliary operator structure of the detection operator to be executed should be sent to the dynamic auxiliary region to build the corresponding auxiliary operator structure. The corresponding running path should be generated according to the selected common operator structure and the dynamic auxiliary region.
[0057] In a preferred embodiment of this application, determining whether to modify the FPGA operator configuration parameters includes: Based on the flow set sequence W, w is set sequentially. i The set of traffic to be monitored; Obtain detection feedback data for the traffic set to be monitored; A corrected evaluation value f is generated based on the detection feedback data for the set of traffic flows to be monitored. f=[ β i s i ]; Where θ1 is the number of correction indicators; β i The influence factor of the i-th correction index; si It is a reference value for generating the i-th correction index based on the detection feedback data; Preset correction evaluation value threshold F1; If f>F1, generate operator correction instructions for the flow set to be monitored; Check sequentially whether to generate operator correction instructions for each flow set.
[0058] Specifically, the correction evaluation value threshold can be set based on historical parameters. When the real-time correction evaluation value is greater than the preset correction evaluation value threshold, it indicates that the running detection operator corresponding to the current monitored traffic set cannot meet the detection requirements, and it is necessary to optimize and correct it in a timely manner according to the operator correction instruction, and adjust the internal operator structure.
[0059] Specifically, the correction indicators include the false alarm rate and the difference between the expected efficiency and the actual efficiency (i.e., the difference between the expected efficiency and the actual efficiency; the larger the difference, the lower the detection efficiency). The larger the false alarm rate, the larger the corresponding reference value; the larger the difference between the expected efficiency and the actual efficiency, the larger the corresponding reference value. Furthermore, through quantitative processing, the reference values of each correction indicator are made to be within the same range.
[0060] Specifically, the sum of the influence factors of the correction index is 1, and the values of each influence factor can be set according to historical parameters. In this application, 0.5 and 0.5 are preferred.
[0061] Specifically, the adjustment parameters of the internal operator structure by each operator correction instruction are recorded, thereby periodically updating the operator knowledge model.
[0062] In another preferred embodiment of the FPGA-based method for generating randomness detection operators for encrypted traffic, based on any of the above preferred embodiments, this preferred embodiment provides an FPGA-based system for generating randomness detection operators for encrypted traffic, comprising: The central control unit is used to generate operator knowledge models based on historical traffic data. The device unit is used to set the static region and multiple dynamic auxiliary regions of the FPGA according to the operator knowledge model; The central control unit includes: The sensing module is used to acquire real-time encrypted traffic; The first processing module is used to set the operator configuration parameters of the FPGA based on the characteristic data of the real-time encrypted traffic; The second processing module is used to acquire detection feedback data and determine whether to correct the FPGA operator configuration parameters based on the detection feedback data.
[0063] In a preferred embodiment of this application, the central control unit further includes: The third processing module is used to establish an operator element library, which includes multiple operator elements; Each operator element includes an operator category and a bit stream packet; Historical detection data is aggregated, and various typical traffic patterns are generated based on the aggregation results. Establish a typical flow pattern sequence A, A=(a1, a2…a…) i …a n ), where a i Let be the i-th typical traffic pattern; n is the number of typical traffic patterns; Based on the typical flow pattern sequence A, a is set sequentially. i Typical traffic patterns for the target; Generate a first-level detection operator for the target typical flow pattern based on the operator component library; First-level detection operators for each typical traffic pattern are generated sequentially; Generate operator knowledge models; The operator knowledge model includes all first-level detection operators and operator element libraries.
[0064] According to the first concept of this application, by establishing an operator knowledge model, the characteristic parameters of encrypted traffic can be perceived in real time, thereby dynamically adjusting the operator configuration parameters in the FPGA to achieve parallel detection of different encrypted traffic, realize rapid response to real-time detection needs, and improve the detection accuracy of encrypted traffic.
[0065] According to the second concept of this application, by setting a static region and multiple dynamic regions in the FPGA, flexible sharing and efficient reuse of hardware resources can be achieved. Only loading or switching operations are needed in the dynamic region, and combined with the static region to form a complete detection operator, reducing the reconstruction time and resource overhead of different detection operators, and realizing on-demand assembly and fast switching of hardware logic.
[0066] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and substitutions can be made without departing from the technical principles of this application, and these improvements and substitutions should also be considered within the scope of protection of this application.
Claims
1. A method for generating an operator for detecting randomness in encrypted traffic based on FPGA, characterized in that, include: Knowledge model for generating operators based on historical traffic detection; The static region and multiple dynamic auxiliary regions of the FPGA are defined based on the operator knowledge model; Acquire the characteristic data of real-time encrypted traffic, and set the operator configuration parameters of the FPGA based on the characteristic data; Obtain detection feedback data and determine whether to correct the FPGA operator configuration parameters based on the detection feedback data.
2. The method for generating an FPGA-based encrypted traffic randomness detection operator as described in claim 1, characterized in that, Generative operator knowledge models include: Establish an operator element library, which includes multiple operator elements; Each operator element includes an operator category and a bit stream packet; Historical detection data is aggregated, and various typical traffic patterns are generated based on the aggregation results. Establish a typical flow pattern sequence A, A=(a1, a2…a…) i …a n ), where a i Let be the i-th typical traffic pattern; n is the number of typical traffic patterns; Based on the typical flow pattern sequence A, a is set sequentially. i Typical traffic patterns for the target; Generate a first-level detection operator for the target typical flow pattern based on the operator component library; First-level detection operators for each typical traffic pattern are generated sequentially; Generate operator knowledge models; The operator knowledge model includes all first-level detection operators and a library of operator elements.
3. The method for generating an FPGA-based encrypted traffic randomness detection operator as described in claim 2, characterized in that, The first-level detection operator for generating typical target traffic patterns includes: Establish the operator element sequence B based on the operator element library; B = (b1, b2, ..., bb) i …b m ), where b i Let be the i-th operator element; m is the number of operator elements; Based on historical detected traffic, generate detection correlation values for each operator element according to the typical traffic pattern of the target. Based on all detected correlation values, select correlation operator elements for multiple target typical flow patterns; Construct multiple initial detection operators for the target typical flow pattern based on all associated operator elements; Generate the detection efficiency values for each initial detection operator; The first-level detection operator for the target typical flow pattern is set based on all detection efficiency values.
4. The method for generating an FPGA-based encrypted traffic randomness detection operator as described in claim 3, characterized in that, Define the static region and multiple dynamic auxiliary regions of the FPGA, including: Multiple sets of detection operators are generated based on the aggregation results of all first-level detection operators; Select the target detection operator set sequentially from the entire set of detection operators; Construct a shared operator structure for the target detection operator set; Generate auxiliary operator structures for each first-level detection operator in the target detection operator set based on the shared operator structure; Generate the common operator structure for each set of detection operators in sequence; Generate the construction evaluation value of each detection operator set, and set the number of common operator structures to be arranged based on the total construction evaluation value; The identification structure is set based on the typical flow pattern sequence A; The static region of the FPGA is defined based on the identification structure and all shared operator structures; Multiple dynamic auxiliary regions are set based on the static region, and the allocation structure is set based on all dynamic auxiliary regions; The allocation structure is arranged in the static area of the FPGA.
5. The method for generating an FPGA-based encrypted traffic randomness detection operator as described in claim 4, characterized in that, The FPGA operator configuration parameters are set based on the feature data, including: Multiple traffic sets are generated based on real-time encrypted traffic; Establish a sequence of flow sets W, W = (w1, w2, ..., w) i …w r ), where w i Let r be the i-th type of traffic set; r is the number of traffic sets; Based on the flow set sequence W, w is set sequentially. i For the target traffic set; The identification structure sets the operation detection operator for the target traffic set based on the characteristic data of the target traffic set; The operation detection operators for each traffic set are generated sequentially; Configure the FPGA operator configuration parameters based on all running detection operators.
6. The method for generating an FPGA-based encrypted traffic randomness detection operator as described in claim 5, characterized in that, The operation detection operator for the set target traffic set includes: The structure is identified to generate a matching evaluation value between the target traffic set and each typical traffic pattern; Establish a sequence of matching evaluation values C, C=(c1,c2…c i …c n ), where c i denoted as the matching evaluation value between the target traffic set and the i-th typical traffic pattern; n is the number of typical traffic patterns. Find the maximum value c in the sequence of matching evaluation values C. max ; Preset matching threshold C1; If c max >C1, set c amx The corresponding first-level detection operator for typical traffic patterns is the operation detection operator for the target traffic set; If c max <C1, generate c amx The correction instruction of the first-level detection operator for the corresponding typical traffic pattern, and generate the operation detection operator of the target traffic set according to the correction result.
7. The method for generating an FPGA-based encrypted traffic randomness detection operator as described in claim 6, characterized in that, Configure the FPGA operator configuration parameters based on all running detection operators, including: Set the detection operators to be executed sequentially among all running detection operators; Obtain the real-time operating parameters of the FPGA; Determine whether to generate a build instruction based on real-time running parameters and the detection operators to be executed; If no setup instructions are generated, set the execution path for the detection operator to be executed; If a first-level construction instruction is generated, select the layout area of the detection operator to be executed in the entire dynamic auxiliary area; The execution path of the detection operator to be executed is set according to the layout area; The execution paths of each detection operator to be executed are generated sequentially; Configure the FPGA operator configuration parameters according to all running paths.
8. The method for generating an FPGA-based encrypted traffic randomness detection operator as described in claim 7, characterized in that, Determine whether to modify the FPGA operator configuration parameters, including: Based on the flow set sequence W, w is set sequentially. i The set of traffic to be monitored; Obtain detection feedback data for the traffic set to be monitored; A corrected evaluation value f is generated based on the detection feedback data for the set of traffic flows to be monitored. f=[ b i s i ]; Where θ1 is the number of correction indicators; β i The influence factor of the i-th correction index; si It is a reference value for generating the i-th correction index based on the detection feedback data; Preset correction evaluation value threshold F1; If f>F1, generate operator correction instructions for the flow set to be monitored; Check sequentially whether to generate operator correction instructions for each flow set.
9. A system for generating an FPGA-based encrypted traffic randomness detection operator, employing the FPGA-based encrypted traffic randomness detection operator generation method described in any one of claims 1-8, characterized in that, include: The central control unit is used to generate operator knowledge models based on historical traffic data. The device unit is used to set the static region and multiple dynamic auxiliary regions of the FPGA according to the operator knowledge model; The central control unit includes: The sensing module is used to acquire real-time encrypted traffic; The first processing module is used to set the operator configuration parameters of the FPGA based on the characteristic data of the real-time encrypted traffic; The second processing module is used to acquire detection feedback data and determine whether to correct the FPGA operator configuration parameters based on the detection feedback data.
10. The FPGA-based encrypted traffic randomness detection operator generation system as described in claim 9, characterized in that, The central control unit also includes: The third processing module is used to establish an operator element library, which includes multiple operator elements; Each operator element includes an operator category and a bit stream packet; Historical detection data is aggregated, and various typical traffic patterns are generated based on the aggregation results. Establish a typical flow pattern sequence A, A=(a1, a2…a…) i …a n ), where a i Let be the i-th typical traffic pattern; n is the number of typical traffic patterns; Based on the typical flow pattern sequence A, a is set sequentially. i Typical traffic patterns for the target; Generate a first-level detection operator for the target typical flow pattern based on the operator component library; First-level detection operators for each typical traffic pattern are generated sequentially; Generate operator knowledge models; The operator knowledge model includes all first-level detection operators and a library of operator elements.