Covert channel detection method, device, computer program product, and computer readable storage medium

Abstract

The application provides a steganographic channel detection method, device, computer program product and computer readable storage medium; the method comprises the following steps: extracting protocol layer features and virtualization layer resource scheduling features from an Internet Protocol version 6 (IPv6) network flow, the IPv6 network flow being obtained from a virtualized mobile device; performing fusion processing on the protocol layer features and the resource scheduling features by using a dynamic time warping algorithm and a bilinear interpolation method to obtain cross-layer joint features, the cross-layer joint features containing space-time correlation information of the virtualization layer and the protocol layer; detecting the cross-layer joint features by using a target detection network to obtain a detection result, the target detection network comprising a first layer classifier and a second layer classifier; the first layer classifier is used for distinguishing normal flow from steganographic channel flow, and the second layer classifier is used for steganographic field positioning of the steganographic channel flow; and determining a threat level of the IPv6 network flow based on the detection result.

Description

Technical Field

[0001] This application relates to wireless communication technology, and more particularly to a covert channel detection method, device, computer program product, and computer-readable storage medium. Background Technology

[0002] Currently, detection techniques for IPv6 covert channels mainly rely on statistical analysis of protocol fields or traditional machine learning methods. Specifically, they establish a baseline for normal traffic by extracting statistical indicators such as entropy and variance from fields like TC and FL in the IPv6 header, or use models like random forests to classify field values ​​and shallow features. However, these methods still face multi-dimensional adaptability challenges: the lack of cross-layer correlation awareness between virtualization layer resource scheduling and protocol layer field changes makes it difficult to detect coordinated attacks where attackers use virtualization layer behavior to drive protocol field jumps, resulting in low detection accuracy. Summary of the Invention

[0003] This application provides a covert channel detection method, device, computer program product, and computer-readable storage medium, which can not only accurately detect covert channels driven by virtualization layer behavior, but also improve the detection accuracy of complex attack patterns.

[0004] The technical solution of this application embodiment is implemented as follows: This application provides a method for detecting covert channels, the method comprising: Extract protocol layer features and virtualization layer resource scheduling features from IPv6 network traffic; where IPv6 network traffic is obtained from virtualized mobile devices; The protocol layer features and resource scheduling features are fused using a dynamic time warping algorithm and bilinear interpolation to obtain cross-layer joint features; wherein, the cross-layer joint features include spatiotemporal correlation information between the virtualization layer and the protocol layer; The target detection network is used to detect the cross-layer joint features to obtain the detection results; wherein, the target detection network includes a first-layer classifier and a second-layer classifier; the first-layer classifier is used to distinguish between normal traffic and covert channel traffic, and the second-layer classifier is used to locate the covert field of the covert channel traffic; Based on the detection results, the threat level of the IPv6 network traffic is determined.

[0005] In the above scheme, the process of fusing the protocol layer features and the resource scheduling features using dynamic time warping and bilinear interpolation to obtain cross-layer joint features includes: The protocol layer features and the resource scheduling features are time-domain aligned using a dynamic time warping algorithm to obtain aligned resource scheduling features. For protocol layer feature points that are not precisely matched by the protocol layer features, a bilinear interpolation algorithm is used to reconstruct the protocol layer feature points to obtain the reconstructed protocol layer features. An encoder is used to fuse the aligned resource scheduling features and the reconstructed protocol layer features to obtain the cross-layer joint features; wherein the encoder is a two-layer multilayer perceptron.

[0006] In the above scheme, the step of using a dynamic time warping algorithm to align the protocol layer features and the resource scheduling features in the time domain to obtain aligned features includes: A protocol layer field sequence is constructed based on the protocol layer features, and a virtualization layer event sequence is constructed based on the resource scheduling features; wherein, the protocol layer field sequence includes the packet arrival timestamp and field vector corresponding to the target field in the IPv6 header; the virtualization layer event sequence includes the event timestamp and feature vector corresponding to the virtualization layer resource scheduling index; Using the time axis corresponding to the virtualization layer event sequence as a reference, the dynamic time warping algorithm is used to determine the optimal mapping path that minimizes the cumulative distance between the protocol layer field sequence and the virtualization layer event sequence; Based on the optimal mapping path, each field vector in the protocol layer field sequence is mapped to the time axis of the virtualization layer event sequence, and the aligned resource scheduling features are output.

[0007] In the above scheme, the step of using bilinear interpolation to reconstruct the protocol layer feature points to obtain reconstructed protocol layer features includes: Determine the target time point corresponding to the feature point of the protocol layer; In the virtualization layer event sequence, target feature vectors located before and after the target time point are selected as interpolation neighborhoods; Based on the feature scale parameter, the target feature vector, the target field vector corresponding to the protocol layer feature point, and the time difference between the target time point and the time point corresponding to the target feature vector, the reconstructed protocol layer feature corresponding to the target time point is calculated using the bilinear interpolation algorithm.

[0008] In the above scheme, the step of using a target detection network to detect the cross-layer joint features and obtaining the detection result includes: The first-layer classifier uses a first activation function to classify the cross-layer joint features, resulting in a classification result. The classification result indicates whether the current network traffic is normal traffic or covert channel traffic. The first activation function maps the classification result to a target interval. If the classification result is the covert channel traffic, the location of the covert field is obtained based on the second-layer classifier, the second activation function, and the cross-layer joint features; wherein, the second activation function is used to convert the classification result into a multi-class probability distribution; the detection result includes the location of the covert field.

[0009] In the above scheme, obtaining the hidden field location based on the second-layer classifier, the second activation function, and the cross-layer joint features includes: The cross-layer joint features are processed using a characteristic distillation layer to obtain the processed features; The hidden field location is obtained by processing the processed features using the second classifier and the second activation function.

[0010] In the above scheme, the step of using a feature distillation layer to compress the cross-layer joint features to obtain compressed features includes: The cross-layer joint features are reduced in dimensionality using the feature distillation layer to obtain compressed features. The compressed features are subjected to feature filtering to obtain the processed features; wherein the processed features are discriminative features that retain the location of the hidden field.

[0011] This application provides a covert channel detection device, the device comprising: The feature extraction unit is used to extract protocol layer features and virtualization layer resource scheduling features from Internet Protocol version 6 (IPv6) network traffic; wherein the IPv6 network traffic is obtained from virtualized mobile devices. The fusion unit is used to fuse the protocol layer features and the resource scheduling features using a dynamic time warping algorithm and a bilinear interpolation method to obtain cross-layer joint features; wherein, the cross-layer joint features include spatiotemporal correlation information between the virtualization layer and the protocol layer; The detection unit is used to detect the cross-layer joint features using a target detection network to obtain a detection result; wherein, the target detection network includes a first-layer classifier and a second-layer classifier; the first-layer classifier is used to distinguish between normal traffic and covert channel traffic, and the second-layer classifier is used to locate the covert field of the covert channel traffic. The processing unit is used to determine the threat level of the IPv6 network traffic based on the detection results.

[0012] This application provides a covert channel detection device, the device comprising: Memory is used to store executable instructions or computer programs. The processor, when executing computer-executable instructions or computer programs stored in the memory, implements the method provided in the embodiments of this application.

[0013] This application provides a computer program product, including a computer program or computer executable instructions, which, when executed by a processor, implement the method provided in this application.

[0014] This application provides a computer-readable storage medium storing a computer program or computer-executable instructions for implementing the method provided in this application when executed by a processor.

[0015] The embodiments of this application have the following beneficial effects: by extracting protocol layer features and virtualization layer resource scheduling features from virtualized mobile devices, and using dynamic time warping algorithm and bilinear interpolation algorithm for cross-layer fusion processing, a cross-layer joint feature containing spatiotemporal correlation information of virtualization layer and protocol layer is constructed, which effectively solves the problem of missing cross-layer correlation perception in related technologies. At the same time, it also combines a target detection network with a first-layer classifier and a second-layer classifier. The first-layer classifier is used to quickly distinguish between normal traffic and covert channel traffic, and the second-layer classifier is used to accurately locate covert fields, thereby improving the detection accuracy of complex attack patterns. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the first process of the covert channel detection method provided in the embodiments of this application; Figure 2 This is a schematic diagram of the second process of the covert channel detection method provided in the embodiments of this application; Figure 3 This is a schematic diagram of the feature distillation layer in the covert channel detection method provided in the embodiments of this application; Figure 4 This is a schematic diagram of module interactions in the covert channel detection method provided in the embodiments of this application; Figure 5 This is a schematic diagram of the covert channel detection device provided in the embodiments of this application; Figure 6 This is a schematic diagram of the covert channel detection device provided in the embodiments of this application.

[0017] It should be noted that the terms "first" and "second" mentioned above are only used to distinguish between different options and do not represent the degree of superiority or inferiority of the options or their priority in the implementation process. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] It should be noted that in the field of network traffic security monitoring and threat identification for virtualized mobile devices (such as cloud phones) in cloud computing environments, the relevant technologies mainly revolve around the infrastructure of cloud phones and the covert communication technology of Internet Protocol version 6 (IPv6). Cloud phones achieve remote interaction through a cloud-virtualized Android system, and their network traffic relies on the IPv6 protocol to support high-throughput, low-latency communication (such as screen streaming and touch commands). Attackers often exploit the complexity of the IPv6 protocol stack to construct covert channels. For example, they may tamper with the priority bits of the Traffic Category (TC) field to store encrypted data, simulate normal traffic distribution through the Flow Label (FL) field, or even use ICMPv6 message timing intervals to evade traditional detection.

[0020] Currently, detection technologies for IPv6 covert channels primarily rely on statistical analysis of protocol fields and traditional machine learning methods. Statistical analysis of protocol fields typically involves extracting statistical indicators such as entropy and variance from key fields in the IPv6 header, such as TC, FL, and hop count limit (HL), to establish a baseline model for normal traffic. For example, the 6 priority bits of the TC field exhibit random distribution characteristics in regular communication. By calculating its entropy using a sliding window, if the entropy value is consistently below a preset threshold, it is determined that covert data encoding behavior may exist. Traditional machine learning methods (such as random forests) rely on the original field values ​​of the IPv6 header (such as TC values ​​and FL bit patterns) and shallow statistical features (such as field mean and standard deviation) to construct classification models, using supervised learning to distinguish between normal traffic and covert channel traffic. Furthermore, some technical solutions combine traffic temporal feature analysis, such as performing Fourier transforms on the packet interval time series to extract periodic patterns, or using dynamic thresholds to detect abnormal temporal features of Internet Control Message Protocol version 6 (ICMPv6) message transmission intervals. From the perspective of implementation process, existing technologies typically follow four steps: data acquisition, feature extraction, model training, and real-time detection. First, IPv6 traffic is captured and header fields are parsed. Then, single-field statistics or correlations of combined fields (such as mutual information between TC and FL) are calculated. Based on historical data, classification models are trained or statistical thresholds are set. Finally, anomaly alarms are output through real-time feature comparison.

[0021] However, related detection technologies face multi-dimensional adaptability challenges in cloud phone scenarios. The core contradiction stems from the mismatch between detection dimensions and scenario characteristics, specifically manifested in the following three aspects: 1) Lack of cross-layer correlation perception. Existing protocol field statistical analysis methods focus on isolated features of the IPv6 protocol layer (such as TC / FL field entropy values), but fail to establish a mapping model between virtualization layer resource scheduling (such as the dynamic frequency of the Virtual Central Processing Unit (vCPU) and the rendering cycle of the Graphics Processing Unit (GPU)) and protocol field changes. Attackers can exploit the cross-layer coupling between virtualization layer behavior and protocol fields to implement covert communication, for example, by driving the lower 3 bits of the TC field to jump synchronously through periodic GPU load fluctuations. Such cross-layer collaborative attacks are difficult to identify by traditional methods due to the lack of virtualization layer monitoring dimensions. 2) Defects in spatiotemporal joint modeling: Related technologies suffer from dual limitations in spatiotemporal feature extraction. Specifically, in the spatial dimension, traditional statistical methods analyze field characteristics on a single packet basis, making it difficult to capture the spatial correlation of multi-field collaborative coding (such as the combined embedding of the lower 3 bits of TC and the higher 5 bits of FL). In the temporal dimension, machine learning models ignore the temporal dependence of service traffic (such as the strict timing synchronization requirements of touch command streams), leading to the failure of temporal covert channel detection based on TC field differential sequences. 3) Edge real-time bottleneck: Existing models have poor edge adaptability. The reliance on high-order features and complex structures (such as deep neural networks) results in inference latency exceeding the real-time threshold of cloud phone services, making efficient deployment on low-power chips of Advanced RISC Machines (ARM) processors difficult.

[0022] Based on this, embodiments of this application provide a covert channel detection method, referring to... Figure 1 As shown, this method, applied to covert channel detection equipment, may specifically include the following steps: Step 101: Extract protocol layer features and virtualization layer resource scheduling features from Internet Protocol version 6 (IPv6) network traffic.

[0023] IPv6 network traffic is obtained from virtualized mobile devices.

[0024] In this embodiment, a virtualized mobile device refers to an Android system instance running on a cloud server using virtualization technology, which users can interact with remotely via the network; IPv6 network traffic refers to data packets transmitted based on the IPv6 protocol, whose headers contain fields such as Traffic Category (TC), Flow Label (FL), and Hop Limit (HL); protocol layer features are field values ​​and their timestamps extracted from IPv6 data packets by the protocol layer feature extraction unit, such as TC field values, FL bit patterns, and data packet arrival times; virtualization layer resource scheduling features are the operating status indicators of the underlying virtualization platform of the virtualized mobile device extracted from IPv6 data packets by the virtualization layer feature extraction unit, such as vCPU scheduling frequency, GPU rendering cycle, and memory access frequency. In one feasible implementation, the virtualized mobile device can be a cloud phone.

[0025] In this embodiment, by deploying traffic probes and performance monitoring probes in the mobile device virtualization platform, IPv6 network traffic is captured in real time, while non-IPv6 network traffic is dynamically filtered. The captured IPv6 network traffic is then parsed to obtain its header fields and arrival time (i.e., protocol layer characteristics) as well as the resource scheduling characteristics of the virtualization layer (such as resource scheduling logs), which record scheduling events and occurrence times of resources such as vCPUs and GPUs. It should be noted that IPv6 network traffic can be collected through a traffic acquisition module. Specifically, this module is responsible for deploying traffic probes in the mobile device virtualization platform, capturing IPv6 network traffic in real time through the network interface, saving it in .pcap format, and parsing and storing the header information and payload content of the captured IPv6 network traffic. Furthermore, this application introduces virtualization layer runtime status information in addition to obtaining protocol layer characteristic data, laying a data foundation for subsequent cross-layer collaborative attack detection and enhancing the comprehensiveness of detection.

[0026] It should be noted that by simultaneously capturing the spatial patterns of multi-field co-coding and the temporal features of traffic mutations through the protocol layer feature extraction unit and the virtualization layer feature extraction unit, complex attack patterns can be detected more accurately, effectively improving the detection rate.

[0027] Step 102: The protocol layer feature data and resource scheduling feature data are fused using the dynamic time warping algorithm and bilinear interpolation method to obtain cross-layer joint features.

[0028] Among them, the cross-layer joint feature includes the spatiotemporal correlation information of the virtualization layer and the protocol layer.

[0029] In this embodiment, the Dynamic Time Warping (DTW) algorithm is an algorithm used to measure the similarity between two time series. It can find the optimal alignment path between two series by nonlinearly scaling the time axis. The bilinear interpolation algorithm is an interpolation method that uses the weighted average of the values ​​of four known points around the target point to estimate the value of the target point. The cross-layer joint feature is a high-dimensional feature vector generated by aligning the features of the virtualization layer and the features of the protocol layer in the time dimension and fusing them. It contains the spatiotemporal correlation information of the two.

[0030] In this embodiment, the cross-layer feature fusion engine module first uses a dynamic time warping algorithm to align the protocol layer features and resource scheduling layer features in the temporal domain. Then, for fields in the protocol layer features that do not match precisely, a bilinear interpolation algorithm is used to reconstruct the features of the virtualization layer that are closest to the time point corresponding to the field in the protocol layer features that do not match precisely. After that, the features obtained from the two processes can be fused to obtain cross-layer joint features. In this way, the problem of missing cross-layer correlation perception in related technologies is effectively solved, enabling the target detection network to perceive cross-layer covert communication methods by attackers using virtualization layer behavior (such as GPU load fluctuations) to drive changes in protocol layer fields (such as TC field jumps).

[0031] Step 103: Use an object detection network to detect the joint features across layers and obtain the detection results.

[0032] The target detection network includes a first-layer classifier and a second-layer classifier; the first-layer classifier is used to distinguish between normal traffic and covert channel traffic, and the second-layer classifier is used to locate the covert field of the covert channel traffic.

[0033] In this embodiment, the target detection network is used to classify and locate cross-layer joint features. Specifically, it can be a Kolmogorov-Arnold Deep Neural Network (KADNN), which includes two classifiers: a first-layer classifier and a second-layer classifier, with the second-layer classifier being a multi-classifier. The detection result indicates whether the current IPv6 network traffic is covert channel traffic, and if so, the location of the covert field. First, the cross-layer joint features are input into the first-layer classifier of the target detection network to determine whether the current IPv6 network traffic is covert channel traffic. If the current IPv6 network traffic is determined to be covert channel traffic (i.e., abnormal traffic), the cross-layer joint features are further input into the second-layer classifier of the target detection network. The second-layer classifier accurately locates the specific fields (such as TC, FL, etc.) in the IPv6 where the covert data is embedded. In this way, the two-layer structure of the target detection network achieves refined management of detection followed by location, which improves detection efficiency and reduces false alarms for normal traffic.

[0034] It should be noted that if the IPv6 network traffic is determined to be normal traffic, no action will be taken.

[0035] Step 104: Based on the detection results, determine the threat level of IPv6 network traffic.

[0036] In this embodiment, after obtaining the detection results (i.e., confirming whether the current IPv6 network traffic is covert channel traffic, and the location of the covert field if it is covert channel traffic), the threat response module can analyze the detection results, assess the threat level of the IPv6 network traffic determined to be covert channel traffic, and take corresponding response measures according to the threat level. At the same time, the threat response module records threat events to provide data support for subsequent security analysis and strategy optimization. In this way, through precise field location, the security team can quickly understand the attack methods (such as attackers using the lower three bits of the TC field for data encoding), thereby formulating more targeted defense strategies and improving the overall security protection capability of the cloud phone system.

[0037] In one feasible implementation, if the detection results indicate that the IPv6 network traffic identified as covert channel traffic has a high-threat covert channel, an alarm can be triggered immediately through the threat response module to notify the security administrator. Different measures can be triggered according to different threat levels, such as real-time alarm notification to the security administrator, blocking related network connections, and recording threat event logs for subsequent auditing and analysis.

[0038] The covert channel detection method provided in this application extracts protocol layer features and virtualization layer resource scheduling features from virtualized mobile devices, and uses dynamic time warping and bilinear interpolation algorithms for cross-layer fusion processing to construct a cross-layer joint feature containing spatiotemporal correlation information of the virtualization layer and the protocol layer. This effectively solves the problem of missing cross-layer correlation perception in related technologies. At the same time, it also combines a target detection network with a first-layer classifier and a second-layer classifier. The first-layer classifier is used to quickly distinguish between normal traffic and covert channel traffic, and the second-layer classifier is used to accurately locate covert fields, thereby improving the detection accuracy of complex attack patterns.

[0039] Based on the foregoing embodiments, this application provides yet another method for covert channel detection, referring to... Figure 2 As shown, this method, applied to covert channel detection equipment, may specifically include the following steps: Step 201: Extract protocol layer features and virtualization layer resource scheduling features from the Internet Protocol version 6 (IPv6) network traffic obtained from virtualized mobile devices.

[0040] Step 202: Use the dynamic time warping algorithm to align the protocol layer feature data and resource scheduling feature data in the time domain to obtain the aligned resource scheduling features.

[0041] In this embodiment of the application, the aligned resource scheduling features refer to the feature sequence obtained by non-linearly aligning the resource scheduling features of the virtualization layer with the features of the protocol layer in the time dimension through the dynamic time warping algorithm; the aligned resource scheduling features can be obtained by dynamically associating the resource scheduling features of the virtualization layer (such as vCPU scheduling interval, GPU instruction cycle) with the field values ​​(such as TC, FL field values) in the protocol layer features through the dynamic time warping algorithm (DTW).

[0042] It should be noted that step 202 can be achieved through the following steps: Step 202A1: Construct a protocol layer field sequence based on protocol layer features, and construct a virtualization layer event sequence based on resource scheduling features.

[0043] The protocol layer field sequence includes the packet arrival timestamp and field vector corresponding to the target field in the IPv6 header; the virtualization layer event sequence includes the event timestamp and feature vector corresponding to the virtualization layer resource scheduling indicators.

[0044] In this embodiment of the application, each protocol layer feature is derived from the timestamp of arrival of each data packet extracted from IPv6 network traffic. ) and field vectors ( ), and dimensions ( It covers eight key fields, including Traffic Category (TC), Flow Label (FL), and Hop Limit (HL), and arranges the protocol layer features into an ordered set in chronological order, thereby constructing a protocol layer field sequence. Resource scheduling features are also extracted from IPv6 network traffic. Each resource scheduling feature includes a timestamp of each scheduling event. ) and eigenvectors ( ), where dimension ( This includes 12 dimensions such as vCPU scheduling frequency, GPU instruction cycle, and memory access frequency. Each resource scheduling feature is arranged in chronological order to form an ordered set, thus constituting a virtualization layer event sequence. It should be noted that the lengths of the protocol layer field sequence and the virtualization layer event sequence typically satisfy the following: Furthermore, the timestamp distribution is non-uniform, providing a basic data format for subsequent alignment operations. This unifies heterogeneous cross-layer data into a sequence format, enabling previously isolated network layer and virtualization layer information to be compared and correlated within the same framework, laying the foundation for resolving the asynchronous timestamp issue.

[0045] Step 202A2: Using the time axis corresponding to the virtualization layer event sequence as a reference, the dynamic time warping algorithm is used to determine the optimal mapping path that minimizes the cumulative distance between the protocol layer field sequence and the virtualization layer event sequence.

[0046] In this embodiment, the Dynamic Time Warping (DTW) algorithm is an algorithm used to measure the similarity between two time series. It allows the time axis to be non-linearly stretched and found the optimal mapping path to minimize the cumulative distance between the series. The optimal mapping path refers to the path that satisfies monotonicity and boundary constraints so that the cumulative distance is minimized, thereby determining the best matching relationship between the elements in the two series.

[0047] In this embodiment, the DTW algorithm is used to find the optimal matching relationship between the protocol layer field sequence and the virtualization layer event sequence. Specifically, a mapping path is defined as path={(i,j)}, where i and j represent the indices of the virtualization layer event and the protocol layer field in their respective sequences. Optimal mapping path: , where path ( It must satisfy strict monotonicity and boundary constraints, with a penalty coefficient ( It was determined through a grid search. This represents the mean of the sample feature vectors of the virtualization layer. This represents the mean of the sample feature vectors of the protocol layer. It should be noted that this formula allows for the soft alignment of protocol layer fields to the virtualization event timeline, ultimately outputting a set of mapped points. ,in The nearest neighbor field index represents the DTW association; this solves the asynchronous timestamp problem between the two types of data caused by different collection sources. By introducing a time difference penalty, DTW can allow a certain time offset while considering feature similarity, thereby more accurately capturing the potential causal relationship between virtualization layer events and protocol layer fields, providing accurate temporal correlations for subsequent fusion.

[0048] Step 202A3: Based on the optimal mapping path, map each field vector in the protocol layer field sequence to the time axis of the virtualization layer event sequence, and output the aligned resource scheduling features.

[0049] In this embodiment of the application, based on the optimal mapping path obtained in the previous step, each field vector in the protocol layer field sequence is mapped to the time axis of the virtualization layer event sequence. Specifically, for each virtualization layer event time point ( Find the associated protocol layer field index from the optimal mapping path. Thus, the set of mapping points is obtained. Its timeline is completely consistent with the virtualization layer event sequence, but the features at each time point are field vectors from the protocol layer. In this way, the features of the virtualization layer event sequence and the aligned protocol layer features are synchronized in time, providing aligned input for subsequent bilinear interpolation and feature fusion. Thus, by outputting time-aligned protocol layer features, subsequent bilinear interpolation can be accurately reconstructed based on a unified timeline, avoiding feature misalignment issues caused by directly using the original asynchronous data. The aligned features retain protocol layer field information and establish a temporal correspondence with virtualization layer events, laying the foundation for constructing cross-layer joint features.

[0050] Step 203: For protocol layer feature points that are not precisely matched, the bilinear interpolation algorithm is used to reconstruct the protocol layer feature points to obtain the reconstructed protocol layer features.

[0051] In this embodiment, a protocol layer feature point refers to a sample point in the protocol layer field sequence, including the arrival timestamp of the data packet and its corresponding 8-dimensional field vector (such as TC, FL, etc. field values); a protocol layer feature point that is not precisely matched refers to a protocol layer feature point that, after alignment by the Dynamic Time Warping (DTW) algorithm, is not directly mapped to the event timeline of the virtualization layer; reconstructing protocol layer features ( The feature sequence is obtained by numerical reconstruction based on the nearest matched protocol layer feature points before and after these mismatched protocol layer feature points using the bilinear interpolation algorithm. It should be noted that step 203 can be achieved through the following steps: Step 203B1: Determine the target time point corresponding to the feature point of the protocol layer.

[0052] In the embodiments of this application, the target time point ( The time reference for interpolation reconstruction is usually the original timestamp of the protocol layer feature point that was not precisely matched. At this time point, a protocol layer feature value aligned with the virtualization layer time axis can be estimated using interpolation methods. Specifically, all protocol layer feature points that were not precisely matched are traversed, and their timestamps are taken as the target time point for reconstruction. This time point is usually located between two adjacent virtualization layer event time points. In this way, the time reference for reconstruction is clearly defined, ensuring that the interpolation operation is performed on the correct time coordinates, providing a basis for subsequent selection of neighborhoods and calculation of weights, and avoiding time misalignment.

[0053] Step 203B2: In the virtualization layer event sequence, select the target feature vectors that are adjacent to the target time point as the interpolation neighborhood.

[0054] In this embodiment, the interpolation neighborhood refers to the set of known sample points used for interpolation calculation; a bilinear interpolation algorithm can be used to select the two nearest virtualization layer event points preceding and following the target time point as the neighborhood. In this way, by selecting the nearest points before and after as the neighborhood, we can make full use of the information of the nearest points in time, ensure the local continuity and smoothness of the interpolation results, and avoid introducing errors caused by distant points.

[0055] Step 203B3: Based on the feature scale parameter, target feature vector, target field vector corresponding to the protocol layer feature point, and time difference between the target time point and the time point corresponding to the target feature vector, the reconstructed protocol layer feature corresponding to the target time point is calculated using a bilinear interpolation algorithm.

[0056] In the embodiments of this application, the feature scale parameter ( The scale difference is used to measure the scale difference between different feature dimensions. It is usually determined by the mean of the eigenvalues ​​of the data covariance matrix. The purpose is to normalize the features of different dimensions during the interpolation process and avoid the influence of the scale. The target feature vector refers to the protocol layer field vectors corresponding to the four nearest events before and after the target time point in the virtualization layer event sequence (i.e., two points in the interpolation neighborhood). The target field vector refers to the field vector corresponding to the protocol layer feature point to be reconstructed in the protocol layer field sequence (i.e., the original value to be interpolated). The time difference is the time interval between the target time point and the time points of the four virtualization layer events before and after it.

[0057] In this embodiment, the target feature vectors corresponding to the four nearest virtualization layer events are selected, centered on the target time point. These feature vectors are then combined with the target field vector, time difference, and feature scale parameters, and a bilinear interpolation formula is used. The reconstructed protocol layer features corresponding to the target time point are calculated. This solves the problem of feature loss caused by asynchronous timestamps, ensures the continuity of protocol layer features on the time axis, provides complete input data for subsequent fusion, and improves the accuracy of cross-layer feature alignment.

[0058] Step 204: Use an encoder to fuse the aligned resource scheduling features and the reconstructed protocol layer features to obtain cross-layer joint features.

[0059] The encoder is a two-layer multilayer perceptron; the cross-layer joint features include spatiotemporal correlation information of the virtualization layer and the protocol layer.

[0060] In this embodiment, the encoder is a two-layer multilayer perceptron (MLP) used to map the concatenated feature vectors to a high-dimensional space and extract more expressive joint features. The aligned resource scheduling features can be concatenated with the reconstructed protocol layer features to form a 20-dimensional input vector, which is then input into the two-layer MLP encoder to output a 356-dimensional joint feature representation (i.e., cross-layer joint features). )(Right now ),in, Indicates encoder, This represents a 20-dimensional input vector (i.e.) This enables deep feature fusion between the virtualization layer and the protocol layer, allowing the model to detect cross-layer collaborative attacks (such as GPU load fluctuations driving TC field jumps), thus improving the comprehensiveness and accuracy of detection.

[0061] It should be noted that by constructing the aforementioned virtualization layer-protocol layer joint feature space, dynamic perception is achieved, significantly improving the ability to detect covert channels and solving the problem of weak covert channel detection capabilities caused by the lack of cross-layer correlation perception in related technologies.

[0062] Step 205: Using the first-layer classifier and the first activation function, classify the cross-layer joint features to obtain the classification result.

[0063] The classification result is used to indicate whether the current network traffic is normal traffic or covert channel traffic; the first activation function is used to map the classification result to the target interval; the target detection network includes a first-layer classifier and a second-layer classifier; the first-layer classifier is used to distinguish between normal traffic and covert channel traffic.

[0064] In this embodiment of the application, the first activation function is: The function maps a linear output to the (0,1) interval, and the output has probabilistic meaning. The joint features from multiple layers are input into the first-layer classifier, where a weighted sum is calculated and processed. Activate, outputting a value between 0 and 1, representing the probability that the current traffic is covert channel traffic, i.e. ,in, This indicates the classification result, used to determine whether the traffic is normal or potentially covert channel traffic; and These are the weights and bias parameters of the classifier; Activation functions can map the results of linear combinations to the (0, 1) interval, giving the results a probabilistic meaning; It is a 356-dimensional cross-layer spatiotemporal feature vector; it should be noted that if the probability of traffic being a covert channel exceeds a preset threshold, then the current IPv6 network traffic is determined to be covert channel traffic). In this way, rapid screening of traffic is achieved, the false alarm rate is reduced, and a screening basis is provided for subsequent location, thereby improving detection efficiency.

[0065] Step 206: If the classification result is covert channel traffic, obtain the location of the covert field based on the second-layer classifier, the second activation function, and cross-layer joint features.

[0066] The second activation function is used to convert the classification results into a multi-class probability distribution; the detection results include the location of hidden fields.

[0067] In this embodiment, the second-layer classifier is used to locate the covert field of covert channel traffic; the second activation function is... The activation function transforms the output into a multi-class probability distribution, with each class corresponding to an IPv6 field (such as TC, FL, etc.). The concealed field location refers to the position where an attacker embeds data using a specific field in the IPv6 header (such as the lower 3 bits of TC). If the first-layer classifier determines that the current IPv6 network traffic is abnormal traffic (i.e., concealed channel traffic), on the one hand, the cross-layer joint features can be directly input into the second-layer classifier, and then... The activation function outputs the probability that each field is a hidden location, and takes the field with the highest probability as the localization result. ,in, It is a multi-class classification result vector, where each element corresponds to the probability of a field position; and These are the weights and biases of the multi-class classifier; The function ensures that the output vector forms a probability distribution; on the other hand, a feature distillation layer can be used to process the joint features across layers first, and then the features can be input into the second classifier and further processed by the second activation function to determine the location of the hidden field (as shown in steps 206C1 and 206C2 below); in this way, a refined management of detection followed by localization is achieved, which can not only identify attack behavior, but also accurately locate attack methods and provide a basis for security response.

[0068] It should be noted that step 206 can be achieved in the following way: Step 206C1: Process the cross-layer joint features using a feature distillation layer to obtain the processed features.

[0069] In this embodiment, the feature distillation layer is a lightweight feature optimization module located before the second-layer classifier. Its function is to extract the most relevant discriminative information for locating hidden fields from high-dimensional cross-layer joint features through dimensionality reduction and filtering, while compressing the feature dimension to reduce the computational burden on subsequent classifiers. The processed features are low-dimensional feature vectors output after dimensionality reduction and filtering by the feature distillation layer, retaining the core information strongly correlated with the location of hidden fields. If the first-layer classifier determines that the current IPv6 network traffic is hidden channel traffic based on the cross-layer joint features, then the feature distillation layer needs to be used again to process the cross-layer joint features to obtain the processed features.

[0070] It should be noted that step 206C1 can be achieved in the following way: 206c1. Dimensionality reduction of cross-layer joint features is performed through feature distillation layer to obtain compressed features.

[0071] In this embodiment, dimensionality reduction is achieved by using linear transformations or nonlinear mappings (such as fully connected layers, principal component analysis, etc.) to map high-dimensional features to a lower-dimensional space, reducing the number of features while preserving as much of the original information's expressive power as possible. Specifically, for example... Figure 3 As shown, it can be adopted The fully connected layer performs dimensionality reduction on the 356-dimensional cross-layer joint features, compressing the 356-dimensional input to a lower dimension (such as 192 dimensions). The compressed features are the low-dimensional feature vectors obtained after dimensionality reduction, which have a dimension much smaller than the cross-layer joint features, but still contain most of the effective information.

[0072] In this embodiment, the feature distillation layer first performs dimensionality reduction on the 356-dimensional cross-layer joint features, through a trainable mapping layer (such as...). The fully connected layer compresses the feature dimension to a low-dimensional space. This process is similar to feature encoding, aiming to remove redundant information, retain the main variation patterns, and provide a more compact representation for subsequent feature selection. In this way, the feature dimension is greatly reduced through dimensionality reduction, which reduces the computation and memory usage of subsequent multi-class classifiers, thereby significantly shortening the model inference latency and meeting the real-time requirements (within 5 milliseconds) of edge nodes in virtualized mobile devices. At the same time, it avoids overfitting and improves the model's generalization ability.

[0073] 206c2. Perform feature filtering on the compressed features to obtain the processed features.

[0074] Among them, the processed features are the discriminative features that are related to the location of hidden fields.

[0075] In this embodiment, feature filtering is based on the dimensionality-reduced features (i.e., compressed features), and further selects the feature components (i.e., high-value features) that are most discriminative for locating covert fields from the compressed features through attention mechanism (SE Block) and selection strategy. Discriminative features refer to feature components that are highly correlated with whether each field of the IPv6 header (such as TC, FL, HL, etc.) is used as a covert channel, and these features can effectively distinguish the abnormal coding patterns of different fields.

[0076] In the embodiments of this application, such as Figure 3 As shown, after obtaining the processed features, since the processed features still contain mixed information from different sources (virtualization layer events, protocol layer fields), grouped parallel convolution can be used to decouple these mixed features by channel dimension. Then, parallel convolution operations are performed within each independent group to extract local correlation features within the group. After that, channel attention (SE Block) is used to weight and dynamically recalibrate the channel dimension of the features obtained from the previous layer. Then, high-value features can be selected according to the weight (i.e., feature selection), thereby outputting a filtered low-dimensional vector (e.g., 128 dimensions), whose information is highly concentrated on the key patterns required for hidden field localization. In this way, feature selection further improves the discriminativeness of the features, enabling the second-layer classifier to more accurately locate hidden fields (e.g., the lower 3 bits of TC, the upper 5 bits of FL, etc.), while eliminating the interference caused by redundant features and improving the detection accuracy.

[0077] It should be noted that by compressing the model size through the aforementioned feature distillation technique, the bottleneck problem of edge real-time performance in related technologies is solved. Furthermore, by reducing inference latency, the low-power hardware constraints of cloud phone edge nodes can be met, achieving efficient detection and localization, and making it suitable for resource-constrained edge computing environments.

[0078] Step 206C2: The hidden field location is obtained by processing the processed features through the second classifier and the second activation function.

[0079] In this embodiment, the input to the second-layer classifier is the processed features output from the feature distillation layer, and the output is the confidence score of each IPv6 field as a hidden location. The processed features are input to the second-layer classifier, which then calculates the score for each field through weighted summation. The function is normalized to a probability distribution, and the field with the highest probability is selected as the hidden field location, thereby achieving precise location from whether it is abnormal to where the abnormality is. In this way, field-level location of the hidden channel is realized, which helps security personnel quickly understand the attack method (such as the specific IPv6 field tampered with), and provides accurate basis for subsequent threat response and strategy optimization. At the same time, since the feature distillation layer has performed lightweight processing on the input, this classifier can run efficiently on resource-constrained edge devices, meeting the real-time detection needs of cloud phones.

[0080] Step 207: Based on the detection results, determine the threat level of IPv6 network traffic.

[0081] It should be noted that, Figure 4This application describes the specific detection process of covert channel traffic in IPv6 network traffic in this embodiment. The architecture for covert channel traffic detection consists of four core modules: a traffic acquisition module, a cross-layer feature fusion engine module, a target detection module, and a threat response module. These modules work closely together through data flow to form a complete automated detection loop. Specifically, firstly, the traffic acquisition module deploys traffic probes on a virtualization platform to capture IPv6 network traffic of virtualized mobile devices (such as cloud phones) in real time and saves it as a raw dataset in .pcap format. This dataset includes both normal service traffic and potential covert channel traffic, and records the arrival timestamp of each data packet to provide basic data for subsequent analysis. Next, the cross-layer feature fusion engine module receives IPv6 network traffic collected by the traffic acquisition module and parses the IPv6 network traffic using the protocol layer feature extraction unit and the virtualization layer feature extraction unit, respectively, to obtain protocol layer features (such as TC and FL field numerical sequences) and resource scheduling features from the virtualization layer (such as vCPU scheduling interval and GPU instruction cycle). Since the timestamp distribution of the two types of data sources is not uniform, the cross-layer feature fusion engine module uses a bilinear interpolation algorithm guided by the Dynamic Time Warping (DTW) algorithm to align the protocol layer features and the resource scheduling features of the virtualization layer in the temporal domain. The optimal event-field mapping path is found through DTW, and then bilinear interpolation is used to reconstruct the protocol fields that are not precisely matched. Finally, through the spatiotemporal feature fusion unit, a two-layer MLP encoder is used to map the aligned 20-dimensional spliced ​​vector (8-dimensional features of the virtualization layer and 12-dimensional features of the protocol layer) into a 356-dimensional cross-layer spatiotemporal feature vector (i.e., cross-layer joint features), realizing the deep fusion of cross-layer features. Subsequently, the target detection module takes the fused 356-dimensional feature vector as input. The first-layer classifier (binary classifier (b-KADNN)) uses a weighted sum (i.e., the first hidden layer, ReLU layer, traffic discrimination KAN layer, second hidden layer, ReLU layer, and output layer) and the Sigmoid activation function to initially classify IPv6 network traffic as normal traffic or covert traffic (i.e., covert channel traffic). If it is determined to be covert channel traffic, the feature is passed to the second layer. The second layer first passes through a feature distillation layer to compress and refine the cross-layer joint features to remove redundant information, and then inputs them into the second-layer classifier (m-KADNN). Through the field localization KAN layer, output layer, and Softmax function, the multi-class probability distribution is output, thereby accurately locating the specific IPv6 field (such as TC, FL, HL, etc.) embedded in the covert data (i.e., locating the covert field). Finally, the threat response module assesses the threat level based on the detection results and triggers corresponding response measures (such as real-time alerts to security administrators, blocking relevant network connections, and logging threat events for subsequent auditing and analysis). It can also generate threat reports to support subsequent security analysis.In summary, the various modules work closely together to form a complete detection system. The traffic acquisition module provides the data foundation for subsequent modules; the cross-layer feature fusion engine module enhances feature representation capabilities, providing more accurate input for the detection module; the target detection module uses the fused features for efficient detection and localization; and the threat response module takes action based on the detection results to ensure the safe and stable operation of the cloud phone system. The entire process, from data acquisition, feature fusion, intelligent detection to proactive response, is interconnected, achieving efficient covert channel threat perception and defense without affecting the normal operation of the cloud phone.

[0082] It should be noted that the descriptions of the same steps and contents as in other embodiments in this embodiment can be found in the descriptions in other embodiments, and will not be repeated here.

[0083] The covert channel detection method provided in this application extracts protocol layer features and virtualization layer resource scheduling features from virtualized mobile devices, and uses dynamic time warping and bilinear interpolation algorithms for cross-layer fusion processing to construct a cross-layer joint feature containing spatiotemporal correlation information of the virtualization layer and the protocol layer. This effectively solves the problem of missing cross-layer correlation perception in related technologies. At the same time, it also combines a target detection network with a first-layer classifier and a second-layer classifier. The first-layer classifier is used to quickly distinguish between normal traffic and covert channel traffic, and the second-layer classifier is used to accurately locate covert fields, thereby improving the detection accuracy of complex attack patterns.

[0084] Based on the foregoing embodiments, this application provides a covert channel detection device, which can be applied to... Figure 1 and Figure 2 In the covert channel detection method provided in the corresponding embodiment, refer to Figure 3 As shown, the covert channel detection device 3 may include: a feature extraction unit 31, a fusion unit 32, a detection unit 33, and a processing unit 34, wherein: The feature extraction unit 31 is used to extract protocol layer features and virtualization layer resource scheduling features from Internet Protocol version 6 (IPv6) network traffic; wherein, the IPv6 network traffic is obtained from virtualized mobile devices; The fusion unit 32 is used to fuse protocol layer features and resource scheduling features using dynamic time warping algorithm and bilinear interpolation method to obtain cross-layer joint features; wherein, the cross-layer joint features include spatiotemporal correlation information of virtualization layer and protocol layer; The detection unit 33 is used to detect cross-layer joint features using a target detection network to obtain detection results; wherein, the target detection network includes a first-layer classifier and a second-layer classifier; the first-layer classifier is used to distinguish between normal traffic and covert channel traffic, and the second-layer classifier is used to locate the covert field of the covert channel traffic. Processing unit 34 is used to determine the threat level of IPv6 network traffic based on the detection results.

[0085] In other embodiments of this application, the fusion unit 32 is further configured to perform the following steps: A dynamic time warping algorithm is used to align protocol layer features and resource scheduling features in the time domain to obtain aligned resource scheduling features. For protocol layer feature points where the protocol layer features are not precisely matched, a bilinear interpolation algorithm is used to reconstruct the protocol layer feature points, resulting in reconstructed protocol layer features. An encoder is used to fuse the aligned resource scheduling features and the reconstructed protocol layer features to obtain cross-layer joint features; the encoder is a two-layer multilayer perceptron.

[0086] In other embodiments of this application, the fusion unit 32 is further configured to perform the following steps: A protocol layer field sequence is constructed based on protocol layer features, and a virtualization layer event sequence is constructed based on resource scheduling features. The protocol layer field sequence includes the packet arrival timestamp and field vector corresponding to the target field in the IPv6 header; the virtualization layer event sequence includes the event timestamp and feature vector corresponding to the virtualization layer resource scheduling indicators. Based on the time axis corresponding to the virtualization layer event sequence, the dynamic time warping algorithm is used to determine the optimal mapping path that minimizes the cumulative distance between the protocol layer field sequence and the virtualization layer event sequence. Based on the optimal mapping path, each field vector in the protocol layer field sequence is mapped to the time axis of the virtualization layer event sequence, and the aligned resource scheduling features are output.

[0087] In other embodiments of this application, the fusion unit 32 is further configured to perform the following steps: Determine the target time point corresponding to the feature points of the protocol layer; In the virtualization layer event sequence, target feature vectors located before and after the target time point are selected as the interpolation neighborhood; Based on the feature scale parameter, target feature vector, target field vector corresponding to the protocol layer feature point, and time difference between the target time point and the time point corresponding to the target feature vector, the reconstructed protocol layer feature corresponding to the target time point is calculated using a bilinear interpolation algorithm.

[0088] In other embodiments of this application, the detection unit 33 is further configured to perform the following steps: The first-layer classifier uses a first activation function to classify the joint features across layers, resulting in a classification result. The classification result indicates whether the current network traffic is normal traffic or covert channel traffic. The first activation function maps the classification result to the target interval. If the classification result is covert channel traffic, the location of the covert field is obtained based on the second-layer classifier, the second activation function, and cross-layer joint features; wherein, the second activation function is used to convert the classification result into a multi-class probability distribution; the detection result includes the location of the covert field.

[0089] In other embodiments of this application, the detection unit 33 is further configured to perform the following steps: The cross-layer joint features are processed using a characteristic distillation layer to obtain the processed features; The hidden field locations are obtained by processing the processed features through a second classifier and a second activation function.

[0090] In other embodiments of this application, the detection unit 33 is further configured to perform the following steps: The dimensionality reduction of cross-layer joint features is performed by a feature distillation layer to obtain compressed features. The compressed features are filtered to obtain the processed features; among them, the processed features are the discriminative features that are related to the location of hidden fields.

[0091] It should be noted that a detailed explanation of the steps performed by each unit can be found in [reference needed]. Figure 1 and Figure 2 The covert channel detection method provided in the corresponding embodiments will not be described in detail here.

[0092] The covert channel detection device provided in this application extracts protocol layer features and virtualization layer resource scheduling features from virtualized mobile devices, and uses dynamic time warping algorithm and bilinear interpolation algorithm for cross-layer fusion processing to construct a cross-layer joint feature containing spatiotemporal correlation information of virtualization layer and protocol layer. This effectively solves the problem of missing cross-layer correlation perception in related technologies. At the same time, it is combined with a target detection network with a first-layer classifier and a second-layer classifier. The first-layer classifier is used to quickly distinguish between normal traffic and covert channel traffic, and the second-layer classifier is used to accurately locate covert fields, thereby improving the detection accuracy of complex attack patterns.

[0093] Based on the foregoing embodiments, embodiments of this application provide a covert channel detection device, which can be applied to... Figure 1 and Figure 2 In the covert channel detection method provided in the corresponding embodiment, refer to Figure 4 As shown, the covert channel detection device 4 may include: a processor 41, a memory 42, and a communication bus 43, wherein: Communication bus 43 is used to realize the communication connection between processor 41 and memory 42; Processor 41 is used to execute the covert channel detection program in memory 42 to perform the following steps: Extract protocol layer features and virtualization layer resource scheduling features from IPv6 network traffic; where IPv6 network traffic is obtained from virtualized mobile devices; The dynamic time warping algorithm and bilinear interpolation method are used to fuse protocol layer features and resource scheduling features to obtain cross-layer joint features; among them, the cross-layer joint features include spatiotemporal correlation information between the virtualization layer and the protocol layer; A target detection network is used to detect cross-layer joint features and obtain detection results. The target detection network includes a first-layer classifier and a second-layer classifier. The first-layer classifier is used to distinguish between normal traffic and covert channel traffic, and the second-layer classifier is used to locate the covert field of the covert channel traffic. Based on the detection results, the threat level of IPv6 network traffic is determined.

[0094] In other embodiments of this application, the processor 41 is used to execute the covert channel detection program in the memory 42, which uses dynamic time warping algorithm and bilinear interpolation to fuse protocol layer features and resource scheduling features to obtain cross-layer joint features, in order to achieve the following steps: A dynamic time warping algorithm is used to align protocol layer features and resource scheduling features in the time domain to obtain aligned resource scheduling features. For protocol layer feature points where the protocol layer features are not precisely matched, a bilinear interpolation algorithm is used to reconstruct the protocol layer feature points, resulting in reconstructed protocol layer features. An encoder is used to fuse the aligned resource scheduling features and the reconstructed protocol layer features to obtain cross-layer joint features; the encoder is a two-layer multilayer perceptron.

[0095] In other embodiments of this application, the processor 41 is used to execute the covert channel detection program in the memory 42 to perform time-domain alignment of protocol layer features and resource scheduling features using a dynamic time warping algorithm to obtain aligned features, thereby implementing the following steps: A protocol layer field sequence is constructed based on protocol layer features, and a virtualization layer event sequence is constructed based on resource scheduling features. The protocol layer field sequence includes the packet arrival timestamp and field vector corresponding to the target field in the IPv6 header; the virtualization layer event sequence includes the event timestamp and feature vector corresponding to the virtualization layer resource scheduling indicators. Based on the time axis corresponding to the virtualization layer event sequence, the dynamic time warping algorithm is used to determine the optimal mapping path that minimizes the cumulative distance between the protocol layer field sequence and the virtualization layer event sequence. Based on the optimal mapping path, each field vector in the protocol layer field sequence is mapped to the time axis of the virtualization layer event sequence, and the aligned resource scheduling features are output.

[0096] In other embodiments of this application, the processor 41 is used to execute the covert channel detection program in the memory 42 to reconstruct protocol layer feature points using a bilinear interpolation algorithm to obtain reconstructed protocol layer features, thereby implementing the following steps: Determine the target time point corresponding to the feature points of the protocol layer; In the virtualization layer event sequence, target feature vectors located before and after the target time point are selected as the interpolation neighborhood; Based on the feature scale parameter, target feature vector, target field vector corresponding to the protocol layer feature point, and time difference between the target time point and the time point corresponding to the target feature vector, the reconstructed protocol layer feature corresponding to the target time point is calculated using a bilinear interpolation algorithm.

[0097] In other embodiments of this application, the processor 41 is used to execute the covert channel detection program in the memory 42 to detect cross-layer joint features using a target detection network and obtain detection results, in order to implement the following steps: The first-layer classifier uses a first activation function to classify the joint features across layers, resulting in a classification result. The classification result indicates whether the current network traffic is normal traffic or covert channel traffic. The first activation function maps the classification result to the target interval. If the classification result is covert channel traffic, the location of the covert field is obtained based on the second-layer classifier, the second activation function, and cross-layer joint features; wherein, the second activation function is used to convert the classification result into a multi-class probability distribution; the detection result includes the location of the covert field.

[0098] In other embodiments of this application, processor 41 is used to execute the covert channel detection program in memory 42 based on a second-layer classifier, a second activation function, and cross-layer joint features to obtain the location of the covert field, in order to implement the following steps: The cross-layer joint features are processed using a characteristic distillation layer to obtain the processed features; The hidden field locations are obtained by processing the processed features through a second classifier and a second activation function.

[0099] In other embodiments of this application, the processor 41 is used to execute the covert channel detection program in the memory 42 to compress the cross-layer joint features using a feature distillation layer to obtain compressed features, in order to implement the following steps: The dimensionality reduction of cross-layer joint features is performed by a feature distillation layer to obtain compressed features. The compressed features are filtered to obtain the processed features; among them, the processed features are the discriminative features that are related to the location of hidden fields.

[0100] It should be noted that a detailed description of the steps performed by the processor can be found in [reference needed]. Figure 1 and Figure 2 The covert channel detection method provided in the corresponding embodiments will not be described in detail here.

[0101] The covert channel detection device provided in this application extracts protocol layer features and virtualization layer resource scheduling features from virtualized mobile devices, and uses dynamic time warping algorithm and bilinear interpolation algorithm for cross-layer fusion processing to construct a cross-layer joint feature containing spatiotemporal correlation information of virtualization layer and protocol layer. This effectively solves the problem of missing cross-layer correlation perception in related technologies. At the same time, it is combined with a target detection network with a first-layer classifier and a second-layer classifier. The first-layer classifier is used to quickly distinguish between normal traffic and covert channel traffic, and the second-layer classifier is used to accurately locate covert fields, thereby improving the detection accuracy of complex attack patterns.

[0102] Based on the foregoing embodiments, this application provides a computer program product, including a computer program, which, when executed by a processor, implements... Figure 1 and Figure 2 The corresponding embodiments provide the steps of the covert channel detection method.

[0103] Based on the foregoing embodiments, this application provides a computer-readable storage medium storing one or more programs that can be executed by one or more processors to achieve... Figure 1 and Figure 2 The corresponding embodiments provide the steps of the covert channel detection method.

[0104] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. A method for detecting covert channels, characterized in that, The method includes: Extract protocol layer features and virtualization layer resource scheduling features from IPv6 network traffic; where IPv6 network traffic is obtained from virtualized mobile devices; The protocol layer features and resource scheduling features are fused using a dynamic time warping algorithm and bilinear interpolation to obtain cross-layer joint features; wherein, the cross-layer joint features include spatiotemporal correlation information between the virtualization layer and the protocol layer; The target detection network is used to detect the cross-layer joint features to obtain the detection results; wherein, the target detection network includes a first-layer classifier and a second-layer classifier; the first-layer classifier is used to distinguish between normal traffic and covert channel traffic, and the second-layer classifier is used to locate the covert field of the covert channel traffic; Based on the detection results, the threat level of the IPv6 network traffic is determined.

2. The method according to claim 1, characterized in that, The process employs dynamic time warping and bilinear interpolation to fuse the protocol layer features and resource scheduling features, resulting in cross-layer joint features, including: The protocol layer features and the resource scheduling features are time-domain aligned using a dynamic time warping algorithm to obtain aligned resource scheduling features. For protocol layer feature points that are not precisely matched by the protocol layer features, a bilinear interpolation algorithm is used to reconstruct the protocol layer feature points to obtain the reconstructed protocol layer features. An encoder is used to fuse the aligned resource scheduling features and the reconstructed protocol layer features to obtain the cross-layer joint features; wherein the encoder is a two-layer multilayer perceptron.

3. The method according to claim 2, characterized in that, The step of using a dynamic time warping algorithm to align the protocol layer features and the resource scheduling features in the time domain to obtain aligned features includes: A protocol layer field sequence is constructed based on the protocol layer features, and a virtualization layer event sequence is constructed based on the resource scheduling features; wherein, the protocol layer field sequence includes the packet arrival timestamp and field vector corresponding to the target field in the IPv6 header; the virtualization layer event sequence includes the event timestamp and feature vector corresponding to the virtualization layer resource scheduling index; Using the time axis corresponding to the virtualization layer event sequence as a reference, the dynamic time warping algorithm is used to determine the optimal mapping path that minimizes the cumulative distance between the protocol layer field sequence and the virtualization layer event sequence; Based on the optimal mapping path, each field vector in the protocol layer field sequence is mapped to the time axis of the virtualization layer event sequence, and the aligned resource scheduling features are output.

4. The method according to claim 3, characterized in that, The process of reconstructing the protocol layer feature points using a bilinear interpolation algorithm to obtain reconstructed protocol layer features includes: Determine the target time point corresponding to the feature point of the protocol layer; In the virtualization layer event sequence, target feature vectors located before and after the target time point are selected as interpolation neighborhoods; Based on the feature scale parameter, the target feature vector, the target field vector corresponding to the protocol layer feature point, and the time difference between the target time point and the time point corresponding to the target feature vector, the reconstructed protocol layer feature corresponding to the target time point is calculated using the bilinear interpolation algorithm.

5. The method according to claim 1, characterized in that, The step of using a target detection network to detect the cross-layer joint features and obtaining detection results includes: The first-layer classifier uses a first activation function to classify the cross-layer joint features, resulting in a classification result. The classification result indicates whether the current network traffic is normal traffic or covert channel traffic. The first activation function maps the classification result to a target interval. If the classification result is the covert channel traffic, the location of the covert field is obtained based on the second-layer classifier, the second activation function, and the cross-layer joint features; wherein, the second activation function is used to convert the classification result into a multi-class probability distribution; the detection result includes the location of the covert field.

6. The method according to claim 5, characterized in that, The process of obtaining the hidden field location based on the second-layer classifier, the second activation function, and the cross-layer joint features includes: The cross-layer joint features are processed using a characteristic distillation layer to obtain the processed features; The hidden field location is obtained by processing the processed features using the second classifier and the second activation function.

7. The method according to claim 6, characterized in that, The step of compressing the cross-layer joint features using a feature distillation layer to obtain compressed features includes: The cross-layer joint features are reduced in dimensionality using the feature distillation layer to obtain compressed features. The compressed features are subjected to feature filtering to obtain the processed features; wherein the processed features are discriminative features that retain the location of the hidden field.

8. A covert channel detection device, characterized in that, The covert channel detection device includes: Memory is used to store executable instructions or computer programs. A processor, when executing computer-executable instructions or computer programs stored in the memory, implements the method according to any one of claims 1 to 7.

9. A computer program product, comprising a computer program, characterized in that, The computer program, when executed by a processor, implements the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs that can be executed by one or more processors to implement the method of any one of claims 1 to 7.

Images