A method and device for detecting covert communication behavior

Abstract

This application provides a method and apparatus for detecting covert communication behavior, relating to the field of network security technology. On one hand, the method uses a dynamic time warping algorithm to determine the minimum cumulative distance between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension. This quantifies temporal misalignment differences, thus solving the problem of missed detection caused by the lack of temporal analysis capabilities in traditional methods. On the other hand, based on the arrival timestamp of the packet length-timestamp sequence, the method determines the differential entropy and the maximum time span of sudden events. The differential entropy can amplify the minute temporal fluctuations caused by the mechanical packet sending of tunnel traffic, while the maximum time span can identify deliberately lengthened idle periods in tunnel traffic. Combining these two methods can accurately capture gradual covert communication such as slow tunnels. Therefore, this method can improve the accuracy of detecting covert communication behavior.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and apparatus for detecting covert communication behavior. Background Technology

[0002] In the field of cybersecurity, covert communication is often used to steal personal privacy and trade secrets, posing a serious threat to network communication security. Therefore, it is necessary to accurately detect covert communication.

[0003] Currently, the presence of covert communication behavior is typically detected based on static statistical indicators of network traffic. For example, normal communication typically involves short packet lengths, while covert communication, which requires the transmission of large amounts of hidden data, can lead to an abnormal surge in packet length. Therefore, if the packet length exceeds a certain threshold, covert communication behavior can be identified, triggering an alarm.

[0004] However, with the evolution of cyberattack techniques, attackers can forge static statistical indicators to make the static statistical indicators of covert communication behavior highly overlap with those of normal communication behavior, resulting in low detection accuracy of covert communication behavior. Furthermore, because these techniques only focus on static statistical indicators, they lack the ability to analyze temporal characteristics, leading to a large number of missed detections and similarly resulting in low detection accuracy of covert communication behavior.

[0005] Therefore, improving the detection accuracy of covert communication behavior has become an urgent technical problem to be solved. Summary of the Invention

[0006] To address the aforementioned issues, this application provides a method and apparatus for detecting covert communication behavior, which can improve the accuracy of covert communication behavior detection.

[0007] The embodiments of this application disclose the following technical solutions: Firstly, this application discloses a method for detecting covert communication behavior, the method comprising: Based on the full traffic log data set, a packet length-timestamp sequence is generated, wherein the packet length-timestamp sequence includes the packet length and arrival timestamp of each data packet in the full traffic log data set; The minimum cumulative distance between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension is determined by a dynamic time warping algorithm. Based on the arrival timestamp dimension of the packet length-timestamp sequence, determine the differential entropy and the maximum time span of the burst event; If the minimum cumulative distance is greater than the first threshold, the differential entropy is less than the second threshold, and the maximum time span is greater than the third threshold, then it is determined that there is covert communication behavior.

[0008] Optionally, determining the minimum cumulative distance between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension using a dynamic time warping algorithm includes: Construct an Euclidean distance matrix in the packet length dimension between the packet length-timestamp sequence and the standard response traffic template sequence. The elements in the Euclidean distance matrix are the absolute values ​​of the differences between the packet length of the m-th data packet in the packet length-timestamp sequence and the mean packet length of the n-th data packet in the standard response traffic template sequence. Based on the Euclidean distance matrix, the minimum cumulative distance is recursively determined using a dynamic time warping algorithm.

[0009] Optionally, the differential entropy is determined as follows: Based on the packet length-timestamp sequence, a data packet interval sequence is generated by determining the difference between two adjacent arrival timestamps; Based on the data packet interval sequence, a second-order difference sequence is generated by determining the difference between the intervals of two adjacent data packets; The value range of the second-order difference sequence is discretized into a equally spaced intervals, and the frequency of each value of the second-order difference sequence falling within the a equally spaced intervals is determined, where a is a positive integer; The differential entropy is determined based on the probability distribution of the frequencies in the aforementioned intervals.

[0010] Optionally, the maximum time span of the sudden event is determined as follows: Based on the packet length-timestamp sequence, a data packet interval sequence is generated by determining the difference between two adjacent arrival timestamps; Determine the large interval point in the data packet interval sequence, where the large interval point is the point where the data packet interval is greater than the fourth threshold; If there are b or more consecutive large intervals in the data packet interval sequence, then the b or more large intervals are determined as a burst event segment, where b is a positive integer. Among the internal ranges of the multiple sudden event segments, the maximum value of the internal range is selected as the maximum time span.

[0011] Optionally, generating a packet length-timestamp sequence based on the full traffic log data set includes: Obtain full traffic log data; The full traffic log data is aggregated according to the session flow to obtain the full traffic log set for each session flow. The session flow includes the source Internet Protocol address, source port, destination Internet Protocol address, destination port, and protocol information. Generate a corresponding packet length-timestamp sequence based on the full traffic log set for each session stream.

[0012] Secondly, this application discloses a device for detecting covert communication behavior, the device comprising: a sequence generation module, a first determination module, a second determination module, and a behavior detection module; The sequence generation module is used to generate a packet length-timestamp sequence based on the full traffic log data set. The packet length-timestamp sequence includes the packet length and arrival timestamp of each data packet in the full traffic log data set. The first determining module is used to determine the minimum cumulative distance between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension using a dynamic time warping algorithm; The second determining module is used to determine the differential entropy and the maximum time span of the burst event based on the arrival timestamp dimension of the packet length-timestamp sequence; The behavior detection module is used to determine that there is covert communication behavior if the minimum cumulative distance is greater than a first threshold, the differential entropy is less than a second threshold, and the maximum time span is greater than a third threshold.

[0013] Optionally, the first determining module includes: a first determining submodule and a second determining submodule; The first determining submodule is used to construct an Euclidean distance matrix between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension. The elements in the Euclidean distance matrix are the absolute values ​​of the differences between the packet length of the m-th data packet in the packet length-timestamp sequence and the average packet length of the n-th data packet in the standard response traffic template sequence. The second determining submodule is used to recursively determine the minimum cumulative distance based on the Euclidean distance matrix using a dynamic time warping algorithm.

[0014] Optionally, the unit for determining the differential entropy is as follows: The first determining unit is used to generate a data packet interval sequence by determining the difference between two adjacent arrival timestamps based on the packet length-timestamp sequence. The second determining unit is used to generate a second-order difference sequence by determining the difference between the intervals of two adjacent data packets based on the data packet interval sequence. The third determining unit is used to discretize the value range of the second-order difference sequence into a equally spaced intervals, and determine the interval frequency of each value of the second-order difference sequence falling within the a equally spaced intervals, where a is a positive integer; The fourth determining unit is used to determine the differential entropy based on the probability distribution of the frequency of the interval.

[0015] Optionally, the unit for determining the maximum time span of the sudden event is as follows: The fifth determining unit is used to generate a data packet interval sequence by determining the difference between two adjacent arrival timestamps based on the packet length-timestamp sequence. The sixth determining unit is used to determine the large interval point in the data packet interval sequence, wherein the large interval point is the point where the data packet interval is greater than the fourth threshold. The seventh determining unit is used to determine the b or more large interval points as a burst event segment if there are b or more consecutive large interval points in the data packet interval sequence, where b is a positive integer. The eighth determining unit is used to select the maximum value of the internal range among the internal ranges of the multiple sudden event segments as the maximum time span.

[0016] Optionally, the sequence generation module includes: a first generation submodule, a second generation submodule, and a third generation submodule; The first generation submodule is used to obtain full traffic log data; The second generation submodule is used to aggregate the full traffic log data according to the session stream to obtain the full traffic log set of each session stream. The session stream includes the source Internet Protocol address, source port, destination Internet Protocol address, destination port and protocol information. The third generation submodule is used to generate a corresponding packet length-timestamp sequence based on the full traffic log set of each session stream.

[0017] Compared with the prior art, this application has the following beneficial effects: This application provides a method and apparatus for detecting covert communication behavior. The method includes: generating a packet length-timestamp sequence based on a full traffic log dataset, wherein the packet length-timestamp sequence includes the packet length and arrival timestamp of each data packet in the full traffic log dataset; determining the minimum cumulative distance between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension using a dynamic time warping algorithm; determining the differential entropy and the maximum time span of the burst event based on the arrival timestamp dimension of the packet length-timestamp sequence; and determining that covert communication behavior exists if the minimum cumulative distance is greater than a first threshold, the differential entropy is less than a second threshold, and the maximum time span is greater than a third threshold. On the one hand, this method, by determining the minimum cumulative distance between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension using a dynamic time warping algorithm, can quantify temporal misalignment differences, thereby solving the problem of missed detection caused by the lack of temporal analysis capabilities in traditional methods. On the other hand, this method determines the differential entropy and the maximum time span of sudden events based on the arrival timestamp of the packet length-timestamp sequence. The differential entropy can amplify the minute hourly time-series fluctuations caused by the mechanical packet transmission of tunnel traffic, while the maximum time span can identify deliberately prolonged idle periods in tunnel traffic. Combining these two methods can accurately capture gradual covert communication such as in slow tunnels. Therefore, this method can improve the detection accuracy of covert communication behavior. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating a method for detecting covert communication behavior provided in an embodiment of this application; Figure 2 This is a schematic diagram of a covert communication behavior detection device provided in an embodiment of this application. Detailed Implementation

[0020] As described earlier, the presence of covert communication behavior is currently detected based on static statistical indicators of network traffic. For example, normal communication typically involves short packet lengths, while covert communication, which requires the transmission of large amounts of hidden data, can lead to an abnormal surge in packet length. Therefore, if the packet length exceeds a certain threshold, covert communication behavior can be identified, triggering an alarm.

[0021] However, with the evolution of cyberattack techniques, attackers can forge static statistical indicators to make the static statistical indicators of covert communication behavior highly overlap with those of normal communication behavior, resulting in low detection accuracy of covert communication behavior. Furthermore, because these techniques only focus on static statistical indicators, they lack the ability to analyze temporal characteristics, leading to a large number of missed detections and similarly resulting in low detection accuracy of covert communication behavior.

[0022] Through research, the inventors have proposed a method and apparatus for detecting covert communication behavior. On one hand, this method uses a dynamic time warping algorithm to determine the minimum cumulative distance between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension. This quantifies temporal misalignment differences, thus solving the problem of missed detection caused by the lack of temporal analysis capabilities in traditional methods. On the other hand, based on the arrival timestamp of the packet length-timestamp sequence, this method determines the differential entropy and the maximum time span of sudden events. The differential entropy amplifies the minute temporal fluctuations caused by the mechanical packet sending of tunnel traffic, while the maximum time span identifies deliberately prolonged idle periods in tunnel traffic. Combining these two methods allows for the accurate capture of gradual covert communication, such as in slow tunnels. Therefore, this method improves the accuracy of covert communication behavior detection.

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0024] See Figure 1 The figure is a flowchart of a method for detecting covert communication behavior provided in an embodiment of this application. The method includes: It should be noted that this method for detecting covert communication behavior can be applied to a server to detect covert communication behavior during the communication process between the server and the client; alternatively, it can also be applied to a third party other than the server and the client to detect covert communication behavior during the communication process between the server and the client. This application does not limit the specific entity that performs the detection.

[0025] S101: Generate a packet length-timestamp sequence based on the full traffic log data set. The packet length-timestamp sequence includes the packet length and arrival timestamp of each data packet in the full traffic log data set.

[0026] Full traffic log data refers to the log data corresponding to all data packets transmitted in the network. Full traffic log data includes not only traffic data (such as packet count and byte count), but also complete header and payload data of network communication, and has the characteristics of fine granularity, completeness and traceability.

[0027] By parsing the full traffic log data set, a packet length-timestamp sequence Seq is constructed, as shown in the following formula (1): Seq= {(L1, T1), (L2, T2),..., (L M T M (1) Among them, L k T is the packet length (in bytes) of the k-th full traffic log data. k Let M be the arrival timestamp of the kth full traffic log data (precision: 0.1ms), and M be the total number of full traffic log data.

[0028] In one specific implementation, a packet length-timestamp sequence is generated based on the full traffic log data set, including: First, obtain the full traffic log data.

[0029] Subsequently, the full traffic log data is aggregated according to session flows to obtain a full traffic log set for each session flow. Each session flow includes the source Internet Protocol (IP) address, source port, destination IP address, destination port, and protocol information. If multiple full traffic log data sets have the same source IP address, source port, destination IP address, destination port, and protocol information, these multiple full traffic log data sets are aggregated to obtain a full traffic log data set for each session flow. This avoids the interference of different session flow full traffic log data sets being mixed together, thereby improving the accuracy of subsequent detection of covert communication behaviors.

[0030] Finally, based on the full traffic log set for each session stream, a corresponding packet length-timestamp sequence is generated.

[0031] It should be noted that the log data corresponding to the first 100 data packets initiated by the client in the network can be obtained as the full traffic log data. This is because the first 100 data packets usually include data on key behaviors such as session establishment and critical interactions. Therefore, this strategy can effectively reduce the amount of data to be processed while ensuring coverage of most key behaviors, thereby improving the detection efficiency of subsequent covert communication behaviors.

[0032] It should also be noted that during the acquisition of full traffic log data, log data corresponding to packets with a length of 32 bytes or less can be omitted. This is because control packets such as TCP ACK / RST and ICMP Echo are typically less than or equal to 32 bytes in length. These control packets are only used to maintain the connection and rarely carry actual data. Therefore, if control packets of less than or equal to 32 bytes are used to transmit data related to covert communication behavior, the data would need to be distributed across a large number (at least hundreds) of control packets, which would not only make it easy for firewalls to block the data but also result in extremely low data transmission efficiency. Therefore, in practical applications, log data corresponding to packets with a length of less than or equal to 32 bytes can be ignored, allowing the detection of covert communication behavior to focus on packets that are more likely to contain data related to covert communication behavior (e.g., packets with a length greater than 64 bytes), thereby improving the efficiency of subsequent covert communication behavior detection.

[0033] It should also be noted that covert communication behavior can be detected in real time by acquiring full traffic log data, or it can be detected offline by acquiring full traffic log data over a historical period. This application does not limit the scope of this application.

[0034] S102: Determine the minimum cumulative distance between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension using a dynamic time warping algorithm.

[0035] The standard response traffic sequence (also known as the template sequence, indicating normal communication behavior) Tem is shown in the following formula (2): Tem = {( ), ( ), ..., ( (2) in, This represents the average packet length of the k-th full traffic log data in the standard response traffic sequence, reflecting the typical packet length of normal communication behavior at this time position. It represents the standard deviation of the packet length of the k-th full traffic log data in the standard response traffic sequence, reflecting the range of packet length fluctuations at this time position in normal communication behavior.

[0036] In the covert communication behavior detection method provided in this application embodiment, the minimum cumulative distance D between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension is determined by the Dynamic Time Warping (DTM) algorithm. dtw Understandably, the minimum cumulative distance D dtw The smaller the value, the closer the packet length-timestamp sequence is to normal communication behavior; minimum cumulative distance D dtwThe larger the value, the more likely the packet length-timestamp sequence is to involve covert communication. Specifically, it includes the following steps A1-A2: A1: Construct the Euclidean distance matrix of the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension. The elements in the Euclidean distance matrix are the absolute values ​​of the differences between the packet length of the m-th data packet in the packet length-timestamp sequence and the mean packet length of the n-th data packet in the standard response traffic template sequence.

[0037] First, extract the packet length dimension sequence Seq={L1, L2, ..., L...} from the packet length-timestamp sequence. M}, and extract the packet length dimension sequence Tem = { from the standard response traffic template sequence. }

[0038] Secondly, according to Seq={L1, L2, ..., L... M} and the sequence of package length dimensions Tem = { Construct the Euclidean distance matrix. The elements in the Euclidean distance matrix are the absolute values ​​of the differences between the length of the m-th data packet in Tem and the average length of the n-th data packet in Tem (m≤M, n≤N, m, n, M, N are all positive integers), as shown in the following formula (3): D[m][n] = | |(3) A2: Based on the Euclidean distance matrix, the minimum cumulative distance D is recursively determined using a dynamic time warping algorithm. dtw .

[0039] First, initialize the cumulative distance matrix C by setting C[0][0]=D[0][0]. The physical meaning of this operation is: start matching from the first data packet of the packet length-timestamp sequence and the first data packet of the standard response traffic template sequence. The initial cumulative distance is the absolute difference value of the packet lengths of the two packets, corresponding to the starting element D[0][0] of the Euclidean distance matrix D.

[0040] Subsequently, the cumulative distance at each position in the cumulative distance matrix C is calculated recursively according to the following formula (4): (4) Where D[i][j] is the element in the i-th row and j-th column of the Euclidean distance matrix D, corresponding to the absolute value of the difference in packet length between the i-th data packet of the packet length-timestamp sequence and the j-th data packet of the standard response traffic template sequence; C[i][j] is the minimum cumulative distance when the first i data packets of the packet length-timestamp sequence match the j-th data packet of the standard response traffic template sequence; min{C[i-1][j], C[i][j-1], C[i-1][j-1]} represents selecting the path with the minimum cumulative distance from the three paths of vertical movement (matching the current packet of the previous sequence), horizontal movement (matching the previous packet of the current sequence), and diagonal movement (matching the previous packet of the previous sequence), ensuring that C[i][j] is the optimal cumulative distance for the current matching position.

[0041] It should be noted that if an "unreachable boundary position" is encountered in the calculation (for example, if trying to access C[i-1][j] when i=0 will result in an out-of-bounds error), the cumulative distance of the out-of-bounds position is padded with infinity (or an equivalent maximum value) to force the algorithm to skip invalid paths and ensure the self-consistency of the recursive logic.

[0042] Finally, after the traversal is complete, take the last position C[M][N] of the cumulative distance matrix C, and normalize it according to the following formula (5) to eliminate the influence of sequence length differences on the result, and obtain the minimum cumulative distance result D. dtw : D dtw = C[M][N] / (M+N)(5) Among them, D dtw For the minimum cumulative distance result, M is the length of the packet length-timestamp sequence, and N is the length of the standard response traffic template sequence.

[0043] Understandably, the minimum cumulative distance result D dtw This is the minimum cumulative distance between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension, used to measure the similarity of their time-packet length features.

[0044] It should be noted that different session streams typically correspond to different communication protocols (such as HTTP, DNS, HTTPS), and different communication protocols typically correspond to different standard response traffic template sequences. In one specific implementation, the standard response traffic template sequence corresponding to the first communication protocol can be generated through the following steps B1-B3: B1: Obtain the first X full traffic log data of the session stream of the first communication protocol.

[0045] It should be noted that X is a positive integer, consistent with the number of full traffic log data obtained in step S101. For example, X = 100. It can be understood that the first X full traffic log data obtained in step B1 are sample data.

[0046] B2: Determine the mean packet length and standard deviation of each full traffic log data.

[0047] average package length The standard deviation of package length can be obtained using the following formula (6). It can be obtained through the following formula (7): (6) (7) in, This is the average length of the package. For the standard deviation of package length, Let N be the packet length of the i-th full traffic log data, and N be the number of sample data, i=1~N.

[0048] It should be noted that the denominator of formula (7) is N-1. This is because when only a portion of the sample data is collected (i.e., a portion of the full traffic log data, not all of the full traffic log data), using N-1 as the degree of freedom can make the standard deviation of packet length closer to the standard deviation of the real population, thus avoiding the systematic underestimation due to incomplete sample data (especially in small sample scenarios, such as when there are few session streams and few time-series location data).

[0049] B3: Determine the standard response flow template sequence based on the mean packet length and the standard deviation of packet length.

[0050] S103: Determine the differential entropy and the maximum time span of the burst event based on the arrival timestamp dimension of the packet length-timestamp sequence.

[0051] Normal communication behavior, due to network fluctuations and human intervention, typically results in large temporal fluctuations and high entropy values. However, covert communication behavior (such as tunnel traffic) exhibits mechanical packet sending characteristics, such as sending packets at fixed intervals, which usually leads to more regular and monotonic second-order differences and lower entropy values. Therefore, covert communication behavior can be identified based on differential entropy. In one specific implementation, the differential entropy can be determined through the following steps C1-C4, based on the arrival timestamp dimension of the packet length-timestamp sequence: C1: Based on the packet length-timestamp sequence, generate a packet interval sequence by determining the difference between two adjacent arrival timestamps.

[0052] The data packet interval sequence Δt is shown in the following formula (8): (8) C2: Based on the data packet interval sequence, a second-order difference sequence is generated by determining the difference between the intervals of two adjacent data packets.

[0053] Second-order difference sequence △ 2 tk As shown in the following formula (9): (9) C3: Discretize the value range of the second-order difference sequence into a equally spaced intervals, and determine the interval frequency of each second-order difference sequence value falling within a equally spaced interval, where a is a positive integer.

[0054] First, all △ 2 t k The range of values ​​is discretized into a equally spaced intervals (e.g., a=10, balancing computational complexity and feature discriminative power). Then, each Δ... 2 t k Count of intervals where the value falls within a equally spaced interval i .

[0055] C4: Determine the differential entropy based on the probability distribution of interval frequencies.

[0056] First, determine the probability distribution of the interval frequency, as shown in the following formula (10): (10) It is understandable that the probability distribution P(Δ) of the interval frequency is... 2 t k The physical meaning of ) is: the "frequency of occurrence" of each interval. Normal communication behavior is usually distributed and dispersed, while covert communication behavior is usually concentrated in a few intervals.

[0057] Subsequently, based on the probability distribution of interval frequencies, the differential entropy is determined as shown in the following formula (11): (11) Among them, H diff Let P(Δ) be the difference entropy. 2 t k ) represents the probability distribution of interval frequencies.

[0058] Understandably, normal communication behavior, due to network fluctuations and complex application-layer interactions, involves second-order differential communication covering multiple intervals, resulting in higher differential entropy. Covert communication behavior, on the other hand, requires mechanical control of packet transmission intervals, concentrating second-order differential communication within a few intervals, thus resulting in lower differential entropy.

[0059] Large intervals in normal communication behavior (such as user operation pauses) are usually randomly encouraged, while covert communication behavior may concentrate large intervals to avoid detection. Therefore, covert communication behavior can be identified based on the maximum time span of the burst event. In one specific implementation, the maximum time span of the burst event can be determined through the following steps D1-D4, based on the arrival timestamp dimension of the packet length-timestamp sequence: D1: Based on the packet length-timestamp sequence, generate a packet interval sequence by determining the difference between two adjacent arrival timestamps.

[0060] D2: Determine the largest interval point in the data packet interval sequence. The largest interval point is the point where the data packet interval is greater than the fourth threshold.

[0061] Large interval points are those where the packet interval is greater than the fourth threshold θ. The fourth threshold θ = 3 × mean(△t), where mean(△t) is the arithmetic mean of the packet intervals.

[0062] D3: If there are b or more consecutive large intervals in the data packet interval sequence, then the b or more large intervals are determined as a burst event segment, where b is a positive integer.

[0063] If there are b or more consecutive large intervals in the data packet interval sequence (e.g., b=5, balancing false alarms and false negatives), then b or more large intervals are identified as burst event segment E. j E j =[△t p , △t p＋1 ,...△t q ], q-p+1≥b.

[0064] It is understandable that large intervals in normal communication are random and isolated, making it difficult to form consecutive large intervals of b or more. However, covert communication may generate large intervals in a concentrated manner, thus making it easy to form consecutive large intervals of b or more.

[0065] D4: Among the internal ranges of multiple sudden event segments, select the maximum value of the internal range as the maximum time span.

[0066] First, for each emergency event segment E j Determine the internal range T of the sudden event segment. j =max(E j )-min(E j Subsequently, among the internal ranges of multiple sudden event segments, the maximum internal range is selected as the maximum time span, i.e., T. brust =max(T) j ).

[0067] Understandably, differential entropy focuses on the "complexity of packet sending rhythm" (due to the mechanical packet sending in covert communication, the entropy value is significantly reduced); the maximum time span captures the "clustering of abnormal burst intervals" (covert communication transmits data, which easily forms continuous large interval segments). Combining the two can cover typical covert communication timing attacks such as "fixed interval packet sending" and "concentrated burst transmission".

[0068] S104: If the minimum cumulative distance is greater than the first threshold, the differential entropy is less than the second threshold, and the maximum time span is greater than the third threshold, then it is determined that there is covert communication behavior.

[0069] First, the first threshold δ1, the second threshold δ2, and the third threshold δ3 will be explained: The first threshold δ1 is the product of the basic similarity distance and the current network load coefficient. The basic similarity distance is obtained through training on historical normal communication behavior. For example, the basic similarity distance could be the 95th quantile of the historical normal traffic DTW distance. It is understandable that the first threshold δ1 needs to be positively correlated with the current network load coefficient because network jitter is aggravated under high load, and the minimum cumulative distance result D for normal communication behavior... dtw The threshold δ1 needs to be increased to avoid misjudgment.

[0070] The second threshold δ2 is determined as follows: First, in a clean network environment (free from covert communication interference), capture 100,000 standard protocol traffic entries (such as DNS, HTTP, and SMTP) as protocol samples. Understandably, the protocol samples need to cover high / low load and different time periods to ensure comprehensiveness.

[0071] Secondly, for each type of protocol, the average differential entropy (i.e., the baseline entropy value) of normal communication behavior is calculated using the following formula (12): (12) Among them, H base Here, H is the average of the differential entropy, K is the number of protocol samples, and H is the average value of the differential entropy. diff It is the differential entropy.

[0072] For example, the average differential entropy of the DNS protocol is typically 2.5 ± 0.3, indicating that the normal DNS query interval fluctuates greatly (due to random user clicks). The average differential entropy of the HTTP protocol is typically 1.8 ± 0.4, indicating that there is a characteristic of strong request bursts due to page loads. The average differential entropy of the SSH protocol is typically 0.9 ± 0.2, indicating that SSH long-connection steady-state transmission has relatively stable intervals.

[0073] Finally, based on the protocol characteristics, the average differential entropy is corrected, i.e., δ2 = corrected value + H. base For example, if the protocol type is a text protocol, the threshold needs to be lowered (e.g., a correction value of -0.3) to enhance detection (avoiding missed detection of tunnel traffic). If the protocol type is a streaming media protocol, the threshold needs to be raised (e.g., a correction value of 0.2) to avoid false positives (normal traffic being treated as tunnel traffic).

[0074] The third threshold δ3 = average burst cycle × 1.5. It can be understood that the physical meaning of multiplying the average burst cycle by 1.5 is to reserve a certain fluctuation margin to avoid misjudging the burst cycle of normal traffic.

[0075] If the minimum cumulative distance D dtw Greater than the first threshold δ1, differential entropy H diff Less than the second threshold δ2, and the maximum time span T brust If the value exceeds the third threshold δ3, then covert communication behavior is confirmed. If covert communication behavior is confirmed, an alarm signal can be issued, and the full traffic log set of the next session stream can be detected; if covert communication behavior is confirmed, the full traffic log set of the next session stream can be detected directly.

[0076] In summary, this application provides a method for detecting covert communication behavior. On one hand, the method uses a dynamic time warping algorithm to determine the minimum cumulative distance between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension, which can quantify the temporal misalignment difference, thereby solving the problem of missed detection caused by the lack of temporal analysis capabilities in traditional methods. On the other hand, the method determines the differential entropy and the maximum time span of the sudden event based on the arrival timestamp of the packet length-timestamp sequence. The differential entropy can amplify the micro-time fluctuations caused by the mechanical packet sending of tunnel traffic, and the maximum time span can identify deliberately lengthened idle periods of tunnel traffic. Combining the two can accurately capture gradual covert communication such as slow tunnels. Therefore, this method can improve the detection accuracy of covert communication behavior.

[0077] See Figure 2 The figure is a schematic diagram of a covert communication behavior detection device provided in an embodiment of this application. The covert communication behavior detection device 200 includes: a sequence generation module 201, a first determination module 202, a second determination module 203, and a behavior detection module 204.

[0078] The sequence generation module 201 is used to generate a packet length-timestamp sequence based on the full traffic log data set. The packet length-timestamp sequence includes the packet length and arrival timestamp of each data packet in the full traffic log data set. The first determining module 202 is used to determine the minimum cumulative distance between the packet length-time stamp sequence and the standard response traffic template sequence in the packet length dimension through a dynamic time warping algorithm; The second determining module 203 is used to determine the differential entropy and the maximum time span of the burst event based on the arrival timestamp dimension of the packet length-timestamp sequence. The behavior detection module 204 is used to determine the existence of covert communication behavior if the minimum cumulative distance is greater than the first threshold, the differential entropy is less than the second threshold, and the maximum time span is greater than the third threshold.

[0079] In one specific implementation, the first determining module 202 includes: a first determining submodule and a second determining submodule; The first determination submodule is used to construct the Euclidean distance matrix between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension. The elements in the Euclidean distance matrix are the absolute values ​​of the differences between the packet length of the m-th data packet in the packet length-timestamp sequence and the mean packet length of the n-th data packet in the standard response traffic template sequence. The second determination submodule is used to recursively determine the minimum cumulative distance based on the Euclidean distance matrix using a dynamic time warping algorithm.

[0080] In one specific implementation, the unit for determining the differential entropy is as follows: The first determining unit is used to generate a data packet interval sequence by determining the difference between two adjacent arrival timestamps based on the packet length-timestamp sequence. The second determining unit is used to generate a second-order difference sequence by determining the difference between the intervals of two adjacent data packets based on the data packet interval sequence. The third determining unit is used to discretize the value range of the second-order difference sequence into a equally spaced intervals, and to determine the interval frequency of the value of each second-order difference sequence falling within the a equally spaced intervals, where a is a positive integer; The fourth determining unit is used to determine the differential entropy based on the probability distribution of the interval frequency.

[0081] In one specific implementation, the unit for determining the maximum time span of a sudden event is as follows: The fifth determining unit is used to generate a data packet interval sequence by determining the difference between two adjacent arrival timestamps based on the packet length-timestamp sequence. The sixth determining unit is used to determine the large interval point in the data packet interval sequence. The large interval point is the point where the data packet interval is greater than the fourth threshold. The seventh determining unit is used to determine b or more large interval points as a burst event segment if there are b or more consecutive large interval points in the data packet interval sequence, where b is a positive integer. The eighth determining unit is used to select the maximum value of the internal range among multiple sudden event segments as the maximum time span.

[0082] In one specific implementation, the sequence generation module 201 includes: a first generation submodule, a second generation submodule, and a third generation submodule; The first generation submodule is used to obtain full traffic log data; The second generation submodule is used to aggregate the full traffic log data according to the session stream to obtain the full traffic log set for each session stream. The session stream includes the source Internet Protocol address, source port, destination Internet Protocol address, destination port and protocol information. The third generation submodule is used to generate the corresponding packet length-timestamp sequence based on the full traffic log set of each session stream.

[0083] In summary, this application provides a device for detecting covert communication behavior. On one hand, the device uses a dynamic time warping algorithm to determine the minimum cumulative distance between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension, quantifying temporal misalignment differences and thus solving the problem of missed detection caused by the lack of temporal analysis capabilities in traditional devices. On the other hand, based on the arrival timestamp of the packet length-timestamp sequence, the device determines the differential entropy and the maximum time span of sudden events. The differential entropy can amplify the micro-time fluctuations caused by the mechanical packet sending of tunnel traffic, and the maximum time span can identify deliberately lengthened idle periods of tunnel traffic. Combining these two aspects can accurately capture gradual covert communication such as slow tunnels. Therefore, this device can improve the detection accuracy of covert communication behavior.

[0084] In the embodiments of this application, the terms "first" and "second" (if they exist) are used only as name identifiers and do not represent the order of first and second.

[0085] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that all or part of the steps in the methods of the above embodiments can be implemented by means of software plus a general-purpose hardware platform. Based on this understanding, the technical solution of this application can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as a read-only memory (ROM) / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, a server, or a network communication device such as a router) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0086] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments. The device and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components indicated as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the solution in this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0087] The above description is merely one specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting covert communication behavior, characterized in that, The method includes: Based on the full traffic log data set, a packet length-timestamp sequence is generated, wherein the packet length-timestamp sequence includes the packet length and arrival timestamp of each data packet in the full traffic log data set; The minimum cumulative distance between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension is determined by a dynamic time warping algorithm. Based on the arrival timestamp dimension of the packet length-timestamp sequence, determine the differential entropy and the maximum time span of the burst event; If the minimum cumulative distance is greater than the first threshold, the differential entropy is less than the second threshold, and the maximum time span is greater than the third threshold, then it is determined that there is covert communication behavior.

2. The method according to claim 1, characterized in that, The step of determining the minimum cumulative distance between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension using a dynamic time warping algorithm includes: Construct an Euclidean distance matrix in the packet length dimension between the packet length-timestamp sequence and the standard response traffic template sequence. The elements in the Euclidean distance matrix are the absolute values ​​of the differences between the packet length of the m-th data packet in the packet length-timestamp sequence and the mean packet length of the n-th data packet in the standard response traffic template sequence. Based on the Euclidean distance matrix, the minimum cumulative distance is recursively determined using a dynamic time warping algorithm.

3. The method according to claim 1, characterized in that, The differential entropy is determined as follows: Based on the packet length-timestamp sequence, a data packet interval sequence is generated by determining the difference between two adjacent arrival timestamps; Based on the data packet interval sequence, a second-order difference sequence is generated by determining the difference between the intervals of two adjacent data packets; The value range of the second-order difference sequence is discretized into a equally spaced intervals, and the frequency of each value of the second-order difference sequence falling within the a equally spaced intervals is determined, where a is a positive integer; The differential entropy is determined based on the probability distribution of the frequencies in the aforementioned intervals.

4. The method according to claim 1, characterized in that, The maximum time span of the aforementioned emergency is determined as follows: Based on the packet length-timestamp sequence, a data packet interval sequence is generated by determining the difference between two adjacent arrival timestamps; Determine the large interval point in the data packet interval sequence, where the large interval point is the point where the data packet interval is greater than the fourth threshold; If there are b or more consecutive large intervals in the data packet interval sequence, then the b or more large intervals are determined as a burst event segment, where b is a positive integer. Among the internal ranges of the multiple sudden event segments, the maximum value of the internal range is selected as the maximum time span.

5. The method according to claim 1, characterized in that, The step of generating a packet length-timestamp sequence based on the full traffic log data set includes: Obtain full traffic log data; The full traffic log data is aggregated according to the session flow to obtain the full traffic log set for each session flow. The session flow includes the source Internet Protocol address, source port, destination Internet Protocol address, destination port, and protocol information. Generate a corresponding packet length-timestamp sequence based on the full traffic log set for each session stream.

6. A device for detecting covert communication behavior, characterized in that, The device includes: a sequence generation module, a first determination module, a second determination module, and a behavior detection module; The sequence generation module is used to generate a packet length-timestamp sequence based on the full traffic log data set. The packet length-timestamp sequence includes the packet length and arrival timestamp of each data packet in the full traffic log data set. The first determining module is used to determine the minimum cumulative distance between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension using a dynamic time warping algorithm; The second determining module is used to determine the differential entropy and the maximum time span of the burst event based on the arrival timestamp dimension of the packet length-timestamp sequence; The behavior detection module is used to determine that there is covert communication behavior if the minimum cumulative distance is greater than a first threshold, the differential entropy is less than a second threshold, and the maximum time span is greater than a third threshold.

7. The apparatus according to claim 6, characterized in that, The first determining module includes: a first determining submodule and a second determining submodule; The first determining submodule is used to construct an Euclidean distance matrix between the packet length-timestamp sequence and the standard response traffic template sequence in the packet length dimension. The elements in the Euclidean distance matrix are the absolute values ​​of the differences between the packet length of the m-th data packet in the packet length-timestamp sequence and the average packet length of the n-th data packet in the standard response traffic template sequence. The second determining submodule is used to recursively determine the minimum cumulative distance based on the Euclidean distance matrix using a dynamic time warping algorithm.

8. The apparatus according to claim 6, characterized in that, The unit for determining the differential entropy is shown below: The first determining unit is used to generate a data packet interval sequence by determining the difference between two adjacent arrival timestamps based on the packet length-timestamp sequence. The second determining unit is used to generate a second-order difference sequence by determining the difference between the intervals of two adjacent data packets based on the data packet interval sequence. The third determining unit is used to discretize the value range of the second-order difference sequence into a equally spaced intervals, and determine the interval frequency of each value of the second-order difference sequence falling within the a equally spaced intervals, where a is a positive integer; The fourth determining unit is used to determine the differential entropy based on the probability distribution of the frequency of the interval.

9. The apparatus according to claim 6, characterized in that, The unit for determining the maximum time span of the sudden event is as follows: The fifth determining unit is used to generate a data packet interval sequence by determining the difference between two adjacent arrival timestamps based on the packet length-timestamp sequence. The sixth determining unit is used to determine the large interval point in the data packet interval sequence, wherein the large interval point is the point where the data packet interval is greater than the fourth threshold. The seventh determining unit is used to determine the b or more large interval points as a burst event segment if there are b or more consecutive large interval points in the data packet interval sequence, where b is a positive integer. The eighth determining unit is used to select the maximum value of the internal range among the internal ranges of the multiple sudden event segments as the maximum time span.

10. The apparatus according to claim 6, characterized in that, The sequence generation module includes: a first generation submodule, a second generation submodule, and a third generation submodule; The first generation submodule is used to obtain full traffic log data; The second generation submodule is used to aggregate the full traffic log data according to the session stream to obtain the full traffic log set of each session stream. The session stream includes the source Internet Protocol address, source port, destination Internet Protocol address, destination port and protocol information. The third generation submodule is used to generate a corresponding packet length-timestamp sequence based on the full traffic log set of each session stream.

Images