A method and system for robust detection of a doh covert tunnel against traffic shaping

Abstract

The application discloses a DoH hidden tunnel robust detection method and system for defense flow shaping, after collecting DoH bidirectional flow at a network boundary and extracting original numerical statistical features, a pre-generated Cauchy distribution random matrix is used for high-dimensional mapping of the original features, so that an encoding vector with disturbance absorption capacity is generated. Subsequently, the system constructs a feature extraction network containing a robust branch and a semantic branch to process the high-dimensional encoding vector and the original features respectively, and dynamically calculates and fuses weights through an attention mechanism to output adaptive fusion features. Finally, the fusion features are input into a classifier to complete tunnel identification. The application uses the mathematical characteristics of the heavy-tailed distribution to naturally suppress local sparse disturbances in the feature space, and at the same time solves the network structure conflict caused by single mapping, greatly improves the robustness in response to the counter-attack on the premise of ensuring the detection accuracy of normal flow.

Description

Technical Field

[0001] This invention belongs to the field of computer network security technology, specifically relating to a robust detection method and system for DoH covert tunnels that defend against traffic shaping. Background Technology

[0002] The Domain Name System (DNS) is the infrastructure of the Internet. In recent years, the DoH (DNS over HTTPS) protocol has been widely used to prevent DNS queries from being eavesdropped on or tampered with during plaintext transmission. However, while the DoH protocol protects user privacy, its HTTPS encrypted channels have also been abused by malware (such as botnets and APT groups) to establish covert tunnels for command and control communications or the transmission of sensitive data.

[0003] Since DoH traffic payloads are encrypted with TLS, traditional defenses based on deep packet inspection or payload keyword matching are completely ineffective. Currently, mainstream detection methods have shifted to machine learning or deep learning-based approaches, using statistical features of the DoH bidirectional flow (such as packet length distribution and packet arrival time intervals) to train classification models.

[0004] However, existing detection models based on statistical features have significant vulnerabilities. Attackers can carry out traffic shaping attacks by padding or injecting random delays at the application layer. Such attacks can fine-tune statistical features without breaking the tunnel communication logic, thereby causing existing decision tree models, convolutional neural networks, or recurrent neural networks to make misjudgments.

[0005] Existing defense methods require prior knowledge of the attack methods and are highly dependent on adversarial training, resulting in insufficient generalization, high training costs, and difficulty in generalizing to unknown traffic shaping strategies. Summary of the Invention

[0006] Purpose of the invention: The purpose of this invention is to address the shortcomings of existing technologies and provide a robust detection method and system for DoH covert tunnels that defend against traffic shaping. By using heavy-tailed random feature encoding to suppress local sparse perturbations in the feature space, and by utilizing an adaptive dual-branch architecture to resolve structural conflicts caused by a single mapping, the invention effectively improves detection accuracy in adversarial environments without increasing training overhead.

[0007] Technical solution: The present invention provides a robust detection method for DoH concealed tunnels that defend against flow shaping, comprising the following steps:

[0008] Step 1: Collect traffic and extract statistical features. First, deploy a traffic mirroring collection device (e.g., a bypass packet capture server) at the network boundary to filter and reconstruct the DoH bidirectional flow, extract the numerical statistical features of the DoH bidirectional flow, and construct the original feature vector. , , For feature dimensions;

[0009] Step 2, Heavy-tailed random feature encoding mapping: using a pre-generated heavy-tailed distributed random matrix For the original feature vector Perform random Fourier projection to generate a high-dimensional encoding vector with perturbation absorption properties. The projection kernel function of the random Fourier projection adopts the Cauchy distribution with heavy-tailed characteristics, and the Laplace kernel is simulated by projection through the Cauchy distribution.

[0010] Step 3: Extract dual-branch adaptive hybrid features. First, construct a feature extraction network containing robust branches and semantic branches, and then encode the high-dimensional vectors. Input robust branch to extract perturbation-resistant global features, and convert the original feature vector The input semantic branch extracts local sequence spatiotemporal features, and then the dynamic fusion weights of the two branches are calculated through an attention mechanism to output fused features;

[0011] Step 4, Hidden Tunnel Classification Decision: Input the fused features into the pre-trained fully connected classification layer, and output the classification probability. According to classification probability Determine whether the DoH bidirectional flow is a hidden tunnel.

[0012] This invention uses a Cauchy heavy-tailed distributed random matrix to perform a high-dimensional random Fourier projection, absorbing sparse perturbations (packet length / delay fine-tuning), introducing heavy-tailed random features into DoH adversarial detection, and extending the perturbation resistance to the feature layer. In order to address the existing defect that high-dimensional encoding destroys temporal features, a dual-branch adaptive hybrid feature extraction network is designed. Its dual branches combine attention fusion to solve the contradiction between high-dimensional mapping and insufficient accuracy, while achieving high robustness and high detection accuracy.

[0013] Furthermore, the numerical statistical features in step 1 include the mean and variance of the length of the forward data packets, the mean and variance of the length of the reverse data packets, the mean and variance of the time interval between data packet arrivals, and the duration of the bidirectional flow.

[0014] Numerical statistical features are the minimum and most effective feature set necessary to achieve robust detection targets; (the mean and variance of packet length and time interval are currently recognized baseline features for identifying encrypted covert tunnels; and in subsequent heavy-tailed random feature encoding, these features, after being projected onto the Cauchy distribution matrix, can effectively suppress disturbances caused by traffic shaping attacks.)

[0015] Furthermore, in step 2, the heavy-tailed distributed random matrix The matrix elements are sampled independently and identically distributed from the probability density function. ;

[0016] γ is a scale parameter that controls the width of the distribution. The target projection dimension and satisfying ;

[0017] The high-dimensional encoding vector The calculation formula is:

[0018] ;

[0019] in, , For random matrices The transpose of .

[0020] Furthermore, the robust branch in step 3 includes methods for handling... The high-dimensional encoding vector of dimension A multilayer perceptron; the semantic branch includes a function for processing the original feature vector. One-dimensional convolutional neural networks or long short-term memory networks, ;

[0021] The calculation method for dynamic fusion weights is as follows: first, the perturbation-resistant global features output by the robust branch are... Local sequence spatiotemporal features of semantic branch output The features are concatenated along the channel dimension; the concatenated features are then processed by a global average pooling layer and a non-linear mapping layer to calculate dynamic weight coefficients. ; Fusion features The calculation formula is:

[0022] ;

[0023] .

[0024] This invention also discloses a robust detection method system for DoH covert tunnels that defend against traffic shaping, including a traffic acquisition module, a preprocessing module, a heavy-tailed random coding module, and an adaptive fusion detection module. The traffic acquisition module is used to capture DoH packets at the network boundary; the preprocessing module clusters data according to bidirectional flow and extracts statistical feature vectors; the heavy-tailed random coding module is used to store heavy-tailed distributed random matrices and perform high-dimensional projection operations on the feature vectors; the adaptive fusion detection module is deployed with a two-branch adaptive hybrid feature extraction network and a classifier to output covert tunnel detection results.

[0025] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0026] Theoretically Proven Robustness to Traffic Shaping: This invention employs a random matrix based on the Cauchy distribution (a heavy-tailed distribution) for feature mapping. This mapping mathematically approximates the Laplace kernel function, whose Lipschitz continuity is inherently insensitive to L1 norm distances in the feature dimension (i.e., sparse traffic shaping perturbations, such as modifying the length or interval of a small number of packets), thus absorbing malicious perturbations from attackers at the feature space level.

[0027] Effectively resolving conflicts in deep network structures: Simple high-dimensional random feature mapping can disrupt the local topological relationships of the original traffic sequence, leading to a decline in the performance of deep learning models such as CNN or LSTM. The dual-branch adaptive fusion architecture of this invention allows the model to focus on the semantic branch for clean traffic, while focusing on the robust branch when facing shaped traffic, thus improving recall in adversarial environments without sacrificing basic detection accuracy.

[0028] Low deployment overhead: The feature encoding process only involves matrix multiplication and trigonometric function operations, resulting in low computational complexity. It eliminates the need for complex adversarial sample generation and retraining processes, fully meeting the real-time processing requirements of core switch bypass deployment. Attached Figure Description

[0029] Figure 1 This is an overall flowchart of the present invention;

[0030] Figure 2 This is a schematic diagram of the architecture of the present invention;

[0031] Figure 3 The following is a block diagram of the dual-branch adaptive hybrid feature extraction network structure in an embodiment;

[0032] Figure 4 This is a block diagram of the system structure of the present invention. Detailed Implementation

[0033] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.

[0034] To address the technical shortcomings of existing machine learning-based detection models, which are prone to misjudgment when facing traffic shaping attacks such as packet padding or random delays, this invention provides a robust detection method for DoH covert tunnels that defends against traffic shaping. Figure 1 The steps shown are as follows:

[0035] Step 1: Traffic Collection and Statistical Feature Extraction. First, deploy a traffic mirroring collection device at the network boundary to filter and reconstruct the DoH bidirectional flow, extract the numerical statistical features of the DoH bidirectional flow, and construct the original feature vector. , , For feature dimensions;

[0036] Step 2, Heavy-tailed random feature encoding mapping: using a pre-generated heavy-tailed distributed random matrix For the original feature vector Perform random Fourier projection to generate a high-dimensional encoding vector with perturbation absorption properties. The projection kernel function of the random Fourier projection adopts the Cauchy distribution with heavy-tailed characteristics, and the Laplace kernel is simulated by projection through the Cauchy distribution.

[0037] Step 3: Extract dual-branch adaptive hybrid features. First, construct a feature extraction network containing robust branches and semantic branches, and then encode the high-dimensional vectors. Input robust branch to extract perturbation-resistant global features, and convert the original feature vector The input semantic branch extracts local sequence spatiotemporal features, and then the dynamic fusion weights of the two branches are calculated through an attention mechanism to output fused features;

[0038] Step 4, Hidden Tunnel Classification Decision: Input the fused features into the pre-trained fully connected classification layer, and output the classification probability. According to classification probability Determine whether the DoH bidirectional flow is a hidden tunnel.

[0039] like Figure 2 As shown, in step 1 of this embodiment, the network interface card (NIC) uses DPDK technology to capture mirrored traffic and filters out HTTPS traffic based on TCP port 443 and TLS handshake characteristics. DoH protocol flows are located using SNI or a known DoH resolver IP blacklist / whitelist. Bidirectional flows are reassembled according to the five-tuple (source IP, destination IP, source port, destination port, protocol). For each flow, the preceding... Data packets (e.g.) ),extract 2D numerical statistical characteristics In this embodiment, The main features include: mean, standard deviation, maximum, and minimum packet lengths in both directions; mean and standard deviation of the packet arrival time intervals in both directions; payload transmission rate; and stream duration. In subsequent heavy-tailed random feature encoding, the obtained numerical statistical features, after being projected onto the Cauchy distribution matrix, can effectively suppress disturbances caused by traffic shaping attacks.

[0040] To defend against attackers' attempts to fine-tune packet length or latency, feature x is not directly fed into the classifier; instead, a value of x is first generated. Heavy-tailed random matrix Heavy-tailed random matrix matrix elements Independent and identically distributed sampling from probability density function ;

[0041] γ is a scale parameter that controls the distribution width (e.g., set to 0.5). The target projection dimension and satisfying The value can be 1024; the Cauchy distribution has a heavy-tailed characteristic, which allows for the generation of a small number of extremely large random projection vector components, which is crucial for amplifying the abnormal distribution of tunnel flow.

[0042] When real-time features are received At that time, the GPU performs the following calculations to obtain a 1024-dimensional encoded vector. High-dimensional encoding vector The calculation formula is:

[0043] ;

[0044] in, , For random matrices The transpose of .

[0045] like Figure 3 As shown, the robust branch in step 3 of this embodiment includes processing The high-dimensional encoding vector of dimension Multilayer perceptrons, for example, receiving 1024-dimensional data. After passing through two MLP layers with 512 and 256 neurons respectively and using the ReLU activation function, a 256-dimensional feature representation containing perturbation resistance was extracted. The semantic branch includes the processing of the original feature vector. One-dimensional convolutional neural networks or long short-term memory networks, For example, receiving 34-dimensional raw features After passing through a one-dimensional convolutional layer (1D-CNN, 64 channels, 3 kernels), fine-grained local features are extracted from the sequence. (After flattening, it is 256-dimensional). The calculation method for dynamic fusion weights is as follows: first, the robust branch outputs the disturbance-resistant global features. Local sequence spatiotemporal features of semantic branch output The features are concatenated along the channel dimension; the concatenated 512-dimensional features are then processed by a global average pooling layer and a nonlinear mapping layer to calculate the dynamic weight coefficients. ; Fusion features The calculation formula is:

[0046] ; .

[0047] This allows the network to rely on standard tunneling traffic that has not been shaped. To ensure accuracy, it relies on the following when encountering distorted flow rates. Maintain robustness. Finally, The input is a two-layer fully connected classifier containing Dropout layers, with the last layer using the Sigmoid activation function to output probabilities. .like If the traffic is detected, it is identified as DoH covert tunnel traffic, and the system generates a security alarm log and pushes it to the administrator console.

[0048] like Figure 4 As shown, the robust detection method system for DoH covert tunnels with anti-traffic shaping based on traffic shaping of the present invention includes a traffic acquisition module, a preprocessing module, a heavy-tailed random coding module, and an adaptive fusion detection module. The traffic acquisition module is used to capture DoH packets at the network boundary; the preprocessing module clusters according to bidirectional flow and extracts statistical feature vectors; the heavy-tailed random coding module is used to store heavy-tailed distributed random matrices and perform high-dimensional projection operations on the feature vectors; the adaptive fusion detection module deploys a dual-branch adaptive hybrid feature extraction network and a classifier to output covert tunnel detection results.

[0049] The DoH covert tunnel robust detection system of this invention is deployed at the core layer exit of an enterprise-level or campus-level network. Specific deployment parameters and hardware operating environment are as follows.

[0050] Network topology deployment: The detection system is connected to the network in a bypass manner through the mirror port of the optical splitter or core switch. This deployment method ensures that the traffic detection and analysis process does not introduce additional network latency to normal business traffic. The network traffic is mirrored to the collection network card of the detection server.

[0051] The hardware operating environment of this embodiment specifically includes computing nodes, acceleration hardware, network interfaces, and storage devices.

[0052] The compute nodes are equipped with dual Intel Xeon Silver 4214R processors and 128GB of DDR4 memory.

[0053] The system utilizes two NVIDIA GeForce RTX 2080 Ti graphics cards, leveraging their Tensor Cores to accelerate heavy-tailed random matrix multiplication (step S102) and real-time inference computation of a dual-branch deep neural network. The network interface employs an Intel X520-DA2 10 Gigabit Ethernet controller, meeting the requirements for real-time capture and feature extraction of large-scale traffic.

[0054] The storage device uses a 1TB NVMe solid-state drive for the operating system and real-time detection model, and an additional 4TB enterprise-grade mechanical hard drive for long-term storage of security audit logs.

[0055] The above software operating environment is set as follows: the operating system is Ubuntu 20.04 LTS, the traffic analysis engine is developed based on the Zeek framework, the deep learning inference is based on the PyTorch framework, and CUDA 11.0 is used to achieve parallel acceleration computing on the graphics card.

[0056] The technical solution of the present invention was further compared with two existing methods, and the results are shown in Table 1.

[0057] Table 1. Performance comparison results of this invention with other detection models

[0058]

[0059] Table 1 shows the performance comparison results of the detection method of this invention and existing mainstream detection models in multiple experimental scenarios. The experimental data all use the CIC public dataset. In the data scenario without any traffic distortion attacks (first group of experiments), the recall rate and F1 score of the technical solution of this invention reached 97.95% and 98.16% respectively, which are comparable to the current best random forest model, proving the detection capability of this invention in normal environments.

[0060] When subjected to traffic distortion attacks (second set of experiments), the performance of existing models all showed varying degrees of decline, revealing the extreme vulnerability of their feature extraction mechanisms to small perturbations. However, thanks to the heavy-tailed random feature encoding mechanism's ability to absorb local sparse perturbations, the present invention maintains an F1 score at a relatively high level of 95.5%.

[0061] Furthermore, although adversarial training (the third set of experiments) can restore some performance of existing models when facing known attacks, the generalization ability of the adversarial training model is severely limited when facing new and unknown traffic deformation attacks (the fourth set of experiments), and the F1 score drops again. In contrast, the technical solution of this invention can maintain an F1 score of 94.21% without retraining when dealing with completely new attack strategies.

[0062] The above-mentioned comparative experimental data demonstrate that the feature mapping and adaptive fusion mechanism adopted in this invention can exhibit relatively stable generalization robustness when facing known and unknown traffic shaping adversarial attacks.

Claims

1. A robust detection method for DoH concealed tunnels that defend against flow shaping, characterized in that, Includes the following steps: Step 1: Traffic Collection and Statistical Feature Extraction. First, deploy a traffic mirroring collection device at the network boundary to filter and reconstruct the DoH bidirectional flow, extract the numerical statistical features of the DoH bidirectional flow, and construct the original feature vector. , , For feature dimensions; Step 2, Heavy-tailed random feature encoding mapping: using a pre-generated heavy-tailed distributed random matrix For the original feature vector Perform random Fourier projection to generate a high-dimensional encoding vector with perturbation absorption properties. The projection kernel function of the random Fourier projection adopts the Cauchy distribution with heavy-tailed characteristics, and the Laplace kernel is simulated by projection through the Cauchy distribution. Step 3: Extract dual-branch adaptive hybrid features. First, construct a feature extraction network containing robust branches and semantic branches, and then encode the high-dimensional vectors. Input robust branch to extract perturbation-resistant global features, and convert the original feature vector The input semantic branch extracts local sequence spatiotemporal features, and then the dynamic fusion weights of the two branches are calculated through an attention mechanism to output fused features; Step 4, Hidden Tunnel Classification Decision: Input the fused features into the pre-trained fully connected classification layer, and output the classification probability. According to classification probability Determine whether the DoH bidirectional flow is a hidden tunnel.

2. The robust detection method for DoH concealed tunnels with defensive flow shaping as described in claim 1, characterized in that, The numerical statistical features in step 1 include the mean and variance of the forward packet length, the mean and variance of the reverse packet length, the mean and variance of the packet arrival time interval, and the duration of the bidirectional flow.

3. The robust detection method for DoH concealed tunnels with anti-flow shaping as described in claim 1, characterized in that, The heavy-tailed distributed random matrix in step 2 The matrix elements are sampled independently and identically distributed from the probability density function. ; γ is a scale parameter that controls the width of the distribution. The target projection dimension and satisfying ; The high-dimensional encoding vector The calculation formula is: ； in, , For random matrices The transpose of .

4. The robust detection method for DoH concealed tunnels with anti-flow shaping as described in claim 1, characterized in that, The robust branch in step 3 includes the processing The high-dimensional encoding vector of dimension A multilayer perceptron; the semantic branch includes a function for processing the original feature vector. One-dimensional convolutional neural networks or long short-term memory networks, ; The calculation method for dynamic fusion weights is as follows: first, the robust branch outputs the global features that resist disturbances. Local sequence spatiotemporal features of semantic branch output The features are concatenated along the channel dimension; the concatenated features are then processed by a global average pooling layer and a non-linear mapping layer to calculate dynamic weight coefficients. ; Fusion features The calculation formula is: ； 。 5. A system for implementing the robust detection method for DoH concealed tunnels with defensive flow shaping as described in any one of claims 1 to 4, characterized in that, It includes a traffic acquisition module, a preprocessing module, a heavy-tailed random coding module, and an adaptive fusion detection module. The traffic acquisition module is used to capture DoH packets at the network boundary; the preprocessing module clusters bidirectional flows and extracts statistical feature vectors; the heavy-tailed random encoding module is used to store heavy-tailed distributed random matrices and perform high-dimensional projection operations on the feature vectors. The adaptive fusion detection module is equipped with a dual-branch adaptive hybrid feature extraction network and a classifier to output the hidden tunnel detection results.

Images