Network malicious traffic detection method and device

Abstract

The application relates to the technical field of computer security, and provides a network malicious traffic detection method and device to solve the problem that network malicious traffic cannot be accurately detected and recognized in related technologies. First, network traffic features of a session flow are converted into a first word element feature vector; then, a second word element feature vector representing a time sequence dependency relationship of the session flow is determined; a fusion feature vector of the first word element feature vector and the second word element feature vector is subjected to classification detection processing to obtain a malicious traffic probability; then, a semantic feature vector describing semantic features of the session flow and a behavior feature vector describing context features of the session flow in a walk sequence are determined; the semantic feature vector and the behavior feature vector are compared to obtain an inconsistency probability; finally, a malicious traffic detection result of the session flow is determined according to the malicious traffic probability and the inconsistency probability. Through organic combination of multi-dimensional features, accurate recognition of complex malicious traffic is realized.

Description

Technical Field

[0001] This application relates to the field of computer security technology, and in particular to methods and devices for detecting malicious network traffic. Background Technology

[0002] In the field of cybersecurity, malicious traffic detection is a crucial technical means to maintain network security. Among related technologies, malicious traffic detection systems primarily rely on rule matching, statistical analysis, or simple machine learning algorithms. These methods suffer from the following problems: (1) Features extracted from network traffic data are usually heterogeneous continuous numerical or categorical variables. These features have low learnability and expressive power, making them difficult to be effectively processed by machine learning algorithms, resulting in low accuracy in identifying complex malicious behaviors or malicious traffic.

[0003] (2) Machine learning algorithms mostly use traditional supervised learning algorithms, such as random forests and support vector machines. These machine learning algorithms only detect each network traffic sample data, and the detection content is relatively one-sided. The detection accuracy is limited, resulting in a low accuracy rate in identifying complex malicious behaviors or malicious traffic.

[0004] Therefore, there is a lack of accurate methods for detecting and identifying malicious network traffic in related technologies. Summary of the Invention

[0005] The purpose of this application is to provide a method and device for detecting malicious network traffic, so as to solve the problem that the related technologies cannot accurately detect and identify malicious network traffic.

[0006] Firstly, this application provides a method for detecting malicious network traffic, the method comprising: For a session stream of a host device, the network traffic features of the session stream are converted into a first term feature vector; the network traffic features are used to characterize the network behavior information of the session stream. Based on the walk sequence and word vector model containing the session flow, a second lexical feature vector of the session flow is determined; the walk sequence is used to characterize the temporal dependencies of the host device behavior, and the second lexical feature vector is used to characterize the temporal dependencies of the session flow. The fused feature vector of the first word feature vector and the second word feature vector is subjected to classification and detection processing to obtain the probability of malicious traffic; The first lexical feature vector is mapped to obtain a semantic feature vector; and the second lexical feature vector is used to obtain a behavioral feature vector; the semantic feature vector is used to describe the semantic features of the conversation flow, and the behavioral feature vector is used to describe the contextual features of the conversation flow in the walk sequence. The semantic feature vector and the behavioral feature vector are compared to obtain the inconsistency probability; The malicious traffic detection result of the session stream is determined based on the malicious traffic probability and the inconsistency probability.

[0007] In one possible implementation, the following steps are used to generate the walk sequence: A host behavior graph of the host device is generated based on multiple session streams of the host device. The host behavior graph includes multiple connection edges, each of which corresponds to a session stream. Each connection edge is used to connect the host device and the target client of the session stream. One of the multiple connecting edges is taken as the starting edge, and the remaining connecting edges are taken as the edges to be transferred; For each edge to be transferred, the transfer probability of the starting edge jumping to the edge to be transferred is determined based on the timestamp of the starting edge and the timestamp of the edge to be transferred. Based on the obtained multiple transition probabilities, the target transition edge to which the starting edge jumps is determined; Add the starting edge and the target transition edge to the walking sequence; The target transition edge is used as the new starting edge, and the remaining connecting edges are used as the new edges to be transitioned. The process is repeated, and for each edge to be transitioned, the step of determining the transition probability of the starting edge jumping to the edge to be transitioned is performed based on the timestamp of the starting edge and the timestamp of the edge to be transitioned, until the length of the walking sequence is the preset length.

[0008] In one possible implementation, generating the host behavior graph of the host device based on multiple session flows of the host device includes: For each session stream of the host device, the session stream is converted into a connection edge; Based on the timestamp order of the session stream, the connection edges corresponding to the session stream are numbered to obtain the host behavior graph of the host device.

[0009] In one possible implementation, converting the network traffic features of the session stream into a first lexical feature vector includes: The lexical results of the session stream are extracted from the network traffic features of the session stream; the network traffic features include at least one of the following: basic statistical features, time-series features, protocol features, domain name features, geographical features, and security features; the lexical results include at least one of the following categories of lexical elements: traffic shape lexical elements, peer organization lexical elements, transport protocol lexical elements, port type lexical elements, top-level domain lexical elements, domain entropy value lexical elements, TLS status lexical elements, TLS handshake lexical elements, TLS version lexical elements, geographical location lexical elements, traffic size lexical elements, and packet quantity lexical elements; The word element results are compared with a preset word element table to obtain a first word element feature vector; the preset word element table includes the correspondence between words and word element feature vectors.

[0010] In one possible implementation, determining the second lexical feature vector of the conversation stream based on the walk sequence and word vector model containing the conversation stream includes: For each session stream, the following steps are performed: select a preset number of category words from the word result of the session stream; concatenate the preset number of category words into a string to obtain the session word key of the session stream; Based on the conversation lexical keys and word vector models of multiple conversation streams in the walk sequence containing the conversation stream, a vector lookup table is determined; the vector lookup table includes the correspondence between conversation lexical keys and lexical feature vectors; The second lexical feature vector of the conversation stream is determined from the vector lookup table.

[0011] In one possible implementation, determining the vector lookup table based on the conversation lexical keys and word vector models of multiple conversation streams in the walk sequence containing the conversation stream includes: For each walk sequence, the following steps are performed: concatenate the conversation lexical keys of multiple conversation streams in the walk sequence to obtain text training samples; The word vector model is trained using multiple obtained text training samples, and a vector lookup table is generated using the trained word vector model.

[0012] In one possible implementation, obtaining the behavior feature vector based on the second lexical feature vector includes: For each of the multiple walk sequences containing the session flow, determine the position of the connection edge corresponding to the session flow in the walk sequence; Based on the position of the connection edge corresponding to the session flow, determine multiple adjacent connection edges of the connection edge corresponding to the session flow within a preset window range; The average value of the second word feature vectors of the conversation streams corresponding to the multiple adjacent connection edges is taken as the feature vector to be mapped. The behavioral feature vector is obtained by mapping the feature vector to be mapped through a preset projection network.

[0013] In one possible implementation, the method further includes: If the conversation lexical key of the conversation stream is not matched in the vector lookup table, a preset random vector is generated and used as the second lexical feature vector of the conversation stream.

[0014] In one possible implementation, determining the malicious traffic detection result of the session stream based on the malicious traffic probability and the inconsistency probability includes: The probability of malicious traffic and the probability of inconsistency are weighted and fused to obtain the fused probability; If the fusion probability is greater than a preset probability threshold, then the session stream is determined to be malicious traffic; If the fusion probability is less than or equal to a preset probability threshold, then the session flow is determined to be normal traffic.

[0015] Secondly, this application provides a network malicious traffic detection device, the device comprising: The first lexical feature vector determination module is configured to convert the network traffic features of the session stream of the host device into a first lexical feature vector; the network traffic features are used to characterize the network behavior information of the session stream. The second lexical feature vector determination module is configured to determine the second lexical feature vector of the session stream based on the walk sequence containing the session stream and the word vector model; the walk sequence is used to characterize the temporal dependency of the host device behavior, and the second lexical feature vector is used to characterize the temporal dependency of the session stream. The malicious traffic probability determination module is configured to perform classification and detection processing on the fused feature vector of the first word feature vector and the second word feature vector to obtain the malicious traffic probability. The lexical feature vector mapping module is configured to map the first lexical feature vector to obtain a semantic feature vector; and to obtain a behavioral feature vector based on the second lexical feature vector; the semantic feature vector is used to describe the semantic features of the conversation flow, and the behavioral feature vector is used to describe the contextual features of the conversation flow in the walk sequence; The inconsistency probability determination module is configured to compare the semantic feature vector and the behavioral feature vector to obtain the inconsistency probability. The malicious traffic detection result determination module is configured to determine the malicious traffic detection result of the session stream based on the malicious traffic probability and the inconsistency probability.

[0016] In one possible implementation, the second lexical feature vector determination module is configured to generate the walking sequence using the following steps: A host behavior graph of the host device is generated based on multiple session streams of the host device. The host behavior graph includes multiple connection edges, each of which corresponds to a session stream. Each connection edge is used to connect the host device and the target client of the session stream. One of the multiple connecting edges is taken as the starting edge, and the remaining connecting edges are taken as the edges to be transferred; For each edge to be transferred, the transfer probability of the starting edge jumping to the edge to be transferred is determined based on the timestamp of the starting edge and the timestamp of the edge to be transferred. Based on the obtained multiple transition probabilities, the target transition edge to which the starting edge jumps is determined; Add the starting edge and the target transition edge to the walking sequence; The target transition edge is used as the new starting edge, and the remaining connecting edges are used as the new edges to be transitioned. The process is repeated, and for each edge to be transitioned, the step of determining the transition probability of the starting edge jumping to the edge to be transitioned is performed based on the timestamp of the starting edge and the timestamp of the edge to be transitioned, until the length of the walking sequence is the preset length.

[0017] In one possible implementation, the second lexical feature vector determination module is specifically configured to generate a host behavior graph of the host device based on multiple session streams of the host device, wherein the second lexical feature vector determination module is configured to: For each session stream of the host device, the session stream is converted into a connection edge; Based on the timestamp order of the session stream, the connection edges corresponding to the session stream are numbered to obtain the host behavior graph of the host device.

[0018] In one possible implementation, the step of converting the network traffic features of the session stream into a first lexical feature vector, wherein the first lexical feature vector determination module is specifically configured to: The lexical results of the session stream are extracted from the network traffic features of the session stream; the network traffic features include at least one of the following: basic statistical features, time-series features, protocol features, domain name features, geographical features, and security features; the lexical results include at least one of the following categories of lexical elements: traffic shape lexical elements, peer organization lexical elements, transport protocol lexical elements, port type lexical elements, top-level domain lexical elements, domain entropy value lexical elements, TLS status lexical elements, TLS handshake lexical elements, TLS version lexical elements, geographical location lexical elements, traffic size lexical elements, and packet quantity lexical elements; The word element results are compared with a preset word element table to obtain a first word element feature vector; the preset word element table includes the correspondence between words and word element feature vectors.

[0019] In one possible implementation, the step of determining a second lexical feature vector of the conversation stream based on the walk sequence and word vector model containing the conversation stream, wherein the second lexical feature vector determination module is specifically configured to: For each session stream, the following steps are performed: select a preset number of category words from the word result of the session stream; concatenate the preset number of category words into a string to obtain the session word key of the session stream; Based on the conversation lexical keys and word vector models of multiple conversation streams in the walk sequence containing the conversation stream, a vector lookup table is determined; the vector lookup table includes the correspondence between conversation lexical keys and lexical feature vectors; The second lexical feature vector of the conversation stream is determined from the vector lookup table.

[0020] In one possible implementation, the second lexical feature vector determination module is specifically configured to: determine a vector lookup table based on the lexical keys of multiple conversation streams in the walk sequence containing the conversation stream and a word vector model; For each walk sequence, the following steps are performed: concatenate the conversation lexical keys of multiple conversation streams in the walk sequence to obtain text training samples; The word vector model is trained using multiple obtained text training samples, and a vector lookup table is generated using the trained word vector model.

[0021] In one possible implementation, the step of obtaining the behavior feature vector based on the second lexical feature vector, wherein the lexical feature vector mapping module is specifically configured as follows: For each of the multiple walk sequences containing the session flow, determine the position of the connection edge corresponding to the session flow in the walk sequence; Based on the position of the connection edge corresponding to the session flow, determine multiple adjacent connection edges of the connection edge corresponding to the session flow within a preset window range; The average value of the second word feature vectors of the conversation streams corresponding to the multiple adjacent connection edges is taken as the feature vector to be mapped. The behavioral feature vector is obtained by mapping the feature vector to be mapped through a preset projection network.

[0022] In one possible implementation, the second lexical feature vector determination module is further configured to: If the conversation lexical key of the conversation stream is not matched in the vector lookup table, a preset random vector is generated and used as the second lexical feature vector of the conversation stream.

[0023] In one possible implementation, the malicious traffic detection result of the session stream is determined based on the malicious traffic probability and the inconsistency probability, wherein the malicious traffic detection result determination module is specifically configured to: The probability of malicious traffic and the probability of inconsistency are weighted and fused to obtain the fused probability; If the fusion probability is greater than a preset probability threshold, then the session stream is determined to be malicious traffic; If the fusion probability is less than or equal to a preset probability threshold, then the session flow is determined to be normal traffic.

[0024] Thirdly, this application provides an electronic device, comprising: Processor and memory; The memory is used to store the processor-executable instructions; The processor is configured to execute the instructions to implement the network malicious traffic detection method as provided in any of the first aspects of this application.

[0025] Fourthly, this application provides a computer-readable storage medium that, when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to perform a network malicious traffic detection method as described in any of the first aspects of this application.

[0026] Fifthly, this application provides a computer program product comprising: computer program code, which, when executed by a processor of an electronic device, enables the electronic device to perform a network malicious traffic detection method as described in any of the first aspects of this application.

[0027] The technical solutions provided by the embodiments of this application have at least the following beneficial effects: In this embodiment, by converting network traffic features into discrete lexical vectors, a unified and standardized representation of network traffic features is achieved, significantly improving the learnability and expressive power of network traffic features. This allows security analysts to intuitively understand the basis and logic of detection, facilitating accurate detection and identification of malicious network traffic. A random walk algorithm generates a walk sequence that reflects the temporal dependencies of host device behavior and generates a second lexical feature vector representing the temporal dependencies of session flows, effectively acquiring the temporal features of network traffic and providing high-quality data for subsequent vector learning. The first and second lexical feature vectors are fused through feature vector concatenation to form richer and more comprehensive host device behavior features. Through the organic combination of multi-dimensional features, accurate identification of complex malicious traffic is achieved. Semantic feature vectors and behavioral feature vectors are obtained, and by comparing the similarity of the two feature vectors, the detection capability for malicious network attacks is enhanced based on the "semantic-behavioral inconsistency" characteristic of malicious network traffic.

[0028] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and do not limit this application. Based on common knowledge in the art, the above preferred conditions can be combined arbitrarily to obtain various preferred embodiments of this application. Attached Figure Description

[0029] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This is a schematic diagram illustrating an application scenario of a network malicious traffic detection method provided in an embodiment of this application. Figure 2 This is a schematic diagram of the overall process of a network malicious traffic detection method provided in an embodiment of this application; Figure 3 A schematic diagram illustrating the process of converting network traffic features of a session stream into a first word feature vector, provided for an embodiment of this application; Figure 4 A schematic diagram of the process for generating a host behavior graph provided in an embodiment of this application; Figure 5 A schematic diagram of host behavior provided in an embodiment of this application; Figure 6 A schematic diagram of the process for generating a walk sequence provided in an embodiment of this application; Figure 7 A schematic diagram illustrating the process of obtaining behavioral feature vectors provided in an embodiment of this application; Figure 8 A flowchart illustrating the process of determining the malicious traffic detection result of a session flow based on the probability of malicious traffic and the probability of inconsistency, provided for an embodiment of this application; Figure 9 A schematic diagram of a network malicious traffic detection device provided in this application embodiment; Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. The described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0032] Furthermore, in the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in the text is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more.

[0033] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined with "first" or "second" may explicitly or implicitly include one or more of that feature.

[0034] The following explains the technical terms and technologies involved in this application: Tokenization features: Converting network traffic features into discrete tokens, similar to the lexicalization process in natural language processing, which facilitates vectorization representation and machine learning processing.

[0035] Word2Vec: A word vector training algorithm that learns distributed representations of words through neural networks, and is used to learn vector representations of network traffic feature tokens.

[0036] Host Behavior Graph: A graph structure with network hosts as nodes and network connections as edges, used to model the communication relationships and behavioral patterns between hosts.

[0037] Random walk: An algorithm that randomly selects paths to traverse a graph structure according to a certain strategy, used to generate walk sequence data that reflects the characteristics of the graph structure.

[0038] Session aggregation: Grouping multiple data packets belonging to the same network session or connection together to form a stream-level feature representation.

[0039] In the field of cybersecurity, malicious traffic detection is a crucial technical means to maintain network security. Traditional network intrusion detection systems mainly rely on rule matching, statistical analysis, or simple machine learning methods, which suffer from the following problems: (1) Features extracted from network traffic data are usually heterogeneous continuous numerical or categorical variables. These features have low learnability and expressive power, making them difficult to be effectively processed by machine learning algorithms, resulting in low accuracy in identifying complex malicious behaviors or malicious traffic.

[0040] (2) Machine learning algorithms mostly use traditional supervised learning algorithms, such as random forests and support vector machines. These machine learning algorithms only detect each network traffic sample data, and the detection content is relatively one-sided. The detection accuracy is limited, resulting in a low accuracy rate in identifying complex malicious behaviors or malicious traffic.

[0041] Therefore, there is a lack of accurate methods for detecting and identifying malicious network traffic in related technologies.

[0042] In view of this, this application provides a method and device for detecting malicious network traffic, in order to solve the problem that the related technologies cannot accurately detect and identify malicious network traffic.

[0043] The inventive concept of this application can be summarized as follows: First, the network traffic features of the session flow are converted into a first lexical feature vector; then, a second lexical feature vector representing the temporal dependency of the session flow is determined; and the fused feature vector of the first and second lexical feature vectors is subjected to classification detection processing to obtain the malicious traffic probability; then, a semantic feature vector describing the semantic features of the session flow and a behavioral feature vector describing the contextual features of the session flow in the walk sequence are determined; and the semantic feature vector and the behavioral feature vector are compared to obtain the inconsistency probability; finally, the malicious traffic detection result of the session flow is determined based on the malicious traffic probability and the inconsistency probability.

[0044] In summary, this embodiment of the application achieves a unified and standardized representation of network traffic features by converting network traffic features into discrete lexical vectors. This significantly improves the learnability and expressive power of network traffic features, enabling security analysts to intuitively understand the basis and logic of detection and facilitating accurate detection and identification of malicious network traffic. Through a random walk algorithm, a walk sequence reflecting the temporal dependencies of host device behavior is generated, along with a second lexical feature vector representing the temporal dependencies of session flows. This effectively acquires the temporal features of network traffic, providing high-quality data for subsequent vector learning. By concatenating feature vectors, the first and second lexical feature vectors are fused to form richer and more comprehensive host device behavior features. Through the organic combination of multi-dimensional features, accurate identification of complex malicious traffic is achieved. Semantic and behavioral feature vectors are obtained, and by comparing the similarity of the two feature vectors, the detection capability for malicious network attacks is enhanced based on the "semantic-behavioral inconsistency" characteristic of malicious network traffic.

[0045] After introducing the main inventive concepts of the embodiments of this application, the following is a brief description of the application scenarios to which the technical solutions of the embodiments of this application are applicable. It should be noted that the application scenarios described below are only for illustrating the embodiments of this application and are not intended to limit the scope. In specific implementation, the technical solutions provided by the embodiments of this application can be flexibly applied according to actual needs.

[0046] For ease of understanding, the following detailed description of a network malicious traffic detection method provided by an embodiment of this application, in conjunction with the accompanying drawings, is provided: like Figure 1 The diagram shown illustrates an application scenario of a network malicious traffic detection method provided in this embodiment. The diagram includes: a network 10, a server 20, and a storage device 30. The server 20 acquires various data, including network traffic data, through the network. Using the method provided in this embodiment, it performs network malicious traffic detection. Through the organic combination of multi-dimensional features, it achieves accurate identification of complex malicious traffic. The description in this application focuses on a single server only. However, those skilled in the art should understand that the illustrated network 10, server 20, and memory 30 are intended to illustrate the operation of the electronic devices, servers, and memory involved in the technical solutions of this application. The detailed description of a single server and memory is at least for ease of explanation and does not imply any limitation on the number, type, or location of servers. It should be noted that adding additional modules to or removing individual modules from the illustrated environment will not change the underlying concept of the exemplary embodiments of this application. Furthermore, although detailed descriptions are provided for ease of explanation... Figure 1 The diagram shows a bidirectional arrow from memory 30 to server 20, but those skilled in the art will understand that the sending and receiving of the aforementioned data also needs to be achieved through network 10.

[0047] It should be noted that the memory in the embodiments of this application can be, for example, a cache system, hard disk storage, memory storage, etc. Furthermore, the method for processing optically dispersed data proposed in this application is not only applicable to… Figure 1 The application scenarios shown can also be used in other possible application scenarios, and the embodiments of this application do not impose any limitations.

[0048] Based on the above description, the embodiments of this application provide a method for detecting malicious network traffic, the overall process of which is as follows: Figure 2 As shown, it includes the following steps: In step 201, for the session flow of the host device, the network traffic features of the session flow are converted into a first term feature vector.

[0049] Among them, network traffic features are used to characterize network behavior information of session flows.

[0050] In one possible implementation, since network traffic data packets may experience out-of-order delivery, retransmission, packet loss, etc. during transmission, and different protocols have different connection characteristics, this application embodiment will collect network traffic data and convert the network traffic data into a session stream, including the following: First, network traffic data is collected and preprocessed, specifically including: Raw packet capture: Collect raw network traffic packets through network probes or mirror ports. Supports PCAP format network packet capture. The packet capture process uses a high-performance lock-free queue mechanism to ensure no packet loss in high-traffic environments.

[0051] High-performance traffic parsing: Employs a high-performance traffic parsing engine to parse raw data packets in real time, specifically including: (a) Ethernet frame header parsing: Extracting source MAC address, destination MAC address, and Ethernet type field; (b) IP layer resolution: Supports IPv4 and IPv6 protocols, extracting fields such as source IP address, destination IP address, protocol type, packet length, TTL / hop count limit, etc. (c) Transport layer parsing: For TCP protocol, extract source port, destination port, sequence number, acknowledgment number, and flags (SYN, ACK, FIN, RST, etc.); for UDP protocol, extract source port, destination port, and data length. (d) Application layer resolution: Identify the characteristics of common protocols such as HTTP, HTTPS, DNS, FTP, and SSH.

[0052] Flow identifier generation: A unique flow identifier is generated based on the five-tuple information (source IP, destination IP, source port, destination port, protocol type). For bidirectional traffic, a normalized key-value generation method is used to ensure that packets in different directions of the same session flow are mapped to the same flow identifier.

[0053] Then, the preprocessed network traffic data undergoes session stream transformation and aggregation, specifically including: (a) TCP Connection Tracking: By monitoring the TCP three-way handshake (SYN, SYN-ACK, ACK) to establish a connection state table, the connection establishment time, last active time, and connection state are recorded. When a TCP four-way handshake (FIN, ACK, FIN, ACK) or the RST flag is detected, the connection is marked as terminated. The connection timeout is set to 300 seconds; connections that time out are automatically marked as terminated.

[0054] (b) UDP Session Aggregation: Since UDP is a connectionless protocol, a fixed time window is used for session aggregation. The default time window is 30 seconds, and all UDP packets of the same 5-tuple within 30 seconds are aggregated into a single session stream. The time window size can be adjusted according to the application scenario.

[0055] (c) Connection ID assignment: Assign a unique connection ID to each identified connection or session stream, using an atomic counter to ensure the uniqueness and thread safety of the ID.

[0056] The steps described above for collecting network traffic data and converting it into session streams lay a solid data foundation for subsequent multi-dimensional network traffic feature and behavior analysis.

[0057] In one possible implementation, after obtaining the session flow, this application embodiment will extract multi-dimensional network traffic features of the session flow, which include the following: (a) Basic statistical characteristics Packet count: Count the number of data packets from client to server (num_pkts_to_server_s_e) and from server to client (num_pkts_to_client_s_e) respectively. The total number of packets (total_pkts_s_e) is the sum of the number of packets in both directions.

[0058] Byte count statistics: Calculate the total number of bytes in both directions (total_bytes_to_server_s_e, total_bytes_to_client_s_e) and the total number of bytes (total_bytes_all_s_e).

[0059] Duration calculation: The duration of a stream is defined as the timestamp of the last packet minus the timestamp of the first packet.

[0060] Packet length statistics: Calculate the average packet length (avg_pkt_len_s_e), standard deviation of packet length (std_pkt_len_s_e), maximum packet length, and minimum packet length.

[0061] (b) Temporal characteristics

[0062] Packet length sequence: Extract the length sequence of the first 5 packets (len_seq_s_e_0 to len_seq_s_e_4) to capture the behavior pattern in the early stages of the connection.

[0063] Packet Interval Sequence: Calculate the time interval between consecutive data packets and extract the first 5 interval values ​​(int_seq_s_e_0 to int_seq_s_e_4).

[0064] Packet interval statistics: Calculate the mean packet interval (avg_iat_s_e) and the standard deviation of the packet interval (std_iat_s_e).

[0065] (c) Protocol characteristics

[0066] Transport protocol identification: Identifies transport layer protocols such as TCP, UDP, and ICMP.

[0067] Application protocol identification: Identifies application protocols such as HTTP, HTTPS, DNS, FTP, SSH, and Telnet by using port numbers, load characteristics, etc.

[0068] TLS Feature Extraction: Detect the TLS handshake process and extract the TLS version (tls_ver_hex_s_e, represented in hexadecimal, such as 0x0303 representing TLS 1.2), cipher suite list (tls_cipher_s_e_0 to tls_cipher_s_e_4), client Hello packet existence (tls_has_client_hello_s_e), and TLS usage flags (is_tls_s_e).

[0069] (d) Domain Characteristics

[0070] Domain name extraction: Extract domain name information from DNS lookup, HTTP Host header, and TLS SNI field.

[0071] Domain name statistics characteristics: Calculate domain name length (dom_len), number of domain name levels (dom_level), punctuation ratio (dom_punct_ratio), numeric character ratio (dom_digit_ratio), and non-alphanumeric character ratio (dom_non_alnum_ratio).

[0072] Domain entropy calculation: The randomness of a domain name (dom_etld_p1_entropy) is calculated using the Shannon entropy formula. A high entropy value may indicate the use of a Domain Name Generation Algorithm (DGA).

[0073] Top-level domain risk assessment: Based on historical threat intelligence of top-level domains, domains are classified into categories such as high-risk, common, new general top-level domains, and country code top-level domains.

[0074] (e) Geographical features

[0075] GeoIP Query: Query the geographic location information of a target IP, including the country (dst_geo_country), through the MaxMind GeoLite2 database.

[0076] ASN information extraction: Query the Autonomous System Number (dst_geo_asn_number) and organization information (dst_geo_asn_org) of the target IP.

[0077] Organization type classification: Network organizations are classified into categories such as cloud service providers (Cloud), CDN, ISP / hosting service providers (ISP_Hosting), educational and research institutions (EduResearch), and unknown (UNK).

[0078] (f) Security features: Assess the use of encryption and authentication.

[0079] This application's embodiments perform deep feature mining on each session stream from multiple dimensions to construct a comprehensive traffic profile. The multi-dimensional network traffic features cover six categories: basic statistical features reflecting the scale and distribution characteristics of traffic; temporal features capturing communication time patterns; protocol features identifying the use of application and transport layer protocols; domain name features analyzing the structure and security risks of target domains; geographic features locating the geographical location and organizational affiliation of communication targets; and security features assessing the use of encryption and authentication. These multi-dimensional network traffic features ensure a comprehensive characterization of network behavior, providing rich data support for the accurate identification of malicious behavior.

[0080] In one possible implementation, after extracting the multi-dimensional network traffic features of the session stream, the embodiments of this application convert the network traffic features of the session stream into a first lexical feature vector, the process of which is as follows: Figure 3 As shown, it includes the following steps: In step 301, the lexical results of the session stream are extracted from the network traffic features of the session stream.

[0081] In step 302, the word element results are compared with the preset word element table to obtain the first word element feature vector.

[0082] The preset lexical table contains 58 lexical units in 12 categories. The 12 categories of lexical units include: traffic shape lexical units, peer organization lexical units, transport protocol lexical units, port type lexical units, top-level domain lexical units, domain entropy value lexical units, TLS status lexical units, TLS handshake lexical units, TLS version lexical units, geographic location lexical units, traffic size lexical units, and packet quantity lexical units. The preset lexical table includes the correspondence between lexical units and lexical feature vectors.

[0083] The preset lexical table specifically includes the following 12 categories of lexical elements: (a) Traffic shape tegature (fshape, 11): Based on the combination of data transmission volume, duration and uplink / downlink traffic ratio, the behavioral pattern of the session flow is abstracted into discrete semantic tags: fshape=Empty, fshape=TinyInteractive, fshape=HeavyUpload, fshape=HeavyDownload, fshape=LargeInteractive, fshape=MediumUpload, fshape=MediumDownload, fshape=MediumInteractive, fshape=SmallUpload, fshape=SmallDownload, fshape=SmallInteractive.

[0084] (b) Peer organization terms (Peer_org, 6 terms): Network organization type classification based on ASN query results: Peer_org=UNK, Peer_org=Cloud, Peer_org=CDN, Peer_org=ISP_Hosting, Peer_org=EduResearch, Peer_org=Other.

[0085] (c) Transport protocol terms (Proto, 3): Proto=TCP, Proto=UDP, Proto=ICMP.

[0086] (d) Port category terms (Port_cat, 7 terms): Port classification based on port number and application layer protocol: Port_cat=HTTPS, Port_cat=HTTP, Port_cat=DNS, Port_cat=FTP, Port_cat=SSH, Port_cat=WellKnownOther, Port_cat=RegOrDyn.

[0087] (e) Top-level domain terms (Name_tld, 7): Based on historical threat intelligence and type classification of top-level domains: Name_tld=NoDom, Name_tld=NoTLD, Name_tld=High, Name_tld=Common, Name_tld=NewgTLD, Name_tld=ccTLD, Name_tld=Other.

[0088] (f) Domain Entropy Value Term (Name_ent, 5 terms): Segmentation and classification based on domain Shannon entropy value, used to identify DGA domains: Name_ent=None, Name_ent=Low, Name_ent=Medium, Name_ent=High, Name_ent=VeryHigh.

[0089] (g) TLS status tokens (tls_status, 2): Boolean mapping based on the is_tls_s_e field: tls_status=Yes, tls_status=No.

[0090] (h) TLS handshake terms (tls_hello, 2 terms): Boolean mapping based on the tls_has_client_hello_s_e field: tls_hello=Yes, tls_hello=No.

[0091] (i) TLS version tokens (tls_ver, 5): based on the hexadecimal value of tls_ver_hex_s_e: tls_ver=TLS10 (0x0301), tls_ver=TLS11 (0x0302), tls_ver=TLS12 (0x0303), tls_ver=TLS13 (0x0304), tls_ver=Unknown.

[0092] (j) Geographic location terms (geo_country, 4 terms): Based on the country classification of GeoIP query results: geo_country=China, geo_country=US, geo_country=Unknown, geo_country=Other.

[0093] (k) Traffic size terms (size_cat, 5 terms): Segmentation based on total bytes (total_bytes_all_s_e): size_cat=Tiny (≤1KB) size_cat=Small (1KB-10KB), size_cat=Medium (10KB-100KB), size_cat=Large (100KB-1MB), size_cat=Huge (>1MB).

[0094] (l) Packet quantity token (pkt_count, 4 tokens): Segmentation classification based on the total number of packets (total_pkts_s_e): pkt_count=Few (≤5), pkt_count=Some (6-20), pkt_count=Many (21-100), pkt_count=Lot (>100).

[0095] It should be supplemented that, for numerical tokens such as traffic volume (total_bytes_all_s_e) and packet quantity (total_pkts_s_e), the embodiments of the present application use a fixed threshold segmentation method based on business semantics to determine the corresponding token result of different session flows.

[0096] Take traffic volume as an example: When the total number of bytes of the session flow satisfies total_bytes_all_s_e≤1024, the traffic volume token is determined as size_cat=Tiny; When the total number of bytes of the session flow satisfies 1024<total_bytes_all_s_e≤10240, the traffic volume token is determined as size_cat=Small; When the total number of bytes of the session flow satisfies 10240<total_bytes_all_s_e≤102400, the traffic volume token is determined as size_cat=Medium; When the total number of bytes of the session flow satisfies 102400<total_bytes_all_s_e≤1048576, the traffic volume token is determined as size_cat=Large; When the total number of bytes of the session flow satisfies total_bytes_all_s_e>1048576, the traffic volume token is determined as size_cat=Huge.

[0097] Take the number of packets as an example: When the total number of packets of the session flow satisfies total_pkts_s_e≤5, the packet quantity token is determined as pkt_count=Few; When the total number of packets of the session flow satisfies 6≤total_pkts_s_e≤20, the packet quantity token is determined as pkt_count=Some; When the total number of packets of the session flow satisfies 21≤total_pkts_s_e≤100, the packet quantity token is determined as pkt_count=Many; When the total number of packets of the session flow satisfies total_pkts_s_e>100, the packet quantity token is determined as pkt_count=Lot.

[0098] For categorized terms such as TLS version (tls_ver_hex_s_e) and geographic location (dst_geo_country), the embodiments of this application determine the corresponding term results for different session streams based on different types.

[0099] For the TLS version (tls_ver_hex_s_e), a direct mapping is used based on the hexadecimal version number: When the hexadecimal version number of the session stream is 0x0301, the TLS version term tls_ver is determined to be TLS10. When the hexadecimal version number of the session stream is 0x0302, the TLS version term tls_ver is determined to be TLS11. When the hexadecimal version number of the session stream is 0x0303, the TLS version term tls_ver is determined to be TLS12. When the hexadecimal version number of the session stream is 0x0304, the TLS version term tls_ver is determined to be TLS13. If the hexadecimal version number of the session stream is any other, then the TLS version term tls_ver=Unknown is determined.

[0100] For geographic location (dst_geo_country), mapping based on GeoIP query results: If the GeoIP query result of the session stream is "China", then the geolocation term geo_country=China is determined; If the GeoIP query result of the session stream is "United States", then the geolocation term geo_country=US is determined; If the GeoIP query result of the session stream is "Unknown" or "UNK_Country", then the geolocation term geo_country=Unknown is determined. If the GeoIP query result of the session stream is "Other", then the geolocation term geo_country=Other is determined.

[0101] The above 58 terms are extracted from different fields of the session stream. For fields that fail to be parsed, this embodiment uses an empty term list for term mapping. For example, if the flow shape term fshape fails to be parsed, it is represented by an empty term. For missing fields, this embodiment uses default values ​​for term mapping. For example, if the TLS status term is missing, it is represented by the default value is_tls_s_e=0.

[0102] The above steps of converting the network traffic features of the session stream into the first term feature vector use one-hot sparse coding to represent the first term feature vector of each session stream as a 58-dimensional sparse vector. Each dimension in the vector corresponds to a term identifier in a preset term table. If the session stream has a certain term, the corresponding dimension value is 1.0, otherwise it is 0.0. For example, in the term result of the session stream, if the traffic shape term fshape=Empty and the top-level domain term Name_tld=NoDom, then these two dimension values ​​are set to 1.0, and the remaining 56 dimension values ​​are set to 0.0.

[0103] In this embodiment, each of the 12 category lexical units can be encoded into a numerical dimension to form a 12-dimensional dense vector, which serves as the first lexical feature vector of the conversation stream, making it suitable for resource-constrained deployment scenarios.

[0104] The steps described above for converting the network traffic features of the session stream into first term feature vectors achieve a unified and standardized representation of network traffic features by converting them into discrete term vectors. This significantly improves the learnability and expressive power of network traffic features, enabling security analysts to intuitively understand the basis and logic of detection. It facilitates accurate detection and identification of malicious network traffic, is independent of message content, is suitable for encrypted traffic scenarios, and has a significantly lower computational cost than the BERT model.

[0105] In one possible implementation, after converting the network traffic features of the session stream into a first lexical feature vector, this embodiment of the application further selects a preset number of category lexicals from the lexical results of the session stream, concatenates the preset number of category lexicals into a string, and obtains the session lexical key of the session stream.

[0106] For example, for each conversation stream, a set of category words are selected from the word word results and concatenated into a string in a fixed order, which serves as the sample text data for that conversation stream during the word vector model training process; The construction rules for conversation lexical keys are as follows: SessionKey=Proto+"|"+Port_cat+"|"+fshape+"|"+tls_status+"|"+tls_hello+"|"+geo_country+"|" +size_cat+"|"+pkt_count+"|"+tls_ver; In this context, "|" is the field separator; Example construction: The token result of a certain session stream is: Proto=TCP, Port_cat=HTTPS, fshape=MediumInteractive, tls_status=Yes, tls_hello=Yes, geo_country=Other, size_cat=Medium, pkt_count=Many, tls_ver=TLS12, then its session token key is: TCP|HTTPS|MediumInteractive|Yes|Yes|Other|Medium|Many|TLS12.

[0107] This application's embodiments, through the step of constructing session lexical keys, enable the same type of session flow to be mapped to the same SessionKey in different datasets, thereby obtaining the same vector representation. This achieves cross-dataset transferable training and inference without relying on instance numbers or flow indexes bound to data files, solving the problem of traditional graph embedding methods using node IDs as vocabulary, which prevents data transfer. The category lexical elements selected in the session lexical keys (protocol type, port type, traffic shape, TLS status, etc.) are all traffic semantic attributes, possessing consistent semantic meaning in different network environments, ensuring semantic stability. The 58-dimensional or 12-dimensional first lexical feature vector is compressed into a single string key, allowing the word vector model to map the session lexical key into a low-dimensional dense vector, achieving a dimensionality reduction effect for the feature vector.

[0108] In step 202, the second lexical feature vector of the conversation stream is determined based on the walk sequence containing the conversation stream and the word vector model.

[0109] Among them, the walking sequence is used to characterize the temporal dependencies of the host device behavior, and the second lexical feature vector is used to characterize the temporal dependencies of the session flow.

[0110] In one possible implementation, before acquiring the walk sequence containing the session flow, embodiments of this application generate a host behavior graph of the host device, such as... Figure 4 As shown, it includes the following steps: In step 401, for each session stream of the host device, the session stream is converted into a connection edge.

[0111] In step 402, the connection edges corresponding to the session streams are numbered according to the timestamp order of the session streams to obtain the host behavior graph of the host device.

[0112] It should be noted that in this embodiment of the application, all session streams of each host device are sorted in ascending order by timestamp, and a continuous sequence number (conn_order) starting from 0 is assigned to the session stream by groupby+cumcount. conn_order is an integer sequence, where 0 represents the first session stream of the host device in the observation period, 1 represents the second, and so on. The connection edge corresponds one-to-one with the session stream.

[0113] For example, such as Figure 5 The host behavior graph shown shows that the host device generates a total of 5 session streams during the observation period. These 5 session streams are converted into 5 connection edges, with each connection edge corresponding to a session stream. Each connection edge is used to connect the host device and the target client of the session stream. The host ID is identified by the source IP address (src_ip_anon field). Each edge attribute includes: sequence number (conn_order) and the first lexical feature vector corresponding to the session stream.

[0114] In one possible implementation, after obtaining the host behavior graph of the host device, this embodiment of the application will generate a walk sequence, the process of which is as follows: Figure 6 As shown, it includes the following steps: In step 601, one of the multiple connecting edges is taken as the starting edge, and the remaining connecting edges are taken as the edges to be transferred.

[0115] In step 602, for each edge to be transferred, the transfer probability of the starting edge jumping to the edge to be transferred is determined based on the timestamp of the starting edge and the timestamp of the edge to be transferred.

[0116] In step 603, the target transition edge for the starting edge is determined based on the obtained multiple transition probabilities.

[0117] In step 604, the starting edge and the target transition edge are added to the walk sequence.

[0118] In step 605, the target transition edge is taken as the new starting edge, and the remaining connecting edges are taken as the new edges to be transitioned. The process is then repeated. For each edge to be transitioned, the transition probability of the starting edge jumping to the edge to be transitioned is determined based on the timestamp of the starting edge and the timestamp of the edge to be transitioned, until the length of the walking sequence is the preset length.

[0119] This application employs a weighted random walk algorithm based on timestamp differences to perform weighted random sampling on multiple connection edges in the host device's behavior graph, generating a walk sequence representing the temporal dependencies of the host device's behavior. Specifically, this includes: (a) Walk generation parameters: Generate γ random walk sequences for each host device (default γ=2, can be adjusted according to the amount of data); The length of each walk sequence is fixed at L steps (preset length L, default L=10). The roaming space is the host behavior graph of this host device, and it does not roam across hosts; (b) Transfer weight calculation formula: For the current connection edge, calculate its transfer weight with other connection edges of the same host, as shown in the following formula (1): (1) in, For connecting edges timestamp, For connecting edges timestamp, , The timestamp difference between the two connecting edges. To prevent small constants from being divided by zero, the value is taken as 1e-6; The smaller the timestamp difference between two session flows, the closer the corresponding two connection edges are in time, and the greater the transfer weight; the larger the timestamp difference, the farther apart the two connection edges are in time, and the smaller the transfer weight. This makes random walk tend to transfer between connections that are close in time, thereby maintaining the temporal characteristics of network traffic. (c) Transition probability normalization: from the connection edge Transfer to the connecting edge The probability of is shown in the following formula (2):

[0120] Among all the connection edges with the host device, ≠ ; The smaller the timestamp difference, the higher the transition probability of the connecting edge, while keeping the sum of the probabilities of all possible transitions to 1; (d) The process of wandering: 1. Randomly select one connection edge from the multiple connection edges of the host device as the starting edge; 2. Calculate the transfer weights of the current starting edge and all edges to be transferred on the same host device; 3. Based on the normalized transition probabilities, use weighted random choice to select the target transition edge from the starting edge; 4. Repeat steps 2-3 until the sequence length reaches L; 5. Arrange the selected connecting edges into a walk sequence in order; 6. Repeat the above process γ times for each host device.

[0121] (e) Example of a walking sequence: Assume that host_A has 3 connected edges with timestamps as follows: Edge_1: t=100.0 seconds; Edge_2: t=101.0 seconds; Edge_3: t=103.0 seconds; Using Edge_1 as the starting edge, calculate the weight: w(Edge_1,Edge_2)=1.0 / (|100.0-101.0| +1e-6)=1.0 / 1.000001≈1.0; w(Edge_1,Edge_3)=1.0 / (|100.0-103.0|+1e-6)=1.0 / 3.000001≈0.333; Normalized transition probabilities: P(Edge_1→Edge_2)=1.0 / (1.0+0.333)≈0.75; P(Edge_1→Edge_3)=0.333 / (1.0+0.333)≈0.25; Edge_2, with a smaller timestamp difference, has a higher transition probability, resulting in a walk sequence that includes Edge_1 and Edge_2.

[0122] The above-described steps for generating walk sequences, through a weighted random walk algorithm based on timestamp differences, can capture the temporal dependencies of host device network behavior. By using the reciprocal of the timestamp difference between session flows as the transition weight, session flows with similar timestamps have a higher transition probability, effectively maintaining the temporal characteristics of network traffic. Unlike general graph embedding methods such as DeepWalk and Node2Vec, which are based on uniform sampling or structural similarity-based random walks, the weighting mechanism of this application embodiment is specifically adapted to the temporal characteristics of network traffic, providing high-quality walk sequence data for subsequent vector learning.

[0123] In one possible implementation, after obtaining the conversation lexical keys of multiple conversation streams in a walk sequence containing conversation streams, for each walk sequence, the following steps are performed: concatenating the conversation lexical keys of multiple conversation streams in the walk sequence to obtain text training samples; and using the obtained multiple text training samples to train the word vector model, and generating a vector lookup table through the trained word vector model.

[0124] Taking the Word2Vec model as an example, the process of training the model and determining the second word feature vector of the conversation flow includes: (a) Use the conversation lexical keys of multiple conversation streams in the walk sequence generated by random walk as text training samples; where the conversation lexical keys of each conversation stream can be regarded as a whole; (b) Training parameter configuration: Model: skip-gram (sg=1); Window size: 3; Minimum word frequency: 0 (retain all words, without filtering based on frequency); Number of training threads: 1 (to ensure reproducible training results); Random seed: 42; (c) After training, the model generates a vector lookup table that forms the correspondence between conversation lexical keys and lexical feature vectors; (d) Determine the lexical feature vector corresponding to the lexical key of the conversation from the vector lookup table, that is, the second lexical feature vector of the conversation flow.

[0125] In one possible implementation, if the conversation lexical key of the conversation stream is not found in the vector lookup table, a preset random vector is generated and used as the second lexical feature vector of the conversation stream.

[0126] For example, when a conversational lexical key is not found in the vector lookup table (i.e., the conversational lexical key has not appeared during the training phase), a D-dimensional small random vector (a random value with a mean of 0 and an amplitude of 0.1) is generated as the second lexical feature vector. This second lexical feature vector can be used to concatenate and fuse with the first lexical feature vector to ensure that subsequent detection can still be performed in the case of a miss.

[0127] In step 203, the fused feature vector of the first word feature vector and the second word feature vector is subjected to classification detection processing to obtain the probability of malicious traffic.

[0128] In one possible implementation, embodiments of this application fuse and normalize the first and second lexical feature vectors of the same conversation stream, including the following steps: (a) For each session stream, obtain the first lexical feature vector (T-dimensional, 58-dimensional or 12-dimensional, tokenized feature vector) and the second lexical feature vector (D-dimensional, Word2Vec vector). (b) The two feature vectors are concatenated into a fused feature vector, as shown in the following formula (3): (3) in, To fuse feature vectors, The first word feature vector, The second word feature vector has a dimension of D+T; (c) L2 normalization: The fused feature vector is normalized using the L2 norm, as shown in the following formula (4): (4) in, This is the normalized fused feature vector. for The L2 norm; like If the value is 0, then the normalized vector remains a zero vector.

[0129] The embodiments of this application eliminate the influence of differences in feature dimensions between different session streams through the above-described normalization steps, so that the feature vectors of each session stream have the same magnitude (magnitude of 1 or 0), which facilitates fair weighting during subsequent host-level aggregation.

[0130] In another possible implementation, the embodiments of this application can also perform weighted aggregation and normalization of the feature vectors at the host level, including the following: (a) Host-level weighted aggregation: For each host device, the normalized feature vectors of all session streams of that host device are collected, and weighted aggregation is performed based on the sequential number of the session streams to obtain the host feature vector, as shown in the following formula (5): e(5) in, Host feature vector, session flow weights , The sequence number of session stream e.

[0131] Since earlier session flows better reflect the initial behavioral intent of the host device (such as C&C back connections which usually occur in the early stages after the host is infected), session flows with smaller sequence numbers (i.e. earlier times) receive higher weights. For example, a session flow with a sequence number of 0 has a weight of 1.0, a session flow with a sequence number of 1 has a weight of 0.5, and a session flow with a sequence number of 2 has a weight of 0.333, thus giving higher weights to early connection patterns in the host behavior sequence.

[0132] (b) Host-level L2 normalization: The host feature vector after weighted aggregation is normalized by the L2 norm, as shown in the following formula (6): |(6) like If | is 0, then the normalized host feature vector Keep it as a zero vector.

[0133] The embodiments of this application eliminate the impact of differences in the number of session streams between different hosts through the above-described normalization steps, so that the feature vectors of each host have the same magnitude, which facilitates unified processing by the classifier.

[0134] In one possible implementation, the embodiments of this application train a classifier and use the trained classifier to classify and detect the fused feature vector of the first word feature vector and the second word feature vector to obtain the probability of malicious traffic.

[0135] Using a random forest classifier as an example, the training process of the classifier includes the following: (a) The fusion feature vector of the first word feature vector and the second word feature vector has a dimension of 58+32=90. This fusion feature vector is used as input and the label (benign / malicious) is used as output. (b) The parameter configuration for the random forest classifier is as follows: Number of trees (n_estimators): 100; Maximum depth: None; Random seed: 42; It should be noted that the parameters of the classifier will differ depending on the dimension of the input feature vector. For example, when the dimension of the input feature vector is 12, strong regularization parameters are used to prevent overfitting. The parameters of the random forest classifier can be adjusted to have 30 trees, a maximum depth of 3, a minimum number of samples for splitting of 8, a minimum number of samples for leaves of 4, and a maximum number of features of √n_features. The specific parameters can be adjusted according to actual needs. (c) Stratified KFold cross-validation is used to evaluate the performance of the random forest classifier to ensure that the ratio of positive and negative samples is consistent in each fold and to avoid evaluation bias caused by sample imbalance. (d) Save the trained random forest classifier and related parameters.

[0136] The fused feature vector is input into a trained random forest classifier, and the resulting detection results contain the following information: Host identifier (src_host), probability of malicious traffic (predicted_probability), predicted label (predicted_label: 0=benign, 1=malicious), host session flow count (host_record_count), confidence assessment.

[0137] The above steps fuse the first word feature vector with the second word feature vector by concatenating feature vectors to form richer and more comprehensive host device behavior features. Through the organic combination of multi-dimensional features, accurate identification of complex malicious traffic is achieved.

[0138] In step 204, the first word feature vector is mapped to obtain a semantic feature vector; and the behavior feature vector is obtained based on the second word feature vector.

[0139] In one possible implementation, the semantic feature vector is obtained based on the first lexical feature vector of the session stream, and is used to describe the discrete semantic attributes of the session stream, that is, what the session stream "is", including explicit attribute information such as protocol type, port type, traffic shape, TLS status, and geographical location. The behavioral feature vector is obtained from the second lexical feature vector of the session stream and is used to describe "what is happening around the session stream", that is, the behavioral pattern of the session stream in the roaming sequence of the host device.

[0140] In one possible implementation, in step 204, the behavior feature vector is obtained based on the second word feature vector, and the process is as follows: Figure 7 As shown, it includes the following: In step 701, for each of the multiple walk sequences containing session flows, the position of the connection edge corresponding to the session flow in the walk sequence is determined.

[0141] In step 702, based on the position of the connection edge corresponding to the session flow, multiple adjacent connection edges of the connection edge corresponding to the session flow within a preset window range are determined.

[0142] In step 703, the average value of the second word feature vectors of the conversation streams corresponding to multiple adjacent connection edges is used as the feature vector to be mapped.

[0143] In step 704, the feature vector to be mapped is mapped by a preset projection network to obtain the behavior feature vector.

[0144] For example, the specific calculation of behavioral feature vectors includes: The connection edge corresponding to the current session flow is e, and this connection edge is located at position p in the walk sequence. Then, this connection edge is denoted as e_p. The preset window size is W (default W=3). The feature vector to be mapped is as shown in the following formula (7): (7) in, For connecting edges The second lexical feature vector is determined by the conversation lexical key in the vector lookup table generated by the word vector model; When there are fewer than W neighboring edges (such as at the beginning or end of the walk sequence), the mean of the actual neighboring edges in the walk sequence is calculated.

[0145] It should be noted that the behavioral feature vector is derived from the second word feature vector of the neighboring session stream, rather than the second word feature vector of the current session stream itself. Even if two session streams have the same second word feature vector, their behavioral feature vectors will be different if their contexts in the host behavior sequence are different. This makes the semantic feature vector and the behavioral feature vector conditionally independent, which is a prerequisite for the effectiveness of subsequent comparative learning.

[0146] Since the first word feature vector is usually 58-dimensional and the second word feature vector or the feature vector to be mapped is usually 32-dimensional, the two have different dimensions and different semantic spaces. The application embodiment maps their two features to a unified shared embedding space through two independent projection networks. The dimension d_shared of this shared embedding space is 16-dimensional by default. The projection mapping process of the semantic feature vector is shown in the following formula (8): (8) in, The first word feature vector is 58-dimensional. The projection matrix is ​​d_shared×58. For bias; The projection mapping process of the behavioral feature vector is shown in the following formula (9): (9) in, It is a 32-dimensional feature vector to be mapped (the same dimension as the second word feature vector). The projection matrix is ​​d_shared×32. For bias; After projection, semantic feature vector and behavioral feature vector Both are 16-dimensional vectors located in the same shared embedding space, which can be used to directly calculate similarity.

[0147] In step 205, the semantic feature vector and the behavioral feature vector are compared to obtain the inconsistency probability.

[0148] In one possible implementation, the semantic feature vector and the behavioral feature vector are compared to obtain the inconsistency probability, which includes the following: Based on semantic feature vectors and behavioral feature vector The cosine distance in the shared embedding space determines the inconsistency probability, as shown in formula (10) below: (10) The inconsistency probability range is [0,2] (cosine distance range). The semantic attributes of a normal conversation flow are consistent with the contextual behavior pattern, that is, the semantic feature vector and the behavioral feature vector are consistent, and the probability of inconsistency is close to 0. The semantic attributes of a malicious session stream are disguised as normal, but its behavioral context (such as periodic heartbeat connections around C&C communication, and similar probe connections around port probes) deviates from the disguised semantic attributes. That is, the semantic feature vector and the behavioral feature vector are inconsistent, and the probability of inconsistency is high.

[0149] In another possible implementation, this application embodiment can also perform host-level inconsistency probability aggregation. For each host device, the inconsistency probability of all session streams of that host device is collected, and the same weighted aggregation strategy as the host feature vector weighted aggregation is adopted, that is, the sequential number of the session stream is used for weighted aggregation to calculate the host inconsistency probability, as shown in the following formula (11): (11) in, Host inconsistency probability, session flow weight , Assign sequential numbering to session flow e to give higher weight to the inconsistency probability of earlier session flows.

[0150] The above steps are based on the "semantic-behavioral inconsistency" characteristic of malicious network traffic. By comparing the similarity between the semantic feature vectors and behavioral feature vectors of the same session stream, the detection capability of malicious network attacks is enhanced.

[0151] In step 206, the malicious traffic detection result of the session stream is determined based on the malicious traffic probability and the inconsistency probability.

[0152] In one possible implementation, the malicious traffic detection result of the session stream is determined based on the malicious traffic probability and the inconsistency probability, as follows: Figure 8 As shown, it includes the following steps: In step 801, the probability of malicious traffic and the probability of inconsistency are weighted and fused to obtain the fused probability; In step 802, if the fusion probability is greater than a preset probability threshold, the session flow is determined to be malicious traffic; In step 803, if the fusion probability is less than or equal to a preset probability threshold, the session flow is determined to be normal traffic.

[0153] For example, the probability of malicious traffic and the probability of inconsistency are weighted and fused to obtain the fused probability, as shown in the following formula (12): (12) in, This represents the probability of malicious traffic. For the probability of inconsistency, Normalize the inconsistency probability to the interval [0, 1]. For fusion weights (default) =0.6), which can be adjusted according to the actual scenario; When fusion probability When the probability exceeds a preset threshold (default 0.5), the session flow is determined to be malicious traffic. The above weighted fusion steps ensure that even if the classifier misses a report due to a lack of attack samples of a certain type in the training data, the inconsistency probability can still capture semantic-behavioral deviation signals, achieving supplementary detection of unknown attacks or unknown malicious traffic.

[0154] It should be noted that the normalized host feature vector Corresponding to the host device, the host inconsistency probability Corresponding to the host device, the normalized fused feature vector Corresponding to the session flow, the inconsistency probability of semantic feature vectors and behavioral feature vectors Corresponding to the session flow; in the step of weighting the probability of malicious traffic and the probability of inconsistency, for a specific session flow, based on the normalized fusion feature vector corresponding to that session flow. Determine the probability of malicious traffic, and the inconsistency probability between the probability of malicious traffic and the corresponding session flow. Processing is performed to determine the malicious traffic detection result of the session stream; for the entire host device, based on the normalized host feature vector corresponding to the host device. Determine the probability of malicious traffic, and compare the probability of malicious traffic with the host inconsistency probability corresponding to the host device. Process the data to determine the malicious traffic detection results of the host device.

[0155] The following describes a specific embodiment of the network malicious traffic detection method provided in this application: Example 1: In a corporate network, host device Host_192.168.1.100 was infected with malware and began covertly communicating with an external C&C server. The detection process for malicious network traffic is as follows: Step 1: Raw Traffic Capture and Session Aggregation: Network communication packets from Host_192.168.1.100 were captured. After five-tuple session aggregation, a suspicious session flow was identified: Source address: 192.168.1.100:49152; Target address: 203.0.113.45:443; Protocol: TCP; Duration: 127.5 seconds; Total number of packets: 245; Total number of bytes: 87,432 bytes; Step 2: Multi-dimensional feature extraction: Extract rich multi-dimensional network traffic features from the session stream obtained in Step 1 above. Traffic statistics characteristics: average packet length 356 bytes, standard deviation of packet interval 0.45 seconds, uplink to downlink traffic ratio 1:3.2; Protocol characteristics: uses TLS 1.2 encryption (tls_ver_hex_s_e=0x0303), cipher suite is ECDHE type, port 443, is_tls_s_e=1, tls_has_client_hello_s_e=1; Domain characteristics: The target domain "x7k9m2p.example.com" has a domain length of 18, a level of 3, and an entropy value of 4.1 (abnormally high). Temporal characteristics: The packet length sequence exhibits periodic changes, and the time intervals show obvious burst patterns; Geographic characteristics: The target IP is located in a cloud service provider outside of China (dst_geo_country="Other"); Step 3: Generation of the first lexical feature vector (58 dimensions); Based on the multi-dimensional network traffic features extracted in Step 2, the following lexical results are generated: fshape=MediumInteractive, Peer_org=Cloud, Proto=TCP, Port_cat=HTTPS, Name_tld=Common, Name_ent=VeryHigh; tls_status=Yes(is_tls_s_e=1); tls_hello=Yes(tls_has_client_hello_s_e=1); tls_ver=TLS12 (tls_ver_hex_s_e=0x0303), geo_country=Other; size_cat=Medium(total_bytes_all_s_e=87432, falling within the 10KB-100KB range); pkt_count=Lot(total_pkts_s_e=245,>100); The lexical results are compared with the preset lexical table to obtain a 58-dimensional first lexical feature vector, in which the dimension value of the above 12 lexicals is 1.0, and the rest are 0.0; The session metakeys are: TCP|HTTPS|MediumInteractive|Yes|Yes|Other|Medium|Lot|TLS12; Step 4: Host Behavior Graph Construction and Random Walk: Construct a host behavior graph from all session flows of host device Host_192.168.1.100. During the observation period, this host generates a total of 15 session flows (connection edges), with sequence number conn_order ranging from 0 to 14. Each connection contains the sequence number conn_order and the first word feature vector. Based on the host behavior graph, two random walk sequences are generated, each with a length of 10 steps. Weighted random walks are performed based on timestamp differences, with edges having higher transition probabilities when timestamps are close together; The generated walk sequences (represented by the sequential numbering of the connecting edges) are: [0,1,3,2,5,4,6,8,7,9] and [1,0,2,4,3,6,5,7,9,8]; Step 5: Second word feature vector generation and feature fusion (32-dimensional second word feature vector + 58-dimensional first word feature vector = 90 dimensions): Train the Word2Vec model using random walk sequences from all hosts to obtain a vector lookup table; The session token key of the session stream obtained in step 1 above is as follows: "TCP|HTTPS|MediumInteractive|Yes|Yes|Other|Medium|Lot|TLS12"; determine the 32-dimensional second word feature vector corresponding to the session stream from the vector lookup table; The 32-dimensional second word feature vector and the 58-dimensional first word feature vector are concatenated to form a 90-dimensional fused feature vector. Connection edge level (or session stream level) L2 normalization: The fused feature vector is normalized by the L2 norm to obtain a normalized 90-dimensional fused feature vector; Step 6: Weighted Aggregation and Normalization of Host Features. Weighted aggregation is performed on the 15 session streams from host device Host_192.168.1.100: The session flow weight with conn_order=0 is 1.0 / (0+1)=1.0; The session flow weight with conn_order=1 is 1.0 / (1+1)=0.5; The session flow weight for conn_order=2 is 1.0 / (2+1)=0.333; Similarly, after weighted aggregation, host-level L2 normalization is performed to obtain a 90-dimensional host feature vector; Step 7: Comparative learning of semantic feature vectors and behavioral feature vectors, and calculation of inconsistency probability: Semantic feature vector mapping: The 58-dimensional first-term feature vector is mapped to a 16-dimensional semantic feature vector through a projection network. Behavioral feature vector calculation: The connection edge corresponding to the conversation flow obtained in step 1 is located at position 4 in the walking sequence (the sequential number of the connection edge is 5) [0,1,3,2,5,4,6,8,7,9]. The mean of the second word feature vector of the neighboring connection edges (connection edges 1,3,2,4,6,8) within the preset window W=3 is taken as the feature vector to be mapped, and then mapped into a 16-dimensional behavioral feature vector through the projection network; The inconsistency probability of the session stream obtained in step 1 is: InconsistencyScore = 1 - cos(z_s, z_b) = 0.72 (significantly high); The semantic feature vector of the session stream obtained in step 1 shows that it is normal TLS encrypted HTTPS communication. However, the context vector in the behavioral feature vector is composed of the mean of the second word feature vectors of the neighboring session streams. These neighboring session streams are mostly small heartbeat packet communications (fshape=TinyInteractive), revealing the periodic behavioral pattern of C&C communication. The context of a normal HTTPS connection is usually diverse business traffic, while the context of the session stream obtained in step 1 is all the same type of heartbeat packets, resulting in semantic-behavioral inconsistency. The host inconsistency probability is: HostInconsistency=0.68 (still too high after weighted aggregation); Step 8: Classification and Fusion Decision: The trained random forest classifier (100 decision trees) is used to classify and detect the 90-dimensional host feature vector. The probability of malicious traffic obtained by the classifier is: P_classifier=0.87; The weighted fusion of the probability of malicious traffic and the probability of inconsistency yields the following fusion probability: FinalScore = 0.6 × 0.87 + 0.4 × Normalize(0.68) = 0.522 + 0.272 = 0.794; If the preset probability threshold is 0.5 and the fusion probability is 0.794 > 0.5, then it is determined that there is malicious traffic in the host device. The main criteria for discrimination are: high entropy domain name (Name_ent=VeryHigh), TLS encrypted communication (tls_status=Yes), overseas cloud service communication (geo_country=Other), large number of data packets (pkt_count=Lot), and high inconsistency of dual features (0.72). The system generated a security alert: suspected malware C&C communication behavior was detected on host device 192.168.1.100. It is recommended to isolate and investigate immediately.

[0156] Example 2: In a corporate network, an internal server Host_10.0.2.88 was infected with a new type of malware. This malware mimics normal HTTPS API call behavior to leak data. Since this type of attack is not in the training data, the random forest classifier has difficulty identifying it, but the dual feature vector contrastive learning successfully detected it through semantic-behavioral inconsistency. Step 1-2: Traffic Collection and Feature Extraction: The session stream of the internal network server Host_10.0.2.88 was captured, and the extracted multi-dimensional network traffic features include: The connection target is a well-known cloud service API endpoint (api legitimate-cloud.com:443). Protocol: TCP, TLS 1.3 encryption; Traffic shape: Medium Interactive, appears to be a normal API call; Abnormal connection frequency: It initiates a connection every 60 seconds at a fixed time, lasting for 7 days; The amount of data per connection is similar (total_bytes_all_s_e≈15KB), and the number of packets is similar (total_pkts_s_e≈12). Steps 3-5: First word feature vector generation, host behavior graph construction, random walk and Word2Vec model training: Word element results: fshape=MediumInteractive, Proto=TCP, Port_cat=HTTPS, tls_status=Yes, tls_hello=Yes, tls_ver=TLS13, geo_country=US, size_cat=Medium, pkt_count=Some; The lexical results are compared with the preset lexical table to obtain a 58-dimensional first lexical feature vector, in which the dimension value of the above 9 lexicals is 1.0, and the rest are 0.0; The session metakeys for this session stream are: TCP|HTTPS|MediumInteractive|Yes|Yes|US|Medium|Some|TLS13; During the observation period, the intranet server generated 168 session streams (conn_order0-167), forming a highly regular timed communication pattern. The walk sequence generated by the random walk algorithm reflects this regularity. The trained Word2Vec model generates a vector lookup table, from which the second lexical feature vector of the conversation flow is determined. This second lexical feature vector reflects the contextual features of the conversation flow as “timed, periodic, and moderately frequent”. Step 6: Feature fusion and classifier detection: The random forest classifier outputs the probability of malicious traffic for this session stream as: P_classifier=0.31 (below the preset malicious traffic threshold of 0.5, the classifier judges it as benign); The classifier determined it to be benign because the session stream disguised itself as a normal HTTPS API call, and the first term feature vector was highly similar to normal cloud service communication in the training set. Step 7: Comparative learning of semantic feature vectors and behavioral feature vectors, and calculation of inconsistency probability: Semantic feature vector mapping: The 58-dimensional first word feature vector is mapped to a 16-dimensional semantic feature vector through a projection network. This 16-dimensional semantic feature vector indicates that the session stream is "TLS encrypted HTTPS medium interactive traffic", which belongs to the common normal cloud service communication mode. Behavioral feature vector calculation: The context vector of this session flow in the walking sequence. Almost all of the 168 neighboring session flows have the same session term key "TCP|HTTPS|MediumInteractive|Yes|Yes|US|Medium|Some|TLS13". The mean of the second term feature vector of the neighboring session flows is highly similar to the second term feature vector of the current session flow itself, forming a highly homogeneous context environment. The inconsistency probability of the current session stream is: InconsistencyScore = 0.65 (significantly high); A normal API call should have a diverse behavioral context (accessing different services at different times, varying traffic volumes), and the session key of adjacent session streams should be distinct. However, the behavioral feature vector of this session stream shows that its context consists entirely of the same type of timed connections. This extremely homogeneous context pattern is inconsistent with the "normal API call" reflected by the semantic feature vector. Since the behavioral feature vector originates from the context of adjacent session streams rather than the session key of the current session stream itself, the abnormal pattern of "surrounded by the same type of connections" in the current session stream can be identified. The host-level inconsistency probability aggregation yields a host inconsistency probability of: HostInconsistency = 0.61; Step 8: Fusion Decision: The probability of malicious traffic and the probability of inconsistency are weighted and fused to obtain the fusion probability: FinalScore = 0.6 × 0.31 + 0.4 × Normalize(0.61) = 0.186 + 0.244 = 0.43; Because the probability of malicious traffic output by the classifier was low and the fusion probability did not exceed the preset threshold of 0.5, the system generated a low-confidence alarm, prompting the security analyst to pay attention to the abnormal behavior pattern of the internal network server. This led the security analyst to further investigate and discover timed data leakage behavior, confirming a new type of malware infection.

[0157] Example 3: In a certain enterprise network, after an attacker compromised the host device Host_192.168.1.50 through a phishing email, the attacker deliberately avoided using large-scale scanning tools. Instead, the attacker probed the target ports of the internal network one by one in a low-frequency, small-batch manner. The behavior of a single probe was highly similar to normal network access, and traditional detection methods based on rate thresholds were difficult to identify. Step 1-2: Traffic Collection and Feature Extraction: The following session flows of host device Host_192.168.1.50 were captured during a 24-hour observation period. Analysis of the session flows yielded the following multi-dimensional features: Initiate TCP connections to 18 different IPs in the 172.16.xx network segment of the internal network, with the target ports being distributed (22, 80, 443, 445, 3389, 8080, etc.). Each connection lasts for a very short time (average 0.8 seconds), with a small number of packets (SYN+RST or SYN+RST+ACK, 2-3 packets), and no data payload is transmitted; The connection intervals are irregular (minimum 3 minutes, maximum 2 hours) to avoid triggering rate alarms; No TLS encryption, no DNS lookup (uses IP address directly); The targets are all internal network IPs (geo_country=Unknown); Step 3: Generation of the first word feature vector; The lexical results include: fshape=TinyInteractive (very short interaction), Proto=TCP, Port_cat=RegOrDyn (mostly dynamic / registered ports); tls_status=No, tls_hello=No, tls_ver=Unknown; geo_country=Unknown (internal network IP); size_cat=Tiny (total bytes are very small), pkt_count=Few (2-3 packets); Name_tld=NoDom, Name_ent=None (No domain name); The lexical results are compared with the preset lexical table to obtain a 58-dimensional first lexical feature vector, in which the dimension value of the above 11 lexicals is 1.0, and the rest are 0.0; Session Token key for the session stream: TCP|RegOrDyn|TinyInteractive|No|No|Unknown|Tiny|Few|Unknown; Steps 4-6: Host Behavior Graph Construction, Random Walk, Feature Fusion, and Classification Detection: The host generated 18 session streams (conn_order0-17) during the observation period, with timestamps spanning 24 hours but exhibiting a "low-frequency continuous" pattern. The weighted random walk based on timestamp difference generates a walk sequence. Since the timestamp difference between session streams is large (from minutes to hours), adjacent session streams in the walk sequence are all probe connections with similar times. A vector lookup table is generated by the trained Word2Vec model, and a 32-dimensional second word feature vector is determined from the vector lookup table. This second word feature vector reflects the behavioral context features of the conversation flow, which are characterized by "low frequency, no load, and multi-port probing". The 58-dimensional first-word feature vector and the 32-dimensional second-word feature vector are fused to obtain a 90-dimensional fused feature vector. After edge-level normalization, weighted aggregation and host-level normalization, the 90-dimensional fused feature vector is input into the classifier, and the probability of malicious traffic is 0.71. Step 7: Comparative learning and similarity probability calculation of semantic feature vectors and behavioral feature vectors: Semantic feature vector mapping: The 58-dimensional semantic feature vector indicates that the session stream is "TCP short connection, dynamic port, no payload". Looking at the semantic attributes of each session stream alone, it is similar to normal network probing or service discovery traffic, and has a strong disguise. Behavioral feature vector calculation: The neighboring session flows in the walk sequence are all of the same type of "TCP|RegOrDyn|TinyInteractive|No|No|Unknown|Tiny|Few|Unknown" connection. The second lexical feature vector of these neighboring session flows encodes the contextual pattern of "low frequency, no load, multi-port probing". The similarity probability of the current session flow is: InconsistencyScore=0.63 (high). The network connection behavior pattern of a normal host is usually diverse (accessing different services at different times, different traffic volumes). The token key types of adjacent connections should be different. However, the behavioral feature vector of the current session flow shows that the current session flow context is full of small connections of the same type, which is inconsistent with the "scattered normal connections" reflected by the semantic feature vector. The host inconsistency probability is: HostInconsistency = 0.59; Step 8: Fusion Decision: The probability of malicious traffic and the probability of inconsistency are weighted and fused to obtain the fusion probability: FinalScore=0.6×0.71+0.4×Normalize(0.59)=0.426+0.236= 0.662; The preset probability threshold is 0.5. If the fusion probability 0.662 > 0.5, then it is determined that there is malicious traffic in the host device. This application embodiment uses host behavior graph modeling and temporal random walks to aggregate 18 low-frequency session streams scattered over 24 hours into a complete behavior pattern. By comparing semantic feature vectors with behavior feature vectors, it reveals the contradiction between "seemingly normal single session streams" and "overall probing behavior patterns".

[0158] In summary, this application's embodiments achieve a unified and standardized representation of network traffic features by converting them into discrete lexical vectors. This significantly improves the learnability and expressive power of network traffic features, enabling security analysts to intuitively understand the basis and logic of detection and facilitating accurate detection and identification of malicious network traffic. Through a random walk algorithm, a walk sequence reflecting the temporal dependencies of host device behavior is generated, along with a second lexical feature vector representing the temporal dependencies of session flows. This effectively acquires the temporal features of network traffic, providing high-quality data for subsequent vector learning. By concatenating feature vectors, the first and second lexical feature vectors are fused to form richer and more comprehensive host device behavior features. Through the organic combination of multi-dimensional features, accurate identification of complex malicious traffic is achieved. Semantic and behavioral feature vectors are obtained, and by comparing the similarity of the two feature vectors, the detection capability for malicious network attacks is enhanced based on the "semantic-behavioral inconsistency" characteristic of malicious network traffic.

[0159] Based on the same inventive concept, embodiments of this application also provide a network malicious traffic detection device, such as... Figure 9 As shown, the device 900 includes: The first lexical feature vector determination module 901 is configured to convert the network traffic features of the session stream of the host device into a first lexical feature vector; the network traffic features are used to characterize the network behavior information of the session stream. The second lexical feature vector determination module 902 is configured to determine the second lexical feature vector of the session stream based on the walk sequence and word vector model containing the session stream; the walk sequence is used to characterize the temporal dependency of the host device behavior, and the second lexical feature vector is used to characterize the temporal dependency of the session stream. The malicious traffic probability determination module 903 is configured to perform classification detection processing on the fused feature vector of the first word feature vector and the second word feature vector to obtain the malicious traffic probability; The lexical feature vector mapping module 904 is configured to map the first lexical feature vector to obtain a semantic feature vector; and to obtain a behavioral feature vector based on the second lexical feature vector; the semantic feature vector is used to describe the semantic features of the conversation flow, and the behavioral feature vector is used to describe the contextual features of the conversation flow in the walk sequence; The inconsistency probability determination module 905 is configured to compare the semantic feature vector and the behavioral feature vector to obtain the inconsistency probability. The malicious traffic detection result determination module 906 is configured to determine the malicious traffic detection result of the session stream based on the malicious traffic probability and the inconsistency probability.

[0160] In one possible implementation, the second lexical feature vector determination module is configured to generate the walking sequence using the following steps: A host behavior graph of the host device is generated based on multiple session streams of the host device. The host behavior graph includes multiple connection edges, each of which corresponds to a session stream. Each connection edge is used to connect the host device and the target client of the session stream. One of the multiple connecting edges is taken as the starting edge, and the remaining connecting edges are taken as the edges to be transferred; For each edge to be transferred, the transfer probability of the starting edge jumping to the edge to be transferred is determined based on the timestamp of the starting edge and the timestamp of the edge to be transferred. Based on the obtained multiple transition probabilities, the target transition edge to which the starting edge jumps is determined; Add the starting edge and the target transition edge to the walking sequence; The target transition edge is used as the new starting edge, and the remaining connecting edges are used as the new edges to be transitioned. The process is repeated, and for each edge to be transitioned, the step of determining the transition probability of the starting edge jumping to the edge to be transitioned is performed based on the timestamp of the starting edge and the timestamp of the edge to be transitioned, until the length of the walking sequence is the preset length.

[0161] In one possible implementation, the second lexical feature vector determination module is specifically configured to generate a host behavior graph of the host device based on multiple session streams of the host device, wherein the second lexical feature vector determination module is configured to: For each session stream of the host device, the session stream is converted into a connection edge; Based on the timestamp order of the session stream, the connection edges corresponding to the session stream are numbered to obtain the host behavior graph of the host device.

[0162] In one possible implementation, the step of converting the network traffic features of the session stream into a first lexical feature vector, wherein the first lexical feature vector determination module is specifically configured to: The lexical results of the session stream are extracted from the network traffic features of the session stream; the network traffic features include at least one of the following: basic statistical features, time-series features, protocol features, domain name features, geographical features, and security features; the lexical results include at least one of the following categories of lexical elements: traffic shape lexical element, peer organization lexical element, transport protocol lexical element, port type lexical element, top-level domain lexical element, domain entropy value lexical element, TLS status lexical element, TLS handshake lexical element, TLS version lexical element, geographical location lexical element, traffic size lexical element, and packet quantity lexical element; The word element results are compared with a preset word element table to obtain a first word element feature vector; the preset word element table includes the correspondence between words and word element feature vectors.

[0163] In one possible implementation, the step of determining a second lexical feature vector of the conversation stream based on the walk sequence and word vector model containing the conversation stream, wherein the second lexical feature vector determination module is specifically configured to: For each session stream, the following steps are performed: select a preset number of category words from the word result of the session stream; concatenate the preset number of category words into a string to obtain the session word key of the session stream; Based on the conversation lexical keys and word vector models of multiple conversation streams in the walk sequence containing the conversation stream, a vector lookup table is determined; the vector lookup table includes the correspondence between conversation lexical keys and lexical feature vectors; The second lexical feature vector of the conversation stream is determined from the vector lookup table.

[0164] In one possible implementation, the second lexical feature vector determination module is specifically configured to: determine a vector lookup table based on the lexical keys of multiple conversation streams in the walk sequence containing the conversation stream and a word vector model; For each walk sequence, the following steps are performed: concatenate the conversation lexical keys of multiple conversation streams in the walk sequence to obtain text training samples; The word vector model is trained using multiple obtained text training samples, and a vector lookup table is generated using the trained word vector model.

[0165] In one possible implementation, the step of obtaining the behavior feature vector based on the second lexical feature vector, wherein the lexical feature vector mapping module is specifically configured as follows: For each of the multiple walk sequences containing the session flow, determine the position of the connection edge corresponding to the session flow in the walk sequence; Based on the position of the connection edge corresponding to the session flow, determine multiple adjacent connection edges of the connection edge corresponding to the session flow within a preset window range; The average value of the second word feature vectors of the conversation streams corresponding to the multiple adjacent connection edges is taken as the feature vector to be mapped. The behavioral feature vector is obtained by mapping the feature vector to be mapped through a preset projection network.

[0166] In one possible implementation, the second lexical feature vector determination module is further configured to: If the conversation lexical key of the conversation stream is not matched in the vector lookup table, a preset random vector is generated and used as the second lexical feature vector of the conversation stream.

[0167] In one possible implementation, the malicious traffic detection result of the session stream is determined based on the malicious traffic probability and the inconsistency probability. Specifically, the malicious traffic detection result determination module is configured to: The probability of malicious traffic and the probability of inconsistency are weighted and fused to obtain the fused probability; If the fusion probability is greater than a preset probability threshold, then the session stream is determined to be malicious traffic; If the fusion probability is less than or equal to a preset probability threshold, then the session flow is determined to be normal traffic.

[0168] The following reference Figure 10 To describe an electronic device 130 according to this embodiment of the present application. Figure 10 The electronic device 130 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0169] like Figure 10 As shown, the electronic device 130 is presented in the form of a general electronic device. The components of the electronic device 130 may include, but are not limited to: at least one processor 131, at least one memory 132, and a bus 133 connecting different system components (including memory 132 and processor 131).

[0170] Bus 133 represents one or more of several bus structures, including a memory bus or memory controller, peripheral bus, processor, or local bus using any of the various bus structures.

[0171] The memory 132 may include a readable medium in the form of volatile memory, such as random access memory (RAM) 1321 and / or cache memory 1322, and may further include read-only memory (ROM) 1323.

[0172] The memory 132 may also include a program / utility 1325 having a set (at least one) of program modules 1324, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0173] Electronic device 130 can also communicate with one or more external devices 134 (e.g., keyboard, pointing device, etc.), and with one or more devices that enable a user to interact with electronic device 130, and / or with any device that enables electronic device 130 to communicate with one or more other electronic devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 135. Furthermore, electronic device 130 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 136. As shown, network adapter 136 communicates with other modules used in electronic device 130 via bus 133. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0174] In an exemplary embodiment, this application also provides a computer-readable storage medium including instructions, such as a memory 132 including instructions, which can be executed by a processor 131 of an electronic device 130 to complete the aforementioned network malicious traffic detection method. Optionally, the computer-readable storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0175] In an exemplary embodiment, a computer program product is also provided, including a computer program that, when executed by a processor 131, implements the network malicious traffic detection method provided in this application.

[0176] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0177] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0178] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0179] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0180] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting malicious network traffic, characterized in that, The method includes: For a session stream of a host device, the network traffic features of the session stream are converted into a first term feature vector; the network traffic features are used to characterize the network behavior information of the session stream. Based on the walk sequence and word vector model containing the session flow, a second lexical feature vector of the session flow is determined; the walk sequence is used to characterize the temporal dependencies of the host device behavior, and the second lexical feature vector is used to characterize the temporal dependencies of the session flow. The fused feature vector of the first word feature vector and the second word feature vector is subjected to classification and detection processing to obtain the probability of malicious traffic; The first lexical feature vector is mapped to obtain a semantic feature vector; and the second lexical feature vector is used to obtain a behavioral feature vector; the semantic feature vector is used to describe the semantic features of the conversation flow, and the behavioral feature vector is used to describe the contextual features of the conversation flow in the walk sequence. The semantic feature vector and the behavioral feature vector are compared to obtain the inconsistency probability; The malicious traffic detection result of the session stream is determined based on the malicious traffic probability and the inconsistency probability.

2. The method according to claim 1, characterized in that, The following steps are used to generate the walking sequence: A host behavior graph of the host device is generated based on multiple session streams of the host device. The host behavior graph includes multiple connection edges, each of which corresponds to a session stream. Each connection edge is used to connect the host device and the target client of the session stream. One of the multiple connecting edges is taken as the starting edge, and the remaining connecting edges are taken as the edges to be transferred; For each edge to be transferred, the transfer probability of the starting edge jumping to the edge to be transferred is determined based on the timestamp of the starting edge and the timestamp of the edge to be transferred. Based on the obtained multiple transition probabilities, the target transition edge to which the starting edge jumps is determined; Add the starting edge and the target transition edge to the walking sequence; The target transition edge is used as the new starting edge, and the remaining connecting edges are used as the new edges to be transitioned. The process is repeated, and for each edge to be transitioned, the step of determining the transition probability of the starting edge jumping to the edge to be transitioned is performed based on the timestamp of the starting edge and the timestamp of the edge to be transitioned, until the length of the walking sequence is the preset length.

3. The method according to claim 2, characterized in that, The step of generating a host behavior graph of the host device based on multiple session streams of the host device includes: For each session stream of the host device, the session stream is converted into a connection edge; Based on the timestamp order of the session stream, the connection edges corresponding to the session stream are numbered to obtain the host behavior graph of the host device.

4. The method according to any one of claims 1 to 3, characterized in that, The step of converting the network traffic features of the session stream into a first term feature vector includes: The lexical results of the session stream are extracted from the network traffic features of the session stream; the network traffic features include at least one of the following: basic statistical features, time-series features, protocol features, domain name features, geographical features, and security features; the lexical results include at least one of the following categories of lexical elements: traffic shape lexical elements, peer organization lexical elements, transport protocol lexical elements, port type lexical elements, top-level domain lexical elements, domain entropy value lexical elements, TLS status lexical elements, TLS handshake lexical elements, TLS version lexical elements, geographical location lexical elements, traffic size lexical elements, and packet quantity lexical elements; The word element results are compared with a preset word element table to obtain a first word element feature vector; the preset word element table includes the correspondence between words and word element feature vectors.

5. The method according to claim 4, characterized in that, The step of determining the second lexical feature vector of the conversation stream based on the walk sequence and word vector model containing the conversation stream includes: For each session stream, the following steps are performed: select a preset number of category words from the word result of the session stream; concatenate the preset number of category words into a string to obtain the session word key of the session stream; Based on the conversation lexical keys and word vector models of multiple conversation streams in the walk sequence containing the conversation stream, a vector lookup table is determined; the vector lookup table includes the correspondence between conversation lexical keys and lexical feature vectors; The second lexical feature vector of the conversation stream is determined from the vector lookup table.

6. The method according to claim 5, characterized in that, The step of determining the vector lookup table based on the conversation lexical keys and word vector models of multiple conversation streams in the walk sequence containing the conversation stream includes: For each walk sequence, the following steps are performed: concatenate the conversation lexical keys of multiple conversation streams in the walk sequence to obtain text training samples; The word vector model is trained using multiple obtained text training samples, and a vector lookup table is generated using the trained word vector model.

7. The method according to claim 5, characterized in that, The step of obtaining the behavior feature vector based on the second word feature vector includes: For each of the multiple walk sequences containing the session flow, determine the position of the connection edge corresponding to the session flow in the walk sequence; Based on the position of the connection edge corresponding to the session flow, determine multiple adjacent connection edges of the connection edge corresponding to the session flow within a preset window range; The average value of the second word feature vectors of the conversation streams corresponding to the multiple adjacent connection edges is taken as the feature vector to be mapped. The behavioral feature vector is obtained by mapping the feature vector to be mapped through a preset projection network.

8. The method according to claim 6, characterized in that, The method further includes: If the conversation lexical key of the conversation stream is not matched in the vector lookup table, a preset random vector is generated and used as the second lexical feature vector of the conversation stream.

9. The method according to any one of claims 1 to 3, characterized in that, Determining the malicious traffic detection result of the session stream based on the malicious traffic probability and the inconsistency probability includes: The probability of malicious traffic and the probability of inconsistency are weighted and fused to obtain the fused probability; If the fusion probability is greater than a preset probability threshold, then the session stream is determined to be malicious traffic; If the fusion probability is less than or equal to a preset probability threshold, then the session flow is determined to be normal traffic.

10. An electronic device, characterized in that, include: Processor and memory; The memory is used to store the processor-executable instructions; The processor is configured to execute the instructions to implement the network malicious traffic detection method as described in any one of claims 1-9.

Images