A domain name pre-flow detection method and system based on non-equidistant interval representation

Abstract

The application discloses a domain name pre-flow detection method and system based on unequal interval representation. The method comprises the following steps: capturing network flow; preprocessing the network flow, recombining it into an independent session, and extracting three traffic element attributes of packet length, packet time and packet direction; uniformly representing the flow of each network session based on unequal interval, generating a fixed-dimension fusion frequency vector; constructing a detector based on a deep learning model; and identifying domain name pre-flow by using the trained detector. The packet length and packet time are respectively mapped to a frequency vector by unequal interval, and then combined with the packet direction to form a uniform representation. The application realizes uniform vectorization of traffic element attributes by unequal interval, constructs a fixed-dimension model input format, solves the problem of poor expansibility of the prior art which depends on exclusive traffic characteristics, and has excellent generalization ability while maintaining high detection accuracy.

Description

Technical Field

[0001] This invention relates to a domain name front-end traffic detection method based on unequal interval representation, and also to a corresponding domain name front-end traffic detection system, belonging to the field of network traffic detection technology. Background Technology

[0002] Domain name fronting is an advanced attack evasion technique. Attackers use high-reputation domains from CDN service providers and cloud platforms as forwarding layers to disguise malicious command and control traffic as legitimate HTTPS requests, thereby bypassing the detection of firewalls and other security devices. In recent years, this technique has been widely abused; over 73% of mainstream cloud services globally, including major providers like Akamai and Fastly, can be used to deploy domain name fronting, resulting in a wide variety of attack scenarios and tools. These constantly emerging and rapidly iterating new attack methods pose a serious challenge to the scalability of existing detection methods.

[0003] Existing technologies generally follow the paradigm of "traffic feature extraction + intelligent model classification," which involves manually designing or automatically extracting statistical features (such as packet length distribution, time intervals, cipher suites, etc.) from network sessions, and then inputting them into machine learning or deep learning models for discrimination. This type of method often performs well against specific known tools, but once the detection target switches to a new domain name prep tool, the effectiveness of the original features decreases significantly, requiring the redesign and validation of new feature combinations. This "one feature per event" dependency makes the expansion process of the detection system time-consuming and labor-intensive, making it difficult to adapt to rapidly evolving attack scenarios.

[0004] To address these issues, researchers have attempted to introduce symbolic feature libraries or metadata feature fusion to improve generalization capabilities. For example, Chinese patent application CN121261921A proposes a high-precision detection method for domain name front-end traffic based on neural symbol integration. This method constructs a symbolic feature library by parsing TLS cipher suites and uses a convolutional neural network for discrimination. However, this method still relies on a specific list of cipher suites and metadata features, and its input format also adjusts according to the detection target, failing to fundamentally break the constraint of feature dependence. When faced with domain name front-end tools not predefined in the feature library, the detection performance of this method significantly decreases, making it difficult to meet the requirements of versatility and rapid adaptation in practical deployments.

[0005] In summary, the core problem with existing domain name front-end traffic detection technologies lies in the high degree of binding between traffic representation methods and specific tool characteristics. This results in inconsistent input formats for the detection models and limited scalability. Therefore, there is an urgent need to explore a new traffic representation approach that can uniformly map network traffic generated by different domain name front-end tools to a fixed-structure mathematical space. This would allow the detection model to smoothly adapt to new tools simply by updating training samples without altering the input format, thereby truly improving the scalability and real-world response efficiency of the detection system. Summary of the Invention

[0006] The primary technical problem to be solved by this invention is to provide a method for detecting domain name front traffic based on unequal interval representation.

[0007] Another technical problem to be solved by the present invention is to provide a domain name front traffic detection system based on the characterization of unequal intervals.

[0008] To achieve the above-mentioned technical objectives, the present invention adopts the following technical solution: According to a first aspect of the present invention, a method for detecting domain name front-end traffic based on unequal interval representation is provided, comprising the following steps: S1: Capture network traffic; S2: Preprocess the network traffic, reassemble the original traffic into independent sessions, and extract three traffic meta-attributes, namely packet length, packet time and packet direction, on a session-by-session basis; S3: Based on unequal intervals, the traffic of each network session is uniformly represented, generating a fixed-dimensional fusion frequency vector; S4: Construct a domain name front-end traffic detector based on a deep learning model; S5: Use the trained detector to identify domain name front traffic in the network; Step S3 includes the following sub-steps: S31: Set unequal intervals for packet length and packet time respectively, and map the packet length value and packet time value of each data packet to their respective unequal intervals; S32: Count the number of times data packets appear in each unequal interval, and calculate the frequency of data packets in each interval to obtain the packet length frequency vector and packet time frequency vector; S33: Combine the packet length frequency vector and the packet time frequency vector with the packet direction value to form the fixed-dimensional fused frequency vector.

[0009] Preferably, step S2 includes the following sub-steps: S21: Aggregate traffic into independent sessions based on the five-tuple in the data packet; S22: Filter the entire TLS session; S23: Extract three traffic meta-attributes—packet length, packet time, and packet direction—on a session basis.

[0010] Preferably, in step S3: The unequal intervals set for the package length are divided into at least two segments, with different interval granularities between the segments. The unequal intervals set for packet time are divided into at least three segments, with different interval granularities between the segments. The packet direction includes two values: up and down. The packet length frequency vector and the packet time frequency vector are split and combined according to up and down directions, respectively, and then spliced ​​to form the fixed-dimensional fused frequency vector.

[0011] Preferably, in step S3: The mapping uses a binary search algorithm to determine the position of the unequal interval to which the attribute value belongs; The statistics use a dictionary structure to record the count distribution of non-empty intervals; The frequency is the ratio obtained by dividing the count of each interval by the total number of data packets in the current session.

[0012] Preferably, in step S3, an ordered unequal interval is given. ,in For the data packet attribute value to be searched Returning the result using binary search interval position ; For the two meta-attributes, packet length and packet time, the corresponding attribute value of each data packet is mapped to the corresponding interval number. During the lookup process, the interval adopts a left-closed, right-open method, and the position is rounded down. The formula for calculating the middle position is:

[0013] in, The middle index position obtained after each iteration of the binary search algorithm is the core positioning parameter for interval binary search; This is the left boundary index of the current binary search range, representing the starting position of the search interval; This is the right boundary index of the current binary search range, representing the end position of the search interval.

[0014] Preferably, in step S3, a dictionary structure is used to process non-empty intervals separately: Let the interval position sequence be Using a dictionary Store the number of occurrences for each interval position:

[0015] in, The value in the sequence is The total number of elements; The total length of the sequence; The loop index variable for summation; For the first in the sequence The value of each element; This is an indicator function that takes the value 1 when the condition is true, and 0 otherwise.

[0016] Preferably, the formula for calculating the frequency is:

[0017] in, The final frequency vector The value of the nth element, i.e., the nth element value The frequency of data packets corresponding to the unequal intervals; This is an index for unequal intervals; It is a set of unequal intervals with data packet distribution; For the first The number of data packets counted within each unequal interval; A rounding function to retain two decimal places; This represents the total number of data packets contained in the current network session.

[0018] Preferably, step S4 includes the following sub-steps: S41: Based on a multi-level convolutional neural network, a binary classification detector is trained using the fused frequency vector; S42: Deploy the trained model and perform unified representation and intelligent discrimination on unknown traffic.

[0019] According to a second aspect of the present invention, a domain name front-end traffic detection system based on unequal interval characterization is provided, comprising a processor and a memory; wherein the memory is coupled to the processor and is used to store a computer program, which, when executed by the processor, enables the processor to implement the above-described domain name front-end traffic detection method.

[0020] Compared with existing technologies, this invention introduces unequal intervals to non-uniformly segment packet length and packet time, and uniformly represents the three traffic element attributes of packet length, packet time, and packet direction as a fixed-dimensional fusion frequency vector. This ensures the consistency of the input format of the detection model from the data input level, so that the detector does not need to redesign features or modify the model architecture when facing new domain name pre-processing tools. It can quickly adapt by simply changing the training samples, thus fundamentally solving the problem of insufficient scalability caused by the high binding of traffic representation to specific tool features in existing methods. At the same time, the multi-level convolutional neural network constructed by this invention can automatically learn the deep interaction patterns in the fusion frequency vector without manual feature analysis, which improves the level of detection automation while ensuring extremely high detection accuracy. Attached Figure Description

[0021] Figure 1 This is a flowchart illustrating a domain name front-end traffic detection method based on unequal interval representation in the first embodiment of the present invention. Figure 2 This is a schematic diagram of a domain name front-end traffic detection system based on unequal interval representation in the second embodiment of the present invention. Detailed Implementation

[0022] The technical content of the present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0023] First Embodiment like Figure 1 As shown, the first embodiment of the present invention provides a domain name front-end traffic detection method based on unequal interval representation, which includes at least the following steps: S1: Capture network traffic; S2: Preprocess the network traffic, reassemble the original traffic into independent sessions, and extract three traffic meta-attributes, namely packet length, packet time and packet direction, on a session-by-session basis; S3: Based on unequal intervals, the traffic of each network session is uniformly represented, generating a fixed-dimensional fusion frequency vector; S4: Construct a domain name front-end traffic detector based on a deep learning model; S5: Use the trained detector to identify domain name front traffic in the network.

[0024] In one embodiment of the present invention, step S2 includes the following sub-steps: S21: Aggregate traffic into independent sessions based on the five-tuple in the data packet; S22: Filter the entire TLS session; S23: Extract three traffic meta-attributes—packet length, packet time, and packet direction—on a session basis.

[0025] In one embodiment of the present invention, step S3 includes the following sub-steps: S31: Set unequal intervals for packet length and packet time respectively, and map the packet length value and packet time value of each data packet to their respective unequal intervals; S32: Count the number of times data packets appear in each unequal interval, and calculate the frequency of data packets in each interval to obtain the packet length frequency vector and packet time frequency vector; S33: Combine the packet length frequency vector and the packet time frequency vector with the packet direction value to form the fixed-dimensional fused frequency vector.

[0026] In one embodiment of the present invention, step S4 includes the following sub-steps: S41: Based on a multi-level convolutional neural network, a binary classification detector is trained using the fused frequency vector.

[0027] S42: Deploy the trained model and perform unified representation and intelligent discrimination on unknown traffic.

[0028] The following is a detailed explanation of the specific implementation steps of the above-mentioned domain name front-end traffic detection method: In step S1, the captured traffic can be acquired in real time online or from a saved offline traffic file. To improve the detector's versatility, it is preferable to save the traffic in pcap or dump format.

[0029] In step S2, the raw data packets collected in S1 are reassembled into structured, standardized independent network session units, and invalid traffic filtering and core meta-attribute extraction are completed. Specifically: In step S21, network traffic, after being captured, presents as a chaotic collection of data packets. To calculate the statistical characteristics of each session, the data packets must first be reassembled into session format. Specifically, data packets are classified according to the five-tuple (source IP, destination IP, source port, destination port, and transport layer protocol), with data packets having the same five-tuple belonging to the same data stream.

[0030] In step S22, the domain name fronting technology relies on the standard TLS protocol, which typically establishes network sessions via port 443. This embodiment of the invention utilizes this port to filter irrelevant traffic during the preprocessing stage, thereby narrowing the scope of subsequent detection. Furthermore, in the domain name fronting scenario, malicious data can only be transmitted after the TLS handshake is complete, and a complete TLS handshake consumes approximately 20 data packets. Therefore, this embodiment of the invention discards sessions that are too short due to connection establishment failures or other reasons during the preprocessing stage, retaining only sessions that have completed a full TLS handshake.

[0031] In step S23, for each session that has completed the TLS handshake, this embodiment of the invention further extracts three basic traffic metadata attributes as raw data for subsequent unified representation: packet length, i.e., the payload length of each data packet in the session, in bytes, reflecting the load characteristics of data transmission; packet time, i.e., the arrival time of each data packet or the time interval between adjacent data packets, in milliseconds or microseconds, reflecting the temporal characteristics of traffic; and packet direction, i.e., the transmission direction of each data packet, which takes the value of uplink (client to server) or downlink (server to client), reflecting the communication behavior pattern. These three metadata attributes together constitute the raw traffic sequence of each session, providing input for subsequent unified representation based on unequal intervals.

[0032] In step S3, this embodiment of the invention is based on the theory of unequal intervals. It designs non-uniformly segmented intervals for two types of continuous numerical attributes: packet length and packet time. It combines a binary search algorithm to locate the attribute value to the interval position and uses indicator functions, statistical formulas and frequency calculation formulas to perform data normalization processing. Finally, it merges the three types of traffic element attributes into a unified representation vector with fixed dimensions.

[0033] Specifically, in step S31, unequal intervals are set for packet length and packet time, and the packet length value and packet time value of each data packet are mapped to their respective unequal intervals.

[0034] Because the widths of unequal intervals are uneven, traditional search methods based on integer division are not applicable. However, this invention observes that the intervals exhibit a monotonically increasing trend, therefore a binary search algorithm is designed: Given ordered non-uniform intervals ,in For the data packet attribute value to be searched Returning the result using binary search interval position .

[0035] This step is performed separately for the packet length and packet time meta-attributes, mapping the corresponding attribute value of each data packet to the corresponding interval number. During the lookup process, the intervals are left-closed and right-open, rounded down, with the middle position calculated using the following formula:

[0036] in, The middle index position obtained after each iteration of the binary search algorithm is the core positioning parameter for interval binary search; This is the left boundary index of the current binary search range, representing the starting position of the search interval; This is the right boundary index of the current binary search range, representing the end position of the search interval.

[0037] In step S32, after traversing a network flow using binary search... Then, the number of times data packets appear in each unequal interval is counted, and the frequency of data packets appearing in each interval is calculated to obtain the packet length frequency vector and the packet time frequency vector.

[0038] Considering that some intervals may be empty while others are not empty, this step uses a dictionary structure to process the non-empty intervals separately: Let the interval position sequence be Using a dictionary Store the number of occurrences for each interval position:

[0039] in, The value in the sequence is The total number of elements; The total length of the sequence; The loop index variable for summation; For the first in the sequence The value of each element; This is an indicator function that takes the value 1 when the condition is true, and 0 otherwise.

[0040] For the packet direction attribute, since it only has two values, up and down, its distribution can be directly calculated without interval mapping.

[0041] In step S33, after completing the interval position statistics, the packet length frequency vector and the packet time frequency vector are combined with the packet direction value to form the fixed-dimensional fused frequency vector. The length of this vector is equal to the length of the unequal interval. Let the total number of data packets be... The length of the unequal interval is Frequency vector Length and If they are equal, the frequency calculation formula is:

[0042] in, The final frequency vector of the th The value of the nth element, i.e., the nth element value The frequency of data packets corresponding to the unequal intervals; This is an index for unequal intervals; It is a set of unequal intervals with data packet distribution; For the first The number of data packets counted within each unequal interval; A rounding function to retain two decimal places; This represents the total number of data packets contained in the current network session.

[0043] The final output frequency vector This reflects the distribution characteristics of network traffic across unequal intervals.

[0044] In one embodiment of the invention, unequal intervals are designed for packet length and packet time. To accommodate attribute values ​​of different sizes, the unequal intervals are divided into three segments: uniform granularity within each segment and non-uniform granularity between segments, covering fine-grained, medium-grained, and coarse-grained cases. Packet length and packet time are thus transformed into frequency vectors based on the unequal intervals. The packet direction is combined with the packet length and packet time intervals to form a complete traffic representation for each network session, serving as input to subsequent deep learning models.

[0045] In step S4, a dedicated multi-layer convolutional neural network is built to complete model training, parameter optimization, and offline deployment. Specifically: In step S41, a binary classifier is used as a domain name front-end traffic detector to label network flows positively and negatively, where positive labels represent domain name front-end traffic and negative labels represent normal network traffic. Network traffic is typically massive, requiring the detector to have high execution efficiency. To meet this requirement and improve the level of detection automation, this embodiment of the invention uses an end-to-end deep learning model to implement the detector. This model can automatically analyze traffic characteristics, improving scalability and eliminating the need for manual feature analysis, thus automating the security response process. Furthermore, this embodiment of the invention uses relatively few model parameters—the events handled by operators during security responses are usually quite specific, requiring only the detection of specific domain name front-end tools within a short timeframe; therefore, a large model is not necessary to achieve good detection results.

[0046] Specifically, this invention presents a multi-layered convolutional neural network model based on deep learning. This neural network model adopts a hierarchical architecture, comprising four convolutional modules and one fully connected classification module. In the convolutional modules, the model sequentially uses 32, 64, 128, and 256 convolutional kernels for feature extraction. Each layer includes a convolutional layer, a batch normalization layer, an activation function layer, a max pooling layer, and a Dropout layer. The convolutional kernel size is uniformly set to 8, the pooling window size is 8, and the stride is 4. The fully connected module contains two hidden layers with 256 and 128 neurons respectively. Glorot uniform distribution weights are initialized, and batch normalization and Dropout mechanisms are introduced to prevent overfitting, with a dropout rate of 0.5. The final output layer uses the Softmax activation function to achieve a binary classification task.

[0047] Training this detector requires two types of labeled data: negative samples are normal network traffic, obtained from traffic generated during normal network access; positive samples are domain name pre-traffic, collected according to different detection targets. The input features used to train the detector are frequency vectors obtained after fusion representation based on unequal intervals, as provided in this embodiment, rather than traditional traffic features.

[0048] In step S42, the trained domain name fronting detection model is deployed in a real network environment. When faced with traffic with unknown attributes, the detector first preprocesses and uniformly represents the network traffic according to step S3, extracting frequency vectors based on unequal intervals. This frequency vector is then directly input into the trained deep learning model for discrimination. The model employs a layer-by-layer convolution mechanism, effectively extracting features of hidden channel traffic from the input vector. Simultaneously, the regularization strategy introduced by the model suppresses overfitting and improves generalization ability. Finally, the Softmax output layer provides the judgment result on whether the network flow is a domain name fronting.

[0049] In step S5, the trained detector is used to identify domain name fronting traffic in the network. Once traffic is identified as domain name fronting, the detector can report the network attributes of the traffic to security operations personnel, or immediately block the relevant network connection, or back up the relevant traffic for subsequent tracing and evidence collection.

[0050] The following is a comparative analysis of relevant experiments in the embodiments of the present invention: This invention uses two proxy software programs, Meek and Snowflake, as experimental subjects. Both are open-source and free software, and are currently widely used in the dark web community, with over 100,000 daily active users.

[0051] For meek traffic, this embodiment of the invention launches the Tor browser in bridged mode and accesses the top 100 websites ranked by Tranco. To ensure that each network flow contains a sufficient number of data packets, the target website is accessed only after the browser's blank page has fully loaded, and the user stays on each website for at least 5 seconds. For snowflake traffic, this embodiment of the invention runs the snowflake-client proxy tool, also using manual operation, to avoid impacting the proxy server's performance in a short period of time.

[0052] Training the detector requires both positive and negative traffic samples, with meek traffic and snowflake traffic serving as positive samples. To collect negative samples (i.e., normal network traffic), this embodiment of the invention runs multiple mainstream browsers such as Chrome, Firefox, and Edge, accesses the top 500 websites ranked by Tranco, and compiles 100 different URLs for video, audio, image, and file requests respectively for traffic collection. Furthermore, to enrich the diversity of the dataset, this embodiment of the invention additionally collects traffic related to online chat, online shopping, online meetings, streaming media, and remote desktops, to cover as many normal network request types in real-world scenarios as possible.

[0053] In the data preprocessing stage, this embodiment of the invention parses the header information of each data packet and aggregates the data packets into the same session based on the same five-tuple. Sessions with a length greater than or equal to 20 data packets are considered valid sessions, as a complete TLS handshake typically consumes approximately 20 data packets. Subsequently, the filter "tcp port 443" is used to filter out complete TLS sessions. A total of 1,247 meek traffic entries, 1,163 snowflake traffic entries, and 5,482 negative sample traffic entries were collected. For these traffic entries, three traffic meta-attributes—packet length, packet time, and packet direction—are extracted on a session-by-session basis and stored in a JSON file as key-value pairs for subsequent traffic characterization.

[0054] For packet length and packet time, this embodiment of the invention designs unequal intervals. The packet length interval is divided into two segments: the first segment uses a 10-byte granularity, and the second segment uses a 100-byte granularity, with an overall coverage range of 5 bytes to 1400 bytes, totaling 24 intervals. To accommodate different time values, the unequal time interval is divided into three segments: uniform granularity within each segment and non-uniform granularity between segments, covering fine-grained, medium-grained, and coarse-grained cases, using granularities of 1 millisecond, 10 milliseconds, and 100 milliseconds respectively, covering a range from 1 millisecond to 1000 milliseconds, totaling 29 intervals. Since the packet direction only includes two states: uplink (outbound) and downlink (inbound), to fuse the representations of different meta-attributes, the packet length and packet time are combined with the packet direction respectively, ultimately constructing a 106-dimensional fused representation vector (uplink 29 dimensions + downlink 29 dimensions + uplink 24 dimensions + downlink 24 dimensions = 106 dimensions).

[0055] Based on this, this invention presents an unequal interval vectorization algorithm to transform network traffic into a vector form that can be learned or judged by the model. The algorithm consists of three stages: (1) Interval location - for each data packet, a binary search algorithm is used to locate the unequal interval number to which it belongs based on the packet length and packet time attributes; (2) Location statistics - after traversing the entire network flow, the number of times data packets appear in each unequal interval is counted, and a dictionary structure is used to record the count distribution of non-empty intervals; (3) Frequency calculation - the count of each interval is divided by the total number of data packets to calculate the frequency of each interval, and finally outputs a frequency vector of the same length as the unequal interval. This frequency vector is the representation of the original network traffic. During the training and testing phases of the detector, all traffic is uniformly represented using the above 106-dimensional vector to ensure the consistency of the model input format and the stability of the detection effect.

[0056] Subsequently, a deep learning-based detection model is trained using the data represented by unequal intervals. In this embodiment of the invention, training data is randomly selected from the dataset, with 70% of the traffic used to train the detector and the remaining 30% used for performance evaluation. Each detector is trained 10 times, and its performance is measured by the average of the 10 evaluation metrics. The model with the best performance is selected and saved for subsequent testing. The output type in the testing phase is consistent with that in the training phase, both being binary classification results, where "positive" represents domain-preceding traffic and "negative" represents normal network traffic. The deep learning model is developed based on the TensorFlow framework, and the optimized hyperparameters are as follows: the optimizer is Adam, the activation function is ReLU, the number of training epochs is 50, the batch size is 128, the learning rate is 0.002, the pooling layer is max pooling, the number of fully connected layers is 4, and the loss function is categorical cross-entropy.

[0057] This invention provides a comparison method, using the existing FrontID method (see IEEE conference paper "Identification Domain Fronting Traffic for Revealing Obfuscated C2 Communications", DOI: 10.1109 / DSC53577.2021.00020) as the comparison object. This method also detects domain fronting traffic based on a deep learning model and is comparable to the domain fronting traffic detection method provided in this invention. The FrontID method is specifically designed for the meek domain fronting tool and does not consider other types of domain fronting tools. Similar to the aforementioned training process, this invention uses 70% of the traffic for training the detector and the remaining 30% for performance evaluation, selecting the detector with the best performance for subsequent testing. The FrontID method trains detection models for both meek and snowflake.

[0058] To evaluate accuracy, this embodiment of the invention re-collected 500 meek traffic entries, 500 snowflake traffic entries, and 500 negative sample traffic entries to form a standard test dataset. Test results show that the domain name front-end traffic detection method provided by this embodiment is significantly superior to FrontID: the detection accuracy for meek traffic is 99.5%, and the detection accuracy for snowflake traffic is 99.3%; in contrast, FrontID's accuracy for meek traffic is 98.5%, and its accuracy for snowflake traffic is only 73.0%.

[0059] The experimental results above demonstrate that the domain name front-end traffic detection method provided in this invention has good scalability—it only requires changing the model training input to obtain the corresponding detection capabilities, thereby effectively detecting different types of domain name front-end tools. In contrast, existing technologies directly use features as model input, essentially locking their own detection capabilities and making it difficult to extend to new detection targets. In summary, this invention effectively solves the problem of insufficient scalability in existing technologies, possesses deployment potential in real-world networks, and can be used to improve the detection capabilities of existing network security facilities.

[0060] Second Embodiment Based on the aforementioned domain name front-end traffic detection method, the second embodiment of the present invention provides a domain name front-end traffic detection system based on unequal interval representation. For example... Figure 2 As shown, the domain name front-end traffic detection system includes one or more processors and a memory. The memory is coupled to the processor and is used to store computer programs. When the computer program is executed by the processor, the domain name front-end traffic detection method in the above embodiment can be implemented.

[0061] The processor controls the overall operation of the domain name front-end traffic detection system to complete all or part of the steps described above. This processor can be a central processing unit (CPU), graphics processing unit (GPU), field-programmable gate array (FPGA), application-specific integrated circuit (ASIC), digital signal processing (DSP) chip, etc. The memory stores various types of data to support the operation of the domain name front-end traffic detection system. This data may include instructions for any application or method operating on the domain name front-end traffic detection system, as well as application-related data. The memory can be implemented using any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, etc.

[0062] In an exemplary embodiment, the domain name front-end traffic detection system can be implemented by a computer chip or physical entity, or by a product with certain functions, to perform the above-described methods and achieve the same technical effects. A typical embodiment is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interface device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0063] In another exemplary embodiment, the present invention also provides a computer-readable storage medium including program instructions that, when executed by a processor, implement the steps of the method in any of the above embodiments. For example, the computer-readable storage medium may be the memory including the program instructions described above, which can be executed by a processor to complete the domain name front-end traffic detection method described above and achieve the same technical effects as the domain name front-end traffic detection method described above.

[0064] It should be noted that the above embodiments are merely illustrative examples. The technical solutions of each embodiment can be combined, and all are within the protection scope of this invention.

[0065] The domain name pre-traffic detection method and system based on unequal interval representation provided by this invention have been described in detail above. Any obvious modifications made by those skilled in the art without departing from the essence of this invention will constitute an infringement of the patent rights of this invention and will incur corresponding legal liability.

Claims

1. A method for detecting domain name front-end traffic based on unequal interval representation, characterized in that... Includes the following steps: S1: Capture network traffic; S2: Preprocess the network traffic, reassemble the original traffic into independent sessions, and extract three traffic meta-attributes, namely packet length, packet time and packet direction, on a session-by-session basis; S3: Based on unequal intervals, the traffic of each network session is uniformly represented, generating a fixed-dimensional fusion frequency vector; S4: Construct a domain name front-end traffic detector based on a deep learning model; S5: Use the trained detector to identify domain name front traffic in the network; Step S3 includes the following sub-steps: S31: Set unequal intervals for packet length and packet time respectively, and map the packet length value and packet time value of each data packet to their respective unequal intervals; S32: Count the number of times data packets appear in each unequal interval, and calculate the frequency of data packets in each interval to obtain the packet length frequency vector and packet time frequency vector; S33: Combine the packet length frequency vector and the packet time frequency vector with the packet direction value to form the fixed-dimensional fused frequency vector.

2. The domain name pre-traffic detection method as described in claim 1, characterized in that, Step S2 includes the following sub-steps: S21: Aggregate traffic into independent sessions based on the five-tuple in the data packet; S22: Filter the entire TLS session; S23: Extract three traffic meta-attributes—packet length, packet time, and packet direction—on a session basis.

3. The domain name front-end traffic detection method as described in claim 1, characterized in that... In step S3: The unequal intervals set for the package length are divided into at least two segments, with different interval granularities between the segments. The unequal intervals set for packet time are divided into at least three segments, with different interval granularities between the segments. The packet direction includes two values: up and down. The packet length frequency vector and the packet time frequency vector are split and combined according to up and down directions, respectively, and then spliced ​​to form the fixed-dimensional fused frequency vector.

4. The domain name front-end traffic detection method as described in claim 1, characterized in that... In step S3: The mapping uses a binary search algorithm to determine the position of the unequal interval to which the attribute value belongs; The statistics use a dictionary structure to record the count distribution of non-empty intervals; The frequency is the ratio obtained by dividing the count of each interval by the total number of data packets in the current session.

5. The domain name front-end traffic detection method as described in claim 4, characterized in that... In step S3, an ordered non-uniformly spaced interval is given. ,in For the data packet attribute value to be searched Returning the result using binary search interval position ; For the two meta-attributes, packet length and packet time, the corresponding attribute value of each data packet is mapped to the corresponding interval number. During the lookup process, the interval adopts a left-closed, right-open method, and the position is rounded down. The formula for calculating the middle position is: in, The middle index position obtained after each iteration of the binary search algorithm is the core positioning parameter for interval binary search; This is the left boundary index of the current binary search range, representing the starting position of the search interval; This is the right boundary index of the current binary search range, representing the end position of the search interval.

6. The domain name front-end traffic detection method as described in claim 4, characterized in that... In step S3, a dictionary structure is used to process non-empty intervals separately: Let the interval position sequence be Using a dictionary Store the number of occurrences for each interval position: in, The value in the sequence is The total number of elements; The total length of the sequence; The loop index variable for summation; For the first in the sequence The value of each element; This is an indicator function that takes the value 1 when the condition is true, and 0 otherwise.

7. The domain name front-end traffic detection method as described in claim 4, characterized in that... The formula for calculating the frequency is: in, The final frequency vector The value of the nth element, i.e., the nth element value The frequency of data packets corresponding to the unequal intervals; This is an index for unequal intervals; It is a set of unequal intervals with data packet distribution; For the first The number of data packets counted within each unequal interval; A rounding function to retain two decimal places; This represents the total number of data packets contained in the current network session.

8. The domain name front-end traffic detection method as described in claim 1, characterized in that... Step S4 includes the following sub-steps: S41: Based on a multi-level convolutional neural network, a binary classification detector is trained using the fused frequency vector; S42: Deploy the trained model and perform unified representation and intelligent discrimination on unknown traffic.

9. A domain name front-end traffic detection system based on unequal interval representation, characterized in that... It includes a processor and a memory; wherein the memory is coupled to the processor and is used to store a computer program, which, when executed by the processor, causes the processor to implement the domain name front-end traffic detection method according to any one of claims 1 to 8.

Images