An encrypted traffic suspicious behavior identification method based on sparse Bayesian learning

Abstract

The present application relates to the technical field of network security, and particularly relates to a suspicious behavior identification method for encrypted traffic based on sparse Bayesian learning. The content comprises: collecting original network data packets, screening encrypted sessions after session recombination, and extracting session-level multi-dimensional feature vectors; based on the data packets of the encrypted sessions, constructing a communication context vector; based on the communication context vector, introducing a communication context-driven sparse weight modeling mechanism, calculating the sparse weight of the features, and constructing a communication context sparse behavior feature vector; constructing a Bayesian inference path, and screening activated Bayesian inference paths; based on the communication context sparse behavior feature vector, performing Bayesian inference on the activated Bayesian inference paths, calculating suspicious behavior scores, and identifying suspicious behaviors. The problems of high feature redundancy, lack of context awareness, overly simple identification model, and fixed inference path selection in traditional suspicious behavior identification methods for encrypted traffic are solved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning. Background Technology

[0002] With the widespread application of encrypted network communication technologies, encryption protocols such as HTTPS, TLS, and QUIC have become mainstream data transmission methods, greatly improving the privacy and security of data during transmission. However, while providing confidentiality, encrypted traffic also offers opportunities for network attackers to conceal malicious activities, rendering traditional traffic detection technologies that rely on plaintext characteristics ineffective. Currently, many attacks, such as data leakage, malicious communication, remote control manipulation, and session hijacking, are often disguised within normal encrypted traffic, exhibiting typical characteristics such as concealed behavioral patterns, invisible data content, and limited feature representation, seriously threatening network security.

[0003] To address the aforementioned issues, existing research has primarily focused on the mining and classification of behavioral features of encrypted traffic, attempting to construct classifiers or anomaly detection models based on statistical features (such as packet length distribution, packet interval, byte entropy, etc.). However, such methods have the following shortcomings: (1) High feature redundancy and lack of targeted selection mechanism: Due to the high feature dimension of encrypted traffic and the large differences in different scenarios, uniformly adopting a fixed feature set is easy to introduce a large amount of invalid information, affecting the recognition performance and efficiency; (2) Lack of context awareness: Existing methods generally ignore the behavioral context factors of encrypted traffic, such as time slice, protocol type, user behavior pattern, etc. These factors are significantly related to suspicious behavior, but have not been effectively modeled and utilized; (3) The recognition model is too simple and difficult to adapt to multimodal behavior patterns: Suspicious behavior presents diverse pattern characteristics in encrypted traffic, such as periodic leakage, sudden traffic surge, atypical interactive disturbance, etc. Traditional single-path reasoning or single classifier methods are difficult to cover multiple patterns at the same time, which can easily lead to misjudgment or missed judgment; (4) Fixed reasoning path selection: In some models, the modeling of different abnormal behaviors often relies on static paths or fixed structures, and fails to dynamically activate and select appropriate reasoning paths according to the actual traffic scenario, affecting the model adaptability and computational efficiency.

[0004] Therefore, in order to address the above shortcomings, there is an urgent need to provide a method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning. Summary of the Invention

[0005] This invention provides a method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning, which solves the technical problems of high feature redundancy, lack of context awareness, overly simplistic identification model, and fixed inference path selection in traditional methods for identifying suspicious behavior in encrypted traffic.

[0006] The present invention provides a method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning, comprising the following steps:

[0007] S1. Collect raw network data packets, perform session reassembly, filter encrypted sessions, and extract session-level multidimensional feature vectors from the encrypted sessions; standardize the feature components of the session-level multidimensional feature vectors to obtain standardized feature components; generate communication context parameters based on the data packets of the encrypted sessions and construct a communication context vector; introduce a communication context-driven sparse weight modeling mechanism to fuse the feature components in the communication context vector to obtain a comprehensive strength score of the communication context and construct sparse weights for the features; adjust the standardized feature components based on the sparse weights of the features and construct a sparse behavior feature vector for the communication context.

[0008] S2. Construct Bayesian inference paths and introduce a path gating mechanism based on communication context awareness. Calculate the gating weights of the paths based on the comprehensive strength score of the communication context, and select the activated Bayesian inference paths. Perform Bayesian inference on the activated Bayesian inference paths based on the sparse behavioral feature vectors of the communication context to obtain the posterior suspicious probability of the path and calculate the suspicious behavior score. Based on the suspicious behavior score, identify suspicious behaviors.

[0009] Preferably, S1 specifically includes:

[0010] The protocol type of the data packets in the reconstructed session is extracted and the encryption attribute is judged to obtain encrypted sessions. The session-level multidimensional feature vector is extracted by statistical analysis of the data packets in the encrypted session. The communication context parameters are obtained by extracting and analyzing the parameters of the data packets in the encrypted session, including time slice type, encryption protocol type, behavior pattern, session duration and session periodicity strength. The communication context vector is constructed based on the communication context parameters.

[0011] Preferably, S1 specifically includes:

[0012] In the implementation of the communication context-driven sparse weight modeling mechanism, the communication context weight coefficient is introduced to weight and fuse the feature components in the communication context vector to obtain the comprehensive strength score of the communication context; based on the comprehensive strength score of the communication context, combined with the exponential function, the sparse weight of the feature is obtained.

[0013] Preferably, S1 specifically includes:

[0014] The specific formula for calculating the sparse weights of the features is as follows: , in, Indicates the first Sparse weights of dimensional features; For communication context weighting coefficients; A comprehensive strength score for the communication context; These are communication context parameters, representing the time slice type of the current encrypted session, the encryption protocol type used by the current encrypted session, the behavior pattern of the current encrypted session, the session duration, and the session periodicity strength, respectively. Indicates the maximum duration of the session; For the first Feature redundancy tendency coefficient of dimensional features; , is a very small constant used to prevent the denominator from being zero.

[0015] Preferably, S1 specifically includes:

[0016] The standardized feature components are multiplied by the sparse weights of the corresponding dimensional features to obtain the feature components after sparse weight adjustment; the feature components after sparse weight adjustment are normalized to obtain normalized feature components, and a sparse behavior feature vector of the communication context is constructed.

[0017] Preferably, S2 specifically includes:

[0018] In the implementation of the communication context-aware path gating mechanism, a path sensitivity adjustment factor is introduced and multiplied with the communication context comprehensive strength score to obtain the path context activation strength score. Then, the sigmoid activation function is combined to calculate the path gating weight.

[0019] Preferably, S2 specifically includes:

[0020] The Bayesian inference paths include periodic abnormal paths, burst traffic paths, and session interference paths. Based on the path gating weights, it is determined whether the Bayesian inference path corresponding to the gating weight is activated. For each Bayesian inference path, a corresponding normal behavior model and a suspicious behavior model are constructed. When a Bayesian inference path is activated, the normalized feature component with the highest correlation to the corresponding suspicious behavior pattern in the sparse behavior feature vector of the communication context is used as input. The conditional probability of the input feature component belonging to the normal behavior model and the suspicious behavior model is calculated. Combined with the corresponding prior probability, the posterior suspicious probability of the corresponding Bayesian inference path is output.

[0021] Preferably, S2 specifically includes:

[0022] Based on path-based gating weights, the posterior suspicious probability of the activated Bayesian inference path is normalized and fused to calculate a suspicious behavior score. Based on the suspicious behavior score, it is determined whether there is suspicious behavior in the current encrypted session. When there is suspicious behavior, the corresponding suspicious behavior pattern label is output by combining the activated Bayesian inference path.

[0023] The beneficial effects of the technical solution of the present invention are:

[0024] 1. This invention introduces a communication context-driven sparse weight modeling mechanism, which can automatically improve the suppression strength of redundant features in peak periods or highly periodic scenarios, while maintaining the integrity of necessary features in low-interference scenarios. Thus, it achieves differentiated sparse control based on feature dimensions without increasing computational complexity.

[0025] 2. This invention proposes a path gating mechanism based on communication context awareness, which comprehensively considers whether the communication context environment of the current encrypted session has an activation tendency and the sensitivity of the current Bayesian inference path to the communication context environment, thereby realizing refined differential modeling and dynamic activation control of multiple suspicious behavior patterns, effectively avoiding the problem of false activation or missed activation of Bayesian inference path.

[0026] 3. This invention achieves stability, comparability, and robustness in the identification of suspicious behaviors in encrypted traffic by gating and normalizing the posterior suspicious probabilities of Bayesian inference paths for different suspicious behaviors. This is achieved by maintaining consistency in scoring intervals and uniformity in judgment criteria under multiple types of suspicious behavior inference. Attached Figure Description

[0027] Figure 1 This is a flowchart of a method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning, as described in this invention.

[0028] Figure 2 This is a statistical graph of the gating weights of each Bayesian inference path in the encrypted traffic suspicious behavior identification method based on sparse Bayesian learning described in this invention. Detailed Implementation

[0029] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0031] The following description, in conjunction with the accompanying drawings, details a specific scheme for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning, provided by this invention.

[0032] See attached document Figure 1 The diagram illustrates a flowchart of a method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning, provided by an embodiment of the present invention. The method includes the following steps:

[0033] S1. Collect raw network data packets, perform session reassembly, filter encrypted sessions, and extract session-level multidimensional feature vectors from the encrypted sessions; standardize the feature components of the session-level multidimensional feature vectors to obtain standardized feature components; generate communication context parameters based on the data packets of the encrypted sessions and construct a communication context vector; introduce a communication context-driven sparse weight modeling mechanism to fuse the feature components in the communication context vector to obtain a comprehensive strength score of the communication context and construct sparse weights for the features; adjust the standardized feature components based on the sparse weights of the features and construct a sparse behavior feature vector for the communication context.

[0034] Raw network data packets (hereinafter referred to as packets) are passively collected from network traffic using mirror ports, network probes, or bypass monitoring devices deployed at network ingress and egress points. These packets are then stored in a traffic database. Each packet contains the following metadata: source IP address, destination IP address, source port, destination port, protocol type, timestamp, packet length (i.e., number of bytes), and packet direction. Based on the five-tuple formed by the source IP address, destination IP address, source port, destination port, and protocol type, the packets can be reassembled into multiple logically related sessions. The reassembled sessions are then filtered based on handshake phase message characteristics to obtain encrypted sessions using encryption protocols such as HTTPS, TLS, or QUIC. These handshake phase message characteristics, such as the TLS protocol version field and the QUIC protocol type identifier, can be extracted using existing deep packet inspection techniques. Each encrypted session contains several packets with the same five-tuple identifier. Session-level multidimensional feature vectors are extracted from the packets within the encrypted session using existing statistical analysis methods. ,in Indicates the first 3D eigencomponents, Indicates the feature component dimension index. The feature component dimension is represented by the session-level multidimensional feature vector. The included feature components include, but are not limited to: average packet length Byte entropy Data packet interval variance Uplink byte ratio Session duration and conversation periodicity The average length of the data packets The byte entropy is obtained by calculating the arithmetic mean of the number of bytes in the data packets contained in the encrypted session; The byte distribution probability is obtained by calculating the frequency distribution of the number of bytes in the data packets contained in the encrypted session, and then the Shannon entropy is calculated from the byte distribution probability; the variance of the data packet interval time is obtained. The packet interval time series is obtained by calculating the timestamp difference between adjacent data packets within an encrypted session, and then the variance of the packet interval time series is calculated. The unit is seconds. 2 The adjacent data packets refer to data packets that are adjacent in position in the sequence after being arranged in ascending order of timestamps; the uplink byte ratio The duration of the session is obtained by calculating the ratio of the sum of the bytes of the uplink data packets contained in the encrypted session to the total number of bytes of the contained data packets; The time interval covered by the timestamps of the data packets contained in the encrypted session is calculated by the difference between the latest and earliest data packet timestamps in the encrypted session, in seconds; the session periodicity... This indicates the degree of regularity in the recurrence of encrypted sessions within the historical observation window. Based on the earliest data packet timestamp of the historical encrypted sessions within the historical observation window that share the same 5-tuple identifier as the current encrypted session, an encrypted session occurrence time series is constructed. The difference between the earliest data packet timestamps of adjacent encrypted sessions within the encrypted session occurrence time series is calculated to form a session interval time series. Subsequently, an autocorrelation function with a lag order of 1 is used to analyze the session interval time series, and the calculated lag order 1 autocorrelation coefficient is taken as the session periodicity. The length of the historical observation window is set according to the actual application scenario, preferably 7 to 30 days. The above calculation process is all existing technology and will not be elaborated here. The calculation of the first... The mean and standard deviation of the 3D feature components are calculated, and the Z-score normalization method is used to evaluate the 3D feature components of the current encrypted session. The 1D feature components are standardized to obtain the standardized feature components. ;

[0035] To achieve context-aware modeling of encrypted session communication, five types of communication context parameters are obtained based on the data packets contained in the encrypted session, and a communication context vector is constructed. ,in, This indicates the time slice type of the current encrypted session, used to indicate whether the current encrypted session is in a peak period. It is calculated by summing the total number of actual bytes transmitted globally within a sliding time window and dividing this sum by the theoretical maximum throughput of the link (e.g., the maximum number of bytes transmitted in 60 seconds for 1Gbps Gigabit Ethernet). The current network load rate is calculated as the ratio of this ratio to 1. If the ratio is greater than 1, the current network load rate is truncated to 1. If the current network load rate is greater than a preset load rate threshold, it is considered a peak period. Otherwise, it is considered off-peak time. As a specific example, the sliding time window length is set to 60 seconds, and the load rate threshold is taken as the 90th quantile of the network load rate distribution within the historical observation window. This indicates the type of encryption protocol used in the current encrypted session. Indicates other encryption protocols, Indicates the HTTPS protocol. This indicates the TLS protocol, where the encryption protocol type is the encryption protocol type corresponding to the encrypted session; This indicates the behavior pattern of the current encrypted session. It is determined by calculating the ratio of the standard deviation to the mean of the packet interval time series of the data packets contained in the current encrypted session, and comparing this ratio with a preset interaction determination threshold. If the ratio is greater than the interaction determination threshold, then... This indicates a user-initiated interactive behavior, such as a user actively visiting a webpage; otherwise, , indicating automatic synchronization behavior, such as background data synchronization; the interaction judgment threshold is the 90th quantile of the ratio distribution of the standard deviation and mean of the packet interval time series of encrypted sessions labeled as automatic synchronization behavior in the historical labeled encrypted session sample set. Session duration ; This indicates the intensity of session periodicity, determined by the periodicity of the session. The results, calculated using the maximum-minimum normalization method, indicate that the closer the session periodicity intensity is to 1, the stronger the session repetition.

[0036] To achieve adaptive compression and redundancy adjustment of feature dimensions in encrypted sessions, a communication context-driven sparse weight modeling mechanism is introduced. By introducing communication context weight coefficients, the feature components in the communication context vector are weighted and fused to calculate the comprehensive strength score of the communication context. Multiplying the comprehensive strength score of the communication context by the feature redundancy tendency coefficient yields the result. The feature context redundancy score of each feature dimension in the encrypted session is calculated. Then, the feature context redundancy score is non-linearly amplified by an exponential function, and the sparse weight of each feature dimension is calculated using a reciprocal structure, as shown in the following formula: , in, , indicating the first The sparse weights of the dimensional features; the smaller the value, the stronger the sparse weights of the dimensional features. The more likely a dimensional feature is to be considered a redundant feature in the current communication context; The communication context weight coefficients are used to measure the contribution of different communication context parameters to the overall strength score of the communication context. They are determined using a five-fold cross-validation combined with a grid search method. As a specific embodiment, the grid search range is set to... The goal is to ensure that the integrated strength score of the fused communication context is within the high gradient response range of the Sigmoid function, with a search step size of 0.1. Historical labeled encrypted session sample sets are extracted from the traffic database, and the training set and validation set are divided. The optimization objective is to maximize the F1-score of the validation set. The label information in the historical labeled encrypted session sample set is obtained by professional technicians based on a comprehensive judgment of known security event information, attack behavior characteristics, security detection results, threat intelligence alarm information, and business behavior analysis results. The label information is used to identify the normal behavior category or suspicious behavior category corresponding to each encrypted session. The overall strength score for the communication context is used to measure the degree of impact of the current communication environment on feature redundancy. These represent the time slice type of the current encrypted session, the encryption protocol type used by the current encrypted session, the behavior pattern of the current encrypted session, the session duration, and the session periodicity strength, respectively. This represents the maximum session duration, obtained by taking the maximum session duration of all encrypted sessions. The characteristic redundancy tendency coefficient represents the first... The degree of redundancy of dimensional features within a historical observation window, when the 1st feature... When the dimensional feature changes little within the historical observation window, A larger value corresponds to a smaller sparse weight. This is achieved by analyzing the first [number] data point within the historical observation window. The standard deviation of the feature components is subjected to maximum and minimum normalization to obtain the feature activity. The difference between 1 and the feature activity is further calculated to obtain the feature redundancy tendency coefficient. Indicates the first Feature context redundancy score for dimensional features; , is a very small constant used to prevent the denominator from being zero;

[0037] The above formula introduces a communication context-driven sparse weight modeling mechanism, which can automatically improve the suppression strength of redundant features during peak periods or highly periodic scenarios, while maintaining the integrity of necessary features in low-interference scenarios, thus achieving differentiated sparsity control based on feature dimensions.

[0038] The first dimensional standardized feature components and corresponding sparse weights Multiplying them together yields the 1st sparse weight adjusted product. The feature components are dimensional; to further unify the feature numerical scale, the feature components after sparse weight adjustment are subjected to maximum and minimum normalization processing, and mapped to the interval [0,1] to obtain normalized feature components. The communication context sparse behavior feature vector is constructed according to the feature dimension index from smallest to largest.

[0039] S2. Construct Bayesian inference paths and introduce a path gating mechanism based on communication context awareness. Calculate the gating weights of the paths based on the comprehensive strength score of the communication context, and select the activated Bayesian inference paths. Perform Bayesian inference on the activated Bayesian inference paths based on the sparse behavioral feature vectors of the communication context to obtain the posterior suspicious probability of the path and calculate the suspicious behavior score. Based on the suspicious behavior score, identify suspicious behaviors.

[0040] To address typical suspicious behavior patterns that may exist in encrypted sessions, such as periodic anomalies, sudden surges, and atypical interactions, specifically corresponding to encrypted communication threat scenarios such as data leakage, malicious bulk downloads, and session hijacking, three Bayesian inference paths are constructed: a periodic anomaly path, a sudden traffic path, and a session interference path. Each path corresponds to a type of suspicious behavior pattern. Specifically, the periodic anomaly path is used to identify regular communication or data leakage behavior, the sudden traffic path is used to identify short-term surges in communication behavior, and the session interference path is used to identify atypical interaction behavior within a session.

[0041] To achieve differentiated modeling and dynamic identification of different suspicious behavior patterns in encrypted sessions, a communication context-aware path gating mechanism is proposed. This mechanism obtains the path context activation strength score by multiplying the overall communication context strength score by a path sensitivity adjustment factor. Then, combined with the sigmoid activation function, the gating weight for each Bayesian inference path is calculated, as shown in the following formula: , in, Let be the gating weight of the path, representing the th . The activation strength of each Bayesian inference path; , representing the index of the Bayesian inference path, corresponding to the periodic anomaly path, the burst traffic path, and the session interference path, respectively; For communication context weight coefficients, used to measure the contribution of different communication context parameters to the overall strength score of the communication context; These represent the time slice type of the current encrypted session, the encryption protocol type used by the current encrypted session, the behavior pattern of the current encrypted session, the session duration, and the session periodicity strength, respectively. Indicates the maximum duration of the session; The overall strength score of the communication context is used to measure the degree to which the current communication environment drives the activation of Bayesian inference paths; This is a path sensitivity adjustment factor used to characterize the path sensitivity modulator. The sensitivity of each Bayesian inference path to the overall strength score of the communication context is calculated by measuring the response of the first Bayesian inference path in the historically labeled encrypted session sample set. The frequency of suspicious behavior patterns corresponding to a single Bayesian inference path is obtained by the ratio of the frequency of occurrence of suspicious behavior patterns corresponding to all Bayesian inference paths to the maximum frequency of occurrence of suspicious behavior patterns. The path context activation strength score represents the current communication context's influence on the first... The activation drive strength of each Bayesian inference path; , for the first The bias terms of each Bayesian inference path are obtained through pre-setting by professional technicians. When, it indicates a decrease in the first. The basic activation threshold of a Bayesian inference path makes it easier to activate within the same communication context; when When, it indicates raising the first The basic activation threshold of each Bayesian inference path is set so that it is activated only when the communication context-driven strength is high; when At that time, no offset adjustment is performed on the path activation;

[0042] The above formula proposes a communication context-aware path gating mechanism. It comprehensively considers whether the current encrypted session's communication context has an activation tendency, and the sensitivity of the current Bayesian inference path to this communication context. This enables refined differential modeling and dynamic activation control of multiple suspicious behavior patterns, effectively avoiding false or missed activation of Bayesian inference paths. To more intuitively illustrate the actual effect of the above gating mechanism, as a specific embodiment, a statistical graph of the gating weights of each Bayesian inference path is attached. Figure 2 As shown, the Bayesian inference paths corresponding to different types of encrypted sessions have different gating weight distributions. Specifically, the gating weight of the periodic abnormal inference path is higher and meets the activation condition in periodic abnormal sessions; the gating weight of the burst traffic inference path is higher and meets the activation condition in burst traffic sessions; and the gating weight of the session interference inference path is higher and meets the activation condition in session interference sessions. Other inference paths that do not correspond to the behavior pattern have relatively lower gating weights. This demonstrates that the communication context-aware path gating mechanism can select the corresponding inference path based on the behavioral characteristics of the current encrypted session, improving the targeting of subsequent suspicious behavior identification.

[0043] Since the path gating weights are calculated using the Sigmoid activation function, their value range is... Furthermore, when the input to the Sigmoid activation function is 0, the output is 0.5. Based on this, the path gating weight threshold is adjusted. The preferred setting is 0.5; when At that time, the judgment of the first Once a Bayesian inference path is activated, the process enters the Bayesian inference path execution phase, and the posterior suspicious probability of the Bayesian inference path is calculated; when At that time, the judgment of the first The Bayesian inference path was not activated and there is no need to enter the Bayesian inference path execution phase;

[0044] The specific implementation process of the Bayesian inference path execution stage is as follows: For each Bayesian inference path, a corresponding normal behavior model and a suspicious behavior model are constructed. Specifically, normal behavior samples and suspicious behavior samples under the corresponding path are obtained from the historical labeled encrypted session sample set, the conditional probability distribution of the input feature components in the normal behavior samples and suspicious behavior samples are statistically analyzed, and normal behavior models and suspicious behavior models are constructed respectively.

[0045] Each Bayesian inference path takes the normalized feature component that has the highest correlation with the corresponding suspicious behavior pattern (e.g., selected based on mutual information) in the sparse behavior feature vector of the communication context as input. As a preferred implementation, the periodic anomaly path takes the feature component describing the session time distribution and repetition pattern as input, including but not limited to the normalized session periodicity; the burst traffic path takes the feature component describing the traffic mutation and burst rate as input, including but not limited to the normalized data packet interval time variance; the session interference path takes the feature component describing the uplink and downlink interaction ratio and interaction density as input, including but not limited to the normalized uplink byte ratio.

[0046] Furthermore, the normalized input feature components of the path corresponding to the current encrypted session are input into the normal behavior model and the suspicious behavior model, respectively, and the conditional probability of it belonging to the normal behavior model and the suspicious behavior model is calculated. Combined with the corresponding prior probability, the first... Posterior suspicious probability of a Bayesian inference path The prior probabilities are obtained through statistics from a historical encrypted session sample set. The prior probability of the normal behavior model is the ratio of the number of normal encrypted session samples to the total number of samples, and the prior probability of the suspicious behavior model is the ratio of the number of suspicious encrypted session samples to the total number of samples.

[0047] Furthermore, when at least one Bayesian inference path exists, the posterior suspicious probability of each activated Bayesian inference path is fused with the corresponding gating weight of the Bayesian inference path, and then divided by the sum of the gating weights of the activated Bayesian inference paths to calculate the suspicious behavior score; if no activated Bayesian inference path exists, the suspicious behavior score is 0, as shown in the following formula: , in, This represents a suspicious behavior score; the higher the value, the more suspicious the current encrypted session is. Indicates the index of the activated Bayesian inference path; Indicates all that satisfy The set of Bayesian inference path indices, when When this occurs, it indicates that the current encrypted session has not triggered any suspicious behavior patterns, therefore the suspicious behavior score is [not specified]. =0, Indicates the empty set; It is the sum of the products of the gating weights of the activated Bayesian inference paths and the posterior suspicious probability; This is the sum of the gating weights of the activated Bayesian inference paths; , where is the gating weight of the path, and represents the activated Bayesian inference path. The activation intensity; , for the activated Bayesian inference path The output posterior suspicious probability, a value close to 1 indicates that the sub-model of the Bayesian inference path considers the input encrypted session to be highly suspicious;

[0048] The above formula, by gating and normalizing the posterior suspicious probability of Bayesian inference paths for different suspicious behaviors, can maintain the consistency of scoring intervals and the uniformity of judgment criteria under multiple types of suspicious behavior inference, thereby improving the stability, comparability and robustness of the suspicious behavior identification process in encrypted sessions.

[0049] The 95th percentile of the suspicious behavior score distribution among normal encrypted session samples in the historical annotated encrypted session sample set is used as the suspicious behavior score threshold. When suspicious behavior is scored When suspicious behavior is detected in the current encrypted session, the system simultaneously determines that the behavior is suspicious based on the activated Bayesian inference path index set. The index in the code outputs the corresponding suspicious behavior pattern label. For example, if only the Bayesian inference path with index 2 is activated, then the condition is satisfied. If so, the corresponding suspicious behavior pattern is determined to be "sudden abnormal traffic"; if If the current encrypted session is deemed to be in normal behavior, the "No anomaly" label will be output.

[0050] In summary, a method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning has been developed.

[0051] The order of the embodiments is for illustrative purposes only and does not represent the superiority or inferiority of the embodiments. The processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0052] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0053] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning, characterized in that, Includes the following steps: S1. Collect raw network data packets, perform session reassembly, filter encrypted sessions, and extract session-level multidimensional feature vectors from the encrypted sessions; standardize the feature components of the session-level multidimensional feature vectors to obtain standardized feature components; generate communication context parameters based on the data packets of the encrypted sessions and construct a communication context vector; introduce a communication context-driven sparse weight modeling mechanism to fuse the feature components in the communication context vector to obtain a comprehensive communication context strength score, and construct sparse weights for the features; Based on the sparse weights of features, the standardized feature components are adjusted, and a sparse behavioral feature vector of the communication context is constructed. S2. Construct Bayesian inference paths and introduce a path gating mechanism based on communication context awareness. Calculate the gating weights of the paths based on the comprehensive strength score of the communication context, and select the activated Bayesian inference paths. Based on the sparse behavioral feature vector of the communication context, Bayesian inference is performed on the activated Bayesian inference path to obtain the posterior suspicious probability of the path and calculate the suspicious behavior score. Suspicious behavior is identified based on suspicious behavior scoring.

2. The method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning according to claim 1, characterized in that, S1 specifically includes: The protocol type of the data packets in the reconstructed session is extracted and the encryption attribute is judged to obtain encrypted sessions. The session-level multidimensional feature vector is extracted by statistical analysis of the data packets in the encrypted session. The communication context parameters are obtained by extracting and analyzing the parameters of the data packets in the encrypted session, including time slice type, encryption protocol type, behavior pattern, session duration and session periodicity strength. The communication context vector is constructed based on the communication context parameters.

3. The method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning according to claim 2, characterized in that, S1 specifically includes: In the implementation of the communication context-driven sparse weight modeling mechanism, the communication context weight coefficient is introduced to weight and fuse the feature components in the communication context vector to obtain the comprehensive strength score of the communication context; based on the comprehensive strength score of the communication context, combined with the exponential function, the sparse weight of the feature is obtained.

4. The method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning according to claim 3, characterized in that, S1 specifically includes: The specific formula for calculating the sparse weights of the features is as follows: ， in, Indicates the first Sparse weights of dimensional features; For communication context weighting coefficients; A comprehensive strength score for the communication context; These are communication context parameters, representing the time slice type of the current encrypted session, the encryption protocol type used by the current encrypted session, the behavior pattern of the current encrypted session, the session duration, and the session periodicity strength, respectively. Indicates the maximum duration of the session; For the first Feature redundancy tendency coefficient of dimensional features; , is a very small constant used to prevent the denominator from being zero.

5. The method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning according to claim 3, characterized in that, S1 specifically includes: The standardized feature components are multiplied by the sparse weights of the corresponding dimensional features to obtain the feature components after sparse weight adjustment; the feature components after sparse weight adjustment are normalized to obtain normalized feature components, and a sparse behavior feature vector of the communication context is constructed.

6. The method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning according to claim 1, characterized in that, S2 specifically includes: In the implementation of the communication context-aware path gating mechanism, a path sensitivity adjustment factor is introduced and multiplied with the communication context comprehensive strength score to obtain the path context activation strength score. Then, the sigmoid activation function is combined to calculate the path gating weight.

7. The method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning according to claim 6, characterized in that, S2 specifically includes: The Bayesian inference paths include periodic abnormal paths, burst traffic paths, and session interference paths. Based on the path gating weights, it is determined whether the Bayesian inference path corresponding to the gating weight is activated. For each Bayesian inference path, a corresponding normal behavior model and a suspicious behavior model are constructed. When a Bayesian inference path is activated, the normalized feature component with the highest correlation to the corresponding suspicious behavior pattern in the sparse behavior feature vector of the communication context is used as input. The conditional probability of the input feature component belonging to the normal behavior model and the suspicious behavior model is calculated. Combined with the corresponding prior probability, the posterior suspicious probability of the corresponding Bayesian inference path is output.

8. The method for identifying suspicious behavior in encrypted traffic based on sparse Bayesian learning according to claim 7, characterized in that, S2 specifically includes: Based on path-based gating weights, the posterior suspicious probability of the activated Bayesian inference path is normalized and fused to calculate a suspicious behavior score. Based on the suspicious behavior score, it is determined whether there is suspicious behavior in the current encrypted session. When there is suspicious behavior, the corresponding suspicious behavior pattern label is output by combining the activated Bayesian inference path.

Images