A network attack identification method based on online traffic feature detection

Abstract

This invention relates to the field of network security technology and discloses a network attack identification method based on online traffic feature detection, comprising the following steps: S1. Network devices using a network traffic acquisition module, in conjunction with a data packet acquisition tool, comprehensively collect network traffic data and perform preliminary screening and processing. This network attack identification method based on online traffic feature detection, through the network traffic acquisition module and its data link, enables real-time monitoring of network traffic, timely detection of potential attack behaviors, and rapid implementation of countermeasures to reduce losses caused by attacks. The network traffic acquisition module connects to various network devices connected to online traffic, thus covering various types of communication and data transmission, avoiding the limitations of single-point monitoring. Furthermore, the entire detection process is based on actual traffic data analysis, reducing the subjectivity and error of human judgment.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a network attack identification method based on online traffic feature detection. Background Technology

[0002] With the continuous development of internet technology, online traffic constitutes the main component of user network usage. Online traffic refers to the amount of data transmitted over the network, which can be any information transmitted via the internet, such as web browsing, file downloads, and video streaming. The management and analysis of network traffic are crucial for the design and maintenance of network architecture, as they directly relate to network performance optimization and network security management. Network security has become a significant challenge for global information security. To better protect network security, it is essential to master network attack detection technologies. Among these, network attack detection technologies based on traffic analysis have become a research hotspot in the field of network security. Advanced persistent threats (APS) have become one of the main threats against high-security networks. APS attacks typically aim to steal sensitive data, and their attack timelines are long, covert, sophisticated, and constantly evolving. There are certain patterns in the communication behavior during APS attacks. Command and control communication scenarios can be detected during the intrusion, establishment of monitoring channels, and data resource discovery and uploading stages. For example:

[0003] Existing network attack detection solutions based on online traffic have shortcomings. Advanced persistent threat attacks may use a variety of methods, tools and means. It is difficult to effectively characterize the attack behavior using only static features such as domain names and IP addresses. Moreover, in the intrusion phase of advanced persistent threat attacks, such as phishing and accessing malicious domain names, there are rarely obvious abnormal traffic behaviors. It is difficult to accurately detect attacks by analyzing traffic values ​​alone.

[0004] To address the aforementioned issues, there is an urgent need for innovative designs based on existing network attack identification methods. Summary of the Invention

[0005] The purpose of this invention is to provide a network attack identification method based on online traffic feature detection, in order to solve the problem mentioned in the background art that it is difficult to effectively characterize the behavioral characteristics of attacks by using only static features such as domain names and IP addresses, and that in the intrusion stage of advanced persistent threat attacks, such as phishing and access to malicious domain names, there are rarely obvious abnormal traffic behaviors, making it difficult to accurately detect attacks by traffic value analysis alone.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a network attack identification method based on online traffic feature detection, comprising the following steps:

[0007] S1. Network devices using network traffic acquisition modules, in conjunction with packet acquisition tools, comprehensively collect network traffic data and perform preliminary screening and processing;

[0008] S2. The preprocessing module performs data compression, filtering, feature extraction, and aggregation on the collected traffic data to reduce the processing time of subsequent modules and more effectively detect attacks.

[0009] S3. The feature detection module matches and compares the features with the collected data in the database to determine whether there are any known attacks and generates corresponding alerts.

[0010] S4. The anomaly detection module uses machine learning algorithms to detect unknown attacks in the network and builds machine learning models by collecting and analyzing normal network data.

[0011] S5. After the analysis and filtering of traffic data by the analysis submodule in the analysis and early warning module, possible attack entry points are found, and the origin and entry point of the attack into the network are determined.

[0012] S6. The alarm submodule in the analysis and early warning module acquires the alarm information from the feature detection module and the anomaly detection module, and provides relevant alarm information to the alarm notification terminal;

[0013] S7. After the attack tracing module detects abnormal traffic in the abnormal traffic analysis and early warning module, it performs attack tracing based on relevant information to reconstruct the network attack path;

[0014] S8. The storage system module uses a cuckoo filter to store traffic data and related analysis results, providing data support for modules such as attack tracing.

[0015] By adopting the above technical solution, network attacks can be identified by detecting the characteristics of online traffic connected through network devices.

[0016] Preferably, the network traffic acquisition module includes a network device and a data packet acquisition tool. The network device connects to online traffic, discards unwanted packets after initial screening and processing, and sends the packet data that meets the rules to subsequent modules.

[0017] By adopting the above technical solution, the network traffic collection module undergoes preliminary screening, which facilitates subsequent module preprocessing.

[0018] Preferably, the network traffic acquisition module monitors and analyzes the traffic during normal network operation for a period of time during the traffic collection process, and establishes a characteristic baseline of normal traffic, including traffic size, direction, protocol distribution, port usage, packet size and interval, etc.

[0019] By adopting the above technical solution, the network traffic acquisition module facilitates the comprehensive collection of online traffic activity characteristics.

[0020] Preferably, the anomaly detection module extracts traffic data related to a specific time period or a specific type of attack from the traffic feature data obtained by the feature detection module, and then the storage system module provides the anomaly detection module with a database of past anomaly detections for inspection.

[0021] The above technical solution facilitates the extraction of corresponding traffic data from traffic feature data.

[0022] Preferably, the analysis and early warning module includes an analysis submodule and an early warning submodule. The analysis submodule collects online traffic data that has been processed by the preprocessing module and correlates attack events at different stages and locations to construct a complete attack scenario. The analysis results are supplemented and verified by combining network devices.

[0023] By adopting the above technical solution, two sub-modules are set up separately as an analysis sub-module and an early warning sub-module, which facilitates synchronous processing in different areas.

[0024] Preferably, the information collected by the early warning submodule, the feature detection module, and the anomaly detection module is responsible for issuing an alarm and providing relevant alarm information when abnormal traffic is detected.

[0025] By adopting the above technical solution, the information from the early warning submodule, the feature detection module, and the anomaly detection module is connected in parallel, which facilitates rapid alarm.

[0026] Preferably, the attack tracing module includes functional sub-modules such as a data analysis and processing service interface and an attack tracing data query service interface, which enable multiple nodes to work together to obtain and query data packet information between each pair of routing nodes, thereby constructing an attack path.

[0027] Using the above technical solution, the attack path is constructed through the collaborative work of multiple nodes in the attack tracing module.

[0028] Preferably, the detailed content of the data packets in the constructed attack path includes header information, payload data, etc. For key data packets or traffic segments, in-depth data packet analysis is performed to find traces of attackers, while combining system logs and other data sources.

[0029] Using the above technical solution, traffic characteristics and attacker traces can be found by analyzing data packets in the attack path.

[0030] Preferably, after finding the attacker's traces, the attacker's IP address, domain name, and other information are analyzed to find the network service provider or related network infrastructure to which the attacker belongs, and correlation analysis is performed to see if there is any connection with other known attack activities, malicious organizations, or previous security incidents.

[0031] By adopting the above technical solution, the attacker's traces can be used to trace the source, which facilitates parallel analysis and processing.

[0032] Preferably, the storage system of the cuckoo filter in the storage system module uses two hash functions to map elements to two different locations. If there is no conflict in either location, the element is directly inserted. If one location is already occupied, the element in that location is replaced in the other location, and then a new element is inserted.

[0033] Using the above technical solution, the storage capacity of the storage system is compressed by the cuckoo filter in the storage system module.

[0034] Compared with existing technologies, the beneficial effects of this invention are: the network attack identification method based on online traffic feature detection:

[0035] 1. The network traffic acquisition module, through its data link and combined analysis and early warning module, can monitor network traffic in real time, promptly detect potential attacks, and take swift countermeasures to reduce the losses caused by attacks. The network traffic acquisition module connects to various network devices to monitor online traffic, covering all types of communication and data transmission, avoiding the limitations of single-point monitoring. Furthermore, the entire detection process is based on actual traffic data analysis, reducing the subjectivity and error of human judgment. Understanding the characteristics of normal traffic provides valuable references for network optimization and resource allocation.

[0036] 2. Through the analysis and early warning module, the early warning submodule and the analysis submodule, together with the feature detection module, often exhibit abnormal traffic characteristics in the early stages of an attack, thereby achieving early warning and buying time for defense. The early warning submodule and the analysis submodule, together with the anomaly detection module, trace the source and path of the attack online, which is helpful for subsequent investigation and evidence collection. Traffic data is correlated with other security-related information, such as threat intelligence and user behavior data, to more comprehensively assess whether a network attack exists. Attached Figure Description

[0037] Figure 1 This is a schematic diagram of the network attack identification method detection process of the present invention;

[0038] Figure 2 This is a schematic diagram of the module flow of the network attack identification method of the present invention;

[0039] Figure 3 This is a schematic diagram illustrating the flow of the network attack identification method module of the present invention. Detailed Implementation

[0040] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0041] Please see Figure 1-3 This invention provides a technical solution: a network attack identification method based on online traffic feature detection, comprising the following steps:

[0042] S1. Network devices using network traffic acquisition modules, in conjunction with packet acquisition tools, comprehensively collect network traffic data and perform preliminary screening and processing;

[0043] S2. The preprocessing module performs data compression, filtering, feature extraction, and aggregation on the collected traffic data to reduce the processing time of subsequent modules and more effectively detect attacks.

[0044] S3. The feature detection module matches and compares the features with the collected data in the database to determine whether there are any known attacks and generates corresponding alerts.

[0045] S4. The anomaly detection module uses machine learning algorithms to detect unknown attacks in the network and builds machine learning models by collecting and analyzing normal network data.

[0046] S5. After the analysis and filtering of traffic data by the analysis submodule in the analysis and early warning module, possible attack entry points are found, and the origin and entry point of the attack into the network are determined.

[0047] S6. The alarm submodule in the analysis and early warning module acquires the alarm information from the feature detection module and the anomaly detection module, and provides relevant alarm information to the alarm notification terminal;

[0048] S7. After the attack tracing module detects abnormal traffic in the abnormal traffic analysis and early warning module, it performs attack tracing based on relevant information to reconstruct the network attack path;

[0049] S8. The storage system module uses a cuckoo filter to store traffic data and related analysis results, providing data support for modules such as attack tracing.

[0050] Referring to the attached diagrams in the instruction manual Figure 1-3 As shown, during operation, various network devices in the network traffic acquisition module, such as routers and switches, acquire traffic data, perform preliminary filtering and processing, discard unnecessary packets, and send packets that meet the rules to subsequent modules. The data as a whole undergoes data transmission, which is done sequentially, such as... Figure 3 As shown, after the network traffic data enters the preprocessing management module, it directly enters the analysis submodule of the analysis and early warning module. The traffic data is correlated with other security-related information, such as threat intelligence and user behavior data. The data processed by the preprocessing module enters the anomaly detection module and the feature detection module, which are connected to the early warning submodule of the analysis and early warning module and run in parallel. When the early warning submodule, together with the anomaly detection module and the feature detection module, detects possible network attack features, an alarm is immediately triggered and corresponding defensive measures are taken, such as blocking suspicious traffic and isolating affected systems. Finally, the attack tracing module traces the source and path of the attack, which helps in subsequent investigation and evidence collection. After the anomaly traffic analysis and early warning module detects abnormal traffic, it traces the attack source based on relevant information and reconstructs the network attack path.

[0051] The network traffic acquisition module sets up network devices and data packet acquisition tools. The network devices connect to online traffic, discard unwanted packets after initial screening and processing, and send the packet data that meets the rules to subsequent modules.

[0052] The network traffic acquisition module monitors and analyzes the traffic during normal network operation for a period of time, and establishes a characteristic baseline of normal traffic, including traffic size, direction, protocol distribution, port usage, packet size and interval, etc.

[0053] Referring to the attached diagrams in the instruction manual Figure 1-3 As shown, the network traffic acquisition module is responsible for capturing and collecting network traffic data. It can use packet acquisition tools such as tcpdump and wireshark, or be developed based on a technology stack similar to gopacket. It monitors and analyzes the traffic during normal network operation for a period of time. Using network monitoring tools or devices, it comprehensively collects network traffic data, including information such as the source address, destination address, protocol type, port number, and traffic size of data packets, which is the source of online traffic.

[0054] The anomaly detection module extracts traffic data related to suspected attacks in specific time periods or of specific types from the traffic feature data obtained by the feature detection module, and then the storage system module provides the anomaly detection module with a database of past anomaly detections for inspection.

[0055] The analysis and early warning module includes an analysis submodule and an early warning submodule. The analysis submodule collects online traffic data from the preprocessing module and the processed data, and correlates attack events at different stages and locations to construct a complete attack scenario. It also supplements and verifies the results of attack tracing analysis by combining network devices.

[0056] The information collected by the early warning submodule, the feature detection module, and the anomaly detection module is responsible for issuing an alarm and providing relevant alarm information when abnormal traffic is detected.

[0057] Referring to the attached diagrams in the instruction manual Figure 1-3 As shown, the anomaly detection module continuously monitors real-time traffic, compares it with an established baseline, and identifies anomalies in the traffic, such as sudden and significant increases or decreases in online traffic, abnormally high traffic on specific ports, and the use of uncommon protocols. The analysis submodule acquires features, and the detection and anomaly detection modules process the data, performing in-depth analysis of the packet content and examining the packet header and payload. This can detect characteristics of malware, illegal instructions, and abnormal command sequences. For online anomaly traffic analysis and identification, the analysis submodule uses the machine learning library provided by SparkMLlib, employing a streaming k-means algorithm for model design and training. The trained model is then used for online anomaly traffic analysis and identification. During training, the k-means algorithm extracts key features reflecting network traffic characteristics from the collected data, randomly selects k samples as initial cluster centers, these centers represent k different clusters, calculates the distance from each sample to each cluster center, assigns it to the cluster containing the nearest cluster center, recalculates the average value of each cluster, and obtains new cluster centers. This process of assigning samples and updating cluster centers is repeated until the online traffic data meets the requirements for anomaly traffic analysis and identification.

[0058] The attack tracing module includes functional sub-modules such as data analysis and processing service interfaces and attack tracing data query service interfaces. It enables multiple nodes to work together to obtain and query data packet information between each pair of routing nodes, thereby constructing the attack path.

[0059] The attack tracing module constructs a collection of detailed data packets in the attack path, including header information, payload data, etc. For key data packets or traffic segments, it performs in-depth data packet analysis to find traces of attackers, while also combining system logs and other data sources.

[0060] After finding traces of attackers, the attack tracing module analyzes information such as the IP address and domain name used by the attackers, finds the network service provider or related network infrastructure to which they belong, and performs correlation analysis to see if there is any connection with other known attack activities, malicious organizations or previous security incidents.

[0061] Referring to the attached diagrams in the instruction manual Figure 1-3 As shown, machine learning or deep learning algorithms are used in the attack tracing module to build a model for identifying network attacks. The model is trained using known normal traffic and attack traffic data, allowing the model to learn the characteristic differences between normal traffic and attack traffic. Following the clues in the traffic data, the attack propagation path in the network is gradually traced. At the same time, the flow of data packets, the relationship between requests and responses, and the interaction with other systems or devices are analyzed. By correlating traffic data at different time points and locations, the attack is reconstructed as it spreads in the network.

[0062] By combining various technologies and tools, and having a deep understanding of network architecture and system configuration, it is also necessary to follow the principles of legality and compliance in actual operation, and ensure that one has the corresponding technical capabilities and permissions. In addition, with the continuous expansion of the model database, network security defense mechanisms should be continuously updated and improved to enhance network security.

[0063] The storage system of the cuckoo filter in the storage system module uses two hash functions to map elements to two different locations. If there is no conflict in either location, the element is inserted directly. If one location is already occupied, the element in that location is replaced in the other location, and then a new element is inserted.

[0064] Referring to the attached diagrams in the instruction manual Figure 1-3 As shown, the storage system module is used to store traffic data and related analysis results. The storage system of the Cuckoo Filter uses the Cuckoo Filter as the primary storage to store hot data, while adding a secondary persistent storage database to ensure data reliability and provide data support for modules such as attack tracing.

[0065] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A network attack identification method based on online traffic feature detection, characterized in that, Includes the following steps: S1. Network devices using network traffic acquisition modules, in conjunction with packet acquisition tools, comprehensively collect network traffic data and perform preliminary screening and processing; S2. The preprocessing module performs data compression, filtering, feature extraction, and aggregation on the collected traffic data to reduce the processing time of subsequent modules and more effectively detect attacks. S3. The feature detection module matches and compares the features with the collected data in the database to determine whether there are any known attacks and generates corresponding alerts. S4. The anomaly detection module uses machine learning algorithms to detect unknown attacks in the network and builds machine learning models by collecting and analyzing normal network data. S5. After the analysis and filtering of traffic data by the analysis submodule in the analysis and early warning module, possible attack entry points are found, and the origin and entry point of the attack into the network are determined. S6. The alarm submodule in the analysis and early warning module acquires the alarm information from the feature detection module and the anomaly detection module, and provides relevant alarm information to the alarm notification terminal; S7. After the attack tracing module detects abnormal traffic in the abnormal traffic analysis and early warning module, it performs attack tracing based on relevant information to reconstruct the network attack path; S8. The storage system module uses a cuckoo filter to store traffic data and related analysis results, providing data support for modules such as attack tracing.

2. The network attack identification method based on online traffic feature detection according to claim 1, characterized in that: The network traffic acquisition module is equipped with network devices and data packet acquisition tools. The network devices connect to online traffic, discard unwanted packets after initial screening and processing, and send the packet data that meets the rules to subsequent modules.

3. The network attack identification method based on online traffic feature detection according to claim 1, characterized in that: The network traffic acquisition module monitors and analyzes the traffic during normal network operation for a period of time, establishing a characteristic baseline of normal traffic, including traffic size, direction, protocol distribution, port usage, packet size and interval, etc.

4. The network attack identification method based on online traffic feature detection according to claim 1, characterized in that: The anomaly detection module extracts traffic data related to suspected attacks from the traffic feature data obtained by the feature detection module, and then the storage system module provides the anomaly detection module with a database of past anomaly detections for inspection.

5. The network attack identification method based on online traffic feature detection according to claim 1, characterized in that: The analysis and early warning module includes an analysis submodule and an early warning submodule. The analysis submodule collects online traffic data from the preprocessing module and other preprocessed data, and correlates attack events at different stages and locations to construct a complete attack scenario. It also supplements and verifies the results of attack tracing analysis by combining network devices.

6. The network attack identification method based on online traffic feature detection according to claim 1, characterized in that: The information collected by the early warning submodule, feature detection module, and anomaly detection module is responsible for issuing an alarm and providing relevant alarm information when abnormal traffic is detected.

7. The network attack identification method based on online traffic feature detection according to claim 1, characterized in that: The attack tracing module includes functional sub-modules such as a data analysis and processing service interface and an attack tracing data query service interface. It enables multiple nodes to work together to obtain and query data packet information between each pair of routing nodes, thereby constructing an attack path.

8. The network attack identification method based on online traffic feature detection according to claim 7, characterized in that: The detailed contents of the data packets in the constructed attack path include header information, payload data, etc. For key data packets or traffic segments, in-depth data packet analysis is performed to find traces of attackers, while combining system logs and other data sources.

9. A network attack identification method based on online traffic feature detection according to claim 8, characterized in that: After finding the attacker's traces, analyze the IP address, domain name, and other information used by the attacker, find the network service provider or related network infrastructure to which the attacker belongs, and conduct correlation analysis to see if there is any connection with other known attack activities, malicious organizations, or previous security incidents.

10. The network attack identification method based on online traffic feature detection according to claim 1, characterized in that: The storage system of the cuckoo filter in the storage system module uses two hash functions to map elements to two different locations. If there is no conflict in either location, the element is directly inserted. If one location is already occupied, the element in that location is replaced in the other location, and then a new element is inserted.

Images