A malicious data leakage analysis method and system based on network traffic logs
Patent Information
- Application Number
- CN202611360705.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-09-03
- Publication Date
- 2026-11-03
AI Technical Summary
Traditional methods for preventing network data leakage struggle to identify malicious data leaks that are encrypted or embedded in covert channels. Furthermore, existing anomaly detection schemes based on traffic logs have a high false alarm rate, especially in C2 server communication scenarios, and lack real-time threat intelligence matching and host behavior profiling modeling.
By combining host registration with external IOC intelligence centers, dynamic behavior profiles are constructed through real-time matching and dynamic behavior analysis. Anomaly scores are calculated using a sliding time window, and combined with in-depth analysis, malicious data leakage detection with low false alarms is achieved.
It achieves targeted, low-false-positive malicious data leakage detection, protects the core data assets of the campus network, reduces computing overhead, adapts to changes in host behavior, and improves detection efficiency.
Smart Images
Figure CN123035031A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application relates to a malicious data leakage analysis method and system based on network traffic logs, and belongs to the technical field of network security. BACKGROUND
[0002] Traditional network data leakage prevention methods mostly rely on static rules or deep packet inspection, and it is difficult to identify malicious data leakage encrypted or embedded in hidden channels, and the protection of important data hosts inside lacks pertinence. The existing abnormality detection scheme based on traffic logs has a high false alarm rate, especially in the scene of communication with a C2 server, because of the lack of real-time threat intelligence matching and host behavior portrait modeling, which often leads to missed reports or alarm storms. Therefore, a low false alarm malicious data leakage detection method combining record filtering, C2 intelligence priority matching and dynamic portrait analysis is urgently needed.
[0003] Therefore, how to find malicious data leakage by combining host records and external C2 intelligence in the numerous hosts storing important data and the massive traffic logs in the campus network, and assist in user host portrait, so as to improve the efficiency of malicious data leakage detection, is a problem to be solved in malicious data leakage analysis. SUMMARY
[0004] In view of the deficiencies of the prior art, the application provides a malicious data leakage analysis method and system based on network traffic logs, which combines host records and external IOC intelligence center, realizes targeted and low false alarm malicious data leakage detection, and effectively protects the core data assets of the campus network.
[0005] The application adopts the following technical scheme:
[0006] A malicious data leakage analysis method based on network traffic logs, comprising the following steps:
[0007] S1, record the IP address, MAC address, department to which the host belongs, data type and security level of the host storing or processing important data in the campus network, and form a protected host list;
[0008] S2, real-time collection of network traffic logs, and filtering according to the protected host list, only retaining the traffic records related to the hosts in the protected host list, reducing the analysis load;
[0009] S3, for the filtered traffic logs, for each outward communication flow in the traffic logs, extract the destination IP, connect the external IOC intelligence center for real-time matching, if the known malicious address in the external IOC intelligence center is hit, directly determine it as malicious leakage and alarm, jump to step S7; for the suspicious traffic not hit, enter step S4 for deep behavior analysis;
[0010] S4, extract real-time behavior features of suspicious traffic hosts that do not match, and build a dynamic behavior portrait;
[0011] S5, continuously extract real-time behavior features of suspicious traffic hosts in a sliding time window, and calculate abnormal behavior scores for the real-time collected behavior feature vectors If the abnormal behavior score exceeds the preset threshold T, it is determined that the current behavior is abnormal, and the host and the corresponding external connection are marked as suspicious objects;
[0012] S6, for the host with abnormal behavior, further analyze the external connection traffic to determine whether there is malicious data exfiltration behavior; if so, construct an alarm record;
[0013] S7, store the current alarm event in the historical case library, and trigger the online update mechanism of the dynamic behavior portrait: adjust the mean and standard deviation in an incremental learning manner, so that the dynamic behavior portrait can adapt to the changes of normal host behavior (such as business periodic expansion), and at the same time, the newly discovered exfiltration target IP is fed back to the internal C2 intelligence cache.
[0014] Further, in step S2, a traffic collection probe is deployed at the core switch at the exit of the campus network, and the core switch mirrors the campus network traffic to the traffic collection probe to generate real-time campus network traffic logs; the network traffic logs include traffic reception time, source IP, destination IP, source port number, destination port number, protocol type, query domain name, etc.
[0015] Extract the source IP field in the network traffic log and match it with the hosts in the protected host list: only keep the traffic logs whose source IP belongs to the hosts in the protected host list, and discard the logs of non-important hosts, thereby reducing the computational overhead of subsequent analysis.
[0016] Further, in step S3, the out-bound connection traffic refers to the destination IP that is not an internal network address, i.e. IP addresses other than the three network segments of 10.0.0.0 / 8, 172.16.0.0 / 12, and 192.168.0.0 / 16.
[0017] If it is a DNS packet, the query domain name is extracted and matched in real time with the external IOC intelligence center; the external IOC intelligence center collects known malicious indicators, including malicious addresses, malicious domain names, file hashes, SSL certificate fingerprints, etc.
[0018] The malicious indicators of the external IOC intelligence center come from publicly known threat intelligence sharing platforms or commercial threat intelligence subscription services. They can be obtained in the following ways:
[0019] (1) Malicious C2 addresses and domain names extracted by security vendors / research institutions through reverse analysis of historical attack events and sample sandbox analysis;
[0020] (2) Crowdsourced reporting through public threat intelligence sharing communities (such as OTX, MISP);
[0021] (3) Threat notices issued by official emergency response agencies such as CERT / CC and CNCERT;
[0022] (4) Commercial threat intelligence subscription services (such as FireEye, Mandiant, Recorded Future, etc.). All of the above are well-known technical means in this field.
[0023] Furthermore, in step S4, multi-dimensional behavioral features are extracted based on historical traffic logs to construct a dynamic behavioral profile (i.e., a dynamic baseline). The formula for the dynamic behavioral profile is:
[0024] F h = [f1,f2,f3,...,f i ,...,f n ]
[0025] In the formula, F h f is the behavioral feature vector of host h; i The i-th dimension of the feature vector represents the feature vector within a unit of time, including baseline features such as the communication peer, traffic timing, data packet size distribution, and transmission frequency; n is the dimension of the feature vector.
[0026] When n is 5, f1 represents the number of IP addresses the host connects to in a unit of time, f2 represents the number of bytes of traffic the host connects to in a unit of time, f3 represents the average packet length of the host's outbound connections in a unit of time, f4 represents the variance of the host's outbound connection interval in a unit of time, and f5 represents the number of connections to high-risk ports.
[0027] Furthermore, in step S5, the sliding time window is 3 to 8 minutes, preferably 5 minutes.
[0028] Furthermore, in step S5, for the real-time behavioral feature vector X=[ , , ,..., ,..., ] Calculate the mean of the eigenvectors for each dimension within the historical period. with standard deviation Define abnormal behavior scores :
[0029]
[0030] In the formula, Indicates the first A multi-dimensional behavioral feature vector; This represents the number of IP addresses that the host connects to externally within a unit of time, collected in real time. This represents the number of bytes of outbound communication traffic collected by the host per unit time in real time. This represents the average length of data packets transmitted outwards by the host per unit time, collected in real time. This represents the variance of the communication intervals between the host and other entities within a unit of time, as collected in real time. This represents the number of connections to high-risk ports collected in real time per unit of time.
[0031] Represents extremely small positive numbers (such as 10). -6 ), to prevent the denominator from being zero; Indicates the first The weights of each dimension of behavioral features satisfy... =1, the weight can be dynamically allocated according to the host's security level (increased weight for traffic bytes for sensitive hosts), which can accurately depict the normal behavior baseline of different hosts and is more sensitive to low-speed, covert leaks. The purpose of this design is to ensure that abnormal behavior scores are accurate. Comparability and interpretability.
[0032] Furthermore, the preset threshold T ranges from 3.0 to 4.0.
[0033] Furthermore, the implementation process of step S6 includes:
[0034] S61 parses the data payload in the traffic and detects whether there is encoded data (such as Base64, hexadecimal string), encrypted features or structured sensitive data patterns (such as ID card number, credit card number).
[0035] S62, combined with time-series correlation analysis, determines whether data is sent in batches to the same destination IP within a short period of time, and whether the data length fluctuates drastically;
[0036] S63. If either S61 or S62 is true, that is, if either S61 or step S62 is "yes", it is determined that there is malicious data leakage. Otherwise, it is marked as "low confidence anomaly" and enters the manual review queue.
[0037] Furthermore, "short time" refers to no more than 5 minutes; for example, if a protected host continuously sends more than 20 data streams to the same destination IP within 5 minutes, and the length of each data stream fluctuates drastically, it is considered a batch transmission. This threshold can be adjusted according to the host's normal business characteristics. For example, it can be set to 10 streams / 5 minutes for regular business hosts, and appropriately relaxed to 50 streams / 5 minutes for database backup hosts.
[0038] Within a sliding time window (5 minutes), extract all outbound traffic records with the same destination IP in timestamp order, and calculate the frequency and time distribution of the destination IP. If the frequency exceeds a threshold (e.g., 20 times) and the time interval variance is small (sending is regular, such as once every 10-15 seconds), it is judged as a batch sending behavior, which is a typical characteristic of malicious data leakage - attackers often use fixed-interval "heartbeat" outbound transmissions to avoid single large traffic alerts.
[0039] Assuming the destination IP receives N data streams in a short period of time, the coefficient of variation (CV) is equal to the ratio of the standard deviation of the N data streams to the mean. When the standard deviation of the N data streams exceeds half of its mean, i.e. the coefficient of variation (CV) is greater than 0.5, it is determined that the data length fluctuates drastically. Malicious leakage often manifests as an alternating pattern of "small packet probing + large packet transmission", and the coefficient of variation is significantly higher than that of stable transmission of normal business.
[0040] Preferably, the alarm log includes the protected host identifier (IP and registration information), the target IP and port of the leak, the time window of the data leak, the amount of data transmitted, and the score of abnormal behavior. If there is an external IOC intelligence match in step S3, a hit tag and a summary of the basis for anomaly judgment will be attached.
[0041] This invention combines host registration with an external IOC intelligence center to achieve targeted, low-false-positive malicious data leakage detection, effectively protecting the core data assets of the campus network.
[0042] A malicious data leakage analysis system based on network traffic logs is deployed on a server located next to the core switch of the monitored network. The core switch mirrors all bidirectional traffic between the monitored network and the Internet to the system to implement the aforementioned malicious data leakage method based on network traffic logs, including:
[0043] The filing and registration module is used to file and register hosts that store or process important data within the park network, recording IP address, MAC address, department, data type and security level to form a list of protected hosts.
[0044] The filtering module is used to collect network traffic logs in real time and filter them according to the list of protected hosts, retaining only traffic records related to hosts in the list of protected hosts, thereby reducing the analysis load.
[0045] The real-time matching module is used to extract the destination IP for each outbound communication traffic in the traffic log, connect to the external IOC intelligence center for real-time matching, and directly determine it as malicious leakage and issue an alarm if it matches a known malicious address in the external IOC intelligence center; for suspicious traffic that does not match, in-depth behavioral analysis is performed.
[0046] The behavior profile building module is used to extract real-time behavior features from suspicious traffic hosts that have not been detected and to build dynamic behavior profiles.
[0047] The anomaly detection module is used to continuously extract real-time behavioral features of suspicious traffic hosts using a sliding time window, and calculate anomaly scores on the collected behavioral feature vectors. If the abnormal behavior score If the threshold T is exceeded, the current behavior is determined to be abnormal, and the host and its corresponding outgoing connection are marked as suspicious objects.
[0048] The data leakage behavior judgment module is used to determine whether there is malicious data leakage behavior. If so, an alarm record is generated.
[0049] The online update module is used to store the current alarm event in the historical case library and trigger the online update mechanism of the dynamic behavior profile, so that the dynamic behavior profile can adapt to changes in the normal behavior of the host.
[0050] For any details not covered in this invention, please refer to the prior art.
[0051] The beneficial effects of this invention are as follows:
[0052] 1. This invention uses host registration and traffic filtering mechanisms to focus in-depth analysis on the protected host set, significantly reducing computational overhead and analysis load while ensuring detection coverage, thus achieving a balance between targeted protection and resource efficiency.
[0053] 2. This invention adopts a layered and progressive detection architecture of "external IOC intelligence center priority matching → profile anomaly analysis → in-depth analysis". The external IOC intelligence center priority matching can directly hit known malicious addresses and quickly determine them. Suspicious traffic that is not hit then enters the profile anomaly analysis. Profile anomalies then trigger in-depth analysis. This layered funnel structure narrows the detection surface at each level, effectively reducing the false positive rate while ensuring the recall rate.
[0054] 3. This invention independently constructs a dynamic behavior profile for each protected host and uses abnormal behavior scoring. To determine whether there are abnormal behaviors, the profile is more granular and more sensitive to low-speed, covert leaks. Furthermore, through an incremental learning mechanism, the profile can adapt to the cyclical changes in host business (such as business expansion and time-of-day traffic fluctuations), avoiding false alarms caused by baseline aging. Attached Figure Description
[0055] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments of this application and their descriptions are used to explain this application and do not constitute an undue limitation of this application.
[0056] Figure 1 This is a schematic diagram illustrating the deployment of the malicious data leakage analysis system based on network traffic logs according to the present invention.
[0057] Figure 2 This is a schematic diagram of the malicious data leakage analysis method based on network traffic logs according to the present invention. Detailed Implementation
[0058] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. However, this is not the only description; all aspects not described in detail herein are based on conventional techniques in the art.
[0059] Example 1
[0060] A method for analyzing malicious data leakage based on network traffic logs, such as Figure 2 As shown, it includes the following steps:
[0061] S1, register and file records of hosts that store or process important data within the park network, recording IP address, MAC address, department, data type and security level, and forming a list of protected hosts;
[0062] S2 collects network traffic logs in real time and filters them according to the list of protected hosts, retaining only traffic records related to hosts in the list of protected hosts, thus reducing the analysis load;
[0063] S3. For the filtered traffic logs, extract the destination IP for each outbound communication traffic in the traffic logs, connect to the external IOC intelligence center for real-time matching. If a known malicious address in the external IOC intelligence center is matched, it is directly judged as malicious leakage and an alarm is triggered, and the process jumps to step S7. For suspicious traffic that does not match, proceed to step S4 for in-depth behavioral analysis.
[0064] S4 extracts real-time behavioral characteristics from suspicious traffic hosts that have not been hit, and builds dynamic behavioral profiles;
[0065] S5 continuously extracts real-time behavioral features of suspicious traffic hosts using a sliding time window, and calculates anomaly scores on the collected behavioral feature vectors. If the abnormal behavior score If the threshold T is exceeded, the current behavior is determined to be abnormal, and the host and its corresponding outgoing connection are marked as suspicious objects.
[0066] S6. For hosts exhibiting abnormalities, further analyze outbound connection traffic to determine if malicious data leakage occurs; if so, generate an alarm record.
[0067] S7 stores this alarm event in the historical case database and triggers the online update mechanism of the dynamic behavior profile: adjusting the mean through incremental learning. with standard deviation This enables dynamic behavioral profiles to adapt to changes in the host's normal behavior (such as periodic business expansion), while also feeding back newly discovered leaked target IPs to the internal C2 intelligence cache.
[0068] Example 2
[0069] A method for analyzing malicious data leakage based on network traffic logs, as shown in Example 1, differs in that, in step S2, a traffic acquisition probe is deployed at the core switch at the campus network egress. The core switch mirrors the campus network traffic to the traffic acquisition probe, generating campus network traffic logs in real time. The network traffic logs include traffic reception time, source IP, destination IP, source port number, destination port number, protocol type, query domain name, etc.
[0070] Extract the source IP field from the network traffic logs and match it with hosts in the protected host list: only retain traffic logs whose source IP belongs to hosts in the protected host list, and discard logs of non-critical hosts, thereby reducing the computational overhead of subsequent analysis.
[0071] Example 3
[0072] A method for analyzing malicious data leakage based on network traffic logs, as shown in Example 2, differs in that, in step S3, outbound communication traffic refers to destination IP addresses that are not internal network addresses, that is, IP addresses other than the three network segments 10.0.0.0 / 8, 172.16.0.0 / 12, and 192.168.0.0 / 16;
[0073] If it is a DNS message, the query domain name is extracted and connected to an external IOC intelligence center for real-time matching; the external IOC intelligence center gathers known malicious indicators, including malicious addresses, malicious domain names, file hashes, SSL certificate fingerprints, etc.
[0074] Malicious indicators from external IOC intelligence centers are derived from well-known threat intelligence sharing platforms or commercial threat intelligence subscription services, and can be obtained through the following methods:
[0075] (1) Malicious C2 addresses and domain names extracted by security vendors / research institutions through reverse analysis of historical attack events and sample sandbox analysis;
[0076] (2) Crowdsourced reporting through public threat intelligence sharing communities (such as OTX, MISP);
[0077] (3) Threat notices issued by official emergency response agencies such as CERT / CC and CNCERT;
[0078] (4) Commercial threat intelligence subscription services (such as FireEye, Mandiant, Recorded Future, etc.). All of the above are well-known technical means in this field.
[0079] Example 4
[0080] A method for analyzing malicious data leakage based on network traffic logs, as shown in Example 3, differs in that, in step S4, multi-dimensional behavioral features are extracted based on historical traffic logs to construct a dynamic behavioral profile (i.e., a dynamic baseline). The formula for the dynamic behavioral profile is:
[0081] F h = [f1,f2,f3,...,f i ,...,f n ]
[0082] In the formula, F h f is the behavioral feature vector of host h; i The i-th dimension of the feature vector represents the feature vector within a unit of time, including baseline features such as the communication peer, traffic timing, data packet size distribution, and transmission frequency; n is the dimension of the feature vector.
[0083] In this embodiment, n is 5, f1 represents the number of IP addresses the host connects to in a unit of time, f2 represents the number of bytes of traffic the host connects to in a unit of time, f3 represents the average data packet length the host connects to in a unit of time, f4 represents the variance of the host's outbound communication interval in a unit of time, and f5 represents the number of connections to high-risk ports.
[0084] Example 5
[0085] A method for analyzing malicious data leakage based on network traffic logs, as shown in Example 4, differs in that the sliding time window in step S5 is 5 minutes.
[0086] For the real-time behavioral feature vector X=[ , , ,..., ,..., ] Calculate the mean of the eigenvectors for each dimension within the historical period. with standard deviation Define abnormal behavior scores :
[0087]
[0088] In the formula, Indicates the first A multi-dimensional behavioral feature vector; This represents the number of IP addresses that the host connects to externally within a unit of time, collected in real time. This represents the number of bytes of outbound communication traffic collected by the host per unit time in real time. This represents the average length of data packets transmitted outwards by the host per unit time, collected in real time. This represents the variance of the communication intervals between the host and other entities within a unit of time, as collected in real time. This represents the number of connections to high-risk ports collected in real time per unit of time.
[0089] Represents extremely small positive numbers (such as 10). -6 ), to prevent the denominator from being zero; Indicates the first The weights of each dimension of behavioral features satisfy... =1, the weight can be dynamically allocated according to the host's security level (increased weight for traffic bytes for sensitive hosts), which can accurately depict the normal behavior baseline of different hosts and is more sensitive to low-speed, covert leaks. The purpose of this design is to ensure that abnormal behavior scores are accurate. Comparability and interpretability.
[0090] In this embodiment, the preset threshold T is set to 3.5.
[0091] Example 6
[0092] A method for analyzing malicious data leakage based on network traffic logs, as shown in Example 5, differs in that the implementation process of step S6 includes:
[0093] S61 parses the data payload in the traffic and detects whether there is encoded data (such as Base64, hexadecimal string), encrypted features or structured sensitive data patterns (such as ID card number, credit card number).
[0094] S62, combined with time-series correlation analysis, determines whether data is sent in batches to the same destination IP within a short period of time, and whether the data length fluctuates drastically;
[0095] S63. If either S61 or S62 is true, that is, if either S61 or step S62 is "yes", it is determined that there is malicious data leakage. Otherwise, it is marked as "low confidence anomaly" and enters the manual review queue.
[0096] Example 7
[0097] A method for analyzing malicious data leakage based on network traffic logs, as shown in Example 6, differs in that "short time" refers to no more than 5 minutes. For example, if a protected host continuously sends more than 20 data streams to the same destination IP within 5 minutes, and the length of each data stream fluctuates drastically, it is considered a batch transmission. This threshold can be adjusted according to the host's normal business characteristics. For example, it can be set to 10 streams / 5 minutes for regular business hosts, and appropriately relaxed to 50 streams / 5 minutes for database backup hosts.
[0098] Within a sliding time window (5 minutes), extract all outbound traffic records with the same destination IP in timestamp order, and calculate the frequency and time distribution of the destination IP. If the frequency exceeds a threshold (e.g., 20 times) and the time interval variance is small (sending is regular, such as once every 10-15 seconds), it is judged as a batch sending behavior, which is a typical characteristic of malicious data leakage - attackers often use fixed-interval "heartbeat" outbound transmissions to avoid single large traffic alerts.
[0099] Assuming the destination IP receives N data streams in a short period of time, the coefficient of variation (CV) is equal to the ratio of the standard deviation of the N data streams to the mean. When the standard deviation of the N data streams exceeds half of its mean, i.e. the coefficient of variation (CV) is greater than 0.5, it is determined that the data length fluctuates drastically. Malicious leakage often manifests as an alternating pattern of "small packet probing + large packet transmission", and the coefficient of variation is significantly higher than that of stable transmission of normal business.
[0100] In this embodiment, the alarm log includes the protected host identifier (IP and registration information), the target IP and port of the leak, the data leakage time window, the amount of data transmitted, and the abnormal behavior score. If there is an external IOC intelligence match in step S3, a hit tag and a summary of the basis for anomaly judgment will be attached.
[0101] Example 8
[0102] A malicious data leakage analysis system based on network traffic logs, such as Figure 1 As shown, the system is deployed on a server located next to the core switch of the monitored network. The core switch mirrors all bidirectional traffic between the monitored network and the Internet to the system, enabling the aforementioned method of malicious data leakage based on network traffic logs, including:
[0103] The filing and registration module is used to file and register hosts that store or process important data within the park network, recording IP address, MAC address, department, data type and security level to form a list of protected hosts.
[0104] The filtering module is used to collect network traffic logs in real time and filter them according to the list of protected hosts, retaining only traffic records related to hosts in the list of protected hosts, thereby reducing the analysis load.
[0105] The real-time matching module is used to extract the destination IP for each outbound communication traffic in the traffic log, connect to the external IOC intelligence center for real-time matching, and directly determine it as malicious leakage and issue an alarm if it matches a known malicious address in the external IOC intelligence center; for suspicious traffic that does not match, in-depth behavioral analysis is performed.
[0106] The behavior profile building module is used to extract real-time behavior features from suspicious traffic hosts that have not been detected and to build dynamic behavior profiles.
[0107] The anomaly detection module is used to continuously extract real-time behavioral features of suspicious traffic hosts using a sliding time window, and calculate anomaly scores on the collected behavioral feature vectors. If the abnormal behavior score If the threshold T is exceeded, the current behavior is determined to be abnormal, and the host and its corresponding outgoing connection are marked as suspicious objects.
[0108] The data leakage behavior judgment module is used to determine whether there is malicious data leakage behavior. If so, an alarm record is generated.
[0109] The online update module is used to store the current alarm event in the historical case library and trigger the online update mechanism of the dynamic behavior profile, so that the dynamic behavior profile can adapt to changes in the normal behavior of the host.
[0110] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. A method for analyzing malicious data leakage based on network traffic logs, characterized in that, Includes the following steps: S1, register and file records of hosts that store or process important data within the park network, recording IP address, MAC address, department, data type and security level, and forming a list of protected hosts; S2 collects network traffic logs in real time and filters them according to the list of protected hosts, retaining only traffic records related to hosts in the list of protected hosts, thus reducing the analysis load; S3. For each outbound communication traffic in the traffic log, extract the destination IP and connect to the external IOC intelligence center for real-time matching. If a known malicious address in the external IOC intelligence center is matched, it is directly determined as malicious leakage and an alarm is triggered, and the process jumps to step S7. For suspicious traffic that does not match, proceed to step S4 for in-depth behavioral analysis. S4 extracts real-time behavioral characteristics from suspicious traffic hosts that have not been hit, and builds dynamic behavioral profiles; S5 continuously extracts real-time behavioral features of suspicious traffic hosts using a sliding time window, and calculates anomaly scores on the collected behavioral feature vectors. If the abnormal behavior score If the threshold T is exceeded, the current behavior is determined to be abnormal, and the host and its corresponding outgoing connection are marked as suspicious objects. S6, for hosts exhibiting abnormalities, further analyze outbound connection traffic to determine if there is any malicious data leakage behavior; If it exists, construct an alarm record; S7 stores this alarm event in the historical case database and triggers the online update mechanism of the dynamic behavior profile, enabling the dynamic behavior profile to adapt to changes in the host's normal behavior.
2. The malicious data leakage analysis method based on network traffic logs according to claim 1, characterized in that, In step S2, a traffic acquisition probe is deployed at the core switch at the campus network egress. The core switch mirrors the campus network traffic to the traffic acquisition probe and generates a campus network traffic log in real time. The network traffic log includes the traffic reception time, source IP, destination IP, source port number, destination port number, protocol type, and query domain name. Extract the source IP field from the network traffic logs and match it with hosts in the protected host list: only retain traffic logs whose source IP belongs to hosts in the protected host list.
3. The malicious data leakage analysis method based on network traffic logs according to claim 2, characterized in that, In step S3, the external IOC intelligence center gathers known malicious indicators, including malicious addresses, malicious domains, file hashes, and SSL certificate fingerprints.
4. The malicious data leakage analysis method based on network traffic logs according to claim 3, characterized in that, In step S4, multi-dimensional behavioral features are extracted based on historical traffic logs to construct a dynamic behavioral profile. The formula for the dynamic behavioral profile is: F h = [f1,f2,f3,...,f i ,...,f n ] In the formula, F h f is the behavioral feature vector of host h; i This represents the feature vector of the i-th dimension per unit time; n is the dimension of the feature vector.
5. The malicious data leakage analysis method based on network traffic logs according to claim 4, characterized in that, In step S5, the sliding time window is 3 to 8 minutes, preferably 5 minutes.
6. The malicious data leakage analysis method based on network traffic logs according to claim 5, characterized in that, In step S5, for the real-time behavioral feature vector X=[ , , ,..., ,..., ] Calculate the mean of the eigenvectors for each dimension within the historical period. with standard deviation Define abnormal behavior scores : In the formula, Indicates the first A multi-dimensional behavioral feature vector; To represent extremely small positive numbers, preventing the denominator from being zero; Indicates the first The weights of each dimension of behavioral features satisfy... =1.
7. The malicious data leakage analysis method based on network traffic logs according to claim 6, characterized in that, The preset threshold T ranges from 3.0 to 4.
0.
8. The malicious data leakage analysis method based on network traffic logs according to claim 6, characterized in that, The implementation process of step S6 includes: S61 parses the data payload in the traffic and detects whether there are encoded data, encryption features, or structured sensitive data patterns; S62, combined with time-series correlation analysis, determines whether data is sent in batches to the same destination IP within a short period of time, and whether the data length fluctuates drastically; S63: If either S61 or S62 is hit, it is determined that there is malicious data leakage; otherwise, it is marked as "low confidence anomaly" and enters the manual review queue.
9. The malicious data leakage analysis method based on network traffic logs according to claim 8, characterized in that, Short time refers to no more than 5 minutes; if the destination IP receives N data streams in a short period of time, and the standard deviation of the N data streams exceeds half of their mean, it is considered that the data length fluctuates drastically. Preferably, the alarm log includes the protected host identifier, the target IP and port of the leak, the time window of the data leak, the amount of data transmitted, and the score of abnormal behavior. If there is an external IOC intelligence match in step S3, a hit tag and a summary of the basis for anomaly judgment will be attached.
10. A malicious data leakage analysis system based on network traffic logs, deployed on a server, for implementing the malicious data leakage method based on network traffic logs as described in any one of claims 1-9, characterized in that, include: The filing and registration module is used to file and register hosts that store or process important data within the park network, recording IP address, MAC address, department, data type and security level to form a list of protected hosts. The filtering module is used to collect network traffic logs in real time and filter them according to the list of protected hosts, retaining only traffic records related to hosts in the list of protected hosts, thereby reducing the analysis load. The real-time matching module is used to extract the destination IP for each outbound communication traffic in the traffic log, connect to the external IOC intelligence center for real-time matching, and directly determine it as malicious leakage and issue an alarm if it matches a known malicious address in the external IOC intelligence center; for suspicious traffic that does not match, in-depth behavioral analysis is performed. The behavior profile building module is used to extract real-time behavior features from suspicious traffic hosts that have not been detected and to build dynamic behavior profiles. The anomaly detection module is used to continuously extract real-time behavioral features of suspicious traffic hosts using a sliding time window, and calculate anomaly scores on the collected behavioral feature vectors. If the abnormal behavior score If the threshold T is exceeded, the current behavior is determined to be abnormal, and the host and its corresponding outgoing connection are marked as suspicious objects. The data leakage behavior judgment module is used to determine whether there is malicious data leakage behavior. If so, an alarm record is generated. The online update module is used to store the current alarm event in the historical case library and trigger the online update mechanism of the dynamic behavior profile, so that the dynamic behavior profile can adapt to changes in the normal behavior of the host.