WO2021243663A1

WO2021243663A1 - Session detection method and apparatus, and detection device and computer storage medium

Info

Publication number: WO2021243663A1
Application number: PCT/CN2020/094457
Authority: WO
Inventors: 罗元海
Original assignee: 深圳市欢太科技有限公司; Oppo广东移动通信有限公司
Priority date: 2020-06-04
Filing date: 2020-06-04
Publication date: 2021-12-09
Also published as: CN115398860A

Abstract

Disclosed is a session detection method, comprising: a detection device obtaining a session to be detected that is transmitted between two network nodes; determining a feature vector of said session, wherein the feature vector is a vector representing a static feature of a network layer and/or a static feature of a transmission layer; and determining, on the basis of the feature vector of said session, whether said session is a malicious session. Further disclosed are a session detection apparatus, a detection device, a computer storage medium, a chip and a computer program product.

Description

Session detection method, device, detection equipment and computer storage medium

Technical field

The embodiments of the present application relate to, but are not limited to, the field of network security, and in particular, to a session detection method, device, detection device, and computer storage medium.

Background technique

With the widespread use of mobile Internet applications, network security is a concern for many technicians. There are a lot of malicious session data in the network session. These malicious session data include the malicious session data generated by the user terminal on the network, and also include the malicious session data generated by the illegal service provider (SP) sending data packets to the user terminal. Technicians need to detect and eliminate this malicious session data to protect the safe operation of the network.

However, there are many different types of malicious session data in the network, which makes the detection of malicious session data difficult.

Summary of the invention

The embodiments of the present application provide a session detection method, device, detection equipment, and computer storage medium.

In a first aspect, a session detection method is provided, including: a detection device obtains a session to be detected transmitted between two network nodes;

Determining a feature vector of the session to be detected, where the feature vector is used to characterize the static feature of the network layer and/or the static feature of the transport layer;

Based on the feature vector of the session to be detected, it is determined whether the session to be detected is a malicious session.

In a second aspect, a session detection device is provided, including:

An obtaining unit for obtaining the to-be-detected session transmitted between two network nodes;

A determining unit, configured to determine a feature vector of the session to be detected, where the feature vector is used to characterize the static feature of the network layer and/or the static feature of the transport layer;

The detection unit is configured to determine whether the session to be detected is a malicious session based on the feature vector of the session to be detected.

In a third aspect, a detection device is provided, including: a memory and a processor,

The memory stores a computer program that can run on the processor,

When the processor executes the program, the steps in the above method are implemented.

In a fourth aspect, a computer storage medium is provided, the computer storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps in the foregoing method.

In a fifth aspect, a chip is provided, including a processor, configured to call and run a computer program from a memory, so that a device installed with the chip executes the steps in the above method.

In a sixth aspect, a computer program product is provided. The computer program product includes a computer storage medium, and the computer storage medium stores computer program code. The computer program code includes instructions that can be executed by at least one processor. When the instructions are executed by the at least one processor, the steps in the above-mentioned method are implemented.

In the embodiment of the present application, the detection device obtains the session to be detected transmitted between two network nodes; determines the feature vector of the session to be detected, and the feature vector is used to characterize the static characteristics of the network layer and/or the static characteristics of the transmission layer; based on The feature vector of the session to be detected, to determine whether the session to be detected is a malicious session. In this way, since the static characteristics of the network layer and/or the static characteristics of the transmission layer corresponding to the normal session data and the malicious session data in the session data are different, the static characteristics and/or transmission of the network layer used to characterize the session to be detected are different. The feature vector of the static feature of the layer determines whether the session to be detected is a malicious session, so that different types of malicious sessions can be easily detected, and the versatility of session detection is improved.

Description of the drawings

FIG. 1 is a schematic diagram of a system architecture of a session detection method provided by an embodiment of this application;

2 is a schematic diagram of the implementation process of a session detection method provided by an embodiment of the application;

3 is a schematic diagram of the implementation process of another session detection method provided by an embodiment of the application;

FIG. 4 is a schematic diagram of a process for determining a feature vector of a session to be detected according to an embodiment of this application;

FIG. 5 is a schematic diagram of a process for generating a model file according to an embodiment of the application;

FIG. 6 is a schematic diagram of another process of generating a model file provided by an embodiment of the application;

FIG. 7 is a schematic diagram of the composition structure of a session detection device provided by an embodiment of the application;

FIG. 8 is a schematic diagram of a hardware entity of a detection device provided by an embodiment of this application;

FIG. 9 is a schematic structural diagram of a chip provided by an embodiment of the present application.

detailed description

Hereinafter, the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems will be described in detail through the embodiments and the accompanying drawings. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

It should be noted that in the examples of this application, "first", "second", etc. are used to distinguish similar objects, and not necessarily used to describe a specific sequence or sequence.

In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

In order to avoid security threats to business systems on the Internet, such as common security threats such as spam comments, database crashes, account theft, and swipes, business security protection is required. This solution is designed to detect and protect these business security issues.

The business security detection and protection schemes in related technologies are generally aimed at a specific business. For example, the detection device first needs to obtain various detailed information of the business. The detailed information includes the parameter information received by the interface of the business server (for example, request Data or access service data), returned parameter information, interface function, correlation information between the interface function and other interfaces, common attack methods for this type of interface, etc., and then use these detailed information to attack this business Modeling, and finally matching the data of the accessed business according to the model, and discovering the malicious request data.

However, because detection equipment requires a deep understanding of specific services and attack methods, but usually the types of services are intricate and the attack methods are varied, one by one, the workload of analysis and modeling is very large, and it is inevitable to miss the analysis of certain services. , The detection methods in related technologies cannot be universal; in addition, because some business data is sensitive and plaintext data cannot be provided, it is impossible to model these sensitive data, which makes the coverage of detection methods in related technologies insufficient.

For at least the above reasons, this application provides a general service security detection and protection idea based on session analysis. As the user’s terminal interacts with the server, session data will be generated, while normal session data and malicious session data are reflected in The sequence of the data packet or the data structure of the data packet is different, and by analyzing the sequence of the underlying data packet or the data structure of the data packet, the normal session data and the malicious session data can be distinguished, thereby realizing general business security protection.

FIG. 1 is a schematic diagram of the system architecture of a session detection method provided by an embodiment of the application. As shown in FIG.

The terminal 11 may be a device used by a user to access the service server 12, such as a desktop computer, a mobile phone, and a tablet computer shown in FIG. Media players, smart speakers, navigation devices, display devices, smart bracelets and other wearable devices, virtual reality (VR) devices, augmented reality (Augmented Reality, AR) devices, pedometers, digital TVs, etc. at least one. The user can access the service server 12 when logging in to the website through the application in the terminal 11. The application can be a dedicated client of the website or a browser client. The user can access by entering the website URL Business server 12.

The business server 12 may be a service device that provides website functions. The business server 12 shown in FIG. 1 is a server cluster composed of multiple business servers. In some embodiments, the business server 12 may be an independent business server. The application does not limit the composition structure of the business server 12.

The forwarding device 13 may be used to capture the communication data between the terminal 11 and the service server 12. The communication data may be an access request sent by the terminal 11 to the service server 12, and/or the access request sent by the service server 12 to the terminal 11 The corresponding visit result. Communication data can be understood as traffic data, and the forwarding device 13 can continuously capture the communication data. For example, the forwarding device can package the captured communication data of a preset duration into a capture file (file in pcap format), or The captured communication data of a preset size is packaged into a captured file, and then the forwarding device can send the captured file to the detection device. In one embodiment, the forwarding device may be a switch.

The forwarding device 13 may use a packet capture method based on a Data Plane Development Kit (DPDK) to capture communication data. In one manner, the forwarding device 13 may be a device with a mirroring port, and the mirroring port can be connected to a detection device, so that the mirroring port can mirror the traffic of the communication port, thereby obtaining communication data of a preset duration or a preset size Communication data. It should be understood that the captured file may include the access request and/or the access result.

The detection device 14 may be a device for detecting whether the session in the captured file is a malicious session. The detection device 14 is used for real-time analysis of the session between the terminal 11 and the service server 12, so as to detect malicious sessions in time and stop the loss in time, so as to protect the safe operation of the network.

In the embodiment shown in FIG. 1, the forwarding device 13 is provided between the terminal 11 and the service server 12 to obtain communication data between the terminal 11 and the service server 12, and the detection device 14 is connected to the forwarding device 13 to detect communication Whether the session in the data is malicious. In the embodiment of the present application, the connection between the terminal 11 and the forwarding device 13, the connection between the forwarding device 13 and the detection device 14, or the connection between the forwarding device 13 and the service server 12 may be a wired connection or a wireless connection.

In some embodiments, the forwarding device 13 and the detection device 14 in the embodiment of the present application can be set in any two network nodes that have traffic data, so that the forwarding device 13 and the detection device 14 can detect that the two network nodes Whether the transmitted session is malicious. The embodiment of the present application does not limit the location where the forwarding device 13 is set.

In some embodiments, the forwarding device 13 and the detecting device 14 may be two separate physical entities, or the forwarding device 13 and the detecting device 14 may be set as one physical entity.

Fig. 2 is a schematic diagram of the implementation process of a session detection method provided by an embodiment of the application. As shown in Fig. 2, the method is applied to a detection device, and the method includes:

S201. The detection device obtains a session to be detected transmitted between two network nodes.

In an embodiment, the two network nodes may be a terminal and a service server, respectively. In another embodiment, the two network nodes may be two nodes in the network with flow data transmission.

The session in the embodiments of this application may refer to a group of data packets divided by quintuples. The quintuple is a communication term and refers to the source Internet Protocol (IP) address, source port, and destination IP address. , Destination port and transport layer protocol. For example, the session to be detected may include M data packets, and M is an integer greater than or equal to 1. The IP address and/or source port and/or destination IP address and/or destination port and/or transport layer protocol of the M data packets are the same. Data packet is the unit of data in Transmission Control Protocol (TCP)/IP protocol communication transmission.

In the case of traffic transmission between two network nodes, in one embodiment, the forwarding device can obtain the traffic data transmitted between the two nodes, form a grab file, and send the grab file to the detection device, In this way, the detection device obtains the captured file, and obtains the session to be detected from the captured file. Wherein, the session to be detected may include: an access request sent by the terminal to the service server, and/or an access result sent by the service server to the terminal. In another implementation manner, the forwarding device may directly send the session to be detected to the detection device, so that the detection device obtains the session to be detected.

S203. The detection device determines a feature vector of the session to be detected, where the feature vector is a vector that characterizes the static feature of the network layer and/or the static feature of the transport layer.

In an embodiment, the feature vector may be determined based on the static attribute information of the network layer and/or the static attribute information of the transport layer of the session to be detected. For example, the detection device may perform statistical analysis on the static attribute information of the network layer and/or the static attribute information of the transmission layer, and then use the vector converted from the statistical analysis result as the feature vector. For another example, the detection device may use the vector converted from the static attribute information of the network layer and/or the static attribute information of the transmission layer as the feature vector. For another example, the detection device may perform other operations on the static attribute information of the network layer and/or the static attribute information of the transmission layer to obtain the feature vector. In the embodiments of the present application, any method that can convert the static attribute information of the network layer and/or the static attribute information of the transmission layer into a feature vector should fall within the protection scope of the present application. In the embodiment of the present application, the static attribute information of the network layer is used to characterize the static characteristics of the network layer, and the static attribute information of the transmission layer is used to characterize the static characteristics of the transmission layer.

In the embodiment of the present application, the detection device can obtain the static attribute information of the network layer and/or the transport layer of the session to be detected by extracting characteristic information for each of the M data packets in the session to be detected. Static attribute information. The static attribute information of the network layer and/or the static attribute information of the transport layer in the embodiment of the present application may refer to the static attribute information and/or transmission of the network layer of each data packet in the M data packets of the session to be detected The static attribute information of the layer.

In an embodiment, the static attribute information of the network layer of the data packet may be a class, method, variable or code block modified by a static modifier in the network layer (IP layer). The static attribute information of the transport layer of the data packet may be a class, method, variable or code block modified by a static modifier in the transport layer (TCP layer).

In one embodiment, the static attribute information may include not only the static attribute information of the header part, but also the static attribute information of the data part. That is, the static attribute information of the transport layer may include the static attribute information of the data part, for example, static attribute information. It can be a character used to characterize "confirmation" or "correct" in the data part. For example, in an application scenario, when a user logs in, after entering the account and password, a login request is sent to the business server. When the business server determines that the account and password match, the data part of the returned data packet includes the characterizing password "Correct" characters. When the business server determines that the account number and password do not match, the data part of the returned data packet includes the characters used to characterize the "wrong" password, the characters used to characterize the "correct" and the character used to characterize " The characters "error" can be static attribute information in the data packet.

In another implementation manner, the static attribute information may only include the header part of the data packet, or only include the data part of the data packet.

S205. The detection device determines whether the session to be detected is a malicious session based on the feature vector of the session to be detected.

In an embodiment, the detection device may input the feature vector of the session to be detected into a specific classifier that is pre-trained, so as to determine whether the session to be detected is a malicious session based on the classification result of the specific classifier.

In another implementation manner, the detection device can determine whether the static attribute information in the feature vector of the session to be detected meets the set attribute information conditions, and when the determination is yes, it determines that the session to be detected is a malicious session; otherwise, Determined as a normal session or a non-malicious session. In some embodiments, the detection device may determine whether the static attribute information of the network layer of the session to be detected meets the set first sub-attribute information, and/or determine whether the static attribute information of the transport layer of the session to be detected meets the set The second sub-attribute information. Among them, whether the static attribute information satisfies the set attribute information conditions may include: whether a certain parameter of the static attribute information is within the set range, if it is determined to be satisfied, otherwise it is determined not to be satisfied, or at least one of the static attribute information Whether the two parameters are both within at least two set ranges, if they are both, it is determined to be satisfied, otherwise, it is determined not to be satisfied.

In the embodiment of the present application, since the static characteristics of the network layer and/or the static characteristics of the transport layer corresponding to the normal session data and the malicious session data in the session data are different, the static characteristics of the network layer used to characterize the session to be detected are different. The feature vector of the feature and/or the static feature of the transport layer determines whether the session to be detected is a malicious session, so that different types of malicious sessions can be easily detected, which improves the versatility of session detection.

FIG. 3 is a schematic diagram of the implementation process of another session detection method provided by an embodiment of the application. As shown in FIG. 3, the method includes:

S301. The forwarding device captures communication data, and generates a capture file based on the captured communication data.

The communication data may be data that flows into the forwarding device within a preset time period. The communication data may include: an access request sent by the terminal to the service server, and/or an access result sent by the service server to the terminal.

S303. The forwarding device sends the captured file to the detection device, and the detection device receives the captured file sent by the forwarding device.

In an implementation manner, the size of the captured file sent by the forwarding device to the detection device each time may be the same, or the size of the captured file may be within a set range. In another implementation manner, the forwarding device sends a captured file to the detection device every specific period of time.

In the embodiment of the present application, the forwarding device can forward all communication data between two network nodes to the detection device, that is, the detection device can detect all the communication data transmitted between the two network nodes, so as to determine Whether all sessions forwarded by the forwarding device are malicious sessions. In another implementation manner, the forwarding device may collect communication data between two network nodes in a sampling manner, so that the load of the forwarding device and the detection device can be reduced.

S305. The detection device parses the captured file to obtain a data packet set.

The captured file can be a pcap file. The overall structure of the pcap file is in the form of file header-data packet header 1-data packet 1-data packet header 2-data packet 2. The purpose of parsing pacp is to obtain data packet 1 in the pacp file Packet 2 and so on, where data packet 1 and data packet 2 are data packets transmitted between the terminal and the service server, so as to obtain a data packet set. It should be understood that there may be N data packets in the data packet set, and N is an integer greater than or equal to 1.

S307. The detection device determines at least one session from the data packet set, and uses at least part of the at least one session as a session to be detected.

The feature information of the data packets included in any session of the at least one session is the same, and the feature information includes at least one of the five-tuples.

In the embodiment of the present application, the feature information includes all of the five-tuple, that is, the feature information includes a source IP address, a source port, a destination IP address, a destination port, and a transport layer protocol. In other embodiments, the characteristic information may include parts of a five-tuple. For example, the characteristic information may include a source IP address, a source port, and a transport layer protocol.

In the implementation process, determining at least one session from the data packet set can be achieved in the following way: the detection device first extracts the characteristic information of each data packet in the data packet set, and then performs session aggregation analysis on the data packet set based on the characteristic information To determine at least one conversation.

For example, in one embodiment, the detection device may extract the quintuple information of each of the N data packets included in the data packet set, and then perform session aggregation analysis on the N data packets based on the quintuple information , Obtain at least one session (P sessions), P is an integer greater than or equal to 1, and P is less than or equal to N. In this way, the detection device can classify N data packets according to the quintuple information, and mark the data packets with the same quintuple as the same session, thereby obtaining P sessions. Each of the P sessions includes The quintuple of the data packet is the same.

When the detection device obtains P sessions, it may use all or part of the P sessions as the sessions to be detected. For example, in an implementation manner, the detection device may regard all P sessions as sessions to be detected. In another implementation manner, the detection device may use part of the P sessions (for example, one session) as the session to be detected.

S309. The detection device extracts at least one piece of static attribute information corresponding to the at least one data packet one-to-one from the at least one data packet included in the session to be detected.

Wherein, the static attribute information may include: static attribute information of the network layer and/or static attribute information of the transport layer. The static attribute information of the network layer (IP layer) may include certain field information of the IP header, and the static attribute information of the transport layer (TCP layer) may include certain field information of the TCP header and/or the static attributes of the data part of the data packet. information.

In an embodiment, the static attribute information of the network layer may include: at least one of the header length ip.hl, the data length ip.len, and the lifetime ip.ttl; the static attribute information of the transport layer may include: the destination port tcp At least one of .dport, static data tcp.data, and buffer remaining space tcp.win. It should be understood that the embodiments of this application only provide a schematic enumeration of static attribute information of the network layer and static attribute information of the transport layer. The static attribute information of the network layer and the static attribute information of the transport layer may also include other static attributes. The attribute information may be replaced by other static attribute information. The other static attribute information may be, for example, the source address of the IP header, the destination address of the IP header, or the source port of the TCP header.

S311. The detection device determines the feature vector of the session to be detected based on at least one piece of static attribute information.

In one embodiment, the detection device may perform statistical analysis on at least one static attribute information to obtain statistical information, and then use the vector converted from the statistical information as the feature vector of the session to be detected. Wherein, the statistical analysis may include: at least one of count, minimum value, maximum value, accumulated value, average value, mean square error, and standard deviation.

In the embodiment of the present application, the content included in the static attribute information can be selected according to actual conditions, and the static attribute information corresponding to the data packets in different scenarios can be different. For example, taking static attribute information including ip.hl, ip.len, ip.ttl, tcp.dport, tcp.data, and tcp.win as an example, the detection device can perform statistical analysis on these static attribute information. The statistical analysis includes but not It is limited to at least one of count, minimum min, maximum max, sum sum, and average avg. It should be understood that statistical analysis can be to calculate the statistical value of each type of attribute information included in the static attribute information. Corresponding count values of M ip.hl, calculating count values of M ip.len corresponding to M data packets one-to-one, etc.

The detection device can then splice the obtained statistical values to obtain the feature vector of the session to be detected. The static attribute information includes ip.ttl and tcp.win. The statistical analysis includes count count, minimum min, maximum max, sum sum, and Take average avg as an example, the feature vector of the session to be detected can be: (count(ip.ttl), min(ip.ttl), max(ip.ttl), sum(ip.ttl), avg(ip.ttl), count(tcp.win), min(tcp.win), max(tcp.win), sum(tcp.win), avg(tcp.win)).

S313. The detection device determines whether the session to be detected is a malicious session based on the feature vector of the session to be detected.

In an embodiment, the detection device may determine a specific classifier, input the feature vector of the session to be detected into the specific classifier, obtain the classification result of the session to be detected, and then determine whether the session to be detected is a malicious session based on the classification result.

In an embodiment, the specific classifier may include a weight matrix, each column of the weight matrix is a weight parameter between the feature vector and each category, and the detection device can determine the classification result of the session to be detected based on the feature vector and the weight matrix Then, based on the classification result, it can be determined whether the session to be detected is a malicious session.

The classifier can be a classification model, and a specific classifier can be obtained by inputting a trained model file into the prediction program, where the model file can include parameters such as a weight matrix.

In an embodiment, the specific classifier may be a binary classifier, and the specific classifier is used to output a first classification result that characterizes the session to be detected as a normal session, or is used to output a second classification result that characterizes the session to be detected as a malicious session result. In another embodiment, the specific classifier may be a multi-point classifier, and the specific classifier is used to output the classification results of different levels of maliciousness. In this way, when the detection device obtains the classification result of the session to be detected from the multi-point classifier, it is based on the classification result. To determine whether the session to be detected is a malicious session.

Taking the counting analysis of at least one static attribute information as an example, it can be understood that if too many data packets are included in a session to be detected, it indicates that there is frequent access. In this way, it can be determined that the session to be detected is a malicious session. The purpose of the classifier may be to treat the to-be-detected session corresponding to a count greater than a certain threshold as a malicious session. In the embodiment of this application, due to the setting of a classifier, the determination of malicious conversations not only depends on the dimension of count, but also on the minimum, maximum, accumulated value, average, mean square deviation, and standard deviation. At least one dimension, so that the predicted classification result can be jointly determined based on various parameters, thereby improving the accuracy of the prediction result.

The specific classifiers in the embodiments of this application may include: decision tree classifiers, random forest classifiers, gradient boosting decision tree (Gradient Boosting Decision Tree, GBDT) classifiers, support vector machine (Support Vector Machine, SVM) classifiers And one of the neural network classifiers.

The method for obtaining a specific classifier can be obtained in the following ways: the detection device first obtains at least one training session, and each training session in the at least one training session corresponds to a real category; then determines the feature vector of each training session; and then obtains the initial classification Based on the real category corresponding to each training session and the feature vector of each training session, the initial classifier is trained to obtain a specific classifier.

The initial classifier may include an initial matrix. The initial matrix is a matrix randomly generated by the detection device. The purpose of training the classifier is to train the initial matrix to obtain the weight matrix.

The training method used when training the initial classifier in the embodiment of the application may be one of a decision tree training method, a random forest training method, a GBDT training method, an SVM training method, a neural network training method, and the like. It should be understood that the selection of a specific classifier should correspond to the training method. For example, if the specific classifier is an SVM classifier, the training method should be an SVM training method.

In one embodiment, the detection device determining the feature vector of each training session can be implemented in the following manner: the detection device extracts at least one data packet one-to-one corresponding to the at least one data packet from the at least one data packet included in each training session. Static attribute information; the static attribute information includes: static attribute information of the network layer and/or static attribute information of the transmission layer; based on at least one static attribute information, the feature vector of each training session is determined.

In an embodiment, the detection device determines the feature vector of each training session based on the at least one static attribute information, which may include: the detection device pairs at least one static attribute corresponding to at least one data packet included in each training session on a one-to-one basis. Perform statistical analysis on the information to obtain statistical information; use the vector transformed from the statistical information as the feature vector of each training session.

Among them, the method for the detection device to determine the feature vector of the training session can be the same as the method for determining the feature vector of the session to be detected. For the content not described in the method for determining the feature vector of the training session, refer to the method of determining the feature vector of the session to be detected. The description in the method.

S315. The detection device sends prompt information to the forwarding device.

The prompt information is used to indicate whether there is a malicious session in the session to be detected, and is used to indicate that if a malicious session exists in the session to be detected, intercept and/or combat the existing malicious session.

It should be understood that when the detection session is one session, the prompt information may include information about whether the one session is a malicious session; when the detection session is at least two sessions, the prompt information may include each of the at least two sessions. Whether it is a malicious session information.

In an embodiment, the prompt information may further include: an interception strategy and/or an attack strategy corresponding to the classification result of the session to be detected. For example, the detection device can determine the interception strategy and/or the strike strategy according to the degree of maliciousness corresponding to the classification result. The higher the degree of maliciousness corresponding to the classification result, the stronger the determined interception strategy and/or strike strategy.

It should be understood that the stronger the degree of maliciousness of the session, the greater the strength of the determined interception strategy and/or strike strategy. Conversely, the smaller the degree of maliciousness of the determined session, the lower the strength of the determined interception strategy and/or strike strategy. For example, when it is determined that a certain session is a normal session, the session will not be intercepted or attacked.

In the embodiment of the present application, the interception strategy and/or the strike strategy may be a strategy that needs to be implemented for each of one or at least two sessions included in the session to be detected. For example, when some of the sessions to be detected are normal sessions, the implemented strategy is not to intercept or attack; when some of the sessions to be detected are malicious sessions with a lesser degree of maliciousness, implement The strategy is to intercept but not attack; when some of the sessions to be detected are malicious sessions with a greater degree of maliciousness, the implemented strategy is to intercept and attack.

In the embodiment of the present application, statistical information is obtained by performing statistical analysis on at least one static attribute information, and the vector transformed by the statistical information is used as the feature vector of the session to be detected, so that the obtained feature vector can reflect the characteristics in multiple dimensions. Features, thereby improving the accuracy of the session classification to be detected. In addition, because the specific classifier and the feature vector of the session to be detected are used to classify the session to be detected, the specific classifier can synthesize the different attribute information included in the static attribute information and the type of statistical analysis to determine whether the session to be detected is a malicious session. , Which can further improve the accuracy of the session classification to be detected.

FIG. 4 is a schematic diagram of a process for determining the feature vector of a session to be detected according to an embodiment of the application. As shown in FIG. 4, in the implementation process of this application, the detection device performs feature extraction to obtain the feature vector of the session to be detected. It can be achieved through the following steps S401 to S407:

S401. The detection device obtains the pacp file, parses the data packets in the pcap file, and obtains a data packet set.

S403. The detection device performs session aggregation on the data packets in the pcap file according to the 5-tuple (source IP, destination IP, source port, destination port, and protocol number), and marks the same 5-tuple as the same session (one time). Business interaction process).

S405. The detection device extracts statistical characteristics in units of sessions: first extract the static attributes of the IP layer and the TCP layer of each data packet in the session, such as ip.hl, ip.len, ip.ttl, tcp.dport, tcp. data, tcp.win, etc.; then based on the session to calculate the statistical value of these static attributes, the statistical value includes but not limited to at least one of count, minimum, maximum, sum and average, etc.

S407. The sequence obtained by splicing the obtained statistical values by the detection device is the feature vector of the session. For example, the feature vector can be (count(ip.ttl), min(ip.ttl), max(ip.ttl), sum (ip.ttl), avg(ip.ttl), count(tcp.win), min(tcp.win), max(tcp.win), sum(tcp.win), avg(tcp.win)... ...).

Figure 5 is a schematic diagram of a process for generating a model file provided by an embodiment of this application. As shown in Figure 5, during the implementation of this application, the way of generating a model file can be implemented through the following steps S501 to S507:

S501. The detection device selects a batch of labeled training samples (indicating that the sample is malicious or normal) (a session is a sample). For example, the training sample may include session 1 (session1), and label 1 (label 1) corresponding to session 1 ),..., session K, label K (label K) corresponding to session K, K is an integer greater than or equal to 1.

S503. The detection device extracts the feature vectors of the samples one by one until the feature vectors of all training set samples are obtained. The feature vectors can be (count(tcp.win), min(tcp.win), max(tcp.win), sum(tcp .win), avg(tcp.win)......).

S505. The detection device inputs the feature vector and the label of its corresponding sample into the machine learning training program for training. The machine learning model used here can choose decision tree, random forest, GBDT, SVM, neural network, etc., and the detection device can combine these common Models (such as decision trees, random forests, GBDT, SVM, and neural networks) are all tried again, and the best model is selected according to the test results.

S507. After the training is completed, the detection device obtains the model file.

In the embodiment of this application, the detection method of the detection device is the core part of the solution, and the detection device can include two parts: a training unit and a detection unit. FIG. 6 is a schematic diagram of another process for generating a model file provided by an embodiment of this application. As shown in FIG. 6, in the process of the embodiment of this application, the training unit of the detection device can train the training sample to obtain the model file, and the detection unit of the detection device can use the model file to obtain the detection result of the sample to be detected. The method of generating model files in the example can be implemented through the following steps S601 to S619:

S601. The testing device selects training samples.

S603. The detection device performs feature extraction on each sample in the training sample.

S605. The detection device obtains the feature vectors of all training set samples.

S607. The detection device uses the feature vectors of all training set samples to perform model training.

S609. The detection device obtains the model file.

S611. The testing device determines the sample to be tested, and the sample to be tested may be the session to be tested in the embodiment of the present application.

S613. The testing device performs feature extraction on the sample to be tested.

S615. The detection device obtains the feature vector of the sample to be detected.

S617. The detection device uses the feature vector of the sample to be detected and the model file to perform model prediction.

S619. The detection device obtains the detection result of the sample to be detected.

In the embodiment of the present application, the detection device analyzes and models the network layer and transport layer data of the network data packet generated by the interaction between the user and the service to distinguish between normal service interaction data and malicious service interaction data. Obtaining business layer data and business logic can realize detection and protection, solve the problems of insufficient versatility, insufficient coverage and heavy workload of existing solutions, improve the versatility and coverage of the model, and reduce the cost of modeling.

Based on the foregoing embodiment, the embodiment of the present application provides a session detection device, which includes each unit included and each module included in each unit, which can be implemented by a processor in a detection device; of course, it can also be Specific logic circuit implementation; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP), or a field programmable gate array (FPGA), etc.

FIG. 7 is a schematic diagram of the composition structure of a session detection device provided by an embodiment of the application. As shown in FIG. 7, the session detection device 70 includes:

The obtaining unit 71 is configured to obtain a session to be detected transmitted between two network nodes;

The determining unit 72 is configured to determine the feature vector of the session to be detected, and the feature vector is used to characterize the static feature of the network layer and/or the static feature of the transport layer;

The detection unit 73 is configured to determine whether the session to be detected is a malicious session based on the feature vector of the session to be detected.

In some embodiments, the obtaining unit 71 is further configured to parse the captured file sent by the forwarding device to obtain a data packet set; determine at least one session from the data packet set, and use at least part of the at least one session as the session to be detected ; Wherein, the characteristic information of the data packets included in any session is the same, and the characteristic information includes at least one of the five-tuples.

In some embodiments, the obtaining unit 71 is further configured to extract characteristic information of each data packet in the data packet set; perform session aggregation analysis on the data packet set based on the characteristic information to determine at least one session.

In some embodiments, the determining unit 72 is further configured to extract at least one piece of static attribute information corresponding to at least one data packet from at least one data packet included in the session to be detected; the static attribute information includes: static state of the network layer The attribute information and/or the static attribute information of the transport layer; based on at least one static attribute information, the feature vector of the session to be detected is determined.

In some embodiments, the static attribute information of the network layer includes: at least one of header length, data length, and time to live; the static attribute information of the transport layer includes: at least one of target port, static data, and remaining space of the buffer.

In some embodiments, the determining unit 72 is further configured to perform statistical analysis on at least one static attribute information to obtain statistical information; and use the vector transformed by the statistical information as the feature vector of the session to be detected.

In some embodiments, the statistical analysis includes: at least one of count, minimum, maximum, accumulated value, average, mean square error, and standard deviation.

In some embodiments, the detection unit 73 is further configured to determine a specific classifier, and input the feature vector of the session to be detected into the specific classifier to obtain the classification result of the session to be detected; based on the classification result, determine whether the session to be detected is malicious Conversation.

In some embodiments, the session detection device 70 further includes:

The training unit 74 is configured to obtain at least one training session, and each training session in the at least one training session corresponds to a real category; to determine the feature vector of each training session; to obtain an initial classifier based on the real category corresponding to each training session Train the initial classifier with the feature vector of each training session to obtain a specific classifier.

In some embodiments, the session detection device 70 further includes:

The sending unit 75 is configured to send prompt information to the forwarding device. The prompt information is used to indicate whether there is a malicious session in the session to be detected, and is used to indicate that the malicious session exists in the session to be detected. Interception and/or strike.

In some embodiments, the prompt information further includes: an interception strategy and/or an attack strategy corresponding to the classification result of the session to be detected.

The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiments of the present application, please refer to the description of the method embodiments of the present application for understanding.

It should be noted that, in the embodiments of the present application, if the above-mentioned session detection method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application can be embodied in the form of a software product in essence or a part that contributes to related technologies. The computer software product is stored in a storage medium and includes a number of instructions to enable One detection device executes all or part of the methods described in the various embodiments of this application. The aforementioned storage media include: U disk, mobile hard disk, read only memory (Read Only Memory, ROM), magnetic disk or optical disk and other media that can store program codes. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

It should be noted that FIG. 8 is a schematic diagram of the hardware entity of a detection device provided by an embodiment of the application. As shown in FIG. 8, the hardware entity of the detection device 80 includes a processor 81 and a memory 82, where the memory 82 stores There is a computer program that can run on the processor 81, and the processor 81 implements the steps in the session detection method of any of the foregoing embodiments when the processor 81 executes the program.

The memory 82 stores computer programs that can run on the processor. The memory 82 is configured to store instructions and applications executable by the processor 81. It can also cache the processor 81 and the modules in the detection device 80 to be processed or have been processed. Data (for example, image data, audio data, voice communication data, and video communication data) can be implemented by flash memory (FLASH) or random access memory (RAM).

When the processor 81 executes the program, the steps of any one of the above-mentioned session detection methods are implemented. The processor 81 generally controls the overall operation of the detection device 80.

The embodiment of the present application provides a computer-readable storage medium, and the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to realize the operation of any of the above embodiments. The steps of the session detection method.

FIG. 9 is a schematic structural diagram of a chip provided by an embodiment of the present application. The chip 90 shown in FIG. 9 includes a processor 91, and the processor 91 can call and run a computer program from the memory to implement the steps of the method executed by the detection device in the embodiment of the present application.

Optionally, as shown in FIG. 9, the chip 90 may further include a memory 92. The processor 91 may call and run a computer program from the memory 92 to implement the steps of the method executed by the detection device in the embodiment of the present application.

The memory 92 may be a separate device independent of the processor 91, or may be integrated in the processor 91.

Optionally, the chip 90 may also include an input interface 93. The processor 91 can control the input interface 93 to communicate with other devices or chips, and specifically, can obtain information or data sent by other devices or chips.

Optionally, the chip 90 may further include an output interface 94. The processor 91 can control the output interface 94 to communicate with other devices or chips, specifically, can output information or data to other devices or chips.

Optionally, the chip can be applied to the network device in the embodiment of the present application, and the chip can implement the corresponding process implemented by the network device in each method of the embodiment of the present application. For the sake of brevity, details are not described herein again.

Optionally, the chip can be applied to the detection device in the embodiment of the present application, and the chip can implement the corresponding process implemented by the detection device in each method of the embodiment of the present application. For the sake of brevity, details are not described herein again.

It should be understood that the chip mentioned in the embodiment of the present application may also be called a system-level chip, a system-on-chip, a system-on-chip, or a system-on-chip, etc.

The embodiments of the present application provide a computer program product. The computer program product includes a computer storage medium. The computer storage medium stores computer program code. The computer program code includes instructions that can be executed by at least one processor. The steps of the method executed by the detection device in the above method are implemented.

It should be pointed out here that the description of the above detection device, computer storage medium, chip, and computer program product embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the embodiments of the testing equipment, computer storage media, chips, and computer program products of the present application, please refer to the description of the method embodiments of the present application for understanding.

It should be understood that the processor of the embodiment of the present application may be an integrated circuit chip with signal processing capability. In the implementation process, the steps of the foregoing method embodiments can be completed by hardware integrated logic circuits in the processor or instructions in the form of software. The aforementioned processor can be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (ASIC), a ready-made programmable gate array (Field Programmable Gate Array, FPGA) or other Programming logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps, and logical block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed and completed by a hardware decoding processor, or executed and completed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

It can be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), and electrically available Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory. The volatile memory may be a random access memory (Random Access Memory, RAM), which is used as an external cache. By way of exemplary but not restrictive description, many forms of RAM are available, such as static random access memory (Static RAM, SRAM), dynamic random access memory (Dynamic RAM, DRAM), synchronous dynamic random access memory (Synchronous DRAM, SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (Double Data Rate SDRAM, DDR SDRAM), Enhanced Synchronous Dynamic Random Access Memory (Enhanced SDRAM, ESDRAM), Synchronous Link Dynamic Random Access Memory (Synchlink DRAM, SLDRAM) ) And Direct Rambus RAM (DR RAM). It should be noted that the memories of the systems and methods described herein are intended to include, but are not limited to, these and any other suitable types of memories.

It should be understood that the foregoing memory is exemplary but not restrictive. For example, the memory in the embodiment of the present application may also be static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), Synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection Dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM) and so on. That is to say, the memory in the embodiments of the present application is intended to include, but is not limited to, these and any other suitable types of memory.

It should be understood that “one embodiment” or “an embodiment” or “an embodiment of the present application” or “the foregoing embodiment” mentioned throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in this In at least one embodiment of the application. Therefore, the appearances of "in one embodiment" or "in an embodiment" or "an embodiment of the present application" or "the foregoing embodiment" appearing in various places throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that, in the various embodiments of the present application, the size of the sequence numbers of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not correspond to the embodiments of the present application. The implementation process constitutes any limitation. The serial numbers of the foregoing embodiments of the present application are for description only, and do not represent the superiority or inferiority of the embodiments.

Unless otherwise specified, the detection device executes any step in the embodiments of the present application, and the processor of the detection device may execute the step. Unless otherwise specified, the embodiment of the present application does not limit the sequence in which the detection device executes the following steps. In addition, the methods used to process data in different embodiments may be the same method or different methods. It should also be noted that any step in the embodiment of the present application can be independently executed by the detection device, that is, when the detection device executes any step in the foregoing embodiment, it may not rely on the execution of other steps.

In the several embodiments provided in this application, it should be understood that the disclosed device and method can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, such as: multiple units or components can be combined, or It can be integrated into another system, or some features can be ignored or not implemented. In addition, the coupling, or direct coupling, or communication connection between the components shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms. of.

The units described above as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, the functional units in the embodiments of the present application may all be integrated into one processing unit, or each unit may be individually used as a unit, or two or more units may be integrated into one unit; the above-mentioned integration The unit of can be implemented in the form of hardware, or in the form of hardware plus software functional units.

The methods disclosed in the several method embodiments provided in this application can be combined arbitrarily without conflict to obtain new method embodiments.

The features disclosed in the several product embodiments provided in this application can be combined arbitrarily without conflict to obtain new product embodiments.

The features disclosed in the several method or device embodiments provided in this application can be combined arbitrarily without conflict to obtain a new method embodiment or device embodiment.

A person of ordinary skill in the art can understand that all or part of the steps in the above method embodiments can be implemented by a program instructing relevant hardware. The foregoing program can be stored in a computer readable storage medium (computer storage medium). When executed, the steps included in the foregoing method embodiment are executed; and the foregoing storage medium includes: various media that can store program codes, such as a mobile storage device, a read only memory (ROM), a magnetic disk, or an optical disc.

Alternatively, if the aforementioned integrated unit of this application is implemented in the form of a software function module and sold or used as an independent product, it may also be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application can be embodied in the form of a software product in essence or a part that contributes to related technologies. The computer software product is stored in a storage medium and includes a number of instructions to enable A computer device (which may be a personal computer, a server, or a network device, etc.) executes all or part of the methods described in the various embodiments of the present application. The aforementioned storage media include: removable storage devices, ROMs, magnetic disks, or optical disks and other media that can store program codes.

The above are only the implementation manners of this application, but the protection scope of this application is not limited to this. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in this application. Covered in the scope of protection of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Industrial applicability

The embodiments of this application provide a session detection method, device, detection device, computer storage medium, chip, and computer program product. Using the session detection scheme in this application, the detection device uses the static state of the network layer to characterize the session to be detected. The feature vector of the feature and/or the static feature of the transport layer determines whether the session to be detected is a malicious session, so that different types of malicious sessions can be easily detected, which improves the versatility of session detection.

Claims

A session detection method, including:

The detection device obtains the to-be-detected session transmitted between two network nodes;

Determining a feature vector of the session to be detected, where the feature vector is a vector that characterizes the static feature of the network layer and/or the static feature of the transport layer;

Based on the feature vector of the session to be detected, it is determined whether the session to be detected is a malicious session.
The method according to claim 1, wherein said detecting device obtains a session to be detected transmitted between two network nodes, comprising:

The detection device parses the captured file sent by the forwarding device to obtain a data packet set;

Determine at least one session from the set of data packets, and use at least part of the at least one session as the session to be detected;

Wherein, the feature information of the data packets included in any one of the sessions is the same, and the feature information includes at least one of the five-tuples.
The method according to claim 2, wherein the determining at least one session from the set of data packets comprises:

Extracting characteristic information of each data packet in the data packet set;

Perform session aggregation analysis on the data packet set based on the characteristic information to determine the at least one session.
The method according to any one of claims 1 to 3, wherein the determining the feature vector of the session to be detected includes:

Extract at least one static attribute information corresponding to the at least one data packet from at least one data packet included in the session to be detected; the static attribute information includes: static attribute information of the network layer and/or transport layer Static property information;

Based on the at least one static attribute information, a feature vector of the session to be detected is determined.
The method according to claim 4, wherein the static attribute information of the network layer includes: at least one of header length, data length, and time to live; the static attribute information of the transport layer includes: target port, static data, and At least one of the remaining space in the buffer.
The method according to claim 4 or 5, wherein the determining the feature vector of the session to be detected based on the at least one static attribute information comprises:

Performing statistical analysis on the at least one static attribute information to obtain statistical information;

The vector transformed by the statistical information is used as the feature vector of the session to be detected.
The method according to claim 6, wherein the statistical analysis includes at least one of count, minimum value, maximum value, accumulated value, average value, mean square error, and standard deviation.
The method according to any one of claims 1 to 7, wherein the determining whether the session to be detected is a malicious session based on the feature vector of the session to be detected comprises:

Determine a specific classifier, input the feature vector of the to-be-detected session into the specific classifier, and obtain a classification result of the to-be-detected session;

Determine whether the session to be detected is a malicious session based on the classification result.
The method according to claim 8, wherein the method further comprises:

Obtaining at least one training session, and each training session in the at least one training session corresponds to a real category;

Determining the feature vector of each training session;

Obtain an initial classifier, and train the initial classifier based on the true category corresponding to each training session and the feature vector of each training session to obtain the specific classifier.
The method according to any one of claims 1 to 9, wherein the method further comprises:

Send prompt information to the forwarding device, where the prompt information is used to indicate whether there is a malicious session in the to-be-detected session, and is used to indicate that if there is a malicious session in the to-be-detected session, perform the operation on the existing malicious session. Interception and/or strike.
The method according to claim 10, wherein the prompt information further comprises: an interception strategy and/or an attack strategy corresponding to the classification result of the session to be detected.
A session detection device includes:

An obtaining unit for obtaining the to-be-detected session transmitted between two network nodes;

A determining unit, configured to determine a feature vector of the session to be detected, where the feature vector is used to characterize the static feature of the network layer and/or the static feature of the transport layer;

The detection unit is configured to determine whether the session to be detected is a malicious session based on the feature vector of the session to be detected.
A detection device, including: a memory and a processor,

The memory stores a computer program that can run on the processor,

When the processor executes the program, the steps in the method according to any one of claims 1 to 11 are implemented.
A computer storage medium that stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method described in any one of claims 1 to 11 A step of.
A chip comprising: a processor, configured to call and run a computer program from a memory, so that a device installed with the chip executes the steps in the method according to any one of claims 1 to 11.
A computer program product includes a computer storage medium, the computer storage medium stores computer program code, and the computer program code includes instructions that can be executed by at least one processor. When executed by a processor, the steps in the method described in any one of claims 1 to 11 are implemented.