CN104519031A - Method and device for detecting malicious network behaviors - Google Patents

Abstract

The present invention relates to a method and device for malicious network behavior detection. The device includes: a calculation module, which is used to calculate the network behavior to be detected and each of the multiple behavior categories according to the respective characteristic parameters of the multiple behavior categories. A degree of correlation value is used to obtain a plurality of degree of correlation values, wherein the plurality of behavior categories include normal behavior categories and at least one malicious behavior category, and the respective characteristic parameters of the plurality of behavior categories utilize known malicious network behaviors in advance And the normal network behavior is obtained as a training sample training; and, the determining module is used to determine whether the maximum correlation degree value among the plurality of correlation degree values is the correlation degree value between the network behavior to be detected and the normal behavior category or The correlation degree value between the network behavior to be detected and one of the at least one malicious behavior category determines that the behavior to be detected belongs to normal network behavior or malicious network behavior. By using the method and device, the accuracy of detecting malicious network behavior can be improved.

Description

A method and device for malicious network behavior detection

technical field

The invention relates to the field of network security, in particular to a method and device for detecting malicious network behaviors.

Background technique

With the advancement of mobile communication technology, the mobile Internet has been extensively developed. Subsequently, there have also been many network attacks against the mobile Internet, which have created a great threat to the mobile Internet and mobile terminals.

Traditionally, signature-based matching techniques are used to detect malicious network behaviors in the mobile Internet. However, malicious network behaviors are not fixed. Usually, attackers will make some small changes to malicious network behaviors to generate polymorphic and deformed malicious network behaviors. However, using signature-based matching techniques cannot effectively detect polymorphisms. and deformed malicious cyber behavior.

To this end, many data mining techniques have been proposed to detect polymorphic and deformed malicious network behaviors. Although compared with the signature-based matching technology, the current data mining technology can detect polymorphic and deformed malicious network behaviors more effectively, but the detection accuracy is still not high enough, and false detections often occur.

Contents of the invention

Considering the above-mentioned problems in the prior art, embodiments of the present invention propose a method and device for malicious network behavior detection, which can improve the accuracy of malicious network behavior detection.

A method for detecting malicious network behavior according to an embodiment of the present invention, comprising: calculating a correlation degree value between the network behavior to be detected and each of the multiple behavior categories according to respective characteristic parameters of the multiple behavior categories, A plurality of correlation degree values are obtained, wherein the plurality of behavior categories include normal behavior categories and at least one malicious behavior category, and the respective characteristic parameters of the plurality of behavior categories use known malicious network behaviors and normal network behaviors as training in advance sample training; and, according to whether the maximum correlation degree value among the plurality of correlation degree values is the correlation degree value between the network behavior to be detected and the normal behavior category or the network behavior to be detected and the at least The correlation degree value of one of the malicious behavior categories determines that the behavior to be detected belongs to normal network behavior or malicious network behavior.

Wherein, the method further includes: according to the behavior characteristics of the network behavior to be detected, determining the behavior category to which the network behavior to be detected belongs; and, from a plurality of behavior recognition models respectively corresponding to different behavior categories , selecting a behavior recognition model corresponding to the determined behavior category, wherein each of the plurality of behavior recognition models includes the respective characteristic parameters of the plurality of behavior categories, wherein the calculation further includes: according to the selected The respective characteristic parameters of the multiple behavior categories included in the behavior recognition model are used to calculate the correlation degree value between the behavior to be detected and each of the multiple behavior categories to obtain the multiple correlation degree values.

Wherein, the method further includes: dividing the known malicious network behaviors and normal network behaviors as the training samples into multiple behavior groups, wherein the network behaviors in each behavior group belong to the same behavior category; The clustering algorithm clusters the network behavior included in each behavior group in the plurality of behavior groups into a plurality of sub-behavior groups, and the network behavior included in each sub-behavior group belongs to one of the plurality of behavior categories; And, using a multi-classifier training algorithm to respectively train the network behaviors in each sub-behavior group included in each behavior group of the multiple behavior groups, so as to obtain the multiple behavior recognition models.

Wherein, the behavior to which the network behavior to be detected is determined to belong is different from the behavior to which the network behavior to be detected actually belongs, and the method further includes: calculating The product of other relevance degree values than the degree of relevance value; check whether the ratio of the maximum degree of relevance value to the calculated product is greater than a specified threshold; and, if the result of the check is positive, use the incremental learning algorithm to use the The detected network behavior is subjected to self-learning training to update the plurality of behavior recognition models.

Wherein, the types of behaviors include propagation behaviors, remote control behaviors, and attack behaviors.

A device for malicious network behavior detection according to an embodiment of the present invention includes: a calculation module, configured to calculate the network behavior to be detected and each of the multiple behavior categories according to the respective characteristic parameters of the multiple behavior categories Correlation degree value, obtain a plurality of correlation degree values, wherein, the plurality of behavior categories include normal behavior categories and at least one malicious behavior category, and the respective characteristic parameters of the plurality of behavior categories are pre-used using known malicious network behaviors and The normal network behavior is trained as a training sample; and, the determining module is configured to determine whether the maximum correlation degree value among the plurality of correlation degree values is the correlation degree value between the network behavior to be detected and the normal behavior category or the The correlation degree value between the network behavior to be detected and one of the at least one malicious behavior category, and determine that the behavior to be detected belongs to normal network behavior or malicious network behavior.

Wherein, the device further includes: a determining module, configured to determine the behavior category of the network behavior to be detected according to the behavior characteristics of the network behavior to be detected; Among the multiple behavior recognition models of the behavior category, select the behavior recognition model corresponding to the determined behavior category, wherein each of the multiple behavior recognition models includes the respective characteristic parameters of the multiple behavior categories, wherein, The calculation module is further configured to: calculate the correlation degree value between the behavior to be detected and each of the multiple behavior categories according to the respective characteristic parameters of the multiple behavior categories included in the selected behavior recognition model , to obtain the multiple correlation degree values.

Wherein, the device further includes: a division module, configured to divide the known malicious network behaviors and normal network behaviors as the training samples into a plurality of behavior groups, wherein the network behaviors in each behavior group belong to the same the type of behavior; the clustering module is used to use a clustering algorithm to cluster the network behavior included in each behavior group in the plurality of behavior groups into multiple sub-behavior groups, and the network behavior included in each sub-behavior group Belonging to one of the plurality of behavior categories; and, a training module, configured to use a multi-classifier training algorithm to respectively perform network behaviors in each sub-behavior group included in each behavior group in the plurality of behavior groups training to obtain the multiple behavior recognition models.

Wherein, the behavior to which the network behavior to be detected is determined to belong is different from the behavior to which the network behavior to be detected actually belongs, and the device further includes:

The multiplication module is used to calculate the product of other correlation degree values except the maximum correlation degree value in the plurality of correlation degree values; the checking module is used to check the product of the maximum correlation degree value and the calculated product Whether the ratio is greater than a specified threshold; and an update module, configured to use an incremental learning algorithm to perform self-learning training using the network behavior to be detected to update the plurality of behavior recognition models if the check result is positive.

It can be seen from the above description that the scheme of the embodiment of the present invention divides the category of network behavior into two or more behavior categories including normal behavior category and several malicious behavior categories, instead of dividing network behavior into The categories of are only divided into two behavior categories of normal behavior category and malicious behavior category. The finer the division of network behavior categories, the interference between different types of behaviors can be reduced, and the detection of the behavior to be detected is more accurate. Therefore, compared with the prior art, the solution of the embodiment of the present invention can improve the detection of malicious network behaviors. accuracy.

Description of drawings

Other features, features, advantages and benefits of the present invention will become more apparent from the following detailed description in conjunction with the accompanying drawings.

Fig. 1 shows a schematic diagram of a multi-classifier training process according to an embodiment of the present invention.

Fig. 2 shows a schematic diagram of a behavior analysis process according to an embodiment of the present invention.

Fig. 3 shows a schematic diagram of a self-learning process according to an embodiment of the present invention.

Fig. 4 shows a schematic diagram of an apparatus for malicious network behavior detection according to an embodiment of the present invention.

Fig. 5 shows a schematic diagram of a device for malicious network behavior detection according to an embodiment of the present invention.

Detailed ways

In the following, various embodiments of the present invention will be described in detail with reference to the accompanying drawings.

In an embodiment of the present invention, a data tuple X={x ₁ , x ₂ ,...,x _k } (k is an integer) is used to characterize network behavior, where x ₁ , x ₂ ,..., x _k are respectively used to describe different characteristic attributes of network behavior, which can be obtained based on groups related to network behavior. For example, x ₁ , x ₂ ,..., x _k can be key fields in the TCP/IP header and application layer protocol header of packets related to network behavior, statistical information of packets related to network behavior (such as , frequency) and keywords in the body of groups related to network behavior, etc. Packets related to network behavior can be sent from mobile terminals, gateway devices in the mobile Internet (for example, Gateway GPRS Support Nodes (GGSN) or Serving GPRS Support Nodes (SGSN) in General Packet Radio Service (GPRS) systems, etc.) or mobile The data transmission interface in the Internet (for example, the Gn interface between GGSN and SGSN, etc.) is captured. Each network action is represented by a data tuple X.

The method for malicious network behavior detection according to an embodiment of the present invention includes a multi-classifier training process, a behavior analysis process and a self-learning process, and these processes can be implemented on any device.

Referring now to FIG. 1 , it shows a schematic diagram of a multi-classifier training process according to an embodiment of the present invention. Before executing the multi-classifier training process of this embodiment, a sufficient number of known malicious network behaviors and normal network behaviors need to be collected as training samples D.

As shown in FIG. 1 , at block 100 , according to different behavioral characteristics of network behaviors, the training sample D is divided into three behavioral groups D1 , D2 , D3 . Among them, the behaviors included in the behavior groups D1, D2, and D3 respectively belong to three types of behaviors: propagation behavior, remote control behavior and attack behavior.

Among them, the dissemination behavior refers to but is not limited to the following behaviors: a malicious or legal program is placed on a website, and a short message containing a network link pointing to the malicious or legal program is sent to a mobile terminal to enable users to use the network Links (such as via HTTP protocol, FTP protocol or email) download the malicious or legal software from the website, and actively send malicious programs to target users through MMS.

Remote control behavior refers to but is not limited to the following behaviors: mobile terminals connect to servers in the mobile Internet to update or download legal or malicious programs, download attack target information and attack instructions, etc.

The attack behavior refers to but is not limited to the following behavior: a mobile terminal accesses other mobile terminals via various communication channels such as SMS, MMS, Bluetooth or mobile Internet. Malicious attacks include privacy theft, privacy dissemination, access to value-added services charged, automatic contact with other mobile terminals, consumption, DoS or DDoS attacks against other terminals or networks, etc.

In block 110, use a clustering algorithm to cluster the behaviors included in each behavior group D1, D2, D3 into m+1 (m is an integer greater than zero) sub-behavior groups, each sub-behavior group Included behaviors belong to one of the m+1 behavior categories. The m+1 behavior categories include normal behavior category C ₀ and m malicious behavior categories C ₁ , C ₂ , . . . , C _m . Here, each malicious behavior category may be, for example, behaviors belonging to similar malicious programs or similar malicious behaviors belonging to the same malicious program family.

After clustering, behavior group D1 includes sub-behavior groups D ₁ ⁰ , D ₁ ¹ , D ₁ ² , ..., D ₁ ^m , and the behaviors included in them respectively belong to behavior categories C ₀ , C ₁ , and C ₂ , ..., C _m ; Behavior group D2 includes sub-behavior groups D ₂ ⁰ , D ₂ ¹ , D ₂ ² , ..., D ₂ ^m , and the behaviors included in them respectively belong to behavior categories C ₀ , C ₁ , C ₂ ,..., C _m ; and, the behavior group D3 includes sub-behavior groups D ₃ ⁰ , D ₃ ¹ , D ₃ ² ,..., D ₃ ^m , and the behaviors included in them respectively belong to the behavior category C ₀ , C ₁ , C ₂ , . . . , C _m . Here, the behaviors included in each behavior category are all divided into the same number of behavior categories, that is, m+1 behavior categories, however, the present invention is not limited thereto, and in some other embodiments of the present invention, each behavior The number of behavior categories into which the behaviors included in the category can vary.

Here, the clustering algorithm can be, but not limited to, using representative point clustering algorithm (CURE: Clustering using Representatives), balanced iterative reduction clustering algorithm (BIRCH), density-based clustering algorithm (DBSCAN), K-means clustering algorithm class algorithm, K-medoids HFC clustering algorithm, K-pototypes algorithm, random search clustering algorithm (CLARANS), automatic subspace clustering algorithm (CLIQUE9), etc.

In block 120, use a multi-classifier training algorithm to train the behaviors included in each sub-behavior group in each behavior group D1, D2, D3, and obtain three behaviors corresponding to the communication behavior and the remote control behavior respectively. and behavior recognition models M1, M2, and M3 of aggressive behavior, wherein each of the behavior recognition models M1, M2, and M3 includes respective characteristic parameters of behavior categories C ₀ , C ₁ , C ₂ , . . . , C _m . Wherein, the characteristic parameter of each behavior type is used to describe the characteristic of the behavior belonging to the behavior type. Here, the multi-classifier training algorithm can be but not limited to multi-classifier Naive Bayesian algorithm, multi-type support vector machine (SVM: Support Vector Machine) algorithm, decision tree, K nearest neighbor algorithm (KNN), vector space model Method (VSM), neural network classification algorithm, etc.

Next, taking the multi-classifier Naive Bayes algorithm as an example, how to obtain the behavior recognition models M1, M2 and M3 will be described in detail.

The multi-classifier Naive Bayesian algorithm uses the following equation (1) to calculate the network behavior to be detected X _D ={x ₁ ^D ,x ₂ ^D ,...,x _k ^D } belongs to the behavior category C _i (i= 0,1,2,...,m) probability P(C _i |X _D ).

$\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; D.</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; D.</span>}}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; D.</span>}}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>$

If P(C _f |X _D )=max{P(C ₁ |X _D ),P(C ₂ |X _D ),...,P(C _m |X _D )}, then determine the network behavior X _D Belongs to behavioral category C _f .

Since P(X _D ) is the same for all behavior categories C _i , for the convenience of calculation, it can be considered that P(C _i |X _D )=P(X _D |C _i )P(C _i ).

Usually, each feature attribute x ₁ , x ₂ ,...,x _k of network behavior X is independent of each other, therefore, P(X _D |C _i )P(C _i ) can be calculated by the following equation (2).

$\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; D.</span>}}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}}^{\mathrm{<span\; class="notranslate">\; D.</span>}}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}}^{\mathrm{<span\; class="notranslate">\; D.</span>}}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; k</span>}}}^{\mathrm{<span\; class="notranslate">\; D.</span>}}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; k</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}}\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}^{\mathrm{<span\; class="notranslate">\; D.</span>}}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; )</span>$

In order to calculate P(x ₁ ^D |C _i ), P(x ₂ ^D |C _i ), ..., P(x _k ^D |C _i ), each feature attribute x _j (j =1,2,...,k) is divided into multiple value intervals x' _j ¹ , x' _j ² ,..., x' _j ^z , z is an integer and z>1 (note that the characteristics of X attributes x ₁ , x ₂ ,...,x _k can be divided into the same or different number of value intervals), and pre-calculated using training samples to obtain P(x' _j ¹ |C _i ), P(x ' _j ² |C _i ),..., P(x' _j ^z |C _i ) and P(C _i ). Use training samples to calculate P(x' _j ¹ |C _i ), P(x' _j ² |C _i ),..., P(x' _j ^z |C _i ) and P(C _i ) for this It is well known to those skilled in the art and will not be repeated here.

Since when the value of the characteristic attribute x _j ^D of the network behavior X _D to be detected is in the value interval x' _j ^u (1<=u<=z), P(x _j ^D |C _i )=P(x ' _j ^u |C _i ), therefore, P(X _D |C _i )P(C _i ) can be calculated using the following equation (3).

$\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; D.</span>}}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; k</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}}\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}^{\mathrm{<span\; class="notranslate">\; D.</span>}}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; k</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}}\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{{{\mathrm{<span\; class="notranslate">\; x</span>}}^{<span\; class="notranslate">\; ,</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}^{\mathrm{<span\; class="notranslate">\; u</span>}}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 3</span>}<span\; class="notranslate">\; )</span>$

In summary, P(C _i |X _D ) can be calculated using the following equation (4).

$\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; D.</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; k</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}}\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>{{{\mathrm{<span\; class="notranslate">\; x</span>}}^{<span\; class="notranslate">\; ,</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}^{\mathrm{<span\; class="notranslate">\; u</span>}}<span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 4</span>}<span\; class="notranslate">\; )</span>$

In equation (4), x' _j ^u is the value interval in which the value of the characteristic attribute x _j ^D of the network behavior X _D to be detected is located.

Among them, P(C _i |X _D ) is the correlation degree value between the network behavior X _D to be detected and the behavior category C _i , P(x' _j ¹ |C _i ), P(x' _j ² |C _i ), ..., P(x' _j ^z |C _i ) and P(C _i ) are the characteristic parameters of the behavior category C _i .

Those skilled in the art should understand that if other multi-classifier training algorithms different from the multi-classifier Naive Bayesian algorithm are used, the correlation degree value of the network behavior X _D to be detected and the behavior category _Ci may not be the probability P(C _i |X _D ), for example, can be the distance between the network behavior X _D to be detected and the behavior category C _i as the correlation degree value between the network behavior X _D to be detected and the behavior category C _i , in this case, the network behavior to be detected The closer the distance between the network behavior X _D and the behavior category C _i is, the more relevant the network behavior X _D to be detected is to the behavior category C _i .

For the behavior recognition model M1, use the behaviors included in the sub-behavior groups D ₁ ⁰ , D ₁ ¹ , D ₁ ² ,..., D ₁ ^m in the behavior group D1 as training samples, and calculate the Respective characteristic parameters of behavior categories C ₀ , C ₁ , C ₂ , . . . , C _m .

For the behavior recognition model M2, use the behaviors included in the sub-behavior groups D ₂ ⁰ , D ₂ ¹ , D ₂ ² ,..., D ₂ ^m in the behavior group D2 as training samples, and calculate the Respective characteristic parameters of behavior categories C ₀ , C ₁ , C ₂ , . . . , C _m .

For the behavior recognition model M3, the behaviors included in the sub-behavior groups D ₃ ⁰ , D ₃ ¹ , D ₃ ² ,..., D ₃ ^m in the behavior group D3 are used as training samples to calculate the Respective characteristic parameters of behavior categories C ₀ , C ₁ , C ₂ , . . . , C _m .

Referring now to FIG. 2 , it shows a schematic diagram of a behavior analysis process according to an embodiment of the present invention. The behavior analysis process in this embodiment is used to analyze whether the network behavior X _d ={x ₁ ^d , x ₂ ^d , . . . , x _k ^d } to be detected is a malicious network behavior or a normal network behavior.

As shown in FIG. 2, at block 200, it is checked whether the network behavior _Xd to be detected is included in the whitelist. Among them, the white list records legal network behaviors. If the network behavior _Xd to be detected is included in the whitelist, it indicates that the network behavior _Xd to be detected is a normal network behavior.

If the checking result of block 200 is affirmative, that is, the network behavior X _d to be detected is included in the white list, then the network behavior X _d to be detected is a normal network behavior, and the process ends.

In block 204, if the check result of block 200 is negative, that is: the network behavior X _d to be detected is not included in the white list, then utilize the signature-based virus scanning method to check whether the network behavior X _d to be detected is Is a malicious network behavior.

If the checking result of block 204 is affirmative, that is, the checking finds that the network behavior X _d to be detected is a malicious network behavior, then the process ends.

In block 208, if the check result of block 204 is negative, that is: the check finds that the network behavior X _d to be detected is not a malicious network behavior, then determine the network behavior to be detected according to the behavior characteristics of the network behavior X _d to be detected The behavior category to which X _d belongs. Here, the behavior type may be propagation behavior, remote control behavior or attack behavior.

In block 212, a behavior recognition model corresponding to the behavior category to which the network behavior X _d to be detected belongs is selected. Wherein, if the behavior category of the network behavior X _d to be detected is a communication behavior, the behavior recognition model M1 is selected; if the behavior category of the network behavior X _d to be detected is a remote control behavior, the behavior recognition model M2 is selected; and , if the behavior category of the network behavior X _d to be detected is an attack behavior, then select the behavior recognition model M3.

In block 216, based on the characteristic parameters of the behavior categories C ₀ , C ₁ , C ₂ , ..., C _m in the selected behavior recognition model, it is calculated that the network behavior X _d to be detected belongs to the behavior category C ₀ , C ₁ , C ₂ , . . . , C _m to obtain a plurality of correlation degree values. Among them, C ₀ is a normal behavior category, and C ₁ , C ₂ , . . . , C _m are malicious behavior categories.

Here, if the respective feature parameters of the behavior categories C ₀ , C ₁ , C ₂ , ..., C _m in the selected behavior recognition model are obtained by using the multi-classifier Naive Bayesian algorithm, the aforementioned Equation (4) is used to calculate the degree of correlation between the network behavior X _d to be detected and the behavior categories C ₀ , C ₁ , C ₂ , . . . , C _m .

At block 220, a maximum relevance value is retrieved from the plurality of relevance values.

In block 224, according to whether the maximum correlation degree value is the correlation degree value between the network behavior X _d to be detected and the behavior category C ₀ or the network behavior X _d to be detected and the malicious behavior categories C ₁ , C ₂ , . . . The correlation degree value of one of C _m determines whether the network behavior X _d to be detected is a normal network behavior or a malicious network behavior. Wherein, if the maximum correlation degree value is the correlation degree value between the network behavior _Xd to be detected and the behavior category _C0 , then it is determined that the network behavior _Xd to be detected is a normal network behavior, and if the maximum correlation degree value is the network behavior to be detected The value of the degree of correlation between the detected network behavior X _d and one of the malicious behavior categories C ₁ , C ₂ , . . . , C _m determines that the network behavior X _d to be detected is a malicious network behavior.

Referring now to FIG. 3 , it shows a schematic diagram of a self-learning process according to an embodiment of the present invention. As shown in FIG. 3 , in block 300 , according to the behavior characteristics of the network behavior X _E , determine the behavior category to which the network behavior X _E belongs. Here, the behavior category may be propagation behavior, remote control behavior or attack behavior. The network behavior X _E is a known normal network behavior determined based on a whitelist or a malicious network behavior determined based on a signature-based virus scanning method, that is, the network behavior X _E actually belongs to a normal network behavior or a malicious network behavior.

In block 304, a behavior recognition model corresponding to the behavior category to which the network behavior X _E belongs is selected. Among them, if the behavior category of the network behavior X _E belongs to the communication behavior, then select the behavior recognition model M1; if the behavior category of the network behavior X _E belongs to the remote control behavior, then select the behavior recognition model M2; and, if the network behavior X _E If the type of behavior is aggressive behavior, the behavior recognition model M3 is selected.

In block 308, based on the characteristic parameters of the behavior categories C ₀ , C ₁ , C ₂ , ..., C _m in the selected behavior recognition model, calculate the network behavior X _E and behavior categories C ₀ , C ₁ , C ₂ , . . . , C _m to obtain a plurality of correlation degree values G. Among them, C ₀ is a normal behavior category, and C ₁ , C ₂ , . . . , C _m are malicious behavior categories.

At block 312 , a maximum correlation degree value G _max is retrieved from the plurality of correlation degree values G .

In block 316, according to whether the maximum correlation degree value G _max is the correlation degree value between network behavior X _E and behavior category C ₀ or one of network behavior X _E and malicious behavior categories C ₁ , C ₂ , ..., C _m The correlation degree value of one of , determines whether the network behavior X _E belongs to a normal network behavior or a malicious network behavior.

In block 320, it is determined whether the behavior that the network behavior X _E is determined to belong to in block 316 is the same as the behavior that the network behavior X _E actually belongs to.

If the determination result of block 320 is affirmative, that is, the behavior that the network behavior X _E is determined to belong to is the same as the behavior that the network behavior X _E actually belongs to, then the process ends.

In block 324, if the judgment result of block 320 is negative, that is, the behavior that the network behavior X _E is determined to belong to is not the same as the behavior that the network behavior X _E actually belongs to, then calculate the multiple correlation degree values G except the maximum The product CJ of the remaining degree-of-correlation values other than the degree-of-correlation value _Gmax .

In block 328, the ratio R of the maximum correlation degree value _Gmax to the product CJ is calculated

At block 332, it is determined whether the ratio R is greater than a specified threshold Th.

If the judgment result of block 332 is negative, that is, the ratio R is not greater than the specified threshold Th, the process ends.

In block 336, if the judgment result of block 332 is affirmative, that is, the ratio R is greater than the specified threshold Th, then use the incremental learning algorithm to use the network behavior X _E to carry out self-learning training to update the behavior recognition models M1, M2 and M3 . The incremental learning algorithm may be, but not limited to, a Naive Bayesian incremental learning algorithm. Since it is known to those skilled in the art to use the network behavior X _E to perform self-learning training to update the behavior recognition models M1 , M2 and M3 , details will not be repeated here.

It can be seen from the above description that the solution of the embodiment of the present invention divides the categories of network behaviors into two or more behavior categories including normal behavior categories and several malicious behavior categories, instead of dividing network behavior categories into The categories are only divided into two behavior categories of normal behavior category and malicious behavior category. The finer the classification of network behaviors, the less interference between different types of behaviors, and the more accurate the detection of the behaviors to be detected. Therefore, the solutions in the embodiments of the present invention can improve the accuracy of detection of malicious network behaviors.

In addition, the solutions of the embodiments of the present invention further divide network behaviors into different behavior types, which can also reduce mutual interference between different types of behaviors, thereby also improving detection accuracy.

other variants

Those skilled in the art should understand that although in the above embodiments, the types of behaviors are propagation behaviors, remote control behaviors and attack behaviors, the present invention is not limited thereto. In some other embodiments of the present invention, the behavior type may also be two of propagation behavior, remote control behavior and attack behavior, or the behavior type may also include one of propagation behavior, remote control behavior and attack behavior, In addition to two or all, other forms of behavioral categories are also included. Or, since the behaviors included in propagation behavior, remote control behavior and attack behavior can be divided into multiple subcategories, the behavior category subcategories included in propagation behavior, remote control behavior and attack behavior can also be used as behavior categories, so that behavior can be divided into more behavior categories.

Those skilled in the art should understand that although in the above embodiments, network behaviors are divided into different behavior types and behavior recognition models corresponding to different behavior types are established, the present invention is not limited thereto. In some other embodiments of the present invention, network behaviors may not be divided into multiple different behavior categories to establish multiple behavior recognition models, but only one behavior recognition model is established, and the behavior recognition model includes each behavior category The characteristic parameters of .

Those skilled in the art should understand that although in the above embodiments, the behavior analysis process includes the operation of using a whitelist and a signature-based virus scanning method to check whether the network behavior to be detected is a malicious network behavior, however, the present invention does not It is not limited to this. In some other embodiments of the present invention, the behavior analysis process may not include the operation of checking whether the network behavior to be detected is a malicious network behavior by using a whitelist and/or a signature-based virus scanning method. Those skilled in the art should understand that although in the above embodiments, the method for malicious network behavior detection includes a multi-classifier training process to obtain a behavior recognition model, the present invention is not limited thereto. In some other embodiments of the present invention, the method for malicious network behavior detection may not include a multi-classifier training process. In this case, the behavior recognition model is provided by other means.

Those skilled in the art should understand that although in the above embodiments, the method for detecting malicious network behavior includes a self-learning process, the present invention is not limited thereto. In some other embodiments of the present invention, the method for malicious network behavior detection may not include a self-learning process.

Those skilled in the art should understand that the method for malicious network behavior detection of the present invention is not only applicable to the mobile Internet, but also applicable to other types of networks.

Referring now to FIG. 4 , it shows a schematic diagram of an apparatus for malicious network behavior detection according to an embodiment of the present invention. The device shown in FIG. 4 can be implemented by hardware, software, or a combination of hardware and software.

As shown in FIG. 4 , an apparatus 400 for malicious network behavior detection may include a calculation module 404 and a determination module 408 . Wherein, the calculation module 404 is configured to calculate the correlation degree value between the network behavior to be detected and each of the multiple behavior categories according to the respective characteristic parameters of the multiple behavior categories, and obtain multiple correlation degree values, wherein the multiple Each behavior category includes a normal behavior category and several malicious behavior categories, and the respective characteristic parameters of the multiple behavior categories are obtained by using known malicious network behaviors and normal network behaviors as training samples in advance, and the determination module 408 is used to Is the maximum correlation value among the plurality of correlation degree values the correlation degree value between the network behavior to be detected and the normal behavior category or the correlation between the network behavior to be detected and one of the several malicious behavior categories The correlation degree value determines that the network behavior to be detected belongs to a normal network behavior or a malicious network behavior.

In one implementation, the device 400 may further include a determination module 412 and a selection module 416, wherein the determination module 412 is configured to determine the behavior to which the network behavior to be detected belongs according to the behavior characteristics of the network behavior to be detected category, the selection module 416 is used to select a behavior recognition model corresponding to the determined behavior category from a plurality of behavior recognition models respectively corresponding to different behavior categories, wherein each of the multiple behavior recognition models includes the The respective characteristic parameters of the plurality of behavior categories, wherein the calculation module 404 is further configured to: calculate the network behavior to be detected and the respective characteristic parameters of the plurality of behavior categories included in the selected behavior recognition model. The correlation degree value of each of the plurality of behavior categories is obtained to obtain the plurality of correlation degree values.

In another implementation manner, the apparatus 400 may further include a division module 420 , a clustering module 424 and a training module 428 . Wherein, the division module 420 is used to divide the known malicious network behaviors and normal network behaviors as the training samples into multiple behavior groups, wherein the network behaviors in each behavior group belong to the same behavior category, clustering Module 424 is used to use a clustering algorithm to cluster the network behaviors included in each behavior group in the plurality of behavior groups into a plurality of sub-behavior groups, and the network behavior included in each sub-behavior group belongs to the plurality of behaviors One of the categories, and the training module 428 is used to use a multi-classifier training algorithm to train the network behaviors in each sub-behavior group included in each behavior group in the multiple behavior groups, and obtain the multiple behavior groups. behavior recognition model.

In yet another implementation, the behavior to which the network behavior to be detected is determined to belong is different from the behavior to which the network behavior to be detected actually belongs, and the device 400 may further include a multiplying module 432 and a checking module 436 and updating module 440, wherein the multiplication module 432 is used to calculate the product of other probabilities in the plurality of correlation degree values except the maximum correlation degree value, and the checking module 436 is used to check the maximum correlation degree value and Whether the calculated ratio of the product is greater than a specified threshold, and the update module 440 is configured to use the incremental learning algorithm to perform self-learning training using the network behavior to be detected to update the plurality of behaviors if the check result is affirmative Identify the model.

Referring now to FIG. 5 , it shows a schematic diagram of a device for malicious network behavior detection according to an embodiment of the present invention. As shown in FIG. 5 , the device 500 may include a memory 510 and a processor 520 connected to the memory 510 . The processor 520 may execute the operations performed by the various modules in the foregoing apparatus 400 .

The embodiment of the present invention also provides a machine-readable medium on which executable instructions are stored, and when the executable instructions are executed, the machine implements operations performed by the processor 520 .

Those skilled in the art should understand that various variations and modifications can be made to the above-disclosed embodiments without departing from the essence of the invention. Therefore, the protection scope of the present invention should be defined by the appended claims.

Claims (11)

1. A method for malicious network behavior detection, comprising: According to the respective characteristic parameters of multiple behavior categories, calculate the correlation degree value between the network behavior to be detected and each of the multiple behavior categories to obtain multiple correlation degree values, wherein the multiple behavior categories include normal behavior categories and at least one malicious behavior category, the feature parameters of each of the multiple behavior categories are pre-trained using known malicious network behaviors and normal network behaviors as training samples; and According to whether the maximum correlation degree value among the plurality of correlation degree values is the correlation degree value between the network behavior to be detected and the normal behavior category or the relationship between the network behavior to be detected and the at least one malicious behavior category One of the correlation degree values, it is determined that the behavior to be detected belongs to a normal network behavior or a malicious network behavior. 2. The method of claim 1, further comprising: According to the behavior characteristics of the network behavior to be detected, determine the type of behavior to which the network behavior to be detected belongs; and From a plurality of behavior recognition models respectively corresponding to different behavior types, select a behavior recognition model corresponding to the determined behavior type, wherein each of the plurality of behavior recognition models includes the respective Characteristic Parameters, Wherein, the calculation further includes: according to the respective characteristic parameters of the multiple behavior categories included in the selected behavior recognition model, calculating the correlation degree value between the behavior to be detected and each of the multiple behavior categories , to obtain the multiple correlation degree values. 3. The method of claim 2, further comprising: dividing the known malicious network behaviors and normal network behaviors as the training samples into a plurality of behavior groups, wherein the network behaviors in each behavior group belong to the same behavior category; Using a clustering algorithm to cluster the network behaviors included in each of the multiple behavior groups into multiple sub-behavior groups, and the network behavior included in each sub-behavior group belongs to one of the multiple behavior categories ;as well as Using a multi-classifier training algorithm to train the network behaviors in each sub-behavior group included in each behavior group of the multiple behavior groups to obtain the multiple behavior recognition models. 4. The method of claim 3, wherein, The behavior to which the network behavior to be detected is determined to belong is different from the behavior to which the network behavior to be detected actually belongs, and The method also includes: calculating a product of other relevance degree values in the plurality of relevance degree values except the maximum relevance degree value; checking whether the ratio of said maximum correlation value to the calculated product is greater than a specified threshold; and If the checking result is affirmative, use the network behavior to be detected to perform self-learning training by using an incremental learning algorithm, so as to update the multiple behavior recognition models. 5. The method according to claim 2, wherein the behavior types include propagation behavior, remote control behavior, and attack behavior. 6. A device for malicious network behavior detection, comprising: A calculation module, configured to calculate a correlation degree value between the network behavior to be detected and each of the multiple behavior categories according to the respective characteristic parameters of the multiple behavior categories, to obtain multiple correlation degree values, wherein the multiple behaviors The categories include normal behavior categories and at least one malicious behavior category, and the respective characteristic parameters of the plurality of behavior categories are pre-trained using known malicious network behaviors and normal network behaviors as training samples; and A determining module, configured to determine whether the maximum correlation degree value among the plurality of correlation degree values is the correlation degree value between the network behavior to be detected and the normal behavior category or the network behavior to be detected and the at least one The correlation degree value of one of the malicious behavior categories determines that the behavior to be detected belongs to a normal network behavior or a malicious network behavior. 7. The apparatus of claim 6, further comprising: A determination module, configured to determine the type of behavior to which the network behavior to be detected belongs according to the behavior characteristics of the network behavior to be detected; and A selection module, configured to select a behavior recognition model corresponding to the determined behavior category from a plurality of behavior recognition models respectively corresponding to different behavior categories, wherein each of the plurality of behavior recognition models includes the multiple The characteristic parameters of each behavior category, Wherein, the calculation module is further used to: calculate the correlation between the behavior to be detected and each of the multiple behavior categories according to the respective characteristic parameters of the multiple behavior categories included in the selected behavior recognition model degree value to obtain the plurality of correlation degree values. 8. The apparatus of claim 7, further comprising: A division module, configured to divide the known malicious network behaviors and normal network behaviors as the training samples into a plurality of behavior groups, wherein the network behaviors in each behavior group belong to the same behavior category; A clustering module, configured to use a clustering algorithm to cluster the network behaviors included in each behavior group in the plurality of behavior groups into a plurality of sub-behavior groups, and the network behavior included in each sub-behavior group belongs to the plurality of behavior groups. one of the behavioral categories; and The training module is configured to use a multi-classifier training algorithm to respectively train the network behaviors in each sub-behavior group included in each behavior group of the multiple behavior groups, so as to obtain the multiple behavior recognition models. 9. The apparatus of claim 8, wherein, The behavior to which the network behavior to be detected is determined to belong is different from the behavior to which the network behavior to be detected actually belongs, and The device also includes: A multiplication module, configured to calculate the product of other correlation degree values in the plurality of correlation degree values except the maximum correlation degree value; A checking module, configured to check whether the ratio of the maximum correlation degree value to the calculated product is greater than a specified threshold; and An updating module, configured to use an incremental learning algorithm to perform self-learning training using the network behavior to be detected, so as to update the plurality of behavior recognition models if the checking result is positive. 10. A device for malicious network behavior detection, comprising: storage; and A processor connected to the memory, configured to perform the operations included in any one of claims 1-5. 11. A machine-readable medium having stored thereon executable instructions which, when executed, cause a machine to perform the operations performed by the processor of claim 10.