CN110311870B

CN110311870B - SSL VPN flow identification method based on density data description

Info

Publication number: CN110311870B
Application number: CN201910498412.5A
Authority: CN
Inventors: 刘扬; 吕思才; 黄俊恒; 孙云霄; 王佰玲; 王超
Original assignee: Hit Weihai Innovation Pioneer Park Co ltd; Harbin Institute of Technology Weihai
Current assignee: Hit Weihai Innovation Pioneer Park Co ltd; Harbin Institute of Technology Weihai
Priority date: 2019-06-10
Filing date: 2019-06-10
Publication date: 2022-08-02
Anticipated expiration: 2039-06-10
Also published as: CN110311870A

Abstract

The invention belongs to the technical field of network data processing, and relates to an SSL VPN flow identification method. An SSL VPN flow identification method based on density data description comprises the following steps: capturing traffic which is transmitted safely by using an SSL protocol from network traffic; performing feature extraction on the captured SSL flow; and classifying and judging the extracted feature vectors by taking the SSL VPN data description domain based on density description as a judgment basis, and if the extracted feature vectors fall into the data description domain, judging the SSL VPN flow, otherwise, judging the SSL VPN flow as the common SSL flow. The SSL VPN flow identification method based on the density data description can convert SSL VPN flow into a feature vector, and a data description domain can be found based on density through the density-based data description, so that the SSL VPN flow is classified.

Description

SSL VPN flow identification method based on density data description

Technical Field

The invention belongs to the technical field of network data processing, and relates to an SSL VPN flow identification method.

Background

With the advent of the big data age, data acquisition becomes more and more convenient, and after the data acquisition is completed, how to acquire required information from the data becomes a new challenge. The classification problem is used as an important class of machine learning, a model is built based on existing data, and then the class of the obtained unknown class data is judged. However, the obtaining of the labeled training data required for classification is not easy, for example, VPN traffic may be obtained by various methods, while non-VPN traffic is of various types, and it is difficult to include all non-VPN traffic types in the usually obtained counter-example set. There is only one type of labeled data that can be used for training in this case.

Currently, in the case that only a single type of data is available, the scholars also propose corresponding classification models, and the most widely used are One-Class SVM and SVDD. The core idea of the One-Class SVM is to take the origin of coordinates as a singular point, find the hyperplane, enable the single-Class data set and the origin of coordinates to respectively fall on two sides of the hyperplane, enable the distance between the origin of coordinates and the hyperplane to be as large as possible, consider the data which fall on the same side with the training sample as the data of the target Class during prediction, and otherwise consider the data not of the target Class. The SVDD maps the original sample to a high-dimensional space through a kernel function, a hypersphere containing most data is searched in the high-dimensional space, the volume of the hypersphere is made to be as small as possible, and when prediction is carried out, the data falling in the hypersphere is regarded as the data of a target class, otherwise, the data is not. Both algorithms have proven to work similarly in dealing with the single classification problem.

Still other scholars deal with the single classification problem as an anomaly detection problem, and data of non-target classes as anomaly points. When an isolated Forest (Isolation Forest) is widely applied and constructed, one feature is randomly selected, a value is randomly selected from the value range of the feature to divide a data set, iteration is carried out for multiple rounds, until only one data point exists in leaf nodes, an isolated Tree (Isolation Tree) is obtained, and meanwhile, multiple isolated trees are constructed to obtain the isolated Forest. The abnormal values are outliers, so that the abnormal values can be divided into leaf nodes quickly; rather than outliers, more partitions are often needed to fall to leaf nodes. Whether the leaf node is an outlier can be determined by the path lengths of the leaf node and the root node.

The VPN is a private network established over a public network, and performs encryption of communication. Therefore, the VPN traffic necessarily covers various types of traffic, and the obtained VPN data set usually contains a plurality of class clusters, so that how to classify and identify the VPN traffic data and acquire the required information is very necessary.

Disclosure of Invention

In order to solve the problem of VPN flow identification, the invention provides an SSL VPN flow identification method based on density data description. The method starts from the internal distribution of VPN flow data, and divides a data description domain, thereby realizing VPN flow identification.

The technical scheme adopted by the invention for solving the technical problems is as follows: an SSL VPN flow identification method based on density data description comprises the following steps:

capturing traffic which is transmitted safely by using an SSL protocol from network traffic;

performing feature extraction on the captured SSL flow;

and classifying and judging the extracted feature vectors by taking the SSL VPN data description domain based on density description as a judgment basis, and if the extracted feature vectors fall into the data description domain, judging the SSL VPN flow, otherwise, judging the SSL VPN flow as the common SSL flow.

Further, the method for acquiring the data description domain of the SSL VPN based on the density description includes:

constructing an SSL VPN flow data density description model function;

carrying out preliminary training on the model function to obtain a hypersphere with the maximum density;

further training the model function, and dividing the data points scattered outside the hypersphere with the maximum density into data description domains again to obtain a plurality of hyperspaces;

and integrating data inside all the hypersphere to form a data description domain of the SSL VPN.

Further, the SSL VPN traffic data density description model function is:

where ρ (R, a) represents the density, R represents the radius of the hypersphere, a represents the center of the hypersphere, and n is a numberNumber of samples in data set, C _n R ⁿ Is the volume of the n-dimensional hypersphere.

The preliminary training method comprises the following steps:

using a gradient ascending method, first the partial derivatives of R and a are calculated:

giving an initial value R ₀ And a ₀ And the learning rate eta, the iterative calculation formula is as follows:

the learning rate is adjusted by using Adadelta method self-adaptive adjustment, according to the gradient calculated each time, the formula of adjustment is as follows:

the further training steps are as follows:

1. initializing an upper error bound gamma, and setting the minimum density alpha or the minimum sample number min _ sample of sample points in a spherical plane;

2. solving the sphere plane with the maximum density of the current data set by gradient ascending;

3. calculating the points of the data set in the hypersphere, and jumping to step 5 if the number of the points is less than min _ sample or the density is less than alpha; otherwise, removing the points, and taking the remaining hyperplane as a new data set;

4. calculating the number of points in the new data set, and jumping to the step 5 if the proportion is less than gamma; otherwise, jumping to the step 2;

5. and outputting all the obtained hypersphere.

The SSL VPN flow identification method based on the density data description can convert SSL VPN flow into a feature vector, and a data description domain can be found based on density through the density-based data description, so that the SSL VPN flow is classified. Has the following beneficial effects:

(1) VPN traffic identification may help managers or operators supervise network traffic;

(2) the method is insensitive to data distribution in the data, can divide a data description domain for data in any shape, and can be suitable for the characteristic of transmitting various flows in a VPN tunnel;

(3) the method is insensitive to abnormal points in the data set, and the abnormal points in the data do not influence the division of the data description domain.

Drawings

FIG. 1 is a flow chart of SSL VPN traffic identification method based on density data description of the present invention;

FIG. 2 is a signature function for type discrimination in a model;

FIG. 3 is an alternative function to the flag function in the model, with the advantages of continuity and derivation;

FIG. 4 illustrates a particular case encountered after solving a model function;

FIG. 5 is a flow chart of model training and solving.

Detailed description of the preferred embodiments

The SSL VPN traffic identification method based on density data description according to the present invention is explained in detail below with reference to the accompanying drawings and embodiments.

The SSL VPN flow identification method based on the density data description of the invention has the flow as shown in figure 1, and comprises the following specific steps:

secondly, performing feature extraction on the captured SSL flow

The SSL VPN traffic classification focuses on information of traffic in a handshake protocol, and firstly, the first stage includes a Client Hello and a Server Hello, and the Client Hello can record cipher suite (supported encryption protocol) and the length of each part of extension. The Server Hello packet directly contains the contents of the certificate and the like in the second stage and the Server hellodone, and can record the length of the certificate, the length of the certificate status and the length of the Server Key Exchange. All SSL VPN traffic characteristics are shown in table 1.

TABLE 1 SSL VPN traffic characteristics

Feature(s)	Description of the invention
		Length of each part of Extension	Extend field length
Lengths of respective parts in Server Hello	Certificate, Server Key Exchange, etc. length
		Forward packet arrival time statistics	Mean, variance, maximum and minimum of forward packet arrival times, etc
Reverse packet arrival time statistics	Mean, variance, maximum and minimum of reverse packet arrival times, etc
		Forward packet length statistic	Mean, variance, maximum and minimum of forward packet length
Reverse packet length statistics	Mean, variance, maximum and minimum of reverse packet length

Thirdly, constructing SSL VPN flow data density description model function

Generally, the data of the same type have certain similarity with each other, which causes the data to be concentrated in a certain area, and the data which does not fall in the area has a larger degree of confidence that the data is not the data (abnormal value) of the type, and the area is called as a data description area.

Based on this feature, a core idea of Density-based Data Description (DBDD) can be given: by finding the hyper-sphere with the highest density in a given dataset, the following model function can be obtained:

where ρ (R, a) represents the density, R represents the radius of the hypersphere, a represents the center of the hypersphere, n is the number of samples in the data set, C _n R ⁿ Is the volume of the n-dimensional hypersphere. The significance of this objective function is to maximize the ratio of the sample points falling into a hypersphere with a as the center of sphere R to the hypersphere volume, i.e. the density.

For p (R, a), the molecular part of the function is not derivable, as shown in fig. 2, which makes it difficult to maximize the values of R and a, and the sigmoid function can be substituted for the function f (x) in the molecule of the function. The sigmoid function is shown in fig. 3.

The sigmoid function is used for replacing the sigmoid function, and the advantages of 1. leading the objective function and being convenient to solve are achieved; 2. for better point processing near the boundary, f (x) directly divides the boundary points into 0 or 1 when processing the boundary points, and the sigmoid function is replaced by a value proportional to the point-to-boundary distance when processing the boundary points, similar to the soft interval in SVM, which prevents overfitting to some extent.

Fourthly, performing preliminary training on the constructed model function

1. Using a gradient ascending method, first the partial derivatives of R and a are calculated:

2. giving an initial value R ₀ And a ₀ And the learning rate eta, the iterative calculation formula is as follows:

however, it is difficult to directly specify a proper learning rate, too large a learning rate may make the iteration unable to converge, and too small a learning rate may make the step size of each iteration small, thereby making convergence slow.

3. The learning rate is adjusted according to the gradient calculated each time by using Adadelta method self-adaptive adjustment learning rate, and the formula of the adjustment is as follows:

4. the above initially trained model can find a hypersphere with the highest density, as shown in fig. 4.

However, the data contained in the ball is only a small part of all the data, so the hypersphere initially trained cannot represent the distribution area of the data, and further training is needed.

Fifthly, further training the model function, as shown in fig. 5, the specific steps are as follows:

step 1, initializing an upper error bound gamma, and setting the minimum density alpha or the minimum sample number min _ sample of sample points in the spherical plane;

step 2, solving the spherical plane with the maximum density of the current data set by gradient rising;

step 3, calculating points of which the data are concentrated in the hypersphere, and jumping to Step 5 if the number of the points is less than min _ sample or the density is less than alpha; otherwise, removing the points, and taking the remaining hyperplane as a new data set;

step 4, calculating the number of points in the new data set, and if the proportion is smaller than gamma, jumping to Step 5; otherwise, jumping to step 2;

and Step 5, outputting all the obtained hypersphere surfaces.

Through the training steps, data points scattered outside the hypersphere with the maximum density can be divided into data description domains again, the data description domains can be prevented from being divided on sparse data through an iterative jumping-out method, and the data description domains can be prevented from being divided based on abnormal points due to the fact that the data amount in the hypersphere is too small.

And sixthly, integrating data in all hyper-spheres to obtain a data description domain of the SSL VPN based on density description.

And seventhly, judging the SSL VPN flow characteristic vector from the characteristic by taking the data description domain of the SSL VPN based on the density description as a judgment basis, and if the SSL VPN flow characteristic vector falls into the data description domain, considering the SSL VPN flow, otherwise, considering the SSL VPN flow as the common SSL flow.

Claims

1. A SSL VPN flow identification method based on density data description is characterized in that: the method comprises the following steps:

performing feature extraction on the captured SSL flow;

classifying and judging the extracted feature vectors by taking a data description domain of the SSL VPN based on density description as a judgment basis, and if the extracted feature vectors fall into the data description domain, judging the SSL VPN flow, otherwise, judging the SSL VPN flow as a common SSL flow;

the method for acquiring the data description domain comprises the following steps:

constructing an SSL VPN flow data density description model function;

integrating all data inside the hypersphere to form a data description domain of the SSL VPN;

the SSL VPN flow data density description model function is as follows:

wherein

Representing density, R represents radius of the hypersphere, a represents center of the hypersphere, n is number of samples in the data set,

is the volume of the n-dimensional hypersphere;

the preliminary training method comprises the following steps:

by gradient ascent, the partial derivatives of R and a are first determined

Giving an initial value

And

learning rate

Then the iterative calculation is as follows:

；

the further training steps are as follows:

initializing an upper error bound gamma, and setting the minimum density alpha or the minimum sample number min _ sample of sample points in a spherical plane;

solving the sphere plane with the maximum density of the current data set by gradient ascending;

calculating the points of the data set in the hypersphere, and jumping to step 5 if the number of the points is less than min _ sample or the density is less than alpha; otherwise, removing the points, and taking the remaining hyperplane as a new data set;

calculating the number of points in the new data set, and jumping to the step 5 if the proportion is less than gamma; otherwise, jumping to the step 2;

and outputting all the obtained hypersphere.