CN112134847A - Attack detection method based on user flow behavior baseline - Google Patents

Abstract

The invention belongs to the technical field of attack detection methods, and in particular relates to an attack detection method based on user traffic behavior baseline. The method extracts the flow-level feature set of the user's network traffic behavior; inputs the feature set into the improved model for training, obtains the user behavior baseline, and uses the baseline as the criterion for attack detection of new access traffic. The method only uses the user's normal behavioral traffic during training. The improved bidirectional generative adversarial network algorithm can perform stable training on high-latitude traffic characteristics, and is suitable for the detection of unknown attacks, with fast detection speed and high accuracy.

Description

Attack detection method based on user traffic behavior baseline

technical field

The invention belongs to the technical field of attack detection methods, and in particular relates to an attack detection method based on user traffic behavior baseline.

Background technique

With the development of machine learning technology in practical applications, it has also been widely used in the field of traffic anomaly detection. Some researchers select a small number of traffic characteristics, only for specific attack scenarios, and use the classic decision tree algorithm, clustering algorithm, genetic algorithm, etc. in the machine learning model to distinguish normal traffic from intrusion traffic, and achieve better detection results. However, these methods have poor performance for complex and high-dimensional traffic data, and have a huge time overhead. The emergence of deep learning models solves the training problem of high-dimensional and complex data. However, it is difficult to obtain attack samples. When the space of attack traffic samples is insufficient, it is difficult for the existing methods to fully train the detection model, and it is difficult to produce good detection of unknown attacks. Effect.

SUMMARY OF THE INVENTION

In view of the defects and problems existing in the prior art, the present invention provides an attack detection method based on user traffic behavior baseline. The method defines user behavior characteristics through network traffic metadata, and depicts behavior patterns of specific users. Only the traffic data of normal users is used to detect abnormal behavior traffic generated by non-users, which can not only detect known attack behaviors, but also warn unknown behaviors.

The scheme adopted by the present invention to solve the technical problem is: an attack detection method based on user traffic behavior baseline, comprising the following steps:

(1) Capture the inbound and outbound traffic data of the network card gateway of a specific user for at least one week, perform IP address filtering on the inbound and outbound traffic data, generate all traffic data related to the user, and then filter the traffic data to discard timeouts, out-of-order and retransmission obtain the complete bidirectional TCP session flow and UDP session flow in the user behavior flow. The direction of the flow is marked by the direction of the first data packet. The TCP session flow starts with SYN, and any end sends FIN and the number is less than 2 is termination, the UDP session flow takes 120 seconds as the timeout time threshold, and is marked as its session ID with the quintuple <source IP, destination IP, source port, destination port, protocol type>; according to the determined feature set dimension, Extract the metadata features in the session flow, perform statistical feature calculation, transform the category features in the extracted features so that the features of the input model belong to the same dimension, calculate the standard deviation of the time-related statistical features, and calculate according to the session flow. The ID integration integrates statistical features into feature sets with specific dimensions;

(2) Selecting part of the traffic feature set of the user as the training set, normalizing the numerical data in the training set, and dummy coding the categorical data in the training set so that it can be used for model training;

(3) Initialize the parameters of the bidirectional generative adversarial network model, determine the model parameters, first train the discriminator in the model, then train the generator and the encoder, and then perform alternate training until the loss function of the discriminator shows an oscillating trend; After the training is completed, the training loss value of the discriminator part and the training loss value of the generator and encoder parts are obtained respectively, and the loss scores of the discriminator part and the generator and encoder parts are calculated respectively through the L1 norm, and then through the abnormal score formula Calculate the baseline of user data;

(4) Integrate the behavioral features of the test sample traffic behavior, normalize the continuous parameters in the test sample feature parameters, and perform dummy coding on the categorical features; input each conversation flow in the test sample into the two-way adversarial network The model calculates to obtain the feature distribution score of each session flow in the test sample; compare the feature distribution score of each session flow in the test sample with the baseline, when the feature distribution score is greater than the baseline, the sample is determined as an attack sample , when the feature distribution score is not greater than the baseline, the sample is a normal sample.

The above-mentioned attack detection method for user traffic behavior baseline, the network communication session flow generated by the user in the first step and the network communication session flow generated by the attack behavior: when the following conditions are met, consider that the data packets belong to the same session flow:

TCP session flow:

Flow direction ∩SrcIP ₁ =SrcIP ₂ ∩DstIP ₁ =DstIP ₂ ∩Prot ₁

=Prot ₂ ∩tcp flag bit

UDP session flow:

Flow direction ∩SrcIP ₁ =SrcIP ₂ ∩DstIP ₁ =DstIP ₂ ∩Prot ₁ =Prot ₂ ∩T _udp

In the formula: SrcIP represents the source IP address, DstIP represents the destination IP address, Prot represents the port number; T _udp represents the timeout time threshold of the UDP stream, and ∩ represents that the conditions are satisfied at the same time.

In the above-mentioned attack detection method for user traffic behavior baseline, in step 1, the inbound and outbound traffic data of the network card gateway is the traffic data of the user for at least one week.

In the above attack detection method for user traffic behavior baseline, the training set is the user's normal behavior traffic feature set.

In the above attack detection method for user traffic behavior baseline, the test sample includes a user's normal behavior traffic feature set and a variety of attack traffic feature sets other than the training set.

Beneficial effects of the present invention: the present invention only uses the user's traffic behavior characteristics in the baseline model training process, and the data is easy to collect, so that the model can be fully trained; high-dimensional network traffic metadata is used to define the user's behavior pattern, and the user It is a general attack detection model, which is a general attack detection model; the invention improves the bidirectional generative confrontation network model, and applies WGAN-GP to the bidirectional GAN framework. , which replaces the loss function of the original model discriminator, so that the model training converges quickly and the detection is efficient.

Description of drawings

Figure 1 is a flowchart of an attack detection method based on user traffic behavior baseline.

Figure 2 is a flowchart of user traffic behavior feature set extraction.

Figure 3 is a flow chart of training a baseline model of user traffic behavior.

FIG. 4 is a flow chart of the detection model performing attack behavior detection according to the baseline.

Detailed ways

In view of the current attack detection methods only for specific attack scenarios, the performance of complex and high-dimensional traffic data is poor, and the time overhead is large. When the attack traffic sample space is insufficient, it is difficult for the existing methods to fully train the detection model and to detect unknown To solve the problem of good detection effect caused by attacks, the present invention provides an attack detection method based on user traffic behavior baseline, which can define user behavior characteristics through network traffic metadata, and describe behavior patterns of specific users. The traffic data of normal users is used to detect abnormal behavior traffic generated by non-users. The present invention is further described below with reference to the accompanying drawings and embodiments.

Embodiment 1: This embodiment provides an attack detection method based on a user traffic behavior baseline. The specific process of the method is shown in FIG. 1 .

The first step is to extract the user's network traffic behavior feature set, the process is shown in Figure 2.

Obtain the inbound and outbound traffic data of the network card gateway of a specific user for at least one week, filter the IP addresses of all traffic data, and retain all the traffic data related to the user. Filter these traffic data again, discard the traffic that times out, out of sequence and retransmission, and obtain the complete bidirectional TCP session flow and UDP session flow in the user behavior traffic, the network communication session flow generated by the user and the network communication session generated by the attack behavior. Flow When the following conditions are met, packets are considered to belong to the same session flow:

TCP session flow:

Flow direction ∩SrcIP ₁ =SrcIP ₂ ∩DstIP ₁ =DstIP ₂ ∩Prot ₁

=Prot ₂ ∩tcp flag bit

UDP session flow:

Flow direction ∩SrcIP ₁ =SrcIP ₂ ∩DstIP ₁ =DstIP ₂ ∩Prot ₁ =Prot ₂ ∩T _udp

Among them, the flow direction is marked by the direction of the first data packet, SrcIP indicates the source IP address, DstIP indicates the destination IP address, Prot indicates the port number, and the tcp flag bit in the TCP session flow indicates that SYN is the starting point, and any end sends FIN And if the number is less than 2, it is terminated. T _udp in the UDP session flow indicates the timeout time threshold of the UDP flow. Here, it is set to T _udp = 120s, and ∩ indicates that the conditions are satisfied at the same time.

The basic information for generating session flow from data packets includes source IP address, destination IP address, source port, destination port, protocol type, timestamp, payload length, Flag identifier, time window, and packet header length; The group <source IP, destination IP, source port, destination port, protocol type> is marked as its ID.

Extract the metadata features in the session stream according to the determined feature dimension, perform statistical feature calculation, and transform the category features in the extracted features. Because the category features in the data need to be preprocessed, such as destination port type and protocol type. The purpose of the transformation is to make the features of the input model belong to the same dimension; calculate the standard deviation of the time-related statistical features to reflect the degree of dispersion of the data, and integrate the statistical features into a feature set with a specific dimension according to the ID integration of the session flow .

Then, select some normal behavior traffic feature sets of specific users as the training set, and normalize the numerical data in the training set. The numerical features in this embodiment are 30-dimensional original statistical features and 22-dimensional calculated statistical features; The categorical data in the training set is dummy encoded. Dummy encoding is to arbitrarily remove a state, that is, if there are four states, three state bits are required, of which three states have a state bit value of 1 when activated, and the fourth state It can be represented by [0, 0, 0]; coding is to treat each discrete feature as a state, and the dummy variable coding method is used here. The coding effect is shown in Table 1, so that it can be used for model training.

Table 1 Dummy coding results

The second step is to conduct baseline learning of conversation features through generative adversarial algorithms. The process is shown in Figure 3, and the details are as follows.

Initialize the parameters of the bidirectional generative adversarial network model, determine the model parameters, first train the discriminator in the model, splicing the training sample X with its hidden layer map, splicing the latent variable Z with the feature map of the real space, and splicing the two pairs of data The input discriminator outputs 64-dimensional data through the first layer of full connection, and then outputs 1-dimensional data through 1 layer of full connection, that is, the last layer of full connection connects each neuron to each output neuron.

Then train the generator and encoder. The generator uses a 4-layer neural network, the input is a 16-dimensional latent space variable, and the first layer is fully connected to output 32-dimensional data, which is activated by ReLU, and the second layer is fully connected to output. The 64-dimensional data is activated by ReLU again, and the third layer is fully connected to output 57 dimensions to obtain the real space feature representation, and try to reconstruct the original input data, that is, G(E(x)).

The encoder uses a 3-layer neural network, the input is 57-dimensional original data, the first layer is fully connected to output 32-dimensional data, activated by Leaky ReLU, and the second layer is fully connected to output 16-dimensional data, and output the hidden layer feature representation, namely E (x).

Map the training sample x from the real space to the hidden layer space to obtain the distribution difference between the training sample and the hidden variable, Loss _e = -E _{x ~ px} [D(x, E(x))]; then transfer the hidden variable z from the hidden layer to The space is mapped to the real space to obtain the distribution difference between the known noise z and the reconstructed variable G(z), Loss _g =E _z～pz [D(G(z),z)]; calculate the reconstructed sample (G(E( The distribution difference between x))) and the original sample x, Loss _d = Loss _e +Loss _g ; Calculate the distribution difference between the reconstructed sample (G(E(x))) and the original sample x, Loss _d = Loss _e +Loss _g ; get the target loss function of the discriminator

The discriminator in the bidirectional generative adversarial network is trained, the gradient is updated, the parameters are passed to the generator and the encoder, and the training generator and the encoder in the bidirectional generative adversarial network are trained at the same time. The data output from the generator and the encoder are spliced and then sent to the discriminator. Therefore, the above process is alternately trained until the target loss function trained to the discriminator shows an oscillating trend; the discriminator finally outputs 1-dimensional data, and the output is the hidden layer space. Feature matching can use local correlation to extract features, reduce the amount of data processing, while retaining useful features, and its penultimate layer is used as feature output.

Calculate the score L _f of the discriminator, L _f =|fD(x,E(x))-fD(E(x),G(E(x)))|, find the L1 norm of L _f to calculate the discriminator's Loss score S _f = ‖L _f ‖ ₁ .

Obtain the loss of G(E(x)) after encoding and then generating the training sample x, that is, L _x .

L _x =||xG(E(x))||,

Find the loss score S _x for the generator and encoder parts of the L1 norm of L _x , S _x = ‖L _x ‖ ₁ .

According to the loss score S _x of the generator and the encoder and the loss score S _f of the discriminator part, calculate the abnormal score Score=(1-weight)*S _x +weight*S _f , which is the baseline.

The third step is to perform attack detection on the test sample. The process is shown in Figure 4, which is as follows: Integrate the behavior features of the test sample traffic behavior, where the test sample includes the user's normal behavior traffic feature set other than the training set and multiple A feature set of attack traffic, normalize the continuous parameters in the feature parameters of the test sample, and perform dummy coding on the features of the category; input each session flow in the test sample into the two-way adversarial network model for calculation, and get the test The feature distribution score of each session flow in the sample; compare the feature distribution score of each session flow in the test sample with the baseline, when the feature distribution score is greater than the baseline, the sample is judged as an attack sample, and when the feature distribution score is different greater than the baseline, the sample is a normal sample.

243703 test samples were detected with the method of the present embodiment, the results are shown in Table 2.

The detection result of table 2 attack detection method of the present invention

type of attack Precision(%) Recall(%) Accuracy (%) F1(%) DoS 100 100 100 100 DDoS 100 100 100 100 web attack 90.89 91.34 96.67 91.53 Infiltration 100 100 100 100

From the detection result data in Table 2, it can be seen that the detection method of the present invention has a precision rate (Precision), a recall rate (Recall), an accuracy rate (Accuracy) and an F1 value of the three attack types of DoS, DDoS and Infiltration, which are all 100%. , indicating that the detection method of the present invention has a better detection effect.

The above are only preferred embodiments of the present invention and do not limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principle scope of the present invention shall be included in the protection scope of the present invention. Inside.

Claims (5)

1. An attack detection method based on a user flow behavior baseline is characterized in that: the method comprises the following steps:

the method comprises the steps that firstly, network card gateway access flow data of a user are captured, IP address filtering is carried out on the access flow data, and all flow data related to the user are reserved; filtering the flow data, discarding overtime, disorder and retransmitted flows, acquiring complete bidirectional TCP session flow and UDP session flow in user behavior flow, and marking quintuple as ID thereof; extracting metadata features in the conversation flow according to the determined feature dimension, performing statistical feature calculation, transforming category features in the extracted features to enable the features of the input model to belong to the same dimension, performing standard deviation calculation on the statistical features related to time, and integrating the statistical features into a feature set with a specific dimension according to ID integration of the conversation flow;

secondly, selecting a part of flow characteristic set of a user as a training set, carrying out normalization processing on numerical data in the training set, and carrying out dummy coding on class type data in the training set so that the class type data can be used for model training;

initializing parameters of a bidirectional generation countermeasure network model, determining model parameters, training a discriminator in the model, then training a generator and an encoder, and then performing alternate training until a loss function of the discriminator presents an oscillation trend; respectively obtaining a training loss value of the discriminator part and training loss values of the generator and the encoder part after training is finished, respectively calculating loss scores of the discriminator part and the generator and the encoder part through an L1 norm, and then calculating a base line of user data through an abnormal score formula;

fourthly, performing behavior characteristic integration on the flow behaviors of the test samples, performing normalization processing on continuous parameters in the characteristic parameters of the test samples, and performing dummy coding on the characteristics of the type; inputting each conversation flow in the test sample into a bidirectional confrontation network model for calculation to obtain a feature distribution score of each conversation flow in the test sample; and comparing the feature distribution score of each conversation flow in the test sample with the baseline, judging the sample as an attack sample when the feature distribution score is larger than the baseline, and judging the sample as a normal sample when the feature distribution score is not larger than the baseline.

2. The user traffic behavior baseline-based attack detection method according to claim 1, wherein: in the first step, the network communication session flow generated by the user and the network communication session flow generated by the attack behavior are as follows: the data packets are considered to belong to the same session flow when the following conditions are met:

TCP session flow:

flow direction ^ SrcIP₁＝SrcIP₂∩DstIP₁＝DstIP₂∩Prot₁＝Prot₂N-tcp flag bit

UDP session flow:

flow direction ^ SrcIP₁＝SrcIP₂∩DstIP₁＝DstIP₂∩Prot₁＝Prot₂∩T_udp

In the formula: SrcIP represents a source IP address, DstIP represents a destination IP address, and Prot represents a port number; t is_udpDenotes a timeout threshold value of the UDP stream, and ∈ denotes that the condition is satisfied at the same time.

3. The user traffic behavior baseline-based attack detection method according to claim 1, wherein: in the first step, the gateway entrance and exit traffic data of the network card is the traffic data of at least one week of the user.

4. The user traffic behavior baseline-based attack detection method according to claim 1, wherein: the training set is a normal behavior flow characteristic set of the user.

5. The user traffic behavior baseline-based attack detection method according to claim 1, wherein: the test sample comprises a normal behavior traffic feature set of the user and feature sets of various attack traffic except the training set.

Images