CN115134168A - Method and system for detecting cloud platform hidden channel based on convolutional neural network - Google Patents
Method and system for detecting cloud platform hidden channel based on convolutional neural network Download PDFInfo
- Publication number
- CN115134168A CN115134168A CN202211036936.0A CN202211036936A CN115134168A CN 115134168 A CN115134168 A CN 115134168A CN 202211036936 A CN202211036936 A CN 202211036936A CN 115134168 A CN115134168 A CN 115134168A
- Authority
- CN
- China
- Prior art keywords
- cloud platform
- layer
- hidden channel
- network
- convolutional neural
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000013527 convolutional neural network Methods 0.000 title claims abstract description 43
- 238000000034 method Methods 0.000 title claims abstract description 28
- 238000001514 detection method Methods 0.000 claims abstract description 59
- 238000011156 evaluation Methods 0.000 claims abstract description 26
- 238000013136 deep learning model Methods 0.000 claims abstract description 22
- 238000007781 pre-processing Methods 0.000 claims abstract description 9
- 238000010276 construction Methods 0.000 claims abstract description 5
- 238000012800 visualization Methods 0.000 claims abstract description 5
- 238000011176 pooling Methods 0.000 claims description 25
- 238000012549 training Methods 0.000 claims description 25
- 239000011159 matrix material Substances 0.000 claims description 16
- 230000004044 response Effects 0.000 claims description 11
- 239000013598 vector Substances 0.000 claims description 11
- 238000004364 calculation method Methods 0.000 claims description 10
- 230000008859 change Effects 0.000 claims description 6
- 238000006243 chemical reaction Methods 0.000 claims description 6
- 238000010606 normalization Methods 0.000 claims description 6
- 230000008569 process Effects 0.000 claims description 6
- 238000012545 processing Methods 0.000 claims description 6
- 238000012360 testing method Methods 0.000 claims description 6
- 210000002569 neuron Anatomy 0.000 claims description 5
- 230000005540 biological transmission Effects 0.000 claims description 4
- 230000014759 maintenance of location Effects 0.000 claims description 4
- PNDPGZBMCMUPRI-UHFFFAOYSA-N iodine Chemical compound II PNDPGZBMCMUPRI-UHFFFAOYSA-N 0.000 claims description 3
- 238000005259 measurement Methods 0.000 claims description 3
- 229910052740 iodine Inorganic materials 0.000 claims description 2
- 239000011630 iodine Substances 0.000 claims description 2
- 238000013135 deep learning Methods 0.000 description 5
- 238000010586 diagram Methods 0.000 description 4
- 238000004422 calculation algorithm Methods 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000002159 abnormal effect Effects 0.000 description 1
- 230000006978 adaptation Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000009792 diffusion process Methods 0.000 description 1
- 239000002360 explosive Substances 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Physics & Mathematics (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Computer Hardware Design (AREA)
- Theoretical Computer Science (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Molecular Biology (AREA)
- Data Mining & Analysis (AREA)
- Computational Linguistics (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Evolutionary Computation (AREA)
- Biophysics (AREA)
- Biomedical Technology (AREA)
- Artificial Intelligence (AREA)
- Life Sciences & Earth Sciences (AREA)
- Health & Medical Sciences (AREA)
- Image Analysis (AREA)
Abstract
The invention discloses a method and a system for detecting a cloud platform hidden channel based on a convolutional neural network, which comprises a cloud platform flow sample acquisition step, a sample preprocessing step, a deep learning model construction step, a feature set selection step, a detection evaluation step and a visualization step.
Description
Technical Field
The invention relates to the technical field of software development and network and information security, in particular to a cloud platform hidden channel detection method and system based on a convolutional neural network.
Background
In recent years, the market scale of cloud computing is in a explosive growth trend, and the application of a cloud platform in daily life of people is more and more extensive. However, in a cloud computing environment, security threats are still rampant because networks of different data information owners are not physically separated in a practical sense. The storage type hidden channel is one of the hazards faced by the cloud platform.
Covert channel refers to the transmission of information in a confidential manner over a communication channel that is not used for communication and that violates a security policy. Covert channels are of a wide variety, and storage-type covert channels are not only used by hackers to transmit and reveal information, but also by trusted parties to share keys. In addition, the method is also used for bypassing network authentication, is a technical means violating the network system security, and hackers use the technical means to carry out diffusion attack and information leakage, thereby causing great threats to the cloud platform security.
Based on this, a feasible, novel and more reliable cloud platform covert channel detection system is needed.
Disclosure of Invention
In order to solve the problems, the invention provides a method and a system for detecting the hidden channel of the cloud platform based on the convolutional neural network, which have the capability of quickly and accurately identifying the hidden channel of the cloud platform.
The technical scheme adopted by the invention is as follows: the cloud platform hidden channel detection method based on the convolutional neural network comprises the following steps:
obtaining cloud platform traffic samples, including: acquiring a network traffic sample containing normal network traffic of a cloud platform and network traffic of a hidden channel of the cloud platform, and constructing a black-white mixed data set;
preprocessing the cloud platform traffic sample, including: carrying out format conversion on the cloud platform flow sample by using a script file, converting the cloud platform flow sample into a metadata file with a readable model, carrying out digital operation on non-digital characteristics in the cloud platform flow sample to convert the non-digital characteristics into digital characteristics, carrying out normalization processing on all the digital characteristics, and converting all the digital characteristics into a binary expression form;
constructing a deep learning model, comprising: selecting a convolutional neural network model as a learning model, initializing a hyper-parameter, and performing learning training and prediction on the black-white mixed data set;
selecting a feature set comprising: under the guidance of the deep learning model, selecting a feature from a feature set of original network flow and bringing the feature into the selected feature set;
detection and evaluation, comprising: training through the deep learning model based on the feature set to generate a candidate cloud platform hidden channel flow detector, testing the candidate cloud platform hidden channel flow detector by using the cloud platform network flow sample, and acquiring an evaluation index;
and forming a detection report according to the evaluation index and the additional information.
In a further aspect of the present invention,
the convolutional neural network model comprises a 2D convolutional layer, a pooling layer, a Dropout layer and a full-connection layer which are sequentially connected;
the 2D convolutional layer comprises 3 layers of 2D convolutional layers which are connected in sequence;
the output of the 3-layer 2D convolutional layer is connected with a pooling layer, and the pooling layer completes maximum pooling on non-overlapping subregions through a maximum filter;
the output of the pooling layer is connected with a Dropout layer, the Dropout layer is used for preventing overfitting, the probability of keep _ prob is set to be 0.75 to reserve input vectors, the Dropout layer does not contain trainable and updated parameters in the process of model training, and the dimension number of the residual dimension non-zero vectors is scaled according to the reciprocal proportion of keep _ prob;
the keep _ prob represents the proportion of the retention result to the total result, when keep _ prob =1, 100% retention result, i.e. Dropout, is not effective;
the Dropout layer output is connected with a fully-connected layer, each neuron in the fully-connected layer receives the output from the previous network layer, the convolutional neural network model changes the data dimension by using the fully-connected layer, the fully-connected layer changes a calculation original matrix of the dimension by using matrix multiplication, and all parameters in the calculation original matrix are updated in real time as trainable parameters along with the increase of the network training iteration number.
Further, in the above-mentioned case,
selecting one characteristic from the characteristic set of the original network flow as a standard for measuring the normal network flow of the platform and the network flow of the hidden channel of the cloud platform, wherein the characteristic comprises the following steps: the number of responses, the DNS request length, the data packet sender length, the data packet response length, the coded DNS query name length, the special character ratio and the information entropy provided in the traffic response are obtained to be used for measuring the normal network traffic of the platform and the hidden channel network traffic of the cloud platform.
Further, in the above-mentioned case,
the evaluation indexes comprise Accuracy (Accuracy), Precision (Precision), Recall (Recall), comprehensive classification F1 score (F1-score) and a characteristic curve ROC curve of the operation of the testees;
wherein, the accuracy rate represents the ratio of the number of samples of the detected pair, the higher the accuracy rate is, the better the detection model is, and the expression is:
the method comprises the following steps that TP represents the number of positive samples of a model predicted to be a positive class, TN represents the number of negative samples of the model predicted to be a negative class, FP represents the number of negative samples of the model predicted to be the positive class, and FN represents the number of positive samples of the model predicted to be the negative class;
the accuracy rate represents the proportion of the normal flow sample divided into the normal flow samples, and the expression is as follows:
the recall ratio represents the proportion of the number of the samples classified as normal flow in the total number of the normal samples, the larger the numerical value is, the higher the detection rate is, and the expression is as follows:
the comprehensive classification rate represents the comprehensive measurement of accuracy and detection rate, the higher the F1 value is, the better the model is, and the expression is as follows:
the ROC curve is used for further evaluating the performance of the detection model, the ROC curve focuses on two indexes of Recall and FPR, the FPR represents the probability of misclassifying a negative case into a positive case, and the FPR expression is as follows:
in the ROC curve, the abscissa of each point is FPR and the ordinate is Recall.
Further, in the above-mentioned case,
the additional information includes time and session information.
Further, in the above-mentioned case,
the forming of the detection report according to the evaluation index and the additional information includes: the method comprises the steps of obtaining a detection result of a hidden channel of the cloud platform, obtaining relevant information of a data packet according to the detection result, and forming a detection report according to the relevant information of the data packet.
In a further aspect of the present invention,
the related information of the data packet comprises: IP address, port number, packet length, and packet transmission time.
Further, in the above-mentioned case,
the types of the cloud platform hidden channel network traffic sample comprise DNS2TCP, DNSCAPY, DNSCAT2, IODINE and OZYMAN.
According to the method for detecting the cloud platform hidden channel based on the convolutional neural network, the invention also claims to protect a cloud platform hidden channel detection system based on the convolutional neural network, which comprises the following steps:
the cloud platform traffic sample acquisition module is used for acquiring a network traffic sample containing the normal network traffic of the cloud platform and the network traffic of the cloud platform hidden channel and constructing a black and white mixed data set;
the data preprocessing module is used for performing format conversion on the cloud platform flow sample by using a script file, converting the cloud platform flow sample into a metadata file with a readable model, performing digital operation on non-digital features in the cloud platform flow sample to convert the non-digital features into digital features, performing normalization processing on all the digital features, and converting all the digital features into a binary expression form;
the deep learning model construction module is used for selecting a convolutional neural network model as a learning model, initializing a hyper-parameter, and performing learning training and prediction on the black and white mixed data set;
the characteristic set selection module is used for selecting one characteristic from the characteristic set of the original network flow under the guidance of the deep learning model and bringing the characteristic into the selected characteristic set;
the detection evaluation module is used for training through the deep learning model based on the feature set to generate a candidate cloud platform hidden channel flow detector, testing the candidate cloud platform hidden channel flow detector by using the cloud platform network flow sample and acquiring an evaluation index;
and the visualization module is used for forming a detection report according to the evaluation index and the additional information.
The invention has the beneficial effects that:
the method adopts a convolutional neural network algorithm in deep learning, selects high-discrimination flow characteristics from a cloud platform original flow characteristic set through a deep learning model, uses the selected characteristics in cloud platform hidden channel flow detector training based on a deep learning method, and finally realizes high-precision and high-response detection on the cloud platform hidden channel flow.
The invention constructs a cloud platform hidden channel detection system, and improves the detection accuracy of the cloud platform hidden channel. By means of feature set selection, feature set vectors are constructed from multiple angles such as domain name length, special character proportion, information entropy and the like, the depth and the breadth of detection of the cloud platform covert channel are increased, and the accuracy of detection of the cloud platform covert channel is improved. Compared with other cloud platform hidden channel flow detection systems, the method is easier to realize and does not need to manually select flow characteristics; according to the abnormal network traffic detector generation method based on deep learning, for different traffic data sets and different initial traffic characteristics, high-discrimination traffic characteristics can be automatically and effectively selected, and finally a high-performance cloud platform hidden channel traffic detector is generated; the generated detector is light enough, has the capability of quickly and accurately identifying the hidden channel traffic of the cloud platform, and has high accuracy and F1 score.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on the drawings without creative efforts.
FIG. 1 is a cloud platform covert channel detection system based on a convolutional neural network;
FIG. 2 is a process diagram for obtaining cloud platform covert channel traffic;
FIG. 3 is a basic flow diagram of data pre-processing;
FIG. 4 is a graph of feature set generation during convolutional neural network training;
FIG. 5 is a network hierarchy diagram employed by a convolutional neural network;
fig. 6 is an evaluation index matrix diagram of the convolutional neural network model.
Detailed Description
First, it is stated that the term "and/or" appearing herein is merely one type of associative relationship that describes an associated object, meaning that three types of relationships may exist, e.g., a and/or B may mean: a exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" herein generally indicates that the former and latter related objects are in an "or" relationship.
In order to make the method of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described and reproduced below with reference to fig. 1 to 6 in the embodiments of the present invention.
Example one
As a most basic implementation scheme of the present invention, the method for detecting a cloud platform hidden channel based on a convolutional neural network provided in this embodiment includes a cloud platform flow sample acquisition step, a sample preprocessing step, a deep learning model construction step, a feature set selection step, a detection evaluation step, and a visualization step, and a deep learning algorithm is adopted to select a high-resolution flow feature from a cloud platform original flow feature set through a deep learning model, and the selected feature is used for training a cloud platform hidden channel flow detector based on a deep learning method, so as to finally realize high-precision and high-response detection on the cloud platform hidden channel flow.
The method comprises the following specific steps:
s1: obtaining cloud platform traffic samples, including: and acquiring a network traffic sample containing the normal network traffic of the cloud platform and the network traffic of the hidden channel of the cloud platform, and constructing a black and white mixed data set.
The types of the cloud platform hidden channel network traffic sample include DNS2TCP, DNSCAPY, DNSCAT2, IODINE, OZYMAN, and the like.
S2: preprocessing the cloud platform flow sample, including: performing format conversion on the cloud platform flow sample by using a script file, converting the cloud platform flow sample into a metadata file which can be read by a model, performing digital operation on non-digital characteristics in the cloud platform flow sample to convert the non-digital characteristics into digital characteristics, performing normalization processing on all the digital characteristics, and converting all the digital characteristics into a binary expression form;
s3: constructing a deep learning model, comprising: selecting a convolutional neural network model as a learning model, initializing a hyper-parameter, and performing learning training and prediction on the black-white mixed data set;
the convolutional neural network model comprises a 2D convolutional layer, a pooling layer, a Dropout layer and a full-connection layer which are sequentially connected;
the 2D convolutional layer comprises 3 layers of 2D convolutional layers which are connected in sequence;
the output of the 3-layer 2D convolutional layer is connected with a pooling layer, and the pooling layer completes maximum pooling on non-overlapping subregions through a maximum filter;
the output of the pooling layer is connected with a Dropot layer, the Dropot layer sets the dimension of the input vector to be 0.75 according to the probability of keep _ prob, the Dropot layer does not contain trainable and updated parameters in the model training process, and the dimension number of the residual dimension non-zero vectors is scaled according to the inverse proportion of keep _ prob;
the Dropout layer output is connected with a fully-connected layer, each neuron in the fully-connected layer receives the output from the previous network layer, the convolutional neural network model uses the fully-connected layer to change the data dimension, the fully-connected layer uses matrix multiplication to change a calculation original matrix of the dimension, and all parameters in the calculation original matrix are updated in real time as trainable parameters as the number of network training iterations increases.
S4: selecting a feature set comprising: under the guidance of the deep learning model, one feature is selected from the feature set of the original network flow and is included in the selected feature set.
Specifically, one feature is selected from the feature set of the original network traffic as a standard for measuring the normal network traffic of the platform and the network traffic of the hidden channel of the cloud platform, and the features include: the number of responses, the DNS request length, the data packet sender length, the data packet response length, the coded DNS query name length, the special character ratio and the information entropy provided in the traffic response are obtained to be used for measuring the normal network traffic of the platform and the hidden channel network traffic of the cloud platform.
S5: detection and evaluation, comprising: training through the deep learning model based on the feature set to generate a candidate cloud platform hidden channel flow detector, testing the candidate cloud platform hidden channel flow detector by using the cloud platform network flow sample, and acquiring an evaluation index;
specifically, the evaluation indexes comprise Accuracy (Accuracy), Precision (Precision), Recall (Recall), comprehensive classification rate F1 score (F1-score) and a characteristic curve ROC curve of the operation of the testee;
wherein, the accuracy rate represents the ratio of the number of samples of the detected pair, the higher the accuracy rate is, the better the detection model is, and the expression is:
the accuracy rate represents the proportion of the normal flow sample divided into the normal flow samples, and the expression is as follows:
the recall rate represents the proportion of the number of samples classified as normal flow in the total number of normal samples, the larger the numerical value is, the higher the detection rate is, and the expression is as follows:
the comprehensive classification rate represents the comprehensive measurement of accuracy and detection rate, the higher the F1 value is, the better the model is, and the expression is as follows:
the ROC curve is used for further evaluating the performance of the detection model, the ROC curve focuses on two indexes of Recall and FPR, the FPR represents the probability of misclassifying a negative case into a positive case, and the FPR expression is as follows:
in the ROC curve, the abscissa of each point is FPR and the ordinate is Recall.
S6 forms a detection report based on the evaluation index and the additional information.
The additional information includes time and session information.
The specific steps of forming the detection report comprise: the method comprises the steps of obtaining a detection result of a hidden channel of the cloud platform, obtaining relevant information of a data packet according to the detection result, and forming a detection report according to the relevant information of the data packet.
The related information of the data packet includes: IP address, port number, packet length, and packet transmission time.
Example two
Based on the method for detecting a hidden channel of a cloud platform based on a convolutional neural network in the first embodiment, the embodiment further provides a system for detecting a hidden channel of a cloud platform based on a convolutional neural network, which includes:
the cloud platform flow sample acquisition module is used for acquiring a network flow sample containing the normal network flow of the cloud platform and the network flow of the cloud platform hidden channel and constructing a black-white mixed data set;
the data preprocessing module is used for performing format conversion on the cloud platform flow sample by using a script file, converting the cloud platform flow sample into a metadata file with a readable model, performing digital operation on non-digital features in the cloud platform flow sample to convert the non-digital features into digital features, performing normalization processing on all the digital features, and converting all the digital features into a binary expression form;
the deep learning model construction module is used for selecting a convolutional neural network model as a learning model, initializing a hyper-parameter and carrying out learning training and prediction on the black-white mixed data set;
the characteristic set selection module is used for selecting one characteristic from the characteristic set of the original network flow under the guidance of the deep learning model and incorporating the selected characteristic set;
the detection evaluation module is used for training through the deep learning model based on the feature set to generate a candidate cloud platform hidden channel flow detector, testing the candidate cloud platform hidden channel flow detector by using the cloud platform network flow sample and acquiring an evaluation index;
and the visualization module is used for forming a detection report according to the evaluation index and the additional information.
The convolutional neural network model comprises a 2D convolutional layer, a pooling layer, a Dropout layer and a full-connection layer which are sequentially connected;
the 2D convolutional layers comprise 3 layers of 2D convolutional layers which are connected in sequence;
the output of the 3 layers of 2D convolutional layers is connected with a pooling layer, and the pooling layer completes maximal pooling on non-overlapping subregions through a maximal filter;
the output of the pooling layer is connected with a Dropot layer, the Dropot layer sets the dimension of the input vector to be 0.75 according to the probability of keep _ prob, the Dropot layer does not contain trainable and updated parameters in the model training process, and the dimension number of the residual dimension non-zero vectors is scaled according to the inverse proportion of keep _ prob;
the Dropout layer output is connected with a fully-connected layer, each neuron in the fully-connected layer receives the output from the previous network layer, the convolutional neural network model changes the data dimension by using the fully-connected layer, the fully-connected layer changes a calculation original matrix of the dimension by using matrix multiplication, and all parameters in the calculation original matrix are updated in real time as trainable parameters along with the increase of the network training iteration number.
According to the method and the system for detecting the cloud platform hidden channel based on the convolutional neural network, for different flow data sets and different initial flow characteristics, the flow characteristics with high discrimination can be automatically and effectively selected, and finally a high-performance cloud platform hidden channel flow detector is generated; the generated detector is light enough, has the capability of quickly and accurately identifying the flow of the hidden channel of the cloud platform, and has lower false alarm rate and false alarm rate.
Other embodiments of the invention will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention following, in general, the principles of the invention and including such departures from the present disclosure as come within known or customary practice within the art to which the invention pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the invention being indicated by the following claims.
It will be understood that the invention is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the invention is limited only by the appended claims.
The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents, improvements and the like that fall within the spirit and principle of the present invention are intended to be included therein.
Claims (10)
1. A cloud platform hidden channel detection method based on a convolutional neural network is characterized by comprising the following steps:
obtaining cloud platform traffic samples, including: acquiring a network traffic sample containing normal network traffic of a cloud platform and network traffic of a hidden channel of the cloud platform, and constructing a black-white mixed data set;
preprocessing the cloud platform traffic sample, including: carrying out format conversion on the cloud platform flow sample by using a script file, converting the cloud platform flow sample into a metadata file with a readable model, carrying out digital operation on non-digital characteristics in the cloud platform flow sample to convert the non-digital characteristics into digital characteristics, carrying out normalization processing on all the digital characteristics, and converting all the digital characteristics into a binary expression form;
constructing a deep learning model, comprising: selecting a convolutional neural network model as a learning model, initializing a hyper-parameter, and performing learning training and prediction on the black-white mixed data set;
selecting a feature set comprising: under the guidance of the deep learning model, selecting a feature from a feature set of original network flow and bringing the feature into the selected feature set;
detection and evaluation, comprising: training through the deep learning model based on the feature set to generate a candidate cloud platform hidden channel flow detector, testing the candidate cloud platform hidden channel flow detector by using the cloud platform network flow sample, and acquiring an evaluation index;
and forming a detection report according to the evaluation index and the additional information.
2. The convolutional neural network-based cloud platform hidden channel detection method of claim 1, characterized in that:
the convolutional neural network model comprises a 2D convolutional layer, a pooling layer, a Dropout layer and a full-connection layer which are sequentially connected;
the 2D convolutional layer comprises 3 layers of 2D convolutional layers which are connected in sequence;
the output of the 3-layer 2D convolutional layer is connected with a pooling layer, and the pooling layer completes maximum pooling on non-overlapping subregions through a maximum filter;
the output of the pooling layer is connected with a Dropout layer, the Dropout layer sets the dimension of an input vector to be 0.75 according to the probability of keep _ prob, the Dropout layer does not contain trainable and updated parameters in the model training process, and the dimension number of the residual dimension non-zero vector is scaled according to the inverse proportion of keep _ prob;
the Dropout layer output is connected with a fully-connected layer, each neuron in the fully-connected layer receives the output from the previous network layer, the convolutional neural network model uses the fully-connected layer to change the data dimension, the fully-connected layer uses matrix multiplication to change a calculation original matrix of the dimension, and all parameters in the calculation original matrix are updated in real time as trainable parameters as the number of network training iterations increases.
3. The convolutional neural network-based cloud platform hidden channel detection method of claim 1, characterized in that:
selecting one characteristic from the characteristic set of the original network flow as a standard for measuring the normal network flow of the platform and the network flow of the hidden channel of the cloud platform, wherein the characteristic comprises the following steps: the number of responses, the DNS request length, the data packet sender length, the data packet response length, the coded DNS query name length, the special character ratio and the information entropy provided in the traffic response are obtained to be used for measuring the normal network traffic of the platform and the hidden channel network traffic of the cloud platform.
4. The convolutional neural network-based cloud platform hidden channel detection method of claim 1, characterized in that:
the evaluation indexes comprise Accuracy, Precision, Recall, comprehensive classification rate F1 score F1-score and a receiver operating characteristic curve ROC curve;
wherein, the accuracy rate represents the ratio of the number of samples of the detected pair, the higher the accuracy rate is, the better the detection model is, and the expression is:
the method comprises the following steps that TP represents the number of positive samples of a model predicted to be a positive class, TN represents the number of negative samples of the model predicted to be a negative class, FP represents the number of negative samples of the model predicted to be the positive class, and FN represents the number of positive samples of the model predicted to be the negative class;
the accuracy rate represents the proportion of the normal flow sample divided into the normal flow samples, and the expression is as follows:
the recall ratio represents the proportion of the number of the samples classified as normal flow in the total number of the normal samples, the larger the numerical value is, the higher the detection rate is, and the expression is as follows:
the comprehensive classification rate represents the comprehensive measurement of the accuracy and the detection rate, the higher the F1 value is, the better the model is, and the expression is as follows:
the ROC curve is used for further evaluating the performance of the detection model, the ROC curve focuses on two indexes of Recall and FPR, the FPR represents the probability of misclassifying a negative case into a positive case, and the FPR expression is as follows:
in the ROC curve, the abscissa of each point is FPR and the ordinate is Recall.
5. The convolutional neural network-based cloud platform hidden channel detection method of claim 1, characterized in that:
the additional information includes time and session information.
6. The method for detecting the hidden channel of the cloud platform based on the convolutional neural network as claimed in claim 1, characterized in that:
the forming of the detection report according to the evaluation index and the additional information includes: the method comprises the steps of obtaining a detection result of a hidden channel of the cloud platform, obtaining relevant information of a data packet according to the detection result, and forming a detection report according to the relevant information of the data packet.
7. The convolutional neural network-based cloud platform hidden channel detection method of claim 6, wherein:
the related information of the data packet comprises: IP address, port number, packet length, and packet transmission time.
8. The convolutional neural network-based cloud platform hidden channel detection method of claim 1, characterized in that:
the types of the cloud platform hidden channel network traffic sample comprise DNS2TCP, DNSCAPY, DNSCAT2, IODINE and OZYMAN.
9. Cloud platform hidden channel detection system based on convolutional neural network, its characterized in that includes:
the cloud platform flow sample acquisition module is used for acquiring a network flow sample containing the normal network flow of the cloud platform and the network flow of the cloud platform hidden channel and constructing a black-white mixed data set;
the data preprocessing module is used for performing format conversion on the cloud platform flow sample by using a script file, converting the cloud platform flow sample into a metadata file with a readable model, performing digital operation on non-digital features in the cloud platform flow sample to convert the non-digital features into digital features, performing normalization processing on all the digital features, and converting all the digital features into a binary expression form;
the deep learning model construction module is used for selecting a convolutional neural network model as a learning model, initializing a hyper-parameter and carrying out learning training and prediction on the black-white mixed data set;
the characteristic set selection module is used for selecting one characteristic from the characteristic set of the original network flow under the guidance of the deep learning model and bringing the characteristic into the selected characteristic set;
the detection evaluation module is used for training through the deep learning model based on the feature set to generate a candidate cloud platform hidden channel flow detector, testing the candidate cloud platform hidden channel flow detector by using the cloud platform network flow sample and acquiring an evaluation index;
and the visualization module is used for forming a detection report according to the evaluation index and the additional information.
10. The convolutional neural network based cloud platform covert channel detection system of claim 9,
the convolutional neural network model comprises a 2D convolutional layer, a pooling layer, a Dropout layer and a full-connection layer which are sequentially connected;
the 2D convolutional layers comprise 3 layers of 2D convolutional layers which are connected in sequence;
the output of the 3-layer 2D convolutional layer is connected with a pooling layer, and the pooling layer completes maximum pooling on non-overlapping subregions through a maximum filter;
the output of the pooling layer is connected with a Dropout layer, the Dropout layer is used for preventing overfitting, the probability of keep _ prob is set to be 0.75 to reserve input vectors, the Dropout layer does not contain trainable and updated parameters in the process of model training, and the dimension number of the residual dimension non-zero vectors is scaled according to the reciprocal proportion of keep _ prob;
the keep _ prob represents the proportion of the retention result to the total result, when keep _ prob =1, 100% retention result, i.e. Dropout, is not effective;
the Dropout layer output is connected with a fully-connected layer, each neuron in the fully-connected layer receives the output from the previous network layer, the convolutional neural network model uses the fully-connected layer to change the data dimension, the fully-connected layer uses matrix multiplication to change a calculation original matrix of the dimension, and all parameters in the calculation original matrix are updated in real time as trainable parameters as the number of network training iterations increases.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211036936.0A CN115134168A (en) | 2022-08-29 | 2022-08-29 | Method and system for detecting cloud platform hidden channel based on convolutional neural network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211036936.0A CN115134168A (en) | 2022-08-29 | 2022-08-29 | Method and system for detecting cloud platform hidden channel based on convolutional neural network |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115134168A true CN115134168A (en) | 2022-09-30 |
Family
ID=83387812
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211036936.0A Pending CN115134168A (en) | 2022-08-29 | 2022-08-29 | Method and system for detecting cloud platform hidden channel based on convolutional neural network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115134168A (en) |
Citations (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108985361A (en) * | 2018-07-02 | 2018-12-11 | 北京金睛云华科技有限公司 | A kind of malicious traffic stream detection implementation method and device based on deep learning |
| CN110149418A (en) * | 2018-12-12 | 2019-08-20 | 国网信息通信产业集团有限公司 | A kind of hidden tunnel detection method of DNS based on deep learning |
| CN110602100A (en) * | 2019-09-16 | 2019-12-20 | 上海斗象信息科技有限公司 | DNS tunnel flow detection method |
| CN110875912A (en) * | 2018-09-03 | 2020-03-10 | 中移（杭州）信息技术有限公司 | Network intrusion detection method, device and storage medium based on deep learning |
| WO2020119481A1 (en) * | 2018-12-11 | 2020-06-18 | 深圳先进技术研究院 | Network traffic classification method and system based on deep learning, and electronic device |
| CN112235309A (en) * | 2020-10-19 | 2021-01-15 | 四川师范大学 | Multi-scale detection system for hidden channel of cloud platform network |
| CN112615713A (en) * | 2020-12-22 | 2021-04-06 | 东软集团股份有限公司 | Detection method and device of hidden channel, readable storage medium and electronic equipment |
| CN112836214A (en) * | 2019-11-22 | 2021-05-25 | 南京聚铭网络科技有限公司 | Communication protocol hidden channel detection method |
| CN112953924A (en) * | 2021-02-04 | 2021-06-11 | 西安电子科技大学 | Network abnormal flow detection method, system, storage medium, terminal and application |
| CN113328986A (en) * | 2021-04-09 | 2021-08-31 | 国网浙江省电力有限公司金华供电公司 | Network flow abnormity detection method based on combination of convolutional neural network and LSTM |
| CN113420294A (en) * | 2021-06-25 | 2021-09-21 | 杭州电子科技大学 | Malicious code detection method based on multi-scale convolutional neural network |
| WO2021238019A1 (en) * | 2020-05-29 | 2021-12-02 | 苏州大学 | Real-time traffic flow detection system and method based on ghost convolutional feature fusion neural network |
| CN114374541A (en) * | 2021-12-16 | 2022-04-19 | 四川大学 | Abnormal network flow detector generation method based on reinforcement learning |
| CN114553722A (en) * | 2022-01-12 | 2022-05-27 | 西安电子科技大学 | VPN and non-VPN network flow classification method based on multi-view one-dimensional convolution neural network |
| CN114567487A (en) * | 2022-03-03 | 2022-05-31 | 北京亚鸿世纪科技发展有限公司 | DNS hidden tunnel detection method with multi-feature fusion |
| CN114615010A (en) * | 2022-01-19 | 2022-06-10 | 上海电力大学 | Design method of edge server-side intrusion prevention system based on deep learning |
-
2022
- 2022-08-29 CN CN202211036936.0A patent/CN115134168A/en active Pending
Patent Citations (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108985361A (en) * | 2018-07-02 | 2018-12-11 | 北京金睛云华科技有限公司 | A kind of malicious traffic stream detection implementation method and device based on deep learning |
| CN110875912A (en) * | 2018-09-03 | 2020-03-10 | 中移（杭州）信息技术有限公司 | Network intrusion detection method, device and storage medium based on deep learning |
| WO2020119481A1 (en) * | 2018-12-11 | 2020-06-18 | 深圳先进技术研究院 | Network traffic classification method and system based on deep learning, and electronic device |
| CN110149418A (en) * | 2018-12-12 | 2019-08-20 | 国网信息通信产业集团有限公司 | A kind of hidden tunnel detection method of DNS based on deep learning |
| CN110602100A (en) * | 2019-09-16 | 2019-12-20 | 上海斗象信息科技有限公司 | DNS tunnel flow detection method |
| CN112836214A (en) * | 2019-11-22 | 2021-05-25 | 南京聚铭网络科技有限公司 | Communication protocol hidden channel detection method |
| WO2021238019A1 (en) * | 2020-05-29 | 2021-12-02 | 苏州大学 | Real-time traffic flow detection system and method based on ghost convolutional feature fusion neural network |
| CN112235309A (en) * | 2020-10-19 | 2021-01-15 | 四川师范大学 | Multi-scale detection system for hidden channel of cloud platform network |
| CN112615713A (en) * | 2020-12-22 | 2021-04-06 | 东软集团股份有限公司 | Detection method and device of hidden channel, readable storage medium and electronic equipment |
| CN112953924A (en) * | 2021-02-04 | 2021-06-11 | 西安电子科技大学 | Network abnormal flow detection method, system, storage medium, terminal and application |
| CN113328986A (en) * | 2021-04-09 | 2021-08-31 | 国网浙江省电力有限公司金华供电公司 | Network flow abnormity detection method based on combination of convolutional neural network and LSTM |
| CN113420294A (en) * | 2021-06-25 | 2021-09-21 | 杭州电子科技大学 | Malicious code detection method based on multi-scale convolutional neural network |
| CN114374541A (en) * | 2021-12-16 | 2022-04-19 | 四川大学 | Abnormal network flow detector generation method based on reinforcement learning |
| CN114553722A (en) * | 2022-01-12 | 2022-05-27 | 西安电子科技大学 | VPN and non-VPN network flow classification method based on multi-view one-dimensional convolution neural network |
| CN114615010A (en) * | 2022-01-19 | 2022-06-10 | 上海电力大学 | Design method of edge server-side intrusion prevention system based on deep learning |
| CN114567487A (en) * | 2022-03-03 | 2022-05-31 | 北京亚鸿世纪科技发展有限公司 | DNS hidden tunnel detection method with multi-feature fusion |
Non-Patent Citations (12)
| Title |
|---|
| 张猛;孙昊良;杨鹏;: "基于改进卷积神经网络识别DNS隐蔽信道", 通信学报, vol. 1, no. 01, pages 185 - 186 * |
| 王勇等: "基于深度卷积神经网络的网络流量分类方法", 《通信学报》 * |
| 王勇等: "基于深度卷积神经网络的网络流量分类方法", 《通信学报》, no. 01, 25 January 2018 (2018-01-25) * |
| 章思宇;邹福泰;王鲁华;陈铭;: "基于DNS的隐蔽通道流量检测", 通信学报, no. 05 * |
| 胡向东等: "基于深度学习的工业物联网智能入侵检测", 《计算机系统应用》 * |
| 胡向东等: "基于深度学习的工业物联网智能入侵检测", 《计算机系统应用》, no. 09, 15 September 2020 (2020-09-15) * |
| 连鸿飞等: "一种数据增强与混合神经网络的异常流量检测", 《小型微型计算机系统》 * |
| 连鸿飞等: "一种数据增强与混合神经网络的异常流量检测", 《小型微型计算机系统》, no. 04, 9 April 2020 (2020-04-09) * |
| 郭益民等: "基于卷积神经网络的Android流量分类方法", 《通信技术》 * |
| 郭益民等: "基于卷积神经网络的Android流量分类方法", 《通信技术》, no. 02, 10 February 2020 (2020-02-10) * |
| 陈广等: "基于深度学习的加密流量分类与入侵检测", 《计算机测量与控制》 * |
| 陈广等: "基于深度学习的加密流量分类与入侵检测", 《计算机测量与控制》, no. 01, 25 January 2020 (2020-01-25) * |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109543674B (en) | Image copy detection method based on generation countermeasure network | |
| CN113032525A (en) | False news detection method and device, electronic equipment and storage medium | |
| Kaiser et al. | Attack hypotheses generation based on threat intelligence knowledge graph | |
| CN114422211B (en) | HTTP malicious traffic detection method and device based on graph attention network | |
| CN116843400A (en) | Block chain carbon emission transaction anomaly detection method and device based on graph representation learning | |
| Puri et al. | Application of ensemble Machine Learning models for phishing detection on web networks | |
| CN116842467A (en) | Network flow anomaly detection and classification method based on bidirectional gating convolutional neural network | |
| Bershad | Resolution, optical-channel capacity and information theory | |
| Alsufyani et al. | Social engineering attack detection using machine learning: Text phishing attack | |
| de Riberolles et al. | Anomaly detection for ICS based on deep learning: a use case for aeronautical radar data | |
| Li et al. | Multi-View Feature Fusion for Ransomware Detection in Executable Files: Dynamic, Static, and Image Features | |
| CN115134168A (en) | Method and system for detecting cloud platform hidden channel based on convolutional neural network | |
| CN113360694B (en) | Malicious image query sample detection and filtering method based on self-encoder | |
| CN114328174A (en) | Multi-view software defect prediction method and system based on counterstudy | |
| Liao et al. | GE-IDS: an intrusion detection system based on grayscale and entropy | |
| Sivanantham et al. | Web Hazard Identification and Detection Using Deep Learning-A Comparative Study | |
| CN114553497B (en) | Internal threat detection method based on feature fusion | |
| Sinthiya et al. | Incorporating Machine Learning Algorithms to Detect Phishing Websites | |
| Duan et al. | Automatic Modulation Recognition Based on Hybrid Neural Network | |
| CN112766312B (en) | User information acquisition method, electronic equipment and medium | |
| CN117131503B (en) | Threat chain identification method for user behavior | |
| CN114169390B (en) | Network anomaly detection method integrating GBDT and neural network | |
| CN117749448B (en) | Intelligent early warning method and device for network potential risk | |
| Long | Understanding and mitigating privacy risk in machine learning systems | |
| Arora et al. | Mischievous URL Prediction Through Supervised Machine Learning Algorithms |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20220930 |
|
| RJ01 | Rejection of invention patent application after publication |