WO2022021897A1 - 一种报文检测方法、设备及可读存储介质 - Google Patents

一种报文检测方法、设备及可读存储介质 Download PDF

Info

Publication number
WO2022021897A1
WO2022021897A1 PCT/CN2021/081440 CN2021081440W WO2022021897A1 WO 2022021897 A1 WO2022021897 A1 WO 2022021897A1 CN 2021081440 W CN2021081440 W CN 2021081440W WO 2022021897 A1 WO2022021897 A1 WO 2022021897A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
value pair
target key
detection
parameter
Prior art date
Application number
PCT/CN2021/081440
Other languages
English (en)
French (fr)
Inventor
杨荣海
徐铭桂
Original Assignee
深信服科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深信服科技股份有限公司 filed Critical 深信服科技股份有限公司
Publication of WO2022021897A1 publication Critical patent/WO2022021897A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection

Definitions

  • the present invention relates to the technical field of network security, and in particular, to a message detection method, device and readable storage medium.
  • a self-learning mechanism is used to improve the accuracy of packet detection.
  • This scheme first learns the format of each parameter in the message. In the detection phase, if the actual value of the parameter is found to be inconsistent with the learned pattern, the abnormal parameter is considered to be attacked. This method greatly improves the detection rate of attacks, but needs to learn each parameter in the message. Obviously, the learning cost of the current self-learning mechanism is high.
  • the purpose of the present invention is to provide a message detection method, device and readable storage medium, which can reduce the learning cost of the current self-learning mechanism to a certain extent.
  • the present invention provides the following technical solutions:
  • a packet detection method comprising:
  • the target key-value pair is sent to the suspicious detection module, and a detection result of the suspicious detection module is obtained, and the detection result is used to indicate whether the target key-value pair is suspicious;
  • the detection result indicates that the target key-value pair is suspicious, obtain each sample message containing the target parameter to train the learning model, and pre-train the trained learning model and the target parameter corresponding to the learning model storage, so as to perform anomaly detection on the target key-value pair in the subsequently acquired message based on the learning model after training.
  • the packet detection method further includes:
  • Anomaly detection is performed on the target key-value pair in the target message by using the current untrained learning model to obtain anomaly detection results.
  • the method further includes:
  • the data corresponding to the target key-value pair in the target key-value pair is generalized to obtain a generalized representation of the target key-value pair, and the data corresponding to the target key-value pair is generalized.
  • the generalized representation and the corresponding target parameters are pre-stored, so as to perform anomaly detection on the target key-value pair in the subsequently acquired message based on the pre-stored generalized representation.
  • the packet detection method further includes:
  • the packet detection method further includes:
  • the state in which the target parameter is set and stored is the second state.
  • the method further includes:
  • the method further includes:
  • the step of sending the target key-value pair to the suspicious detection module to obtain the detection result of the suspicious detection module and subsequent steps are returned to.
  • the method further includes:
  • the target key-value pair is input to the threat detection module for threat detection, and a threat detection result is obtained, wherein the threat detection result is used to indicate the Whether the target key-value pair constitutes threat data.
  • the packet detection method further includes;
  • the detection result of the learned model after statistical training indicates abnormality, but the threat detection result indicates the number of times that the target key-value pair does not constitute threat data, so that the number of times the target key-value pair does not constitute threat data
  • the learning model corresponding to the target parameter is retrained.
  • the method further includes:
  • the preset rule includes a first type of rule and a second type of rule
  • the step of parsing the target packet to obtain the target key-value pair included in the target packet and subsequent steps are performed.
  • a packet detection device comprising:
  • the processor is configured to implement the steps of the above message detection method when executing the computer program.
  • a readable storage medium storing a computer program on the readable storage medium, when the computer program is executed by a processor, implements the steps of the above method for packet detection.
  • the target message is first parsed to obtain the target key-value pair included in the target message; then, it is detected whether the target parameter in the target key-value pair is hit by storage, If it is hit by storage, the target key-value pair can be transmitted to the suspicious detection module for suspicious detection, and a detection result indicating whether the target key-value pair is suspicious can be obtained (in the embodiment of this application, "suspicious” refers to the target
  • the key value has the possibility of containing abnormal information.
  • the suspicious detection module determines whether it is suspicious or not by the method of "setting a threshold”
  • the threshold used can be set relatively low to avoid missed detection.
  • the implementation process of the specific suspicious detection module can adopt existing technologies, such as semantic analysis or program analysis, etc. This application does not limit the implementation of the suspicious detection module) . If the detection result indicates that the target key-value pair is suspicious, each sample packet containing the target parameter is acquired to train the learning model. In this way, the trained learning model can perform anomaly detection on the target key-value pair in the subsequently acquired message. It can be seen that in the whole detection process, when learning, instead of learning each parameter, learn suspicious parameters. Whether it is a suspicious parameter is determined according to the suspicious detection module. Compared with learning every parameter in the prior art, the method only learns some parameters, and the method has the technical effect of reducing the number of parameters to be learned and the cost of training and learning.
  • the embodiments of the present invention further provide a message detection device and a readable storage medium corresponding to the foregoing message detection method, which have the foregoing technical effects, and are not repeated here.
  • Fig. 1 is the implementation flow chart of a kind of message detection method in the embodiment of the present invention
  • FIG. 2 is a schematic structural diagram of a message detection device in an embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of a packet detection device in an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a specific structure of a packet detection device in an embodiment of the present invention.
  • the packet detection method provided by the embodiment of the present invention can be applied to a computer device carrying products such as an application layer firewall (such as a WAF) and a security situation awareness.
  • an application layer firewall such as a WAF
  • Web Application Firewall is a product that provides protection for Web applications by implementing several security policies for protocols such as HTTP/HTTPS.
  • Web attacks attackers tamper with data, obtain sensitive information, and illegally operate websites by attacking Web application services.
  • Web attacks are not limited to: SQL injection, XSS cross-site scripting, CSRF cross-site request forgery, file uploading , file inclusion, framework security, PHP common vulnerabilities, code auditing, etc.
  • FIG. 1 is a flowchart of a packet detection method according to an embodiment of the present invention. The method includes the following steps:
  • the target key-value pair may specifically be an expression form of a key-value pair (key:value), wherein the key (key) may specifically be the parameter name, and the value (value) is the parameter value.
  • key may specifically be the parameter name
  • value is the parameter value.
  • the parameters in the URL can be parsed into: (product:computer) and (tid:1000) in the form of key-value pairs.
  • the target message may be a specific message corresponding to the transmission protocol.
  • the target message may be an HTTP message, HTTP (HyperText Transfer Protocol), that is, a hypertext transfer protocol.
  • HTTP HyperText Transfer Protocol
  • the target packet can be obtained by intercepting the traffic by means such as a firewall.
  • the target packet can be parsed by means of a transmission protocol.
  • a transmission protocol For example, for the HTTP message, the target message can be parsed into different parts, such as request method, URI, cookie, User-Agent, body, etc., according to the RFC standard and the processing method of the server. Then, perform decoding operations on each part, such as base64, unicode, etc., to restore the real content of the HTTP message. For each part, parse to get the target key-value pair.
  • the parameter information may be stored in the cache or other storage medium in advance.
  • hit in storage specifically refers to: the target parameter (parameter name) is stored and which method is used for the target parameter. to deal with (for example, which method is used to detect whether it is abnormal, or whether it is directly considered normal).
  • parameter state which method to use to detect abnormality can be indicated by "parameter state”.
  • the abnormality detection method corresponding to the second state for example, comparing with the generalized representation
  • the first state is used for the parameter URL.
  • a state-corresponding anomaly detection method eg, learning a model after training to detect whether it is anomalous.
  • a reference generalized representation of the parameter may also be stored.
  • the reference generalization representation may specifically be generalizing the representation of the value of the corresponding parameter name. For example, if the parameter value is a letter, the parameter value is correspondingly generalized to A; if the parameter value is a number, the parameter value is correspondingly generalized to N; if the parameter value corresponds to a special character, the parameter value is correspondingly generalized to S. It should be noted that there are various generalization methods, which are not limited to the listed generalization method. After generalizing the representation, the memory consumption can be reduced, and there is no need to store a large amount of reference data.
  • the parameter status may be determined according to the possibility that the parameter may carry abnormal information, and specifically in this application, the parameter status may be determined according to the suspicious detection module. For example, if the suspicious detection module determines that the target key-value pair is suspicious, so that when learning the target parameter corresponding to the target key-value pair, the parameter state of the target parameter can be set to the first state; if the suspicious detection module determines that the target key-value pair is If it is not suspicious, you can set the parameter state to the second state (meaning that the possibility of this parameter carrying abnormal information is small, you do not need to use a learning module to identify whether it is abnormal, you can use other methods, such as whether it is a generalized representation to determine whether it is abnormal or not. abnormal).
  • the parameter state of each parameter may also be manually set according to the technical accumulation of those skilled in the art. Whether there is information corresponding to the target key value in the target key value pair in the storage can be determined by means of retrieval. If the storage is not hit, it can be considered that it is impossible to identify whether the target key-value pair is abnormal.
  • the "storage" described in step S200 may specifically be a cache, or may be a readable storage medium such as a magnetic disk or a hard disk.
  • the suspicious detection module can perform suspicious detection on the target key-value pair to obtain a detection result indicating whether the target key-value pair is suspicious.
  • the implementation process of the specific suspicious detection module can adopt existing technologies, such as semantic analysis or program analysis, etc., and can also use HMM (Hidden Markov Model, Hidden Markov Model) or deep learning. That is, the specific detection method and structure of the suspicious detection module are not limited in this embodiment.
  • HMM Hidden Markov Model is a kind of Markov chain. Its state cannot be directly observed, but it can be observed through the sequence of observation vectors. Each observation vector is represented by some probability density distribution. Each observation vector is generated by a state sequence with a corresponding probability density distribution.
  • the target key-value pair can be used as the input of the suspicious detection module, and then the suspicious detection module performs suspicious detection on the target key-value pair, and finally obtains the output of the suspicious detection module.
  • the output may specifically be the detection result of whether the target key-value pair is suspicious.
  • step S400 can be performed; if the detection result indicates that the target key-value pair is not suspicious, the target message can be terminated. It is determined that the target message is safe and reliable, and can be released directly (those skilled in the art should understand that when all target key-value pairs in the message are not suspicious, it is determined that the target message is safe and reliable and can be released directly).
  • each sample packet containing the target parameter can be obtained to train the learning model. In this way, anomaly detection can be performed on the subsequently acquired packets containing the target key-value pair based on the trained learning model.
  • the training and learning model mainly includes three stages: 1) Collecting data: a batch of trusted IP addresses can be preset, and only the packets initiated by the trusted IP addresses are used for training. The purpose is to prevent the attacker's packets Contaminate the sample packets used for training. In addition, you can also limit the use of only part of the packets of each IP address for learning, which can also prevent the attacker from capturing a certain IP address and causing a large number of polluted sample packets. 2) Model training: When the collected sample packets reach the preset threshold, start training the anomaly detection model. The present invention does not limit a specific anomaly detection model, and an HMM model or a deep learning model can be used. 3) When the model training is completed, the trained learning model is used to detect whether the target key-value pair in the subsequent message is abnormal.
  • the learning model and its corresponding parameters are stored, and in the subsequent execution of the packet detection method, it will be determined that the parameter is a memory hit, so that when the memory hits, the corresponding learning model can be used for abnormality detection.
  • the target message is first parsed to obtain the target key-value pair included in the target message; then, it is detected whether the target parameter in the target key-value pair is hit by storage, If the storage hits, the target key-value pair can be sent to the suspicious detection module for suspicious detection, and a detection result indicating whether the target key-value pair is available can be obtained. If the detection result indicates that the target key-value pair is suspicious, each sample packet containing the target parameter is acquired to train the learning model. In this way, the trained learning model can perform anomaly detection on the target key-value pair in the subsequently acquired message. It can be seen that in the whole detection process, when learning, instead of learning each parameter, learn suspicious parameters. Whether it is a suspicious parameter is determined according to the suspicious detection module. Compared with the prior art where each parameter is learned, this method only learns some parameters, and the method has the technical effect of reducing the number of parameters to be learned and the cost of training and learning.
  • the embodiments of the present invention also provide corresponding improvement solutions.
  • the same steps or corresponding steps in the above-mentioned embodiments can be referred to each other, and corresponding beneficial effects can also be referred to each other, which will not be repeated in the preferred/improved embodiments herein.
  • the learning model can also be used to perform anomaly detection on the target key-value pair while training the learning model.
  • the learning and training mechanism based on the learning model can quickly discover and detect new anomalies.
  • the message detection method further includes: using the current untrained learning model to perform abnormality detection on the target key-value pair in the target message Detect and get abnormal detection results.
  • the abnormality detection result indicates whether the target key-value pair is abnormal; if the abnormality detection result indicates that the target key-value pair is abnormal, exception processing can be performed at this time, such as alarming and/or intercepting the target message; if the abnormality detection result indicates that the target key-value pair is abnormal
  • the target key-value pair is normal. At this time, it can be determined that the target message is normal, and a preset normal processing operation is performed, such as release (those skilled in the art should understand that the normal processing operation can be performed only when all target key-value pairs are normal, such as release).
  • effective screening of packet detection can also be performed by combining strong rules and weak rules. Specifically, after obtaining the target message, the following steps are also included:
  • the preset rules include the first type of rules and the second type of rules
  • the target packet matches the first type of rules in the preset rules, the target packet is directly intercepted;
  • the steps of parsing the target packet to obtain the target key-value pair included in the target packet and subsequent steps are performed.
  • the first type of rules corresponds to strong rules
  • the second type of rules corresponds to weak rules.
  • rules can be preset, and the rules are divided into strong rules and weak rules.
  • the traffic hit by the strong rule it is considered that the possibility of being malicious is high, and it can be directly judged as black.
  • the traffic hit by the weak rule it is considered that it may be malicious traffic, and it enters the subsequent processing; otherwise, it is considered that the traffic cannot be attack data, and it is directly released. Benefiting from the high efficiency of the rules, a large amount of normal traffic can be quickly filtered out.
  • new and normal key-value pairs can be effectively recorded, and can also be generalized and stored.
  • the specific implementation process includes: after the step of sending the target key-value pair to the suspicious detection module to obtain the detection result of the suspicious detection module, it also includes:
  • the data corresponding to the target key-value pair in the target key-value pair is generalized to obtain the generalized representation of the target key-value pair, and the generalized representation and the corresponding target parameters Pre-storage is performed, so as to perform anomaly detection on the target key-value pair in the subsequently acquired message based on the pre-stored generalized representation.
  • the state of the parameter information in the storage can be effectively marked.
  • the packet detection method further includes:
  • the state of setting and storing the target parameter is the first state
  • the packet detection method further includes:
  • the state in which the target parameter is set and stored is the second state.
  • the first state may correspond to a state predicted by a learning model
  • the second state may correspond to a state without learning. That is, after the learning model can identify the target parameter, the state of the target parameter is determined to be the predicted state, and the learning model can be used to predict whether it is abnormal or not. If the detection result indicates that the target key-value pair is not suspicious, then it can be determined that the state of the target parameter is the second state, that is, although it is unknown, it is not necessary to learn because the threat is not large.
  • the generalized representation can also be aggregated to determine the target key-value pair for detection. Specifically, after the step of detecting whether the target parameter in the target key-value pair is hit by storage, the method further includes:
  • the method further includes: if it does not conform to the generalized representation, returning to execute the target key-value pair
  • the value pair is sent to the suspicious detection module to obtain the detection result of the suspicious detection module and the subsequent steps.
  • the suspicious detection model is determined not to be suspicious and needs to be generalized and stored, it can be stored on the previous generalization representation. It can be added or replaced directly, and those skilled in the art can set it according to the actual situation.
  • a threat detection module may also be used to perform threat detection.
  • the method further includes: if the target key-value pair is determined to be abnormal based on the trained learning model, the target key-value pair Input to the threat detection module for threat detection to obtain a threat detection result, wherein the threat detection result is used to indicate whether the target key-value pair constitutes threat data.
  • the present invention does not limit the specific implementation of the threat detection module, which may be the prior art, including but not limited to semantic analysis, machine learning, program analysis, or virtual execution (eg, sandbox). Specifically, in practice, if the threat detection module uses the method of "setting a threshold" to determine whether there is a threat, the threshold used can be set relatively high to avoid false detection.
  • the message detection method further includes: for the target parameter in the target key-value pair, the detection result of the statistical trained learning model is indicated as abnormal, but
  • the threat detection result indicates the number of times that the target key-value pair does not constitute threat data, so that when the number of times exceeds the preset number of times, the learning model corresponding to the target parameter is retrained. That is, for some target parameters, the parameter form or type may change over time. At this time, there may be a situation where the abnormality detection module determines the abnormality, but the threat detection module thinks that there is no threat, indicating that at this time The learned model needs to be retrained.
  • the suspicious detection module and the threat detection module may be inherited into one module, which is not limited in this application.
  • the suspicious detection module can be used to determine the parameter status, and the parameter status is specifically: no need to learn, learn, predict or update; wherein, the parameter status is learning, that is, the corresponding parameter may be threatened, and the abnormal discrimination ability of the parameter needs to be obtained through learning;
  • the parameter status is no need to learn, that is, the corresponding parameter cannot be threatened, and the abnormal discrimination ability of the parameter does not need to be obtained by learning;
  • the parameter status is preset, that is, the abnormal discrimination ability of the parameter has been learned;
  • the parameter status is updated , that is, the cached reference generalization representation currently needs to be updated, or the abnormal discrimination ability of the parameter needs to be regained through learning.
  • some parameter values will also change. For example, some parameters can only receive numeric parameters originally, but now they can also receive alphabetic parameters. For this, it is necessary to update its generalization representation accordingly or the corresponding learned model needs to be relearned. Specifically, if the abnormal number of times is detected and the corresponding threat detection results are all non-attack special parameters exceeding the preset threshold, the parameter status of the special parameters is determined to be updated. That is, when it is found that the abnormal number of a parameter exceeds the preset threshold, and these abnormal parameters are not attacks, it will enter the parameter update stage, update the cache state accordingly, and enter the learning stage, re-collect data, train or rebuild the learning model. .
  • the parameter status can also be confirmed based on the threat detection result (or the detection result of the suspicious detection module). Specifically, after obtaining the threat detection result (or the detection result of the suspicious detection module), the threat detection result (or the detection result of the suspicious detection module) can also be used to determine the parameter status of the target parameter as learning or no learning; in the parameter status Update the cache after changes are made.
  • Step 1.1 If the parameter state is no need to learn, then judge whether the target generalization representation of the target key-value pair is consistent with the reference generalization representation;
  • Step 1.2 If yes, determine that the target key-value pair is normal
  • Step 1.3 If no, determine that the target key-value pair is abnormal.
  • the anomaly detection process specifically includes: retrieving the reference generalized representation of the target parameter in the cache and comparing it with the target generalized representation. If the two are consistent, it is considered to be white traffic, that is, the target key-value pair has no abnormality. If it is inconsistent, it is considered that the target parameter has changed, and it can be further sent to the threat detection module (or suspicious detection module) to determine whether the current parameter is threatening (or suspicious), and it can also be reconfirmed whether the parameter needs to be learned (such as , when the threat detection module determines that there is a threat, the parameter can be learned, that is, the corresponding learning model can be trained). Of course, if it is subsequently determined that the parameter state changes, the state in the cache is updated accordingly. In this way, it can prevent the originally seemingly harmless data from being injected with malicious attack code.
  • the generalized representation of the attack has changed greatly (ie, from N to NASNS), and it is likely to be an attack at this time, so it is necessary to send it to the threat detection module (or anomaly detection module), to judge whether it is threatening (or suspicious), and to determine whether it is necessary to relearn this parameter. Because the probability of changes in the generalized representation is small, most parameters do not need to be judged by the threat detection model.
  • the learning process includes:
  • Stage 1 Collect training sample data corresponding to target parameters
  • Stage 2 Use the training sample data to train the learning model
  • Stage 3 After the training is completed, update the parameter state of the target parameter in the cache to prediction.
  • the learning process can consist of three stages:
  • each IP may be limited to collect only a certain number of request packets for learning.
  • a batch of trusted IP addresses can also be preset, and only the key-value pairs obtained by parsing in the request initiated by the trusted IP address are used for training.
  • Model training you can start training the learning model after the collected training data reaches the preset threshold.
  • the specific process of training is not limited in this embodiment.
  • Case 3 If the parameter state is prediction, the corresponding packet detection method includes: if the parameter state is prediction, anomaly detection will be performed based on the learning model.
  • the target key-value pair can be input into the learning model (after the generalized representation can be performed, the corresponding generalized parameter representation can be used as the input of the learning model) to see whether the output is abnormal. If so, it is sent to the threat detection module. Otherwise, it is directly judged to be white, and it can be directly determined that the target key-value pair has no threat.
  • Step 4.1 If the parameter status is updated, the target parameter can be re-learned; or, the generalized representation in the cache is updated.
  • the learning model is retrained to avoid misjudgment. For example, if the original parameter value of the parameter uid represents a pure number, its corresponding reference generalization is represented as N, and after an application upgrade or update, the representation of the uid parameter value can be a number plus a letter, then its generalization The generalization representation is NA, and the original reference generalization representation is replaced with NA; if the two representations can be applied concurrently, the generalization representation of uid is added to the cache.
  • the suspicious detection module can only record, but not intercept.
  • the suspicious detection module is in the prediction state, that is, the data entering the threat detection model is abnormal data, and the attack can be intercepted at this time.
  • the embodiments of the present invention further provide a packet detection device, and a packet detection device described below and a packet detection method described above can be referred to each other correspondingly.
  • the message detection device includes:
  • the key-value pair obtaining unit 101 is used to obtain the target message, and parse the target message to obtain the target key-value pair included in the target message;
  • Storage hit detection unit 102 for detecting whether the target parameter in the target key-value pair is hit by storage
  • the suspicious detection unit 103 is used to send the target key-value pair to the suspicious detection module if it is not stored and hit, to obtain the detection result of the suspicious detection module, and the detection result is used to indicate whether the target key-value pair is suspicious;
  • the parameter learning unit 104 is configured to obtain each sample message containing the target parameter to train the learning model if the detection result indicates that the target key-value pair is suspicious, and pre-store the trained learning model and the target parameter corresponding to the learning model , so as to perform anomaly detection on the target key-value pair in the subsequently acquired packets based on the trained learning model.
  • the target message is first parsed to obtain the target key-value pair included in the target message; then, the target parameter in the target key-value pair is detected Whether it is a memory hit or not, if it is a memory hit, the target key-value pair can be transmitted to the suspicious detection module for suspicious detection, and a detection result indicating whether the target key-value pair can be obtained is obtained. If the detection result indicates that the target key-value pair is suspicious, each sample packet containing the target parameter is acquired to train the learning model. In this way, the trained learning model can perform anomaly detection on the target key-value pair in the subsequently acquired message.
  • the message detection device further includes:
  • the abnormality detection unit is used to perform abnormality detection on the target key-value pair in the target message by using the current untrained learning model to obtain the abnormality detection result.
  • the message detection device further includes:
  • the generalization unit is used to send the target key-value pair to the suspicious detection module, and after the step of obtaining the detection result of the suspicious detection module, if the detection result indicates that the target key-value pair is not suspicious, then the target key-value pair in the target key-value pair
  • the data corresponding to the value is generalized to obtain the generalized representation of the target key-value pair, and the generalized representation and the corresponding target parameters are pre-stored, so that based on the pre-stored generalized representation, the data in the subsequently acquired message can be analyzed.
  • Target key-value pair for anomaly detection is used to send the target key-value pair to the suspicious detection module, and after the step of obtaining the detection result of the suspicious detection module, if the detection result indicates that the target key-value pair is not suspicious, then the target key-value pair in the target key-value pair
  • the data corresponding to the value is generalized to obtain the generalized representation of the target key-value pair, and the generalized representation and the corresponding target parameters are pre-stored,
  • the message detection device further includes:
  • a first state setting unit configured to set and store the state of the target parameter as the first state after obtaining the trained learning model for identifying the target parameter
  • the message detection device further includes:
  • the second state setting unit for setting and storing the state of the target parameter as the second state
  • the message detection device further includes:
  • the state-based detection unit is configured to determine whether the state of the target parameter in the target key-value pair is the first state or the second state after the step of detecting whether the target parameter in the target key-value pair is hit in storage, if the target parameter in the target key-value pair is hit in storage ; If it is the first state, then identify whether the target key-value pair is abnormal based on the training learning model corresponding to the target parameter in the target key-value pair; if it is the second state, then the target key-value pair and the pre-stored generalization Perform comparison to determine whether the target key-value pair conforms to the generalized representation; if it conforms to the generalized representation, it is determined that the target key-value pair in the target message is normal.
  • the message detection device further includes:
  • the suspicious detection triggering unit is used to compare the target key-value pair with the pre-stored generalized representation to determine whether the target key-value pair conforms to the generalized representation. If it does not conform to the generalized representation, return to execute the target The key-value pair is sent to the suspicious detection module to trigger the suspicious detection unit 103 .
  • the message detection device further includes:
  • the threat detection unit is used for identifying whether the target key-value pair is abnormal based on the trained learning model corresponding to the target parameter in the target key-value pair, and if the target key-value pair is abnormal based on the trained learning model, the target key-value pair is determined to be abnormal.
  • the key-value pair is input to the threat detection module for threat detection, and a threat detection result is obtained, wherein the threat detection result is used to indicate whether the target key-value pair constitutes threat data.
  • the message detection device further includes:
  • the parameter learning triggering unit is used to, after obtaining the threat detection result, for the target parameter in the target key-value pair, the detection result of the learning model after statistical training indicates that the detection result is abnormal, but the threat detection result indicates that the target key-value pair does not constitute threat data
  • the number of times so that when the number of times exceeds the preset number of times, the learning model corresponding to the target parameter is retrained.
  • the message detection device further includes:
  • the message processing unit is used to identify the target message based on preset rules after acquiring the target message, the preset rules include the first type of rules and the second type of rules; if the target message and the first type of the preset rules If the rule matches, the target packet is directly intercepted; if the target packet matches the second type of rule in the preset rules, the key-value pair acquisition unit 101 is triggered.
  • the embodiments of the present invention further provide a packet detection device, and a packet detection device described below and a packet detection method described above can be referred to each other correspondingly.
  • the packet detection device includes:
  • memory 332 for storing computer programs
  • the processor 322 is configured to implement the steps of the packet detection method of the above method embodiments when executing the computer program.
  • FIG. 4 is a schematic diagram of a specific structure of a packet detection device provided in this embodiment.
  • the packet detection device may vary greatly due to different configurations or performances, and may include one or one
  • the above processor (central processing units, CPU) 322 for example, one or more processors) and memory 332,
  • the memory 332 stores one or more stored computer programs 342 (including at least one that can implement the above-mentioned message detection when executed) method) or data 344.
  • the memory 332 may be short-lived storage or persistent storage.
  • the computer program stored in memory 332 may include one or more modules (not shown), each module may include a series of instructions to operate on a data processing apparatus.
  • the central processing unit 322 may be configured to communicate with the memory 332 to execute a series of instruction operations in the memory 332 on the message detection device 301 .
  • the packet detection device 301 may also include one or more power supplies 326 , one or more wired or wireless network interfaces 350 , one or more input and output interfaces 358 , and/or one or more operating systems 341 .
  • one or more power supplies 326 for example, Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.
  • the steps in the packet detection method described above can be implemented by the structure of the packet detection device.
  • the embodiments of the present invention further provide a readable storage medium, and a readable storage medium described below and a packet detection method described above can be referred to each other correspondingly.
  • a readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the steps of the packet detection method in the above method embodiment.
  • the readable storage medium may specifically be a USB flash drive, a removable hard disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, etc. Readable storage medium.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Debugging And Monitoring (AREA)
  • Train Traffic Observation, Control, And Security (AREA)
  • Management Or Editing Of Information On Record Carriers (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种报文检测方法、设备及可读存储介质，该方法包括以下步骤：获取目标报文，并解析目标报文，得到目标报文包含的目标键值对（S100）；检测目标键值对中的目标参数是否被存储命中（S200）；如果未被存储命中，则将目标键值对发送至可疑检测模块，得到可疑检测模块的检测结果，检测结果用于指示目标键值对是否可疑（S300）；若检测结果指示目标键值对可疑，则获取包含目标参数的各个样本报文以训练学习模型，并将训练后的学习模型以及该学习模型对应的目标参数进行预先存储，以便基于训练后的学习模型对后续获取的报文中的目标键值对进行异常检测（S400）。本方法仅针对部分参数进行学习，本方法具有学习的参数数量下降，训练学习成本降低的技术效果。

Description

一种报文检测方法、设备及可读存储介质
本申请要求于2020年7月27日提交至中国专利局、申请号为202010732006.3、发明名称为“一种报文检测方法、设备及可读存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及网络安全技术领域，特别是涉及一种报文检测方法、设备及可读存储介质。
背景技术
随着互联网的高速发展，网络安全攻防不断升级，对报文检测的准确性要求也越来越高。
相关技术中，采用自学习机制来提高报文检测的准确率。此种方案首先学习报文中每个参数的格式。在检测阶段，如果发现参数的实际值与学习到的模式不一致，则认为该异常参数存在攻击。这种方法极大地提高了攻击的检出率，但是需要对报文中的每个参数进行学习，显然目前的自学习机制的学习成本较高。
发明内容
本发明的目的是提供一种报文检测方法、设备及可读存储介质，可以在一定程度上降低目前自学习机制的学习成本。
为解决上述技术问题，本发明提供如下技术方案：
一种报文检测方法，包括：
获取目标报文，并解析所述目标报文，得到所述目标报文包含的目标键值对；
检测所述目标键值对中的目标参数是否被存储命中；
如果未被存储命中，则将所述目标键值对发送至可疑检测模块，得到所述可疑检测模块的检测结果，所述检测结果用于指示所述目标键值对是否可疑；
若所述检测结果指示所述目标键值对可疑，则获取包含所述目标参数 的各个样本报文以训练学习模型，并将训练后的所述学习模型以及该学习模型对应的目标参数进行预先存储，以便基于训练后的所述学习模型对后续获取的报文中的目标键值对进行异常检测。
优选地，若所述检测结果指示所述目标键值对可疑，所述报文检测方法还包括：
利用当前的未训练完成的所述学习模型对所述目标报文中的目标键值对进行异常检测，得到异常检测结果。
优选地，在所述将所述目标键值对发送至可疑检测模块，得到所述可疑检测模块的检测结果的步骤之后，还包括：
若所述检测结果指示所述目标键值对不可疑，则将所述目标键值对中的目标键值对应的数据进行泛化，得到所述目标键值对的泛化表示，并将该泛化表示以及对应的目标参数进行预先存储，以便基于预先存储的该泛化表示对后续获取的报文中的目标键值对进行异常检测。
优选地，若所述检测结果指示所述目标键值对可疑，所述报文检测方法还包括：
在得到用于识别所述目标参数的训练后的学习模型后，设置并存储所述目标参数的状态为第一状态；
若所述检测结果指示所述目标键值对不可疑，所述报文检测方法还包括：
设置并存储所述目标参数的状态为第二状态。
相应地，在所述检测所述目标键值对中的目标参数是否被存储命中的步骤之后，还包括：
如果被存储命中，则确定所述目标键值对中目标参数的状态是所述第一状态还是所述第二状态；
若为所述第一状态，则基于所述目标键值对中目标参数对应的训练后的学习模型识别所述目标键值对是否异常；
若为所述第二状态，则将所述目标键值对与事先存储的泛化表示进行比对，确定所述目标键值对是否符合所述泛化表示；
若符合所述泛化表示，则确定所述目标报文中的目标键值对正常。
优选地，在所述将所述目标键值对与事先存储的泛化表示进行比对， 确定所述目标键值对是否符合所述泛化表示的步骤之后，还包括：
若不符合所述泛化表示，则返回执行所述将所述目标键值对发送至可疑检测模块，得到所述可疑检测模块的检测结果的步骤以及后续步骤。
优选地，在所述基于所述目标键值对中目标参数对应的训练后的学习模型识别所述目标键值对是否异常的步骤之后，还包括：
若基于训练后的学习模型确定所述目标键值对异常后，将所述目标键值对输入至威胁检测模块进行威胁检测，得到威胁检测结果，其中，所述威胁检测结果用于指示所述目标键值对是否构成威胁数据。
优选地，在所述得到威胁检测结果之后，所述报文检测方法还包括；
对于所述目标键值对中的目标参数，统计训练后的学习模型的检测结果指示为异常，但所述威胁检测结果指示所述目标键值对不构成威胁数据的次数，以便在所述次数超过预设次数时，对该目标参数对应的学习模型进行重新训练。
优选地，在所述获取目标报文之后，还包括：
基于预设规则识别所述目标报文，所述预设规则包括第一类规则和第二类规则；
若所述目标报文与所述预设规则中的第一类规则匹配，则直接对所述目标报文进行拦截；
若所述目标报文与所述预设规则中的第二类规则匹配，则执行所述解析所述目标报文，得到所述目标报文包含的目标键值对的步骤以及后续步骤。
一种报文检测设备，包括：
存储器，用于存储计算机程序；
处理器，用于执行所述计算机程序时实现上述报文检测方法的步骤。
一种可读存储介质，所述可读存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现上述报文检测方法的步骤。
应用本发明实施例所提供的方法，获取目标报文，并解析目标报文，得到目标报文包含的目标键值对；检测目标键值对中的目标参数是否被存储命中；如果未被存储命中，则将目标键值对发送至可疑检测模块，得到可疑检测模块的检测结果，检测结果用于指示目标键值对是否可疑；若检 测结果指示目标键值对可疑，则获取包含目标参数的各个样本报文以训练学习模型，并将训练后的学习模型以及该学习模型对应的目标参数进行预先存储，以便基于训练后的学习模型对后续获取的报文中的目标键值对进行异常检测。
在本方法中，在获取到目标报文之后，首先对目标报文进行解析，得到目标报文所包含的目标键值对；然后，检测该目标键值对中的目标参数是否被存储命中，如果被存储命中，则可将目标键值对发射至可疑检测模块进行可疑检测，得到用于指示目标键值对是否可疑的检测结果(在本申请实施例中，“可疑”即是指该目标键值具备包含异常信息的可能性，具体在实际中，若可疑检测模块是通过“设定阈值”的方法来判断是否可疑时，可以将所使用的阈值设置的比较低，从而避免漏检，尽可能地将可能包含异常信息的键值对都检测出来；具体可疑检测模块的实现过程，可以采用现有技术，比如语义分析或者程序分析等，本申请对可疑检测模块的实现方式不作限定)。若检测结果指示目标键值对可疑，则获取包含该目标参数的各个样本报文以训练学习模型。如此，便可使得训练后的学习模型对后续获取的报文中的目标键值对进行异常检测。可见，在整个检测过程中，在进行学习时，不是学习每个的参数，而是学习可疑参数，具体是否为可疑参数，根据可疑检测模块来确定。相较于现有技术中对每个参数都进行学习，本方法仅针对部分参数进行学习，本方法具有学习的参数数量下降，训练学习成本降低的技术效果。
相应地，本发明实施例还提供了与上述报文检测方法相对应的报文检测设备和可读存储介质，具有上述技术效果，在此不再赘述。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例中一种报文检测方法的实施流程图；
图2为本发明实施例中一种报文检测装置的结构示意图；
图3为本发明实施例中一种报文检测设备的结构示意图；
图4为本发明实施例中一种报文检测设备的具体结构示意图。
具体实施方式
为了使本技术领域的人员更好地理解本发明方案，下面结合附图和具体实施方式对本发明作进一步的详细说明。显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例所提供的报文检测方法可应用于运载应用层防火墙(如WAF)和安全态势感知等产品的计算机设备中。
其中，WAF，Web Application Firewall：Web应用防火墙。Web应用防火墙是通过执行针对HTTP/HTTPS等协议的若干安全策略来专门为Web应用提供保护的一款产品。
其中，Web攻击：攻击者通过攻击Web应用服务对网站进行篡改数据、敏感信息获取、非法操作等行为，WEB类的攻击不限于：SQL注入、XSS跨站脚本、CSRF跨站请求伪造、文件上传、文件包含、框架安全、PHP常见漏洞、代码审计等。
请参考图1，图1为本发明实施例中一种报文检测方法的流程图，该方法包括以下步骤：
S100、获取目标报文，并解析目标报文，得到目标报文包含的目标键值对。
其中，目标键值对，可具体为键值对(key：value)的表达形式，其中，键(key)可具体为参数名称，值(value)即为参数值。举例说明：可将URL中的参数解析成：(product:computer)及(tid:1000)这种键值对的表示形式。
该目标报文可以为传输协议对应的具体报文。举例说明，目标报文可以为HTTP报文，HTTP(HyperText Transfer Protocol)，即超文本传输协议。
可通过防火墙等方式对流量进行拦截的方式获得目标报文。
得到目标报文之后，可借助传输协议对目标报文进行解析。举例说明， 对HTTP报文，可以依据RFC标准及服务器的处理方式，将目标报文解析成不同部分，如请求方法、URI，cookie，User-Agent，body等。然后，对每个部分进行解码操作，如base64，unicode等，以还原出HTTP报文的真实内容。对于每个部分，进行解析，得到目标键值对。
S200、检测目标键值对中的目标参数是否被存储命中。
在本实施例中，可预先在缓存中或其他存储介质中存储参数信息，在本申请中，“被存储命中”具体指：存储有目标参数(参数名称)以及该目标参数具体采用哪种方法来处理(比如，采用哪种方法来检测是否异常，或者，是否直接认为是正常)。
其中，具体用哪种方法来检测异常可以用“参数状态”来指示，比如，若有两种方法来检测是否异常，则可以有两种参数状态，即第一状态和第二状态，比如，tid--第二状态，或者URL--第一状态，即是对于参数tid采用第二状态对应的异常检测方法(比如，与泛化表示进行比对)来检测是否异常，对于参数URL采用第一状态对应的异常检测方法(比如，训练后学习模型)来检测是否异常。
具体的，在本申请实施例中，还可存储参数的参考泛化表示。其中，参考泛化表示可具体为将对应参数名称的值的表现形式进行泛化。例如将参数值为字母的，将参数值对应泛化为A；参数值为数字的，将参数值对应泛化为N；参数值对应特殊字符的，将参数值对应泛化为S。需要说明的是，泛化方式有多种方式，并不仅限于所列举的这一种泛化方式。泛化表示后，可降低内存消耗，无需存储大量的参考数据。对于每个键值对，如果值为字母的话，则都映射成A(Alphabet)；如果值为数字的话，则映射成N(Number)；特殊字符映射成S(Special Character)。举例说明：泛化表示前dev＝abc&uid＝123&random＝abc.123；泛化表示之后为dev＝A&uid＝N&random＝ASN；可见，即便存在用户id(uid)及设备id(dev)不一致，但泛化后其表示相同。
参数状态可以根据参数可能携带异常信息的可能性来确定，具体在本申请中，可根据可疑检测模块确定参数状态。例如，若可疑检测模块确定目标键值对可疑，使得对该目标键值对所对应的目标参数进行学习时，该目标参数的参数状态可设置为第一状态；若可疑检测模块确定目标键值对 不可疑，则可设置参数状态为第二状态(意味着该参数携带异常信息的可能性较小，可无需采用学习模块来识别是否异常，可采用其他方法，比如是否为泛化表示来确定是否异常)。
当然，在本申请实施例中，各个参数的参数状态，还可根据本领域技术人员的技术积累进行人工设置。可通过检索的方式确定出存储中是否存在与目标键值对中目标键值对应的信息。若未命中存储，可视为无法对该目标键值对是否异常进行识别。
在全自动无需人工设置参数状态时，可视为执行本申请报文检测方法的终端设备从未接触过该目标键值对；若命中存储，则表明并非首次接触该目标键值对，可进行异常检测。
其中，步骤S200所述的“存储”可以具体为缓存也可以为磁盘、硬盘等可读存储介质。
S300、如果未被存储命中，则将目标键值对发送至可疑检测模块，得到可疑检测模块的检测结果，检测结果用于指示目标键值对是否可疑。
也就是说，将目标键值对发送至可疑检测模块之后，可疑检测模块能够对目标键值对进行可疑检测，得到用于指示目标键值对是否可疑的检测结果。
具体可疑检测模块的实现过程，可以采用现有技术，比如语义分析或者程序分析等，还为能够使用HMM(Hidden Markov Model，隐马尔科夫模型)或者是深度学习。即，在本实施例中并不限定可疑检测模块的具体检测方法以及其结构。
其中，HMM：隐马尔可夫模型是马尔可夫链的一种，它的状态不能直接观察到，但能通过观测向量序列观察到，每个观测向量都是通过某些概率密度分布表现为各种状态，每一个观测向量是由一个具有相应概率密度分布的状态序列产生。
具体的，可将目标键值对作为可疑检测模块的输入，然后可疑检测模块对目标键值对进行可疑检测，最终得到可疑检测模块的输出。该输出可具体为目标键值对是否可疑的检测结果。
得到检测结果之后，便可基于检测结果的具体情况，执行相应步骤。具体的，若检测结果指示目标键值对可疑，则可确定目标报文可能会存在 问题，且可执行步骤S400的操作；若检测结果指示目标键值对不可疑，则可结束针对目标报文的检测，确定目标报文安全可靠，可直接放行(本领域技术人员应理解，在报文中的所有目标键值对都不可疑时，才确定安全可靠，直接放行)。
S400、若检测结果指示目标键值对可疑，则获取包含目标参数的各个样本报文以训练学习模型，并将训练后的所述学习模型以及该学习模型对应的目标参数进行预先存储，以便基于训练后的学习模型对后续获取的报文中的目标键值对进行异常检测。
如果检测结果指示目标键值对可疑，则可获取包含了目标参数的各个样本报文来训练学习模型。如此，便可基于训练后的学习模型对后续获取的包含有目标键值对的报文进行异常检测。
具体地，训练学习模型主要包含三个阶段：1)收集数据：可以预设一批可信IP地址，只使用可信IP地址发起的报文进行训练，该目的是为了防止攻击者的报文污染训练用的样本报文，此外，还可以限定只使用每个IP地址的部分报文进行学习，这样也可以在一定程度上避免攻击者攻陷某一IP地址后，造成大量污染样本报文；2)模型训练：当收集到的样本报文达到预设阈值后，开始训练异常检测模型。本发明不限定具体的异常检测模型，可以使用HMM模型或者是深度学习模型。3)当完成模型训练后，采用训练后的学习模型对后续报文中的目标键值对是否异常进行检测。
具体地，将学习模型及其对应的参数进行存储，在后续执行报文检测方法中，会判断出该参数被存储命中，从而在存储命中时，可以采用对应的学习模型进行异常检测。
应用本发明实施例所提供的方法，获取目标报文，并解析目标报文，得到目标报文包含的目标键值对；检测目标键值对中的目标参数是否被存储命中；如果未被存储命中，则将目标键值对发送至可疑检测模块，得到可疑检测模块的检测结果，检测结果用于指示目标键值对是否可疑；若检测结果指示目标键值对可疑，则获取包含目标参数的各个样本报文以训练学习模型，并将训练后的学习模型以及该学习模型对应的目标参数进行预先存储，以便基于训练后的学习模型对后续获取的报文中的目标键值对进行异常检测。
在本方法中，在获取到目标报文之后，首先对目标报文进行解析，得到目标报文所包含的目标键值对；然后，检测该目标键值对中的目标参数是否被存储命中，如果被存储命中，则可将目标键值对发射至可疑检测模块进行可疑检测，得到用于指示目标键值对是否可以的检测结果。若检测结果指示目标键值对可疑，则获取包含该目标参数的各个样本报文以训练学习模型。如此，便可使得训练后的学习模型对后续获取的报文中的目标键值对进行异常检测。可见，在整个检测过程中，在进行学习时，不是学习每个的参数，而是学习可疑参数，具体是否为可疑参数，根据可疑检测模块来确定。相较于，现有技术中对每个参数都进行学习，本方法仅针对部分参数进行学习，本方法具有学习的参数数量下降，训练学习成本降低的技术效果。
需要说明的是，基于上述实施例，本发明实施例还提供了相应的改进方案。在优选/改进实施例中涉及与上述实施例中相同步骤或相应步骤之间可相互参考，相应的有益效果也可相互参照，在本文的优选/改进实施例中不再一一赘述。
优选地，在实际应用中，还可一边训练学习模型，一边利用该学习模型对目标键值对进行异常检测。如此，基于学习模型的学习训练机制，便可实现快速发现新的异常，并检出。具体的，即在执行完上述步骤S300之后，若检测结果指示目标键值对可疑，报文检测方法还包括：利用当前的未训练完成的学习模型对目标报文中的目标键值对进行异常检测，得到异常检测结果。该异常检测结果即指示目标键值对是否异常；若异常检测结果表明目标键值对异常，此时可进行异常处理，如告警和/或对目标报文进行拦截等操作；若异常检测结果表明目标键值对正常，此时可确定目标报文正常，执行预设正常处理操作，如放行(本领域技术人员应该理解，可在所有目标键值对均正常时，才执行正常处理操作，如放行)。
此外，在本申请实施例中，根据训练中的学习模型进行异常检测会存在误差，因为还可以直接发出提示信息，让技术人员来进行判断是否存在异常等。
优选地，为了提高报文检测效率，还可结合强规则和弱规则来对报文检测进行有效的筛查。具体的，即在获取目标报文之后，还包括执行以下步骤：
基于预设规则识别目标报文，预设规则包括第一类规则和第二类规则；
若目标报文与预设规则中的第一类规则匹配，则直接对目标报文进行拦截；
若目标报文与预设规则中的第二类规则匹配，则执行解析目标报文，得到目标报文包含的目标键值对的步骤以及后续步骤。
为便于描述，下面将上述三个步骤结合起来进行说明。
其中，第一类规则对应强规则，第二类规则对应弱规则。在本实施例中，可预先设置规则，并将规则分为强规则和弱规则。
具体的，对于强规则命中的流量，认为其为恶意的可能性高，可直接判黑。对于弱规则命中的流量，则认为其有可能是恶意流量，进入后续处理；否则，则认为该流量不可能是攻击数据，直接放行。受益于规则的高效，可以快速地过滤掉大量正常流量。
优选地，为了使得存储能够命中更多的键值对，能够对新且正常的键值对进行有效记录，还可将其泛化并进行存储。如此，再次遇见该键值对时，则可快速确定其安全，省去后续的可疑检测步骤。具体实现过程，包括：在将目标键值对发送至可疑检测模块，得到可疑检测模块的检测结果的步骤之后，还包括：
若检测结果指示目标键值对不可疑，则将目标键值对中的目标键值对应的数据进行泛化，得到目标键值对的泛化表示，并将该泛化表示以及对应的目标参数进行预先存储，以便基于预先存储的该泛化表示对后续获取的报文中的目标键值对进行异常检测。
优选地，为便于管理，该可针对存储中的参数信息的状态进行有效标注。具体的，若检测结果指示目标键值对可疑，报文检测方法还包括：
在得到用于识别目标参数的训练后的学习模型后，设置并存储目标参数的状态为第一状态；
若检测结果指示目标键值对不可疑，报文检测方法还包括：
设置并存储目标参数的状态为第二状态。
其中，第一状态可以对应采用学习模型预测状态，第二状态可以对应无需学习状态。即，在学习模型能够对目标参数进行识别之后，该目标参数的状态确定为预测状态，即可对其采用学习模型进行预测是否异常的状态。而若检测结果指示目标键值对不可疑，此时可确定目标参数的状态为第二状态，即虽然未知但因其威胁不大，可无需进行学习。
当然，在实际应用中，对于参数的状态设置可以多种多样，且针对不同状态的参数设置不同的处理方式。
为了快速检测，还可集合泛化表示确定目标键值对进行检测。具体的，在检测目标键值对中的目标参数是否被存储命中的步骤之后，还包括：
如果被存储命中，则确定目标键值对中目标参数的状态是第一状态还是第二状态；
若为第一状态，则基于目标键值对中目标参数对应的训练后的学习模型识别目标键值对是否异常；
若为第二状态，则将目标键值对与事先存储的泛化表示进行比对，确定目标键值对是否符合泛化表示；
若符合泛化表示，则确定目标报文中的目标键值对正常。
优选地，在将目标键值对与事先存储的泛化表示进行比对，确定目标键值对是否符合泛化表示的步骤之后，还包括：若不符合泛化表示，则返回执行将目标键值对发送至可疑检测模块，得到可疑检测模块的检测结果的步骤以及后续步骤，此时，若可疑检测模型确定不可疑，需要进行泛化存储时，可以在之前的已经存储的泛化表示上进行追加，也可以直接进行替换，具体本领域技术人员可以根据实际情况进行设定。
优选地，为了有效明确目标报文是否存在真的存在威胁，即是避免误检还可利用威胁检测模块进行威胁检测。在基于目标键值对中目标参数对应的训练后的学习模型识别目标键值对是否异常的步骤之后，还包括：若基于训练后的学习模型确定目标键值对异常后，将目标键值对输入至威胁 检测模块进行威胁检测，得到威胁检测结果，其中，威胁检测结果用于指示目标键值对是否构成威胁数据。本发明不限定具体的威胁检测模块的实现方式，可以为现有技术，包括但不限于语义分析、机器学习、程序分析或者是虚拟执行(如沙箱)等。具体在实际中，若威胁检测模块是通过“设定阈值”的方法来判断是否具备威胁时，可以将所使用的阈值设置的比较高，从而避免误检。
优选地，为了有效检测出新发现的威胁，在得到威胁检测结果之后，报文检测方法还包括；对于目标键值对中的目标参数，统计训练后的学习模型的检测结果指示为异常，但威胁检测结果指示目标键值对不构成威胁数据的次数，以便在次数超过预设次数时，对该目标参数对应的学习模型进行重新训练。也即是对于某些目标参数，可能其参数形式或类型会随着时间而发生改变，此时，可能会存在异常检测模块确定异常，但威胁检测模块却认为不存在威胁的情况，说明此时需要对学习模型进行重新训练。
在本申请实施例中，可疑检测模块和威胁检测模块可以继承到一个模块中，本申请对此不做限定。
上述若干改进内容，在实际应用中可结合起来进行应用，为便于理解，下面结合具体情况对如何结合进行详细说明。
可利用可疑检测模块确定参数状态，参数状态具体为：无需学习、学习、预测或更新；其中，参数状态为学习，即对应的参数有可能存在威胁，需要通过学习获得该参数的异常鉴别能力；参数状态为无需学习，即对应的参数不可能存在威胁，不需要通过学习获得该参数的异常鉴别能力；参数状态为预设，即为已经学习得到了该参数的异常鉴别能力；参数状态为更新，即当前需要更新缓存的参考泛化表示，或者需要通过学习重新获得该参数的异常鉴别能力。
考虑到，随着应用更新，一些参数值也会发生变化。比如有些参数，原本只能接收数字参数，现在还可以接收字母参数。为此，有必要相应地更新其泛化表示或者对应的学习模型需要重新学习。具体的，若检测出异常次数且对应的威胁检测结果均为非攻击超过预设阈值的特殊参数，则确 定特殊参数的参数状态为更新。即当发现某参数异常次数超过预设阈值，且这些异常参数都不是攻击的时候，就进入参数更新阶段，相应地更新缓存状态，并可以进入学习阶段，重新收集数据，训练或者重新构建学习模型。
考虑到参数种类可能会出现新增，也会出现原本无威胁的参数被攻击者利用成为有威胁的参数。因此，在本实施例中，还可基于威胁检测结果(或可疑检测模块的检测结果)对参数状态进行确认。具体的，在得到威胁检测结果(或可疑检测模块的检测结果)之后，还可利用威胁检测结果(或可疑检测模块的检测结果)，确定目标参数的参数状态为学习或无需学习；在参数状态发生变化后更新缓存。
为了便于理解，下面针对每一种参数状态对报文检测方法进行详细说明。
情况一：对于参数状态为无需学习的参数，则其对应的异常检测过程包括：
步骤1.1、若参数状态为无需学习，则判断目标键值对的目标泛化表示与参考泛化表示是否一致；
步骤1.2、如果是，则确定目标键值对无异常；
步骤1.3、如果否，则确定目标键值对异常。
无需学习：表明该目标参数通常不具备威胁性。此时，异常检测流程具体包括：检索缓存中目标参数的参考泛化表示，并与目标泛化表示对比。如果两者一致，则认为是白流量，即目标键值对无异常。如果不一致，则认为该目标参数发生了变化，后续还可以进一步送入威胁检测模块(或可疑检测模块)判断当前参数是否有威胁(或可疑)，同时也可再次确认该参数是否需要学习(比如，当威胁检测模块确定有威胁时，可以对该参数进行学习，即训练相应的学习模型)。当然，如果后续确定参数状态改变，则相应地更新缓存中的状态。这样可以防止原本看似无恶意性的数据，被注入恶意的攻击代码。
以http://www.example.com？dev＝abc&uid＝123&random＝abc.123例进行介绍。假如服务器后台根据其中参数uid进行数据库检索，并返回该用户的信息。后台可能执行的代码为：select user_info from users where uid＝123； 此时，uid的泛化表示为N，威胁检测模型认为不会造成危害，无需学习。然而，攻击者可以利用uid，注入恶意的SQL代码uid＝123 union select password from users where uid＝234--。上述代码可以导致服务器返回另外一个用户(用户id＝234)的密码。当发生此种攻击时，攻击的泛化表示发生了较大变化(即从N变为NASNS)，这时就很有可能是攻击，因此有必要送入威胁检测模块(或异常检测模块)，以判断是否威胁(或可疑)，并且确定是否有必要重新学习该参数。因为泛化表示发生变化的概率较小，因此大部分参数无需使用威胁检测模型判断。
情况二：对于参数状态为学习的参数，则其对应的报文检测方法包括：
若参数状态为学习，则学习目标参数；
其中，学习过程包括：
阶段一：收集与目标参数对应的训练样本数据；
阶段二：利用训练样本数据对学习模型进行训练；
阶段三：在训练完成之后，更新缓存中的目标参数的参数状态为预测。
学习：即可疑检测模块认为目标参数可能造成危害，则对该参数进行学习(可学习参数的正常泛化表示)。学习过程可包括三个阶段：
收集数据，优选地，为防止攻击者的数据污染学习模型，可以限定每个IP(或者每个用户)只采集一定数量的请求报文进行学习。进一步地，还可以预设一批可信IP地址，只使用可信IP地址发起的请求中解析得到的键值对进行训练。
模型训练，可在收集的训练数据达到预设阈值后，开始训练学习模型。在本实施例中不限定训练的具体过程。
当完成模型训练后，更新缓存中的参数状态为预测。
情况三：若参数状态为预测，则其对应的报文检测方法包括：若参数状态为预测，则将基于学习模型进行异常检测。
即，已经完成训练，具备了对目标参数的鉴别能力。此时，可将目标键值对输入至学习模型中(可以进行泛化表示后，将对应的泛化后的参数表示作为学习模型的输入)，看其输出是否为异常。如果是的话，再送入威胁检测模块。否则，则直接判白，即可直接确定目标键值对无威胁。
情况四：若参数状态为更新，则其对应的报文检测方法包括：
步骤4.1、若参数状态为更新，则可以重新学习目标参数；或者，更新缓存中的泛化表示。
当参数状态为更新，即重新训练学习模型，以避免出现误判。举例说明，若参数uid原参数值表现形状为纯数字，则其对应的参考泛化表示为N，而在进行应用升级或更新之后，uid参数值的表现形式可以为数字加字母，则其泛化表示为NA，将原本的参考泛化表示替换为NA；若两种表现方式可以并存应用，则在缓存中添加uid的泛化表示NA。
根据参数所处的状态(如学习状态还是预测状态)，可以使用不同的检测模式。若可疑检测模块处于学习状态时，威胁检测模型可以只记录，而不拦截。当可疑检测模块处于预测状态时，即进入到威胁检测模型的数据都是异常数据，此时可开始拦截攻击。
相应于上面的方法实施例，本发明实施例还提供了一种报文检测装置，下文描述的一种报文检测装置与上文描述的一种报文检测方法可相互对应参照。
请参考图3，该报文检测装置，包括：
键值对获取单元101，用于获取目标报文，并解析目标报文，得到目标报文包含的目标键值对；
存储命中检测单元102，用于检测目标键值对中的目标参数是否被存储命中；
可疑检测单元103，用于如果未被存储命中，则将目标键值对发送至可疑检测模块，得到可疑检测模块的检测结果，检测结果用于指示目标键值对是否可疑；
参数学习单元104，用于若检测结果指示目标键值对可疑，则获取包含目标参数的各个样本报文以训练学习模型，并将训练后的学习模型以及该学习模型对应的目标参数进行预先存储，以便基于训练后的学习模型对后续获取的报文中的目标键值对进行异常检测。
应用本发明实施例所提供的装置，在获取到目标报文之后，首先对目标报文进行解析，得到目标报文所包含的目标键值对；然后，检测该目标键值对中的目标参数是否被存储命中，如果被存储命中，则可将目标键值 对发射至可疑检测模块进行可疑检测，得到用于指示目标键值对是否可以的检测结果。若检测结果指示目标键值对可疑，则获取包含该目标参数的各个样本报文以训练学习模型。如此，便可使得训练后的学习模型对后续获取的报文中的目标键值对进行异常检测。可见，在整个检测过程中，在进行学习时，不是学习每个的参数，而是学习可疑参数，具体是否为可疑参数，根据可疑检测模块来确定。相较于，现有技术中对每个参数都进行学习，本装置仅针对部分参数进行学习，本装置具有学习的参数数量下降，训练学习成本降低的技术效果。
在本发明的一种具体实施方式中，若检测结果指示目标键值对可疑，报文检测装置还包括：
异常检测单元，用于利用当前的未训练完成的学习模型对目标报文中的目标键值对进行异常检测，得到异常检测结果。
在本发明的一种具体实施方式中，该报文检测装置，还包括：
泛化单元，用于在将目标键值对发送至可疑检测模块，得到可疑检测模块的检测结果的步骤之后，若检测结果指示目标键值对不可疑，则将目标键值对中的目标键值对应的数据进行泛化，得到目标键值对的泛化表示，并将该泛化表示以及对应的目标参数进行预先存储，以便基于预先存储的该泛化表示对后续获取的报文中的目标键值对进行异常检测。
在本发明的一种具体实施方式中，若检测结果指示目标键值对可疑，报文检测装置还包括：
第一状态设置单元，用于在得到用于识别目标参数的训练后的学习模型后，设置并存储目标参数的状态为第一状态；
若检测结果指示目标键值对不可疑，报文检测装置还包括：
第二状态设置单元，用于设置并存储目标参数的状态为第二状态；
相应地，该报文检测装置，还包括：
基于状态的检测单元，用于在检测目标键值对中的目标参数是否被存储命中的步骤之后，如果被存储命中，则确定目标键值对中目标参数的状态是第一状态还是第二状态；若为第一状态，则基于目标键值对中目标参数对应的训练后的学习模型识别目标键值对是否异常；若为第二状态，则将目标键值对与事先存储的泛化表示进行比对，确定目标键值对是否符合 泛化表示；若符合泛化表示，则确定目标报文中的目标键值对正常。
在本发明的一种具体实施方式中，该报文检测装置，还包括：
可疑检测触发单元，用于在将目标键值对与事先存储的泛化表示进行比对，确定目标键值对是否符合泛化表示的步骤之后，若不符合泛化表示，则返回执行将目标键值对发送至可疑检测模块，以触发可疑检测单元103。
在本发明的一种具体实施方式中，该报文检测装置，还包括：
威胁检测单元，用于在基于目标键值对中目标参数对应的训练后的学习模型识别目标键值对是否异常的步骤之后，若基于训练后的学习模型确定目标键值对异常后，将目标键值对输入至威胁检测模块进行威胁检测，得到威胁检测结果，其中，威胁检测结果用于指示目标键值对是否构成威胁数据。
在本发明的一种具体实施方式中，该报文检测装置，还包括：
参数学习触发单元，用于在得到威胁检测结果之后，对于目标键值对中的目标参数，统计训练后的学习模型的检测结果指示为异常，但威胁检测结果指示目标键值对不构成威胁数据的次数，以便在次数超过预设次数时，对该目标参数对应的学习模型进行重新训练。
在本发明的一种具体实施方式中，该报文检测装置，还包括：
报文处理单元，用于在获取目标报文之后，基于预设规则识别目标报文，预设规则包括第一类规则和第二类规则；若目标报文与预设规则中的第一类规则匹配，则直接对目标报文进行拦截；若目标报文与预设规则中的第二类规则匹配，则触发键值对获取单元101。
相应于上面的方法实施例，本发明实施例还提供了一种报文检测设备，下文描述的一种报文检测设备与上文描述的一种报文检测方法可相互对应参照。
参见图3所示，该报文检测设备包括：
存储器332，用于存储计算机程序；
处理器322，用于执行计算机程序时实现上述方法实施例的报文检测方法的步骤。
具体的，请参考图4，图4为本实施例提供的一种报文检测设备的具体 结构示意图，该报文检测设备可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上处理器(central processing units，CPU)322(例如，一个或一个以上处理器)和存储器332，存储器332中存储了一个或一个以上存储计算机程序342(至少包括一个执行时可实现上述报文检测方法的计算机程序)或数据344。其中，存储器332可以是短暂存储或持久存储。存储在存储器332中的计算机程序可以包括一个或一个以上模块(图示没标出)，每个模块可以包括对数据处理设备中的一系列指令操作。更进一步地，中央处理器322可以设置为与存储器332通信，在报文检测设备301上执行存储器332中的一系列指令操作。
报文检测设备301还可以包括一个或一个以上电源326，一个或一个以上有线或无线网络接口350，一个或一个以上输入输出接口358，和/或，一个或一个以上操作系统341。例如，Windows ServerTM，Mac OS XTM，UnixTM，LinuxTM，FreeBSDTM等。
上文所描述的报文检测方法中的步骤可以由报文检测设备的结构实现。
相应于上面的方法实施例，本发明实施例还提供了一种可读存储介质，下文描述的一种可读存储介质与上文描述的一种报文检测方法可相互对应参照。
一种可读存储介质，可读存储介质上存储有计算机程序，计算机程序被处理器执行时实现上述方法实施例的报文检测方法的步骤。
该可读存储介质具体可以为U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可存储程序代码的可读存储介质。
本领域技术人员还可以进一步意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。本领域技 术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。

Claims (10)

  1. 一种报文检测方法，其特征在于，包括：
    获取目标报文，并解析所述目标报文，得到所述目标报文包含的目标键值对；
    检测所述目标键值对中的目标参数是否被存储命中；
    如果未被存储命中，则将所述目标键值对发送至可疑检测模块，得到所述可疑检测模块的检测结果，所述检测结果用于指示所述目标键值对是否可疑；
    若所述检测结果指示所述目标键值对可疑，则获取包含所述目标参数的各个样本报文以训练学习模型，并将训练后的所述学习模型以及该学习模型对应的目标参数进行预先存储，以便基于训练后的所述学习模型对后续获取的报文中的目标键值对进行异常检测。
  2. 如权利要求1所述的报文检测方法，其特征在于，若所述检测结果指示所述目标键值对可疑，所述报文检测方法还包括：
    利用当前的未训练完成的所述学习模型对所述目标报文中的目标键值对进行异常检测，得到异常检测结果。
  3. 如权利要求1所述的报文检测方法，其特征在于，在所述将所述目标键值对发送至可疑检测模块，得到所述可疑检测模块的检测结果的步骤之后，还包括：
    若所述检测结果指示所述目标键值对不可疑，则将所述目标键值对中的目标键值对应的数据进行泛化，得到所述目标键值对的泛化表示，并将该泛化表示以及对应的目标参数进行预先存储，以便基于预先存储的该泛化表示对后续获取的报文中的目标键值对进行异常检测。
  4. 如权利要求3所述的报文检测方法，其特征在于，若所述检测结果指示所述目标键值对可疑，所述报文检测方法还包括：
    在得到用于识别所述目标参数的训练后的学习模型后，设置并存储所述目标参数的状态为第一状态；
    若所述检测结果指示所述目标键值对不可疑，所述报文检测方法还包括：
    设置并存储所述目标参数的状态为第二状态；
    相应地，在所述检测所述目标键值对中的目标参数是否被存储命中的步骤之后，还包括：
    如果被存储命中，则确定所述目标键值对中目标参数的状态是所述第一状态还是所述第二状态；
    若为所述第一状态，则基于所述目标键值对中目标参数对应的训练后的学习模型识别所述目标键值对是否异常；
    若为所述第二状态，则将所述目标键值对与事先存储的泛化表示进行比对，确定所述目标键值对是否符合所述泛化表示；
    若符合所述泛化表示，则确定所述目标报文中的目标键值对正常。
  5. 如权利要求4所述的报文检测方法，其特征在于，在所述将所述目标键值对与事先存储的泛化表示进行比对，确定所述目标键值对是否符合所述泛化表示的步骤之后，还包括：
    若不符合所述泛化表示，则返回执行所述将所述目标键值对发送至可疑检测模块，得到所述可疑检测模块的检测结果的步骤以及后续步骤。
  6. 如权利要4所述的报文检测方法，其特征在于，在所述基于所述目标键值对中目标参数对应的训练后的学习模型识别所述目标键值对是否异常的步骤之后，还包括：
    若基于训练后的学习模型确定所述目标键值对异常后，将所述目标键值对输入至威胁检测模块进行威胁检测，得到威胁检测结果，其中，所述威胁检测结果用于指示所述目标键值对是否构成威胁数据。
  7. 如权利要求6所述的报文检测方法，其特征在于，在所述得到威胁检测结果之后，所述报文检测方法还包括；
    对于所述目标键值对中的目标参数，统计训练后的学习模型的检测结果指示为异常，但所述威胁检测结果指示所述目标键值对不构成威胁数据的次数，以便在所述次数超过预设次数时，对该目标参数对应的学习模型进行重新训练。
  8. 如权利要求1至7中任一项所述的报文检测方法，其特征在于，在所述获取目标报文之后，还包括：
    基于预设规则识别所述目标报文，所述预设规则包括第一类规则和第二类规则；
    若所述目标报文与所述预设规则中的第一类规则匹配，则直接对所述目标报文进行拦截；
    若所述目标报文与所述预设规则中的第二类规则匹配，则执行所述解析所述目标报文，得到所述目标报文包含的目标键值对的步骤以及后续步骤。
  9. 一种报文检测设备，其特征在于，包括：
    存储器，用于存储计算机程序；
    处理器，用于执行所述计算机程序时实现如权利要求1至8任一项所述报文检测方法的步骤。
  10. 一种可读存储介质，其特征在于，所述可读存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现如权利要求1至8任一项所述攻击检测方法的步骤。
PCT/CN2021/081440 2020-07-27 2021-03-18 一种报文检测方法、设备及可读存储介质 WO2022021897A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010732006.3 2020-07-27
CN202010732006.3A CN114070899B (zh) 2020-07-27 2020-07-27 一种报文检测方法、设备及可读存储介质

Publications (1)

Publication Number Publication Date
WO2022021897A1 true WO2022021897A1 (zh) 2022-02-03

Family

ID=80037457

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/081440 WO2022021897A1 (zh) 2020-07-27 2021-03-18 一种报文检测方法、设备及可读存储介质

Country Status (2)

Country Link
CN (1) CN114070899B (zh)
WO (1) WO2022021897A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114884883A (zh) * 2022-06-16 2022-08-09 深圳星云智联科技有限公司 一种流量转发方法、装置、设备及存储介质
CN116910631A (zh) * 2023-09-14 2023-10-20 深圳市智慧城市科技发展集团有限公司 数组对比方法、装置、电子设备及可读存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101895521A (zh) * 2009-05-22 2010-11-24 中国科学院研究生院 一种网络蠕虫检测与特征自动提取方法及其系统
CN105187411A (zh) * 2015-08-18 2015-12-23 福建省海峡信息技术有限公司 一种分布式异常检测网络数据流的方法
CN109391599A (zh) * 2017-08-10 2019-02-26 蓝盾信息安全技术股份有限公司 一种基于https流量特征分析的僵尸网络通讯信号的检测系统
CN109462521A (zh) * 2018-11-26 2019-03-12 华北电力大学 一种适用于源网荷互动工控系统的网络流量异常检测方法
US10516686B2 (en) * 2013-11-04 2019-12-24 At&T Intellectual Property I, L.P. Malware and anomaly detection via activity recognition based on sensor data
US20200137084A1 (en) * 2018-10-25 2020-04-30 EMC IP Holding Company LLC Protecting against and learning attack vectors on web artifacts

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20160002058A (ko) * 2014-06-30 2016-01-07 한국전자통신연구원 모드버스 통신 패턴 학습에 기반한 비정상 트래픽 탐지 장치 및 방법
KR101714520B1 (ko) * 2015-10-30 2017-03-09 현대자동차주식회사 차량 내 네트워크 공격 탐지 방법 및 장치
US10432661B2 (en) * 2016-03-24 2019-10-01 Cisco Technology, Inc. Score boosting strategies for capturing domain-specific biases in anomaly detection systems
US10389741B2 (en) * 2016-03-24 2019-08-20 Cisco Technology, Inc. Edge-based detection of new and unexpected flows
US10764310B2 (en) * 2016-03-25 2020-09-01 Cisco Technology, Inc. Distributed feedback loops from threat intelligence feeds to distributed machine learning systems
CN106060043B (zh) * 2016-05-31 2019-06-07 北京邮电大学 一种异常流量的检测方法及装置
US10733530B2 (en) * 2016-12-08 2020-08-04 Resurgo, Llc Machine learning model evaluation in cyber defense
CN107154950B (zh) * 2017-07-24 2021-05-04 深信服科技股份有限公司 一种日志流异常检测的方法及系统
CN108958217A (zh) * 2018-06-20 2018-12-07 长春工业大学 一种基于深度学习的can总线报文异常检测方法
CN111078488B (zh) * 2018-10-18 2021-11-09 杭州海康威视数字技术股份有限公司 数据采集方法、装置、存储介质及系统
CN109391624A (zh) * 2018-11-14 2019-02-26 国家电网有限公司 一种基于机器学习的终端接入数据异常检测方法及装置
CN110011999B (zh) * 2019-03-29 2021-02-26 东北大学 基于深度学习的IPv6网络DDoS攻击检测系统及方法
CN110365648A (zh) * 2019-06-14 2019-10-22 东南大学 一种基于决策树的车载can总线异常检测方法
CN110300127A (zh) * 2019-07-31 2019-10-01 广东电网有限责任公司 一种基于深度学习的网络入侵检测方法、装置以及设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101895521A (zh) * 2009-05-22 2010-11-24 中国科学院研究生院 一种网络蠕虫检测与特征自动提取方法及其系统
US10516686B2 (en) * 2013-11-04 2019-12-24 At&T Intellectual Property I, L.P. Malware and anomaly detection via activity recognition based on sensor data
CN105187411A (zh) * 2015-08-18 2015-12-23 福建省海峡信息技术有限公司 一种分布式异常检测网络数据流的方法
CN109391599A (zh) * 2017-08-10 2019-02-26 蓝盾信息安全技术股份有限公司 一种基于https流量特征分析的僵尸网络通讯信号的检测系统
US20200137084A1 (en) * 2018-10-25 2020-04-30 EMC IP Holding Company LLC Protecting against and learning attack vectors on web artifacts
CN109462521A (zh) * 2018-11-26 2019-03-12 华北电力大学 一种适用于源网荷互动工控系统的网络流量异常检测方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114884883A (zh) * 2022-06-16 2022-08-09 深圳星云智联科技有限公司 一种流量转发方法、装置、设备及存储介质
CN114884883B (zh) * 2022-06-16 2024-01-30 深圳星云智联科技有限公司 一种流量转发方法、装置、设备及存储介质
CN116910631A (zh) * 2023-09-14 2023-10-20 深圳市智慧城市科技发展集团有限公司 数组对比方法、装置、电子设备及可读存储介质
CN116910631B (zh) * 2023-09-14 2024-01-05 深圳市智慧城市科技发展集团有限公司 数组对比方法、装置、电子设备及可读存储介质

Also Published As

Publication number Publication date
CN114070899B (zh) 2023-05-12
CN114070899A (zh) 2022-02-18

Similar Documents

Publication Publication Date Title
US11783035B2 (en) Multi-representational learning models for static analysis of source code
US10855700B1 (en) Post-intrusion detection of cyber-attacks during lateral movement within networks
US10735438B2 (en) System, method and computer-accessible medium for network intrusion detection
US10764313B1 (en) Method and system for protection against network-based cyber threats
US10200384B1 (en) Distributed systems and methods for automatically detecting unknown bots and botnets
Wang et al. Trafficav: An effective and explainable detection of mobile malware behavior using network traffic
US8763103B2 (en) Systems and methods for inhibiting attacks on applications
US11816214B2 (en) Building multi-representational learning models for static analysis of source code
US11647037B2 (en) Penetration tests of systems under test
WO2022021897A1 (zh) 一种报文检测方法、设备及可读存储介质
CN112788034B (zh) 对抗网络攻击的处理方法、装置、电子设备和存储介质
Xiao et al. HomeShield: A credential-less authentication framework for smart home systems
Hsiao et al. Cross-level behavioral analysis for robust early intrusion detection
Janagam et al. Analysis of network intrusion detection system with machine learning algorithms (deep reinforcement learning algorithm)
CN114553513A (zh) 一种通信检测方法、装置及设备
Blackwell Ramit-Rule-Based Alert Management Information Tool
Lakra HSNORT: A Hybrid intrusion detection system using artificial intelligence with snort
JP2022541250A (ja) インラインマルウェア検出
Zalbina et al. HTTP Attack Detection System Based on HTTP Inspect Preprocessor and Rule Options
Drakos Implement a security policy and identify Advance persistent threats (APT) with ZEEK anomaly detection mechanism
Araujo et al. Deception-enhanced threat sensing for resilient intrusion detection
Todd et al. Alert verification evasion through server response forging
Dzulqarnain Investigating IoT malware characteristics to improve network security
TWI741698B (zh) 察覺惡意攻擊的方法及網路安全管理裝置
Salemi et al. " Automated rules generation into Web Application Firewall using Runtime Application Self-Protection

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21849842

Country of ref document: EP

Kind code of ref document: A1