WO2023056808A1 - 加密恶意流量检测方法、装置、存储介质及电子装置 - Google Patents

加密恶意流量检测方法、装置、存储介质及电子装置 Download PDF

Info

Publication number
WO2023056808A1
WO2023056808A1 PCT/CN2022/116590 CN2022116590W WO2023056808A1 WO 2023056808 A1 WO2023056808 A1 WO 2023056808A1 CN 2022116590 W CN2022116590 W CN 2022116590W WO 2023056808 A1 WO2023056808 A1 WO 2023056808A1
Authority
WO
WIPO (PCT)
Prior art keywords
predetermined number
bilstm
target
traffic
head attention
Prior art date
Application number
PCT/CN2022/116590
Other languages
English (en)
French (fr)
Inventor
王继刚
谷勇浩
张晓青
徐昊
黄泽祺
王翼翡
田甜
王静
马苏安
付鹏
Original Assignee
中兴通讯股份有限公司
北京邮电大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司, 北京邮电大学 filed Critical 中兴通讯股份有限公司
Publication of WO2023056808A1 publication Critical patent/WO2023056808A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F40/00—Handling natural language data
    • G06F40/20—Natural language analysis
    • G06F40/279—Recognition of textual entities
    • G06F40/284—Lexical analysis, e.g. tokenisation or collocates
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/044—Recurrent networks, e.g. Hopfield networks
    • G06N3/0442—Recurrent networks, e.g. Hopfield networks characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G06N3/0455—Auto-encoder networks; Encoder-decoder networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G06N3/084—Backpropagation, e.g. using gradient descent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • Embodiments of the present disclosure relate to the communication field, and in particular, relate to a method, device, storage medium, and electronic device for detecting encrypted malicious traffic.
  • HTTPS Hyper Text Transfer Protocol Over Secure Socket
  • SSL/TLS Secure Sockets Layer/Transport Layer Security
  • FIG. 1 shows the encrypted malicious traffic in related technologies.
  • the detection flow chart includes: capturing network traffic from network card nodes, preprocessing the network traffic, specifically including data cleaning, data slicing, dimension processing, and data transformation, and using the preprocessed data as Data samples; use the convolutional neural network (Convolutional Neural Network, referred to as 1D-CNN) to extract the representational features of the data samples in the spatial domain.
  • Convolutional Neural Network Convolutional Neural Network
  • the LSTM neural network is used to extract the time series features of the traffic data, that is, the original traffic is input into the LSTM, and the before and after states of each byte are calculated through the LSTM. Use a classifier to combine the extracted features, then classify, and then process malicious traffic, that is, determine whether the network traffic is abnormal or not.
  • This method extracts the information of the first m bytes, and uses 1D-CNN and LSTM to learn the spatial and temporal features between bytes.
  • the byte itself is only a part of the key field and does not have complete semantic information. For example, if the length of the message is 13, 1 and 3 are only part of the length field, and they do not have actual semantics alone. Convolving individual bytes, the 1d-CNN model does not learn good spatial features.
  • LSTM focuses on forward information and lacks the learning of backward dependencies.
  • the model will pass the above information to the following, so the LSTM model pays more attention to the forward information.
  • the LSTM model lacks the ability to represent the backward dependency relationship.
  • the input slice is too short and lacks encrypted features.
  • the model extracts the first m bytes of traffic (100 bytes in the patent).
  • the first 100 bytes are mainly the information of the TCP three-way handshake, which has little correlation with the encryption process, and lacks the analysis of SSL/TLS traffic encryption information and the extraction of key fields.
  • the malicious traffic detection method based on the original input, the first m bytes of the traffic are extracted as input, which is just a simple slice of the traffic bytes, and the byte granularity does not have complete semantics, so the accurate semantics of the traffic cannot be learned.
  • Embodiments of the present disclosure provide an encrypted malicious traffic detection method, device, storage medium, and electronic device to at least solve the problem of extracting the first m bytes of traffic as an input in the malicious traffic detection method in the related art, which is only the traffic byte. Simple slicing cannot learn the accurate semantics of traffic, which leads to poor detection of malicious encrypted traffic.
  • a method for detecting encrypted malicious traffic including:
  • BiLSTM Bidirectional Long Short-Term Memory
  • Encrypted malicious traffic detection is performed according to the target BiLSTM model.
  • an encrypted malicious traffic detection device including:
  • An extraction module configured to extract various messages of a predetermined number of training samples
  • a constituting module configured to extract different key fields from various messages of the predetermined number of training samples, and form the predetermined number of word vectors with the extracted key fields;
  • the construction module is set to adopt multi-head attention Multi-Head Attention and the mode of bidirectional long-term short-term memory network BiLSTM, constructs target BiLSTM model according to the word vector of described predetermined quantity;
  • the detection module is configured to detect encrypted malicious traffic according to the target BiLSTM model.
  • a computer-readable storage medium where a computer program is stored in the storage medium, wherein the computer program is set to execute any one of the above method embodiments when running in the steps.
  • an electronic device including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to perform any of the above Steps in the method examples.
  • Fig. 1 is a flowchart of encrypted malicious traffic detection in the related art
  • FIG. 2 is a block diagram of the hardware structure of the mobile terminal of the encrypted malicious traffic detection method of the embodiment of the present disclosure
  • FIG. 3 is a flow chart of a method for detecting encrypted malicious traffic according to an embodiment of the present disclosure
  • FIG. 4 is an architecture diagram of encrypted malicious traffic detection based on word vector modeling according to an embodiment of the present disclosure
  • FIG. 5 is a flowchart of a model training process according to an embodiment of the present disclosure.
  • Fig. 6 is a block diagram of an encrypted malicious traffic detection device according to an embodiment of the present disclosure.
  • FIG. 2 is a block diagram of the hardware structure of the mobile terminal of the encrypted malicious traffic detection method of the embodiment of the present disclosure.
  • the mobile terminal may include one or more (only shown in FIG. 2 a) a processor 102 (the processor 102 may include but not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the above-mentioned mobile terminal may also include a memory for communication Functional transmission device 106 and input and output device 108 .
  • a processor 102 may include but not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA
  • a memory 104 for storing data
  • the above-mentioned mobile terminal may also include a memory for communication Functional transmission device 106 and input and output device 108 .
  • FIG. 2 is only for illustration, and it does not limit the structure of the above mobile terminal.
  • the mobile terminal may also include more or fewer components than those shown in FIG. 2, or have a different configuration from that shown in FIG.
  • the memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the encrypted malicious traffic detection method in the embodiment of the present disclosure, and the processor 102 runs the computer program stored in the memory 104, thereby Executing various functional applications and slicing processing of the service chain address pool is to realize the above-mentioned method.
  • the memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory.
  • the memory 104 may further include a memory that is remotely located relative to the processor 102, and these remote memories may be connected to the mobile terminal through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • the transmission device 106 is used to receive or transmit data via a network.
  • the specific example of the above network may include a wireless network provided by the communication provider of the mobile terminal.
  • the transmission device 106 includes a network interface controller (NIC for short), which can be connected to other network devices through a base station so as to communicate with the Internet.
  • the transmission device 106 may be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet in a wireless manner.
  • RF Radio Frequency
  • FIG. 3 is a flowchart of a method for detecting encrypted malicious traffic according to an embodiment of the present disclosure. As shown in FIG. 3 , the process Including the following steps:
  • Step S302 extracting various messages of a predetermined number of training samples
  • the above step S302 may specifically include: extracting the Client_Hello message, the Server_Hello message and the Certificate message of the predetermined number of training samples.
  • Step S304 extracting different key fields from various messages of the predetermined number of training samples, and forming the predetermined number of word vectors from the extracted key fields;
  • Step S306 using multi-head attention Multi-Head Attention and bidirectional long-short-term memory network BiLSTM, constructing a target BiLSTM model according to the predetermined number of word vectors;
  • Step S308 performing encrypted malicious traffic detection according to the target BiLSTM model.
  • step S306 may specifically include:
  • step S2061 may specifically include:
  • the target BiLSTM model is tested according to the test samples to obtain the accuracy rate Acc, recall rate Rec, precision rate Pre and F1 score.
  • the above step S304 may specifically include: processing the extracted key fields into target key fields with the same field length; forming the word vectors with the target key fields.
  • the lengths of the predetermined number of word vectors are unified according to the preset correspondence between packets and lengths.
  • FIG. 4 is an architecture diagram of encrypted malicious traffic detection based on word vector modeling according to an embodiment of the present disclosure. As shown in FIG. 4 , it includes: a preprocessing stage, a model building and training stage, and a model testing stage.
  • the raw traffic obtained from the network environment needs to be preprocessed before it can be input into the model.
  • the specific process of the preprocessing stage is as follows.
  • the bidirectional flow is divided according to the flow quintuple, and the first Client_Hello, Server_Hello and Certificate messages of each bidirectional flow are extracted based on the transport layer protocol in combination with the direction of the bidirectional flow.
  • Key field extraction Extract the byte value of the corresponding key field according to different messages. For example, for Client_Hello, fields such as handshake message type, message length, and supported encryption components are extracted, and the specific extracted fields are shown in Table 1.
  • Uniform field length In order to eliminate the influence of different key field lengths, in this embodiment, truncation and zero padding are performed on each feature field. For feature fields that do not satisfy 4 bytes, 0 is added to the high bits, and for feature fields that exceed 4 bytes Fields are truncated, and for fields whose lower bits are truncated, repeat the above process until there are no remaining bytes.
  • Uniform sample length Unify the input lengths of all samples. For each message, select Client_hello: 20, Server_hello: 10, and Certificate: 25, take 55 as the total length, and finally use (55, 4) as the input dimension.
  • FIG. 5 is the flowchart of the model training process according to the embodiment of the present disclosure, as shown in Fig. 5, in the model construction phase, this embodiment consists of Multi-Head Attention, BiLSTM and linear layer (Linear1, Linear2 )composition. Multi-Head Attention and neuron settings of each layer are shown in Table 2.
  • the Adam optimizer with a learning rate of 0.0001 is used to participate in the gradient descent process.
  • the loss function of the model is the cross entropy of the label y_label and the output y_pred.
  • this embodiment uses the training set to train the model by minimizing the reconstruction error.
  • the method of Multi-Head attention and BiLSTM as shown in Figure 5 is used , after the training is completed, the model can well learn the semantic relationship between the various fields of the traffic.
  • the model training process is as follows.
  • the sample X (x1, x2, . . . xn) is trained on the current sample space.
  • V W V X
  • Q, K, and V are Query, Key, and Value defined in the attention mechanism, respectively
  • WQ, WK, and WV are n*n matrices corresponding to Q, K, and V, respectively.
  • the input information X is encoded and selected. By calculating the correlation with other fields, the weight of the corresponding key fields is increased, and some more important key fields are highlighted. At this time, the encoding The final result is X', and X' is input into the BiLSTM layer.
  • the prediction result y_pred is output, and the cross-entropy loss of y_label and y_pred is calculated, and the reverse gradient transfer is performed to update the parameters of each neuron in the model.
  • the processed input is directly input into the model to obtain the detection result.
  • the normal traffic in the data set is composed of traffic generated by normal processes, and the abnormal traffic is composed of traffic generated by malicious processes. There are 18,565 flows in total, including 8,801 normal samples and 9,764 malicious samples.
  • the training set is randomly divided according to the ratio of 2:1 between the training set and the test set.
  • the number of samples in the training set is 12431, and the number of samples in the test set is 6134. There is no intersection between the training set and the test set.
  • the training set and the verification set are divided according to the ratio of 4:1.
  • the verification set is aimed at judging whether the model has converged and adjusting parameters during the model learning process, and does not participate in training and testing.
  • the experimental performance indicators include accuracy rate Acc, recall rate Rec, precision rate Pre and F1 score.
  • the calculation process is shown in the following formula:
  • TP is the number of samples of malicious traffic detected as malicious traffic
  • TN is the number of samples of normal traffic detected as normal traffic
  • FP is the number of samples of normal traffic detected as malicious traffic
  • FN is the number of samples of malicious traffic detected as normal traffic.
  • This embodiment analyzes the time performance indicators of each method in terms of feature extraction, model training time and model testing time.
  • feature extraction time the original input ⁇ field word vector ⁇ load size behavior sequence ⁇ flow-level feature+encrypted feature, since the original input is the same as the field information, only the payload of the first few packets needs to be extracted Information, compared with other methods, does not need to traverse all the packets of the flow, so the feature extraction time is much shorter than other methods;
  • the model training time the load size behavior sequence ⁇ flow-level features + encrypted features ⁇ original input ⁇ Field word vector, because the training of the neural network requires more epochs and the complexity of the model, the method proposed in the patent has the problem of long model training time; in terms of model testing time, the methods are basically the same.
  • the present invention intends to use offline training and online testing to overcome the shortcoming of long training time.
  • features can be extracted faster , improve the real-time performance of flow detection, and give detection results with high accuracy.
  • key fields are extracted to form word vectors, and the word vector modeling method of increasing the corresponding weight through Multi-HeadAttention is used, and the encrypted malicious traffic detection system is constructed by using the BiLSTM model.
  • the BiLSTM model First, distinguish key fields are extracted to form field word vectors, and the weight of key fields is increased through Multi-Head Attention, and finally the long-distance dependence of traffic is obtained through BiLSTM.
  • BiLSTM BiLSTM.
  • FIG. 6 is a block diagram of an encrypted malicious traffic detection device according to an embodiment of the present disclosure. As shown in FIG. 6 , it includes:
  • Extraction module 62 is configured to extract various messages of a predetermined number of training samples
  • the composition module 64 is configured to extract different key fields from various messages of the predetermined number of training samples, and form the predetermined number of word vectors with the extracted key fields;
  • Construction module 66 is set to adopt multi-head attention Multi-Head Attention and the mode of two-way long short-term memory network BiLSTM, constructs target BiLSTM model according to the word vector of described predetermined quantity;
  • the detection module 68 is configured to detect encrypted malicious traffic according to the target BiLSTM model.
  • the building blocks 66 include:
  • Encoding selects submodule is set to pass through the Multi-Head Attention layer of BiLSTM model, the word vector of described predetermined quantity is carried out encoding selection, obtains the sample after the encoding of described predetermined quantity;
  • the input submodule is configured to input the predetermined number of encoded samples into the BiLSTM layer of the BiLSTM model, and output the predetermined number of prediction results y_pred after passing through the linear layer and the softmax layer;
  • the update sub-module is configured to perform reverse gradient transfer through the cross-entropy loss of the predetermined number of prediction results y_pred and the corresponding label y_label, update the neuron parameters of the BiLSTM model, and obtain the trained target BiLSTM model.
  • the encoding selection submodule is further set to
  • the extraction module 62 is further configured to
  • the device also includes:
  • the test module is configured to test the target BiLSTM model according to the test sample to obtain the accuracy rate Acc, recall rate Rec, precision rate Pre and F1 scores.
  • the constituent modules 64 include:
  • the processing submodule is configured to process the extracted key field as a target key field with the same field length
  • a submodule is configured to form the word vector with the target key field.
  • the device also includes:
  • the length unification module is configured to unify the lengths of the predetermined number of word vectors according to the preset correspondence between messages and lengths.
  • Embodiments of the present disclosure also provide a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps in any one of the above method embodiments when running.
  • the above-mentioned computer-readable storage medium may include but not limited to: U disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM) , mobile hard disk, magnetic disk or optical disk and other media that can store computer programs.
  • ROM read-only memory
  • RAM random access memory
  • mobile hard disk magnetic disk or optical disk and other media that can store computer programs.
  • Embodiments of the present disclosure also provide an electronic device, including a memory and a processor, where a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.
  • the electronic device may further include a transmission device and an input and output device, wherein the transmission device is connected to the processor, and the input and output device is connected to the processor.
  • each module or each step of the above-mentioned disclosure can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network composed of multiple computing devices In fact, they can be implemented in program code executable by a computing device, and thus, they can be stored in a storage device to be executed by a computing device, and in some cases, can be executed in an order different from that shown here. Or described steps, or they are fabricated into individual integrated circuit modules, or multiple modules or steps among them are fabricated into a single integrated circuit module for implementation. As such, the present disclosure is not limited to any specific combination of hardware and software.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Artificial Intelligence (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Computational Linguistics (AREA)
  • Health & Medical Sciences (AREA)
  • Data Mining & Analysis (AREA)
  • Computer Security & Cryptography (AREA)
  • Mathematical Physics (AREA)
  • Biomedical Technology (AREA)
  • Biophysics (AREA)
  • Evolutionary Computation (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Molecular Biology (AREA)
  • Computing Systems (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Hardware Design (AREA)
  • Audiology, Speech & Language Pathology (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

实施例提供了一种加密恶意流量检测方法、装置、存储介质及电子装置，该方法包括：提取预定数量的训练样本的多种报文（S302）；分别对该预定数量的训练样本的多种报文提取不同的关键字段，并将提取的该关键字段构成该预定数量的词向量（S304）；采用多头注意力和BiLSTM的方式，根据该预定数量的词向量构建目标BiLSTM模型（S306）；根据该目标BiLSTM模型进行加密恶意流量检测（S308），可以解决相关技术中恶意流量检测方法中，提取流量的前m个字节作为输入只是对流量字节的简单切片，无法学习到流量的准确语义，导致恶意加密流量检测效果不佳的问题，通过多头注意力的方式，提高关键字段的权重，并通过BiLSTM获取前向和后向的长距离依赖，实现更好的恶意加密流量检测效果。

Description

加密恶意流量检测方法、装置、存储介质及电子装置
相关申请的交叉引用
本公开基于2021年10月08日提交的发明名称为“加密恶意流量检测方法、装置、存储介质及电子装置”的中国专利申请CN202111173358.0，并且要求该专利申请的优先权，通过引用将其所公开的内容全部并入本公开。
技术领域
本公开实施例涉及通信领域，具体而言，涉及一种加密恶意流量检测方法、装置、存储介质及电子装置。
背景技术
在各种窃听和中间人攻击的背景下，在安全和隐私的考虑下，HTTPS(Hyper Text Transfer Protocol Over Secure Socket)逐渐占据主流，随之带来的是加密流量比例增加。在保护传输内容的同时，恶意攻击也使用安全套接层/传输层安全(Secure Sockets Layer/Transport layer Security，简称为SSL/TLS)协议进行加密，伪装成正常流量。
相关技术中提出基于CNN和长短期记忆网络(Long Short-Term Memory，简称为BiLSTM)的异常流量检测方法，学习原始流量数据的空间域的表征和时序特征，图1是相关技术中加密恶意流量检测的流程图，如图1所示，包括：从网卡节点中捕获网络流量，对网络流量进行预处理，具体包括数据清洗、数据切片、维处理以及数据变换，并将预处理后的数据作为数据样本；利用卷积神经网络(Convolutional Neural Network，简称为1D-CNN)对数据样本进行空间域的表征特征提取。利用LSTM神经网络对流量数据进行时序特征提取，即将原始流量输入到LSTM中，通过LSTM计算每个字节的前后状态。使用分类器对提取的特征进行合并，然后进行分类，之后进行恶意流量处理，即判定网络流量异常与否。
该方法提取前m个字节的信息，利用1D-CNN和LSTM学习字节之间的空间和时间特征。而本身字节只是关键字段的一部分，本身并不具有完整语义信息，例如长度报文，若长度为13，1和3只是长度字段的一部分，单独并不具备实际语义。对单独的字节进行卷积，1d-CNN模型并没有学习到很好的空间特征。
LSTM关注前向的信息，缺失后向依赖关系的学习。在LSTM模型中，模型会传递上文的信息给下文，因此LSTM模型更加关注前向信息。流量数据包中的各字节之间存在从前往后的序列关系，也存在后向依赖关系，LSTM模型缺少后向依赖关系表征能力。
输入切片过短，缺少加密特征。在该专利给出的输入中，模型提取流量的前m个字节(专利中是100字节)。根据通信过程分析，前100字节主要是TCP三次握手的信息，与加密过程相关性不大，缺乏对SSL/TLS流量加密信息的分析与关键字段的提取。
基于原始输入的恶意流量检测方法中，提取流量的前m个字节作为输入，只是对流量字节的简单切片，字节粒度上并没有完整的语义，无法学习到流量的准确语义。
针对相关技术中恶意流量检测方法中，提取流量的前m个字节作为输入只是对流量字节的简单切片，无法学习到流量的准确语义，导致恶意加密流量检测效果不佳的问题，尚未提 出解决方案。
发明内容
本公开实施例提供了一种加密恶意流量检测方法、装置、存储介质及电子装置，以至少解决相关技术中恶意流量检测方法中，提取流量的前m个字节作为输入只是对流量字节的简单切片，无法学习到流量的准确语义，导致恶意加密流量检测效果不佳的问题。
根据本公开的一个实施例，提供了一种加密恶意流量检测方法，包括：
提取预定数量的训练样本的多种报文；
分别对所述预定数量的训练样本的多种报文提取不同的关键字段，并将提取的所述关键字段构成所述预定数量的词向量；
采用多头注意力Multi-Head Attention和双向长短期记忆网络(Bidirectional Long Short-Term Memory，BiLSTM)的方式，根据所述预定数量的词向量构建目标BiLSTM模型；
根据所述目标BiLSTM模型进行加密恶意流量检测。
根据本公开的另一个实施例，还提供了一种加密恶意流量检测装置，包括：
提取模块，设置为提取预定数量的训练样本的多种报文；
构成模块，设置为分别对所述预定数量的训练样本的多种报文提取不同的关键字段，并将提取的所述关键字段构成所述预定数量的词向量；
构建模块，设置为采用多头注意力Multi-Head Attention和双向长短期记忆网络BiLSTM的方式，根据所述预定数量的词向量构建目标BiLSTM模型；
检测模块，设置为根据所述目标BiLSTM模型进行加密恶意流量检测。
根据本公开的又一个实施例，还提供了一种计算机可读的存储介质，所述存储介质中存储有计算机程序，其中，所述计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
根据本公开的又一个实施例，还提供了一种电子装置，包括存储器和处理器，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行上述任一项方法实施例中的步骤。
附图说明
图1是相关技术中加密恶意流量检测的流程图；
图2是本公开实施例的加密恶意流量检测方法的移动终端的硬件结构框图；
图3是根据本公开实施例的加密恶意流量检测方法的流程图；
图4是根据本公开实施例的基于词向量建模的加密恶意流量检测的架构图；
图5是根据本公开实施例的模型训练过程的流程图；
图6是根据本公开实施例的加密恶意流量检测装置的框图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本公开的实施例。
需要说明的是，本公开的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
本公开实施例中所提供的方法实施例可以在移动终端、计算机终端或者类似的运算装置中执行。以运行在移动终端上为例，图2是本公开实施例的加密恶意流量检测方法的移动终端的硬件结构框图，如图2所示，移动终端可以包括一个或多个(图2中仅示出一个)处理器102(处理器102可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)和用于存储数据的存储器104，其中，上述移动终端还可以包括用于通信功能的传输设备106以及输入输出设备108。本领域普通技术人员可以理解，图2所示的结构仅为示意，其并不对上述移动终端的结构造成限定。例如，移动终端还可包括比图2中所示更多或者更少的组件，或者具有与图2所示不同的配置。
存储器104可用于存储计算机程序，例如，应用软件的软件程序以及模块，如本公开实施例中的加密恶意流量检测方法对应的计算机程序，处理器102通过运行存储在存储器104内的计算机程序，从而执行各种功能应用以及业务链地址池切片处理，即实现上述的方法。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至移动终端。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置106用于经由一个网络接收或者发送数据。上述的网络具体实例可包括移动终端的通信供应商提供的无线网络。在一个实例中，传输装置106包括一个网络适配器(Network Interface Controller，简称为NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置106可以为射频(Radio Frequency，简称为RF)模块，其用于通过无线方式与互联网进行通讯。
在本实施例中提供了一种运行于上述移动终端或网络架构的加密恶意流量检测方法，图3是根据本公开实施例的加密恶意流量检测方法的流程图，如图3所示，该流程包括如下步骤：
步骤S302，提取预定数量的训练样本的多种报文；
本公开实施例中，上述步骤S302具体可以包括：提取所述预定数量的训练样本的Client_Hello报文、Server_Hello报文以及Certificate报文。
步骤S304，分别对所述预定数量的训练样本的多种报文提取不同的关键字段，并将提取的所述关键字段构成所述预定数量的词向量；
步骤S306，采用多头注意力Multi-Head Attention和双向长短期记忆网络BiLSTM的方式，根据所述预定数量的词向量构建目标BiLSTM模型；
步骤S308，根据所述目标BiLSTM模型进行加密恶意流量检测。
通过上述步骤S302至S308，可以解决相关技术中恶意流量检测方法中，提取流量的前m个字节作为输入只是对流量字节的简单切片，无法学习到流量的准确语义，导致恶意加密流量检测效果不佳的问题，提取多种报文的关键字段，拼接为词向量，通过Multi-Head Attention的方式，提高关键字段的权重，并通过BiLSTM获取前向和后向的长距离依赖，实现更好的恶意加密流量检测效果。
本公开实施例中，上述步骤S306具体可以包括：
S3061，通过BiLSTM模型的Multi-Head Attention层，对所述预定数量的词向量进行编码选择，得到所述预定数量的编码后的样本；
进一步的，上述步骤S2061具体可以包括：
确定所述预定数量的词向量中的每个词向量的Query、Key以及Value：
Query＝W QX；
Key＝W KX；
Value＝W vX，其中，X为所述词向量，W Q、W K、W V为所述BiLSTM模型的神经元参数，W Q、W K、W V是分别对应所述Query、所述Key以及所述Value的n*n矩阵，n为正整数；
根据所述Query、所述Key以及所述Value从所述每个词向量提取多个信息；
拼接所述多个信息得到所述每个词向量的注意力分布；
确定所述每个词向量的注意力分布为所述每个词向量的编码后的样本。
S3062，将所述预定数量的编码后的样本输入到所述BiLSTM模型的BiLSTM层中，经过线性层与softmax层后，输出所述预定数量的预测结果y_pred；
S3063，通过所述预定数量的预测结果y_pred与对应的标签y_label的交叉熵损失进行反向梯度传递，更新所述BiLSTM模型的神经元参数，得到训练好的所述目标BiLSTM模型。
在一实施例中，在上述步骤S306之后，根据测试样本对所述目标BiLSTM模型进行测试，得到准确率Acc、召回率Rec、精确率Pre和F1分数。
本实施例中，上述步骤S304具体可以包括：将提取的所述关键字段处理为字段长度相同的目标关键字段；将所述目标关键字段构成所述词向量。
在另一实施例中，在上述步骤S204之后，根据预先设置的报文与长度的对应关系对所述预定数量的词向量的长度进行统一。
图4是根据本公开实施例的基于词向量建模的加密恶意流量检测的架构图，如图4所示，包括：预处理阶段、模型构建与训练阶段和模型测试阶段。
预处理阶段，从网络环境中获取的原始流量需要进行一定预处理才能输入到模型，预处理阶段的具体流程如下。
报文提取。本实施例按照流量五元组划分双向流，并结合双向流的方向基于传输层协议提取了每个双向流的第一个Client_Hello、Server_Hello以及Certificate报文。
关键字段提取。根据不同的报文，提取相应的关键字段的字节值。例如对于Client_Hello，提取握手报文类型、报文长度、支持加密组件等字段，具体提取字段如表1所示。
统一字段长度。为了消除不同关键字段长度的影响，本实施例对各特征字段进行了截长补零的操作，针对不满足4个字节的特征字段，在高位补0，针对超过4个字节的特征字段，进行截断，对于低位被截取的字段，重复以上过程，直至没有字节残余。
统一样本长度。对所有样本的输入长度进行统一，对于各个报文，分别选取Client_hello：20、Server_hello：10以及Certificate：25，以55为总长度，最终以(55，4)作为输入维度。
表1
Figure PCTCN2022116590-appb-000001
Figure PCTCN2022116590-appb-000002
模型构建与训练阶段，图5是根据本公开实施例的模型训练过程的流程图，如图5所示，在模型构建阶段，本实施例由Multi-Head Attention、BiLSTM和线性层(Linear1、Linear2)组成。Multi-Head Attention和各层神经元设置如表2所示。使用学习率为0.0001的Adam优化器参与梯度下降过程。模型的损失函数是标签y_label和输出y_pred的交叉熵。
表2
模型构成 设置超参数
Multi-Head attention nums_head＝2
BiLSTM nums_layer＝1，hidden_num＝144
Dropout 0.3
Linear (288，84)
Linear (84，2)
在模型训练阶段，本实施例使用训练集，通过最小化重构误差对模型进行训练，为了学习关于字段之间的关系与上下文关系，采用如图5所示的Multi-Head attention和BiLSTM的方法，训练完成后模型能够很好的学到流量各个字段之间的语义关系。模型训练过程如下。
将样本X＝(x1，x2，...xn)在当前样本空间上进行训练。
根据以下公式计算当前样本的Q、K、V：
Q＝W QX；
K＝W KX；
V＝W VX；
其中，Q、K和V分别是attention机制中定义的Query、Key和Value，WQ、WK、WV是分别对应Q、K、V的n*n矩阵。
根据以下公式，利用多个查询Q＝[q1，q2，..，qn]来平行地计算，从输入信息中选择多个信息，每个注意力关注输入信息的不同部分，再进行拼接得到注意力分布：
Figure PCTCN2022116590-appb-000003
Figure PCTCN2022116590-appb-000004
通过Multi-Head Attention的方式，对输入信息X进行了编码选择，通过计算与其他字 段的相关性，提高了相应关键字段的权重，更突出某些更为重要的关键字段，此时编码后结果为X’，将X’输入到BiLSTM层中。
上次输出经过线性层与softmax层后，输出预测结果y_pred，通过计算y_label和y_pred的交叉熵损失，进行反向梯度传递，更新模型各神经元参数。
在模型测试阶段，对于新来的流量，根据前文所描述的数据预处理过程，将处理好的输入直接输入到模型即可得到检测结果。此时若y_pred＝1，则为正常流量，若y_pred＝0，则为恶意流量。
数据集正常流量由正常进程产生的流量组成，异常流量由恶意进程产生的流量构成，流量共有18565个，其中正常样本共有8801个，恶意样本共有9764个。根据训练集和测试集2∶1的比例随机划分训练集，训练集样本数目共有12431个，测试集共有6134个。训练集和测试集没有交集。其中训练集中，按照4∶1的比例，划分训练集和验证集。验证集针对模型学习过程中，判断模型是否收敛和进行调参，并没有参与训练与参与测试。
实验性能指标包括准确率Acc、召回率Rec、精确率Pre和F1分数，计算过程如以下公式所示：
Figure PCTCN2022116590-appb-000005
Figure PCTCN2022116590-appb-000006
Figure PCTCN2022116590-appb-000007
Figure PCTCN2022116590-appb-000008
其中，TP为恶意流量检测为恶意流量的样本数目，TN为正常流量检测为正常流量的样本数目，FP为正常流量检测为恶意流量的样本数目，FN为恶意流量检测为正常流量的样本数目。
实验结果如表3所示，与传统恶意加密流量检测方法(流级特征+加密特征、负载大小行为序列、原始输入)相比，本发明在各项指标上均有提升，可以更好的检测恶意流量。与传统机器学习方法对比，神经网络通过构建多层神经元提取不同层次的数据特征，表征能力更强；另一方面，本专利通过Multi-Head Attention机制，根据权重，提高各个关键字段的重要性，并且通过BiLSTM机制，提取了输入前向和后向的长距离依赖关系，使其有着更强的表征能力，并显著提升了模型对恶意加密流量的检测能力。
表3
Figure PCTCN2022116590-appb-000009
本实施例分析了各方法从特征提取、模型训练时间以及模型测试时间三个方面的时间性 能指标。其中，如表4所示，在提取特征时间上，原始输入＜字段词向量＜负载大小行为序列＜流级特征+加密特征，由于原始输入和字段信息一样，只需要提取前几个包的负载信息，与其他方法相比，并不需要遍历流的所有包，因此在提取特征时间上，要远小于其他方法；在模型训练时间上，负载大小行为序列＜流级特征+加密特征＜原始输入＜字段词向量，由于神经网络的训练需要更多的epoch，以及模型的复杂性，专利提出的方法存在模型训练时间较长的问题；在模型测试时间上，各方法基本一致。因此出于以上的分析，本发明拟采用离线训练，在线测试的方式，来克服训练时间较长的缺点，同时，模型训练好后，由于提取特征时间上的优越性，可以更快的提取特征，提高流量检测的实时性，高准确率的给出检测结果。
本公开实施例，提取关键字段，构成词向量，并通过Multi-HeadAttention提升相应权重的词向量建模方法，并使用BiLSTM模型，构建了加密恶意流量检测系统。首先提取具有区分度的关键字段，构成字段词向量，并通过Multi-Head Attention提高关键字段的权重，最后通过BiLSTM获取流量的长距离依赖关系。相较于传统的提取流级统计特征的检测方法，无需等待流量全部结束，有效提高了特征提取的时间；相比原始输入的检测方法，通过提取关键字段，去除了流量负载中无用的随机字节信息和加密后的信息，保留了有效特征。
表4
Figure PCTCN2022116590-appb-000010
根据本公开的另一个实施例，还提供了一种加密恶意流量检测装置，图6是根据本公开实施例的加密恶意流量检测装置的框图，如图6所示，包括：
提取模块62，设置为提取预定数量的训练样本的多种报文；
构成模块64，设置为分别对所述预定数量的训练样本的多种报文提取不同的关键字段，并将提取的所述关键字段构成所述预定数量的词向量；
构建模块66，设置为采用多头注意力Multi-Head Attention和双向长短期记忆网络BiLSTM的方式，根据所述预定数量的词向量构建目标BiLSTM模型；
检测模块68，设置为根据所述目标BiLSTM模型进行加密恶意流量检测。
在一示例性实施例中，所述构建模块66包括：
编码选择子模块，设置为通过BiLSTM模型的Multi-Head Attention层，对所述预定数 量的词向量进行编码选择，得到所述预定数量的编码后的样本；
输入子模块，设置为将所述预定数量的编码后的样本输入到所述BiLSTM模型的BiLSTM层中，经过线性层与softmax层后，输出所述预定数量的预测结果y_pred；
更新子模块，设置为通过所述预定数量的预测结果y_pred与对应的标签y_label的交叉熵损失进行反向梯度传递，更新所述BiLSTM模型的神经元参数，得到训练好的所述目标BiLSTM模型。
在一示例性实施例中，所述编码选择子模块，还设置为
确定所述预定数量的词向量中的每个词向量的Query、Key以及Value：
Query＝W QX；
Key＝W KX；
Value＝W VX，其中，X为所述词向量，W Q、W K、W V为所述BiLSTM模型的神经元参数，W Q、W K、W V是分别对应所述Query、所述Key以及所述Value的n*n矩阵，n为正整数；
根据所述Query、所述Key以及所述Value从所述每个词向量提取多个信息；
拼接所述多个信息得到所述每个词向量的注意力分布；
确定所述每个词向量的注意力分布为所述每个词向量的编码后的样本。
在一示例性实施例中，所述提取模块62，还设置为
提取所述预定数量的训练样本的Client_Hello报文、Seiver_Hello报文以及Certificate报文。
在一示例性实施例中，所述装置还包括：
测试模块，设置为根据测试样本对所述目标BiLSTM模型进行测试，得到准确率Acc、召回率Rec、精确率Pre和F1分数。
在一示例性实施例中，所述构成模块64包括：
处理子模块，设置为将提取的所述关键字段处理为字段长度相同的目标关键字段；
构成子模块，设置为将所述目标关键字段构成所述词向量。
在一示例性实施例中，所述装置还包括：
长度统一模块，设置为根据预先设置的报文与长度的对应关系对所述预定数量的词向量的长度进行统一。
本公开的实施例还提供了一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序，其中，该计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
在一个示例性实施例中，上述计算机可读存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储计算机程序的介质。
本公开的实施例还提供了一种电子装置，包括存储器和处理器，该存储器中存储有计算机程序，该处理器被设置为运行计算机程序以执行上述任一项方法实施例中的步骤。
在一个示例性实施例中，上述电子装置还可以包括传输设备以及输入输出设备，其中，该传输设备和上述处理器连接，该输入输出设备和上述处理器连接。
本实施例中的具体示例可以参考上述实施例及示例性实施方式中所描述的示例，本实施 例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本公开的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本公开不限制于任何特定的硬件和软件结合。
以上所述仅为本公开的优选实施例而已，并不用于限制本公开，对于本领域的技术人员来说，本公开可以有各种更改和变化。凡在本公开的原则之内，所作的任何修改、等同替换、改进等，均应包含在本公开的保护范围之内。

Claims (10)

  1. 一种加密恶意流量检测方法，包括：
    提取预定数量的训练样本的多种报文；
    分别对所述预定数量的训练样本的多种报文提取不同的关键字段，并将提取的所述关键字段构成所述预定数量的词向量；
    采用多头注意力Multi-Head Attention和双向长短期记忆网络BiLSTM的方式，根据所述预定数量的词向量构建目标BiLSTM模型；
    根据所述目标BiLSTM模型进行加密恶意流量检测。
  2. 根据权利要求1所述的方法，其中，采用多头注意力Multi-Head Attention和双向长短期记忆网络BiLSTM的方式，根据所述预定数量的词向量构建目标BiLSTM模型包括：
    通过BiLSTM模型的Multi-Head Attention层，对所述预定数量的词向量进行编码选择，得到所述预定数量的编码后的样本；
    将所述预定数量的编码后的样本输入到所述BiLSTM模型的BiLSTM层中，经过线性层与softmax层后，输出所述预定数量的预测结果y_pred；
    通过所述预定数量的预测结果y_pred与对应的标签y_label的交叉熵损失进行反向梯度传递，更新所述BiLSTM模型的神经元参数，得到训练好的所述目标BiLSTM模型。
  3. 根据权利要求2所述的方法，其中，通过BiLSTM模型的Multi-Head Attention层，对所述预定数量的词向量进行编码选择，得到编码后的样本包括：
    确定所述预定数量的词向量中的每个词向量的Query、Key以及Value：
    Query＝W QX；
    Key＝W KX；
    Value＝W VX，其中，X为所述词向量，W Q、W K、W V为所述BiLSTM模型的神经元参数，W Q、W K、W V是分别对应所述Query、所述Key以及所述Value的n*n矩阵，n为正整数；
    根据所述Query、所述Key以及所述Value从所述每个词向量提取多个信息；
    拼接所述多个信息得到所述每个词向量的注意力分布；
    确定所述每个词向量的注意力分布为所述每个词向量的编码后的样本。
  4. 根据权利要求1所述的方法，其中，提取预定数量的训练样本的多种报文包括：
    提取所述预定数量的训练样本的Client_Hello报文、Server_Hello报文以及Certificate报文。
  5. 根据权利要求1所述的方法，其中，在采用多头注意力Multi-Head Attention和双向长短期记忆网络BiLSTM的方式，根据所述预定数量的词向量构建目标BiLSTM模型之后，所述方法还包括：
    根据测试样本对所述目标BiLSTM模型进行测试，得到准确率Acc、召回率Rec、精确率Pre和F1分数。
  6. 根据权利要求1至5中任一项所述的方法，其中，将提取的所述关键字段构成所述预定数量的词向量包括：
    将提取的所述关键字段处理为字段长度相同的目标关键字段；
    将所述目标关键字段构成所述词向量。
  7. 根据权利要求6所述的方法，其中，在将提取的所述关键字段构成所述预定数量的词向量之后，所述方法还包括：
    根据预先设置的报文与长度的对应关系对所述预定数量的词向量的长度进行统一。
  8. 一种加密恶意流量检测装置，包括：
    提取模块，设置为提取预定数量的训练样本的多种报文；
    构成模块，设置为分别对所述预定数量的训练样本的多种报文提取不同的关键字段，并将提取的所述关键字段构成所述预定数量的词向量；
    构建模块，设置为采用多头注意力Multi-Head Attention和双向长短期记忆网络BiLSTM的方式，根据所述预定数量的词向量构建目标BiLSTM模型；
    检测模块，设置为根据所述目标BiLSTM模型进行加密恶意流量检测。
  9. 一种计算机可读的存储介质，所述存储介质中存储有计算机程序，其中，所述计算机程序被设置为运行时执行所述权利要求1至7任一项中所述的方法。
  10. 一种电子装置，包括存储器和处理器，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行所述权利要求1至7任一项中所述的方法。
PCT/CN2022/116590 2021-10-08 2022-09-01 加密恶意流量检测方法、装置、存储介质及电子装置 WO2023056808A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111173358.0 2021-10-08
CN202111173358.0A CN115967504A (zh) 2021-10-08 2021-10-08 加密恶意流量检测方法、装置、存储介质及电子装置

Publications (1)

Publication Number Publication Date
WO2023056808A1 true WO2023056808A1 (zh) 2023-04-13

Family

ID=85803884

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/116590 WO2023056808A1 (zh) 2021-10-08 2022-09-01 加密恶意流量检测方法、装置、存储介质及电子装置

Country Status (2)

Country Link
CN (1) CN115967504A (zh)
WO (1) WO2023056808A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116319107A (zh) * 2023-05-19 2023-06-23 新华三人工智能科技有限公司 一种数据流量识别模型训练方法及装置
CN116506216A (zh) * 2023-06-19 2023-07-28 国网上海能源互联网研究院有限公司 一种轻量化恶意流量检测存证方法、装置、设备及介质
CN116668198A (zh) * 2023-07-31 2023-08-29 南京争锋信息科技有限公司 基于深度学习的流量回放测试方法、装置、设备及介质
CN116708313A (zh) * 2023-08-08 2023-09-05 中国电信股份有限公司 流量检测方法、流量检测装置、存储介质和电子设备
CN117113352A (zh) * 2023-10-25 2023-11-24 西安热工研究院有限公司 Dcs上位机恶意可执行文件检测方法、系统、设备及介质
CN117811850A (zh) * 2024-03-01 2024-04-02 南京信息工程大学 一种基于STBformer模型的网络入侵检测方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111241294A (zh) * 2019-12-31 2020-06-05 中国地质大学（武汉） 基于依赖解析和关键词的图卷积网络的关系抽取方法
CN112307473A (zh) * 2019-08-01 2021-02-02 四川大学 一种基于Bi-LSTM网络和注意力机制的恶意JavaScript代码检测模型
CN112487109A (zh) * 2020-12-01 2021-03-12 朱胜青 实体关系抽取方法、终端和计算机可读存储介质
US11017173B1 (en) * 2017-12-22 2021-05-25 Snap Inc. Named entity recognition visual context and caption data
CN112926303A (zh) * 2021-02-23 2021-06-08 南京邮电大学 一种基于BERT-BiGRU的恶意URL检测方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11017173B1 (en) * 2017-12-22 2021-05-25 Snap Inc. Named entity recognition visual context and caption data
CN112307473A (zh) * 2019-08-01 2021-02-02 四川大学 一种基于Bi-LSTM网络和注意力机制的恶意JavaScript代码检测模型
CN111241294A (zh) * 2019-12-31 2020-06-05 中国地质大学（武汉） 基于依赖解析和关键词的图卷积网络的关系抽取方法
CN112487109A (zh) * 2020-12-01 2021-03-12 朱胜青 实体关系抽取方法、终端和计算机可读存储介质
CN112926303A (zh) * 2021-02-23 2021-06-08 南京邮电大学 一种基于BERT-BiGRU的恶意URL检测方法

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
LIU, YONGQIANG; XU, YI; HE, YONG-HUI; LIU, WEN-BIN: "Wind Power Prediction Method Based on Bidirectional long-Short Term Memory Neural Network", TIANJIN-LIGONG-DAXUE-XUEBAO = JOURNAL OF TIANJIN UNIVERSITY OF TECHNOLOGY, TIANJIN UNIVERSITY OF TECHNOLOGY, CN, vol. 36, no. 5, 31 October 2020 (2020-10-31), CN , pages 49 - 54, 59, XP009546252, ISSN: 1673-095X, DOI: 10.3969/j.issn.1673-095X.2020.05.011 *
SUN TINGTING; ZHANG CHUNHONG; JI YANG; HU ZHENG: "MSnet: Multi-Head Self-Attention Network for Distantly Supervised Relation Extraction", IEEE ACCESS, IEEE, USA, vol. 7, 1 January 1900 (1900-01-01), USA , pages 54472 - 54482, XP011723422, DOI: 10.1109/ACCESS.2019.2913316 *

Cited By (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116319107A (zh) * 2023-05-19 2023-06-23 新华三人工智能科技有限公司 一种数据流量识别模型训练方法及装置
CN116319107B (zh) * 2023-05-19 2023-08-18 新华三人工智能科技有限公司 一种数据流量识别模型训练方法及装置
CN116506216A (zh) * 2023-06-19 2023-07-28 国网上海能源互联网研究院有限公司 一种轻量化恶意流量检测存证方法、装置、设备及介质
CN116506216B (zh) * 2023-06-19 2023-09-12 国网上海能源互联网研究院有限公司 一种轻量化恶意流量检测存证方法、装置、设备及介质
CN116668198A (zh) * 2023-07-31 2023-08-29 南京争锋信息科技有限公司 基于深度学习的流量回放测试方法、装置、设备及介质
CN116668198B (zh) * 2023-07-31 2023-10-20 南京争锋信息科技有限公司 基于深度学习的流量回放测试方法、装置、设备及介质
CN116708313A (zh) * 2023-08-08 2023-09-05 中国电信股份有限公司 流量检测方法、流量检测装置、存储介质和电子设备
CN116708313B (zh) * 2023-08-08 2023-11-14 中国电信股份有限公司 流量检测方法、流量检测装置、存储介质和电子设备
CN117113352A (zh) * 2023-10-25 2023-11-24 西安热工研究院有限公司 Dcs上位机恶意可执行文件检测方法、系统、设备及介质
CN117113352B (zh) * 2023-10-25 2024-02-06 西安热工研究院有限公司 Dcs上位机恶意可执行文件检测方法、系统、设备及介质
CN117811850A (zh) * 2024-03-01 2024-04-02 南京信息工程大学 一种基于STBformer模型的网络入侵检测方法及系统
CN117811850B (zh) * 2024-03-01 2024-05-28 南京信息工程大学 一种基于STBformer模型的网络入侵检测方法及系统

Also Published As

Publication number Publication date
CN115967504A (zh) 2023-04-14

Similar Documents

Publication Publication Date Title
WO2023056808A1 (zh) 加密恶意流量检测方法、装置、存储介质及电子装置
CN110445653B (zh) 网络状态预测方法、装置、设备及介质
US10812358B2 (en) Performance-based content delivery
Wei et al. TRUST: A TCP throughput prediction method in mobile networks
Vlăduţu et al. Internet traffic classification based on flows' statistical properties with machine learning
US10027739B1 (en) Performance-based content delivery
Bacquet et al. Genetic optimization and hierarchical clustering applied to encrypted traffic identification
Lee et al. Performance analysis of local exit for distributed deep neural networks over cloud and edge computing
CN111431819A (zh) 一种基于序列化的协议流特征的网络流量分类方法和装置
CN103780501A (zh) 一种不可分小波支持向量机的对等网络流量识别方法
Li et al. ETCC: Encrypted Two‐Label Classification Using CNN
Safari Khatouni et al. Machine learning based classification accuracy of encrypted service channels: analysis of various factors
Meng et al. Packet representation learning for traffic classification
Zhou et al. Encrypted network traffic identification based on 2d-cnn model
Cai et al. Memg: Mobile encrypted traffic classification with markov chains and graph neural network
CN112437022B (zh) 网络流量识别方法、设备及计算机存储介质
Pang et al. A multi-modal approach for context-aware network traffic classification
CN113128626A (zh) 基于一维卷积神经网络模型的多媒体流细分类方法
Hu et al. tCLD-Net: a transfer learning internet encrypted traffic classification scheme based on convolution neural network and long short-term memory network
CN112839051A (zh) 基于卷积神经网络的加密流量实时分类方法及装置
Dener et al. RFSE-GRU: Data balanced classification model for mobile encrypted traffic in big data environment
Gomez et al. Efficient network telemetry based on traffic awareness
WO2023052827A1 (en) Processing a sequence of data items
Hagos et al. Classification of delay-based TCP algorithms from passive traffic measurements
Wehner et al. On learning hierarchical embeddings from encrypted network traffic

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22877830

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE