CN113556317A - Abnormal flow detection method and device based on network flow structure feature fusion - Google Patents
Abnormal flow detection method and device based on network flow structure feature fusionDownload PDFInfo
- Publication number
- CN113556317A CN113556317ACN202110633083.8ACN202110633083ACN113556317ACN 113556317 ACN113556317 ACN 113556317ACN 202110633083 ACN202110633083 ACN 202110633083ACN 113556317 ACN113556317 ACN 113556317A
- Authority
- CN
- China
- Prior art keywords
- network flow
- detected
- feature
- preset
- network
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
- G06F18/2413—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on distances to training or reference patterns
- G06F18/24147—Distances to closest patterns, e.g. nearest neighbour classification
Landscapes
- Engineering & Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- Physics & Mathematics (AREA)
- Bioinformatics & Computational Biology (AREA)
- General Physics & Mathematics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Life Sciences & Earth Sciences (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Translated fromChinese
Description
Technical Field
The invention relates to the technical field of network security, in particular to an abnormal traffic detection method and device based on network flow structural feature fusion.
Background
The network intrusion behavior is different from the traffic generated by the normal behavior of the network. By analyzing network traffic, network anomalous behavior can be detected. Therefore, network anomaly traffic detection is the key point of network intrusion detection research.
The current detection methods are mainly divided into two types, namely a detection method based on network flow and a detection method based on a network diagram; the detection method based on the network flow mainly calculates the statistical characteristics of the network flow according to the head information of the data packets, and combines the statistical method, the machine learning or the deep learning and other technologies to realize abnormal flow detection; the detection method based on the network diagram mainly discovers abnormal behaviors by mining the potential relation of communication modes in the network communication diagram.
However, the current work of network abnormal traffic detection has the following two disadvantages: 1. the existing network abnormal flow detection method is lack of network flow structure information, and the detection is carried out according to the extracted network flow content characteristics, so that the structure relation information among the network flows is ignored, the characteristics are incomplete, and the detection effect is influenced; 2. single type feature detection capability is insufficient: the existing detection method mainly depends on single type of characteristics for detection, and is easy to be disguised by an attacker so as to bypass detection, so that the detection effect is poor.
Disclosure of Invention
Aiming at the problems in the prior art, the embodiment of the invention provides an abnormal traffic detection method and device based on network flow structural feature fusion.
In a first aspect, an embodiment of the present invention provides an abnormal traffic detection method based on network flow structure feature fusion, including:
acquiring a network flow to be detected;
inputting the network flow to be detected to a preset prejudging device to obtain a judgment result corresponding to the network flow to be detected;
if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can be detected only by depending on the network flow structural characteristics, inputting the network flow to be detected to a preset network flow structural characteristic detector for detecting the network flow to be detected, and determining an abnormal network flow detection result;
if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can not be detected only by means of the network flow structural characteristics, inputting the network flow to be detected to a preset full-characteristic detector for detecting the network flow to be detected, and determining an abnormal network flow detection result; the preset full-feature detector is a detector constructed based on network flow features and network flow structural features.
Further, the preset network flow structure feature detector includes:
acquiring network flow characteristics of a data set; the network flow characteristics comprise identification characteristics and statistical characteristics of the network flow;
extracting structural features of the network flow based on the identification features of the network flow;
and constructing a preset network flow structural feature detector by adopting a KNN classification algorithm based on the structural features of the network flow.
Further, the preset full-feature detector comprises:
acquiring network flow characteristics of a data set; the network flow characteristics comprise identification characteristics and statistical characteristics of the network flow;
extracting structural features of the network flow based on the identification features of the network flow;
forming a full feature vector based on the structural features of the network flow and the network flow features;
and constructing a preset full-feature detector by adopting a KNN classification algorithm based on the full-feature vector.
Further, the identifying characteristics of the network flow include an IP address of the source node, an IP address of the destination node, a timestamp, a source port, and a destination port.
Further, the preset prejudger includes:
constructing a data set by using test results of a preset network flow structure characteristic detector and a preset full characteristic detector;
constructing a preset prejudgment device by adopting a KNN classification algorithm based on the data set;
if the output result of the preset prejudger is 0, the input network flow can be detected only by depending on the structural characteristics of the network flow;
and if the output result of the preset prejudger is 1, the input network flow cannot be detected only by the structural characteristics of the network flow.
In a second aspect, an embodiment of the present invention provides an abnormal traffic detection apparatus based on network flow structure feature fusion, including:
the acquisition module is used for acquiring the network flow to be detected;
the pre-judging module is used for inputting the network flow to be detected to a preset pre-judging device to obtain a judgment result corresponding to the network flow to be detected;
the detection module is used for inputting the network flow to be detected to a preset network flow structure characteristic detector to detect the network flow to be detected and determining an abnormal network flow detection result if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can be detected only by means of network flow structure characteristics; if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can not be detected only by means of the network flow structural characteristics, inputting the network flow to be detected to a preset full-characteristic detector for detecting the network flow to be detected, and determining an abnormal network flow detection result; the preset full-feature detector is a detector constructed based on network flow features and network flow structural features.
Further, the preset network flow structure feature detector in the detection module includes:
acquiring network flow characteristics of a data set; the network flow characteristics comprise identification characteristics and statistical characteristics of the network flow;
extracting structural features of the network flow based on the identification features of the network flow;
and constructing a preset network flow structural feature detector by adopting a KNN classification algorithm based on the structural features of the network flow.
Further, the preset full-feature detector in the detection module comprises:
acquiring network flow characteristics of a data set; the network flow characteristics comprise identification characteristics and statistical characteristics of the network flow;
extracting structural features of the network flow based on the identification features of the network flow;
forming a full feature vector based on the structural features of the network flow and the network flow features;
and constructing a preset full-feature detector by adopting a KNN classification algorithm based on the full-feature vector.
In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, where the processor implements the steps of the method for detecting abnormal traffic based on feature fusion of network flows according to the first aspect when executing the program.
In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the steps of the method for detecting abnormal traffic based on feature fusion of network flows according to the first aspect.
According to the technical scheme, the abnormal traffic detection method and device based on the fusion of the network flow structural features, provided by the embodiment of the invention, are implemented by acquiring the network flow to be detected; inputting the network flow to be detected to a preset prejudging device to obtain a judgment result corresponding to the network flow to be detected; if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can be detected only by depending on the network flow structural characteristics, inputting the network flow to be detected to a preset network flow structural characteristic detector for detecting the network flow to be detected, and determining an abnormal network flow detection result; if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can not be detected only by means of the network flow structural characteristics, inputting the network flow to be detected to a preset full-characteristic detector for detecting the network flow to be detected, and determining an abnormal network flow detection result; the preset full-feature detector is a detector constructed based on network flow features and network flow structural features. According to the invention, after the network flow to be detected is obtained, the judgment is carried out by the pre-judging device, the proper detector is selected according to the judgment result to carry out abnormal flow detection, and the fusion of the network flow characteristics and the network flow structure characteristics is realized by the pre-judging type characteristic fusion scheme, so that the problem of lacking of network flow structure information is solved, the detection rate is improved, and the false alarm rate is reduced.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to these drawings without creative efforts.
Fig. 1 is a schematic flowchart of an abnormal traffic detection method based on fusion of network flow structural features according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of a general flow chart provided by an embodiment of the present invention;
fig. 3 is a schematic structural diagram of an abnormal traffic detection apparatus based on network flow structural feature fusion according to an embodiment of the present invention;
fig. 4 is a schematic physical structure diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some embodiments, but not all embodiments, of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention. The abnormal traffic detection method based on the fusion of network flow structural features provided by the invention will be explained and explained in detail through specific embodiments.
Fig. 1 is a schematic flowchart of an abnormal traffic detection method based on fusion of network flow structural features according to an embodiment of the present invention; as shown in fig. 1, the method includes:
step 101: and acquiring the network flow to be detected.
In this step, it can be understood that the network flow to be detected is acquired, that is, the network flow data for performing abnormal traffic detection is acquired.
Step 102: and inputting the network flow to be detected to a preset prejudging device to obtain a judgment result corresponding to the network flow to be detected.
In this step, it should be noted that, for a preset prejudger, the prejudger is configured to judge a detection capability of a network flow structural feature, and a construction method of the preset prejudger specifically includes: constructing a data set by using test results of a preset network flow structure characteristic detector and a preset full characteristic detector; after the data set is constructed, training and constructing a network flow structure characteristic pre-judging device model (namely a pre-judging device) by adopting a KNN classification algorithm based on the data set; specifically, a network flow to be detected is input to a preset prejudging device, two prejudging results are obtained through judgment of the prejudging device, and one result is that the network flow to be detected can be detected only by means of the structural characteristics of the network flow; one is that the network flow to be detected cannot be detected only by means of the structural characteristics of the network flow.
Step 103: if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can be detected only by depending on the network flow structural characteristics, inputting the network flow to be detected to a preset network flow structural characteristic detector for detecting the network flow to be detected, and determining an abnormal network flow detection result; if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can not be detected only by means of the network flow structural characteristics, inputting the network flow to be detected to a preset full-characteristic detector for detecting the network flow to be detected, and determining an abnormal network flow detection result; the preset full-feature detector is a detector constructed based on network flow features and network flow structural features.
In this step, for a preset network flow structure feature detector, it should be noted that the preset network flow structure feature detector is constructed by the following steps: acquiring network flow characteristics of a data set; the network flow characteristics comprise identification characteristics and statistical characteristics of the network flow; extracting structural features of the network flow based on the identification features of the network flow; and constructing a preset network flow structural feature detector by adopting a KNN classification algorithm based on the structural features of the network flow.
In this step, for a preset full-feature detector, it should be noted that the preset full-feature detector is constructed by the following steps: acquiring network flow characteristics of a data set; the network flow characteristics comprise identification characteristics and statistical characteristics of the network flow; extracting structural features of the network flow based on the identification features of the network flow; forming a full feature vector based on the structural features of the network flow and the network flow features; and constructing a preset full-feature detector by adopting a KNN classification algorithm based on the full-feature vector.
Compared with the prior art, the abnormal traffic detection method based on the fusion of the network flow structural features provided by the embodiment of the invention realizes the mining of the network flow structural information, and fully fuses the network flow content features and the structural features, so that the network abnormal traffic detection can be developed under more features, and the detection result is more accurate.
According to the technical scheme, the abnormal flow detection method based on the fusion of the network flow structural features provided by the embodiment of the invention obtains the network flow to be detected; inputting the network flow to be detected to a preset prejudging device to obtain a judgment result corresponding to the network flow to be detected; if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can be detected only by depending on the network flow structural characteristics, inputting the network flow to be detected to a preset network flow structural characteristic detector for detecting the network flow to be detected, and determining an abnormal network flow detection result; if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can not be detected only by means of the network flow structural characteristics, inputting the network flow to be detected to a preset full-characteristic detector for detecting the network flow to be detected, and determining an abnormal network flow detection result; the preset full-feature detector is a detector constructed based on network flow features and network flow structural features. According to the invention, after the network flow to be detected is obtained, the judgment is carried out by the pre-judging device, the proper detector is selected according to the judgment result to carry out abnormal flow detection, and the fusion of the network flow characteristics and the network flow structure characteristics is realized by the pre-judging type characteristic fusion scheme, so that the problem of lacking of network flow structure information is solved, the detection rate is improved, and the false alarm rate is reduced.
On the basis of the foregoing embodiment, in this embodiment, the preset network flow structure feature detector includes:
acquiring network flow characteristics of a data set; the network flow characteristics comprise identification characteristics and statistical characteristics of the network flow;
extracting structural features of the network flow based on the identification features of the network flow;
and constructing a preset network flow structural feature detector by adopting a KNN classification algorithm based on the structural features of the network flow.
In this embodiment, for example, first, a data set is collected, for example, by using a cic flowmeter tool, to obtain network flow characteristics of the data set, where the network flow characteristics include identification characteristics and statistical characteristics of network flows (i.e., the remaining network flows except the identification characteristics in the network flow characteristicsFlow characteristics). The identification characteristics include information such as a source IP address, a destination IP address (i.e., an IP address of a source node, an IP address of a destination node), a timestamp, and source and destination ports (i.e., a source port and a destination port); the statistical characteristics include 80 characteristics such as flow duration, number of packets in the forward (backward) direction, maximum packets in the forward (backward) direction, etc. Then, extracting the structural features of the network flow according to the identification features of the network flow, wherein the extraction method adopted by the embodiment of the invention is as follows: the network structure formed by the network flows in the past period is used for representing the network flow structure at the current moment. First, time is divided into a sequence of equal-length time slices
And Tm＝[t(m-1)n,tmn]，tcIs the current time, there is tc∈Tm. Then, for tcNetwork flow f of time of daytc(u, v), construction time period [ t ](m-1)n,tc]Wherein u and v represent the network flow f, respectivelytcSource, destination node. Finally, a four-dimensional vector consisting of the out degree and the in degree of u and v in the network communication diagram is used
To represent network flows
The embodiment of the invention refers to the structural characteristics of the network flow as the network fluidity df. According to the expression method, the embodiment of the invention extracts the structural characteristics of the network flow, and the extraction formula is as follows:
As can be seen from the above technical solutions, the abnormal traffic detection method based on network flow structural feature fusion provided in the embodiments of the present invention represents network flow structural information, extracts network flow structural features, solves the problem of lacking network flow structural information, and then realizes fusion of network flow features and network flow structural features through pre-judgment type feature fusion, thereby improving detection rate and reducing false alarm rate.
On the basis of the foregoing embodiment, in this embodiment, the preset full-feature detector includes:
acquiring network flow characteristics of a data set; the network flow characteristics comprise identification characteristics and statistical characteristics of the network flow;
extracting structural features of the network flow based on the identification features of the network flow;
forming a full feature vector based on the structural features of the network flow and the network flow features;
and constructing a preset full-feature detector by adopting a KNN classification algorithm based on the full-feature vector.
In this embodiment, for example, the network flow characteristics of the data set are obtained; the network flow characteristics comprise identification characteristics and statistical characteristics of the network flow; extracting structural features of the network flow based on the identification features of the network flow; and then training and constructing a full-feature detector, for example, selecting a 12-dimensional full-feature vector consisting of 8 network flow features and network flow structure features, and training the full-feature detector by using a KNN classification algorithm. The 8 network flow characteristics are: flow Duration, Total Fwd Packets, Total Backward Packets, Total Length of Fwd Packets, Total Length of Bwd Packets, Flow Bytes/s, Flow Packets/s, and Average Packet Size.
As can be seen from the above technical solutions, the abnormal traffic detection method based on network flow structural feature fusion provided in the embodiments of the present invention represents network flow structural information, extracts network flow structural features, solves the problem of lacking network flow structural information, and then realizes fusion of network flow features and network flow structural features through pre-judgment type feature fusion, thereby improving detection rate and reducing false alarm rate.
On the basis of the foregoing embodiment, in this embodiment, the identification characteristics of the network flow include an IP address of the source node, an IP address of the destination node, a timestamp, a source port, and a destination port.
On the basis of the foregoing embodiment, in this embodiment, the preset prejudger includes:
constructing a data set by using test results of a preset network flow structure characteristic detector and a preset full characteristic detector;
constructing a preset prejudgment device by adopting a KNN classification algorithm based on the data set;
if the output result of the preset prejudger is 0, the input network flow can be detected only by depending on the structural characteristics of the network flow;
and if the output result of the preset prejudger is 1, the input network flow cannot be detected only by the structural characteristics of the network flow.
In this embodiment, for example, the data set of the prejudger is constructed by using the test results of the full feature detector and the network flow structure feature detector. The data set is composed of network flow structural features, and comprises two types of positive samples and negative samples which are respectively marked as 0 and 1. 0 represents the network flow structure characteristics which can be correctly classified by the input structure characteristic detector; 1 represents the structural features that the input network flow structural feature detector misclassifies but the input full feature detector can correctly classify in combination with the network flow features (i.e., full features). The positive to negative sample ratio of the data set was 7: 3. The data set was divided into a training set and a test set on an 8:2 scale. And after the data set is constructed, training the pre-judging device by using a KNN algorithm to finally obtain a network flow structure characteristic pre-judging device model.
For better understanding of the present invention, the following examples are further provided to illustrate the present invention, but the present invention is not limited to the following examples, which are shown in the general flow chart of fig. 2, for example:
the method comprises the following steps: data set feature extraction
1. By means of a CICFlowMeter tool, network flow characteristics of the data set are acquired, including identification characteristics and statistical characteristics of the network flow. The identification characteristics comprise information such as source and destination IP addresses, timestamps, source and destination ports and the like; the statistical characteristics include 80 characteristics such as flow duration, number of packets in the forward (backward) direction, maximum packets in the forward (backward) direction, etc.
2. And extracting the structural characteristics of the network flow according to the identification characteristics of the network flow.
The method for representing the structural features of network flow and the extraction process are introduced. The embodiment of the invention uses the network structure formed by the network flow in the past period of time to represent the network flow structure at the current moment. First, time is divided into a sequence of equal-length time slices
And Tm＝[t(m-1)n,tmn]，tcIs the current time, there is tc∈Tm. Then, for tcNetwork flow of time of day
Construction of time period [ t ](m-1)n,tc]Wherein u and v represent the network flow f, respectivelytcSource, destination node. Finally, a four-dimensional vector consisting of the out degree and the in degree of u and v in the network communication diagram is used
To represent network flows
The embodiment of the invention refers to the structural characteristics of the network flow as the network fluidity df. According to the expression method, the embodiment of the invention extracts the structural characteristics of the network flow, and the extraction formula is as follows:
Step two: training two detectors
3. After the above-mentioned work is completed, the embodiment of the present invention first trains the full-feature detector. And selecting a 12-dimensional full-feature vector consisting of 8 network flow features and network flow structure features, and training a full-feature detector by using a KNN classification algorithm. The 8 network flow characteristics are: flow Duration, Total Fwd Packets, Total Backward Packets, Total Length of Fwd Packets, Total Length of Bwd Packets, Flow Bytes/s, Flow Packets/s, and Average Packet Size.
4. Then, embodiments of the present invention train a network flow structural feature detector. And selecting the network flow structure characteristics, and training a structure characteristic detector by using a KNN classification algorithm.
Step three: construct a prejudger
5. And constructing a data set of the prejudge device by using the test results of the full feature detector and the network flow structure feature detector. The data set is composed of network flow structural features, and comprises two types of positive samples and negative samples which are respectively marked as 0 and 1. 0 represents the network flow structure characteristics which can be correctly classified by the input structure characteristic detector; 1 represents the structural features that the input network flow structural feature detector misclassifies but the input full feature detector can correctly classify in combination with the network flow features (i.e., full features). The positive to negative sample ratio of the data set was 7: 3. The data set was divided into a training set and a test set on an 8:2 scale.
6. And after the data set is constructed, training the pre-judging device by using a KNN algorithm to finally obtain a network flow structure characteristic pre-judging device model.
Step four: detecting abnormal network traffic
7. In order to detect abnormal network traffic, the embodiment of the present invention first performs feature extraction on the input network traffic, that is, extracts network flow features and network flow structural features according to the method in step one.
8. And (4) judging whether the network flow can be detected only by depending on the structural characteristics of the network flow by using a prejudger constructed in the step three. If yes, inputting a structure characteristic detector, and finishing the detection of the network flow by the structure characteristic of the network flow; if not, the network flow characteristics and the network flow structure characteristics are integrated for detection, namely 12-dimensional characteristic vectors are formed and input into a full characteristic detector, and therefore the detection of the network flow is completed.
Step five: and storing the detection result and generating a detection report.
The embodiment of the invention provides two schemes based on two defects in the existing detection work. Aiming at the problem that the prior work lacks network flow structure information, the embodiment of the invention provides a representation scheme of network flow structure information, namely selecting a part of network flow structure in the past period of time, approximately representing the structure information of the current network flow, and extracting the structure characteristics of the network flow based on the scheme; aiming at the problem of insufficient detection capability of a single type of network flow characteristic, a pre-judgment type characteristic fusion scheme is provided, namely, a pre-judgment device judges the detection capability of the network flow structural characteristic and selects a proper detector to detect abnormal flow according to the judgment result, so that the fusion of the network flow characteristic and the network flow structural characteristic is realized.
Fig. 3 is a schematic structural diagram of an abnormal traffic detection apparatus based on network flow structural feature fusion according to an embodiment of the present invention, and as shown in fig. 3, the apparatus includes: an obtainingmodule 201, aprejudging module 202 and a detectingmodule 203, wherein:
the acquiringmodule 201 is configured to acquire a network flow to be detected;
thepre-judging module 202 is configured to input the network flow to be detected to a preset pre-judging device, so as to obtain a judgment result corresponding to the network flow to be detected;
thedetection module 203 is configured to, if the determination result corresponding to the to-be-detected network flow indicates that the to-be-detected network flow can be detected only by means of the network flow structural feature, input the to-be-detected network flow to a preset network flow structural feature detector to detect the to-be-detected network flow, and determine an abnormal network flow detection result; if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can not be detected only by means of the network flow structural characteristics, inputting the network flow to be detected to a preset full-characteristic detector for detecting the network flow to be detected, and determining an abnormal network flow detection result; the preset full-feature detector is a detector constructed based on network flow features and network flow structural features.
On the basis of the foregoing embodiment, in this embodiment, the preset network flow structure feature detector in the detection module includes:
acquiring network flow characteristics of a data set; the network flow characteristics comprise identification characteristics and statistical characteristics of the network flow;
extracting structural features of the network flow based on the identification features of the network flow;
and constructing a preset network flow structural feature detector by adopting a KNN classification algorithm based on the structural features of the network flow.
On the basis of the foregoing embodiment, in this embodiment, the preset full-feature detector in the detection module includes:
acquiring network flow characteristics of a data set; the network flow characteristics comprise identification characteristics and statistical characteristics of the network flow;
extracting structural features of the network flow based on the identification features of the network flow;
forming a full feature vector based on the structural features of the network flow and the network flow features;
and constructing a preset full-feature detector by adopting a KNN classification algorithm based on the full-feature vector.
The abnormal traffic detection device based on the fusion of the network flow structural features provided in the embodiment of the present invention may be specifically used for executing the abnormal traffic detection method based on the fusion of the network flow structural features in the above embodiment, and the technical principle and the beneficial effect thereof are similar, and reference may be specifically made to the above embodiment, and details are not described here.
Based on the same inventive concept, an embodiment of the present invention provides an electronic device, which specifically includes the following components, with reference to fig. 4: aprocessor 301, acommunication interface 303, amemory 302, and acommunication bus 304;
the processor 301, the communication interface 303 and the memory 302 complete mutual communication through the communication bus 304; the communication interface 303 is used for realizing information transmission between related devices such as modeling software, an intelligent manufacturing equipment module library and the like; the processor 301 is used for calling the computer program in the memory 302, and the processor executes the computer program to implement the method provided by the above method embodiments, for example, the processor executes the computer program to implement the following steps: acquiring a network flow to be detected; inputting the network flow to be detected to a preset prejudging device to obtain a judgment result corresponding to the network flow to be detected; if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can be detected only by depending on the network flow structural characteristics, inputting the network flow to be detected to a preset network flow structural characteristic detector for detecting the network flow to be detected, and determining an abnormal network flow detection result; if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can not be detected only by means of the network flow structural characteristics, inputting the network flow to be detected to a preset full-characteristic detector for detecting the network flow to be detected, and determining an abnormal network flow detection result; the preset full-feature detector is a detector constructed based on network flow features and network flow structural features.
Based on the same inventive concept, another embodiment of the present invention further provides a non-transitory computer-readable storage medium, on which a computer program is stored, where the computer program is implemented to perform the methods provided by the above method embodiments when executed by a processor, for example, acquiring a network flow to be detected; inputting the network flow to be detected to a preset prejudging device to obtain a judgment result corresponding to the network flow to be detected; if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can be detected only by depending on the network flow structural characteristics, inputting the network flow to be detected to a preset network flow structural characteristic detector for detecting the network flow to be detected, and determining an abnormal network flow detection result; if the judgment result corresponding to the network flow to be detected is that the network flow to be detected can not be detected only by means of the network flow structural characteristics, inputting the network flow to be detected to a preset full-characteristic detector for detecting the network flow to be detected, and determining an abnormal network flow detection result; the preset full-feature detector is a detector constructed based on network flow features and network flow structural features.
The above-described embodiments of the apparatus are merely illustrative, and the units described as separate parts may or may not be physically separate, and the parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the present embodiment. One of ordinary skill in the art can understand and implement it without inventive effort.
Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware. With this understanding in mind, the above-described technical solutions may be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as ROM/RAM, magnetic disk, optical disk, etc., and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods of the various embodiments or some parts of the embodiments.
In addition, in the present invention, terms such as "first" and "second" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "a plurality" means at least two, e.g., two, three, etc., unless specifically limited otherwise.
Moreover, in the present invention, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
Furthermore, in the description herein, reference to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the terms used above are not necessarily intended to refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, various embodiments or examples and features of different embodiments or examples described in this specification can be combined and combined by one skilled in the art without contradiction.
Finally, it should be noted that: the above examples are only intended to illustrate the technical solution of the present invention, but not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.
Claims (10)
Translated fromChinesePriority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110633083.8ACN113556317B (en) | 2021-06-07 | 2021-06-07 | Abnormal flow detection method and device based on network flow structure feature fusion |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110633083.8ACN113556317B (en) | 2021-06-07 | 2021-06-07 | Abnormal flow detection method and device based on network flow structure feature fusion |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113556317Atrue CN113556317A (en) | 2021-10-26 |
| CN113556317B CN113556317B (en) | 2022-10-11 |
Family
ID=78130374
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110633083.8AActiveCN113556317B (en) | 2021-06-07 | 2021-06-07 | Abnormal flow detection method and device based on network flow structure feature fusion |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113556317B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114548271A (en)* | 2022-02-15 | 2022-05-27 | 中国银行股份有限公司 | Network abnormality detection method and device |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104135474A (en)* | 2014-07-18 | 2014-11-05 | 国家计算机网络与信息安全管理中心 | Network anomaly behavior detection method based on out-degree and in-degree of host |
| CN108011894A (en)* | 2017-12-26 | 2018-05-08 | 陈晶 | Botnet detecting system and method under a kind of software defined network |
| WO2020062390A1 (en)* | 2018-09-25 | 2020-04-02 | 深圳先进技术研究院 | Network traffic classification method and system, and electronic device |
| CN111885035A (en)* | 2020-07-15 | 2020-11-03 | 中国科学院深圳先进技术研究院 | Network anomaly detection method, system, terminal and storage medium |
| CN112257760A (en)* | 2020-09-30 | 2021-01-22 | 北京航空航天大学 | A method for abnormal detection of host network communication behavior based on timing motif |
| CN112617860A (en)* | 2020-12-31 | 2021-04-09 | 山东师范大学 | Emotion classification method and system of brain function connection network constructed based on phase-locked value |
| CN112836676A (en)* | 2021-03-01 | 2021-05-25 | 创新奇智(北京)科技有限公司 | Abnormal behavior detection method and device, electronic equipment and storage medium |
- 2021
- 2021-06-07CNCN202110633083.8Apatent/CN113556317B/enactiveActive
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104135474A (en)* | 2014-07-18 | 2014-11-05 | 国家计算机网络与信息安全管理中心 | Network anomaly behavior detection method based on out-degree and in-degree of host |
| CN108011894A (en)* | 2017-12-26 | 2018-05-08 | 陈晶 | Botnet detecting system and method under a kind of software defined network |
| WO2020062390A1 (en)* | 2018-09-25 | 2020-04-02 | 深圳先进技术研究院 | Network traffic classification method and system, and electronic device |
| CN111885035A (en)* | 2020-07-15 | 2020-11-03 | 中国科学院深圳先进技术研究院 | Network anomaly detection method, system, terminal and storage medium |
| CN112257760A (en)* | 2020-09-30 | 2021-01-22 | 北京航空航天大学 | A method for abnormal detection of host network communication behavior based on timing motif |
| CN112617860A (en)* | 2020-12-31 | 2021-04-09 | 山东师范大学 | Emotion classification method and system of brain function connection network constructed based on phase-locked value |
| CN112836676A (en)* | 2021-03-01 | 2021-05-25 | 创新奇智(北京)科技有限公司 | Abnormal behavior detection method and device, electronic equipment and storage medium |
Non-Patent Citations (1)
| Title |
|---|
| 赵琦等: "一种基于HTTP协议的隐蔽隧道及其检测方法", 《计算机与现代化》* |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114548271A (en)* | 2022-02-15 | 2022-05-27 | 中国银行股份有限公司 | Network abnormality detection method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113556317B (en) | 2022-10-11 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107992746B (en) | Malicious behavior mining method and device | |
| CN113645232B (en) | Intelligent flow monitoring method, system and storage medium for industrial Internet | |
| CN112966714B (en) | Edge time sequence data anomaly detection and network programmable control method | |
| CN111355697B (en) | Detection method, device, equipment and storage medium for botnet domain name family | |
| CN103795723B (en) | Distributed type internet-of-things safety situation awareness method | |
| CN108965340B (en) | Industrial control system intrusion detection method and system | |
| CN109218321A (en) | A kind of network inbreak detection method and system | |
| CN113516144B (en) | Target detection method and device, computing equipment | |
| CN110611640A (en) | DNS protocol hidden channel detection method based on random forest | |
| KR102470364B1 (en) | A method for generating security event traning data and an apparatus for generating security event traning data | |
| Zhao et al. | A few-shot learning based approach to IoT traffic classification | |
| CN108809989B (en) | Botnet detection method and device | |
| CN118041699B (en) | Network intrusion positioning system based on artificial intelligence | |
| CN113065395A (en) | A New Class Detection Method for Radar Targets Based on Generative Adversarial Networks | |
| CN115277102A (en) | Network attack detection method and device, electronic equipment and storage medium | |
| CN116015914A (en) | A method and system for real attack detection of alarm logs based on deep learning framework | |
| Kozik et al. | Pattern extraction algorithm for NetFlow‐based botnet activities detection | |
| CN118590274A (en) | A method for detecting abnormal nodes in provenance graph based on honeypoint intelligence threshold adjustment | |
| CN118051818A (en) | Internet of things equipment identification method based on federal learning and behavior analysis | |
| CN116918302A (en) | Apparatus and methods for analyzing cyber threat intelligence | |
| CN112765313A (en) | False information detection method based on original text and comment information analysis algorithm | |
| CN112835995A (en) | A method and device for domain name graph embedded representation analysis based on resolution relationship | |
| CN113556317A (en) | Abnormal flow detection method and device based on network flow structure feature fusion | |
| CN108805211A (en) | IN service type cognitive method based on machine learning | |
| CN110995713A (en) | Botnet detection system and method based on convolutional neural network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |