CN116192490A - Network threat detection method and system based on flow behaviors - Google Patents

Network threat detection method and system based on flow behaviors Download PDF

Info

Publication number
CN116192490A
CN116192490A CN202310112450.9A CN202310112450A CN116192490A CN 116192490 A CN116192490 A CN 116192490A CN 202310112450 A CN202310112450 A CN 202310112450A CN 116192490 A CN116192490 A CN 116192490A
Authority
CN
China
Prior art keywords
data
session
target
flow
flow data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202310112450.9A
Other languages
Chinese (zh)
Inventor
刘庆林
陈健
李小琼
魏海宇
谢辉
安恩庆
张乃亮
杨晓峰
刘海洋
姜小光
杨帆
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Zorelworld Information Technology Co ltd
Original Assignee
Beijing Zorelworld Information Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Zorelworld Information Technology Co ltd filed Critical Beijing Zorelworld Information Technology Co ltd
Priority to CN202310112450.9A priority Critical patent/CN116192490A/en
Publication of CN116192490A publication Critical patent/CN116192490A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

The invention discloses a network threat detection method and a system based on flow behaviors, wherein a flow receiving module receives target flow data, the flow receiving module sends the target flow data to a transmission layer analysis module, the transmission layer analysis module extracts all protocol related fields in the target flow data and extracts characteristic data of the target flow data, a session management module calculates a Hash according to the characteristic data of the target flow data, aggregates the same session flow information in the target flow data according to the Hash, extracts session data of a session, feeds the session data back to a comprehensive analysis module, and the comprehensive analysis module performs rule matching on the session data according to preset behavior rules, if the target flow data is matched, judges the target flow data as threat flow data and outputs matched session data.

Description

Network threat detection method and system based on flow behaviors
Technical Field
The application relates to the technical field of network threat detection based on traffic behaviors, in particular to a network threat detection method and system based on traffic behaviors.
Background
As network traffic is increasingly encrypted, the traditional detection model based on deep packet inspection is more and more difficult to deal with malicious traffic detection, and the traditional detection model fails. At present, the identification method of the malicious traffic by the traditional network threat detection still adopts a characteristic value matching method, and the characteristic value matching method is a method for judging the malicious traffic by comparing part or all of data information in the traffic with the existing characteristic data information. The feature matching is a main method for identifying network threats by current security manufacturers, and the feature matching can accurately match the malicious traffic, but the traditional feature matching method fails to detect due to the fact that the current network traffic is more and more encrypted.
Disclosure of Invention
Based on the above, a network threat detection method and system based on traffic behavior are provided to solve the problem that the conventional eigenvalue matching method fails to detect due to the fact that the encryption of network traffic is more and more at present.
In a first aspect, a method for detecting a cyber threat based on traffic behavior, the method comprising:
the flow receiving module receives target flow data;
the flow receiving module sends the target flow data to a transport layer analyzing module;
the transport layer analysis module extracts all protocol related fields in the target flow data and extracts characteristic data of the target flow data;
the session management module calculates a Hash according to the characteristic data of the target flow data, aggregates the same session flow information in the target flow data according to the Hash, extracts the session data of the session, and feeds the session data back to the comprehensive analysis module;
and the comprehensive analysis module performs rule matching on the session data according to a preset behavior rule, and if the matching hits, the comprehensive analysis module judges that the target flow data is threat flow data and outputs the session data hit by the matching.
In the foregoing solution, optionally, before the flow receiving module receives the target flow data, the method includes:
obtaining flow data to be detected and copying the flow data to be detected to generate target flow data; the method comprises the steps of copying the flow data to be detected to generate target flow data, and specifically, performing flow beam splitting or flow mirroring on the flow data to be detected to generate target flow data.
In the above solution, further optionally, the traffic receiving module uses a DPDK efficient packet receiving engine to receive the target traffic data, where the DPDK efficient packet receiving engine operates in a user space, and utilizes a data plane library provided by itself to complete the sending and receiving of the data packet, thereby bypassing a processing procedure of the data packet by a linux kernel protocol stack.
In the above solution, further optionally, the transport layer parsing module extracts all protocol related fields in the target traffic data, and extracts feature data of the target traffic data, including: and extracting characteristic data of the target flow data through analysis of a link layer, a network layer and a transmission layer of the target flow data by processing the target flow data.
In the above solution, further optionally, the feature data of the target traffic data includes five-tuple data of the target traffic, a MAC address, a session formation packet number, a packet length sequence, a packet interval time sequence, a session length, a feature word, a TTL value, an ICMP command type and command code, a TCP session window, a TCP flag bit, a UD protocol field, and an igmp protocol field.
In the above solution, further optionally, the session management module calculates a Hash according to the feature data of the target traffic data, aggregates the same session flow information in the target traffic data according to the Hash, extracts the session data of the session, specifically, the session management module calculates a Hash according to the MAC address and the five-tuple, aggregates the same session flow information in the target traffic data according to the Hash, extracts the number of uplink bytes and downlink bytes of the session, the duration of the session, the session start time and the session end time, and simultaneously performs timeout analysis on the traffic data.
In a second aspect, a cyber threat detection system based on traffic behavior, the system comprising:
the flow receiving module is used for: the system comprises a transport layer analysis module, a transmission layer analysis module and a target flow data receiving module, wherein the transport layer analysis module is used for receiving the target flow data and sending the target flow data to the transport layer analysis module;
and a transmission layer analysis module: extracting all protocol related fields in the target flow data, and extracting characteristic data of the target flow data;
session management module: the method comprises the steps of calculating a Hash according to characteristic data of target flow data, aggregating same session flow information in the target flow data according to the Hash, extracting session data of the session, and feeding the session data back to a comprehensive analysis module;
and the comprehensive analysis module is used for: and the method is used for carrying out rule matching on the session data according to a preset behavior rule, and if the matching is hit, judging the target flow data as threat flow data and outputting the session data hit by the matching.
In the foregoing solution, optionally, before the flow receiving module receives the target flow data, the method includes:
obtaining flow data to be detected and copying the flow data to be detected to generate target flow data; the method comprises the steps of copying the flow data to be detected to generate target flow data, specifically, performing flow beam splitting or flow mirroring on the flow data to be detected to generate target flow data;
the traffic receiving module receives the target traffic data by using a DPDK efficient packet receiving engine, wherein the DPDK efficient packet receiving engine operates in a user space, and utilizes a data plane library provided by the DPDK efficient packet receiving engine to complete the receiving and transmitting of the data packet, thereby bypassing the processing process of the data packet by a linux kernel protocol stack.
In the above solution, further optionally, the transport layer parsing module extracts all protocol related fields in the target traffic data, and extracts feature data of the target traffic data, including: extracting characteristic data of target flow data through analysis of a link layer, a network layer and a transmission layer of the target flow data by processing the target flow data;
the characteristic data of the target flow data comprises quintuple data of the target flow, an MAC address, a session constitution packet number, a packet length sequence, a packet interval time sequence, a session length, a characteristic word, a TTL value, an ICMP command type and command code, a TCP session window, a TCP flag bit, a UD protocol field and an igmp protocol field.
In the above solution, further optionally, the session management module calculates a Hash according to the feature data of the target traffic data, aggregates the same session flow information in the target traffic data according to the Hash, extracts the session data of the session, specifically, the session management module calculates a Hash according to the MAC address and the five-tuple, aggregates the same session flow information in the target traffic data according to the Hash, extracts the number of uplink bytes and downlink bytes of the session, the duration of the session, the session start time and the session end time, and simultaneously performs timeout analysis on the traffic data.
The invention has at least the following beneficial effects:
the invention is based on further analysis and research of the prior art, and recognizes that the problem of failure detection of the traditional eigenvalue matching method is caused by more and more encryption of the current network traffic. The invention can fill the defect of identifying the network threat in the traditional characteristic mode, and improves the detection capability of threat flow by extracting the behavior elements, so that the detection of the flow threat is more perfect.
Drawings
FIG. 1 is a flow chart of a method for detecting network threats based on traffic behavior according to one embodiment of the present invention;
FIG. 2 is a flow chart of a method for detecting traffic behavior based on a network threat detection method according to an embodiment of the invention;
fig. 3 is a schematic diagram of a flow receiving module DPDK efficient packet receiving engine according to a network threat detection method based on flow behavior according to an embodiment of the present invention;
FIG. 4 is a schematic diagram illustrating the internal operation of a session management module of a network threat detection method based on traffic behavior according to an embodiment of the present invention;
fig. 5 is a schematic diagram illustrating an internal decision of an integrated analysis module of a network threat detection method based on traffic behavior according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application will be further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the present application.
In one embodiment, as shown in fig. 1 and fig. 2, the method for detecting a network threat based on traffic behavior includes the following steps:
the flow receiving module receives target flow data;
the flow receiving module sends the target flow data to a transport layer analyzing module;
the transport layer analysis module extracts all protocol related fields in the target flow data and extracts characteristic data of the target flow data;
the session management module calculates a Hash according to the characteristic data of the target flow data, aggregates the same session flow information in the target flow data according to the Hash, extracts the session data of the session, and feeds the session data back to the comprehensive analysis module;
and the comprehensive analysis module performs rule matching on the session data according to a preset behavior rule, and if the matching hits, the comprehensive analysis module judges that the target flow data is threat flow data and outputs the session data hit by the matching.
In one embodiment, the flow receiving module includes, prior to receiving the target flow data:
obtaining flow data to be detected and copying the flow data to be detected to generate target flow data; the method comprises the steps of copying the flow data to be detected to generate target flow data, and specifically, performing flow beam splitting or flow mirroring on the flow data to be detected to generate target flow data.
In one embodiment, the traffic receiving module receives the target traffic data by using a DPDK efficient packet receiving engine, where the DPDK efficient packet receiving engine operates in a user space, and completes the sending and receiving of the data packet by using a data plane library provided by the DPDK efficient packet receiving engine, thereby bypassing a processing procedure of the linux kernel protocol stack on the data packet.
In one embodiment, the transport layer parsing module extracts all protocol related fields in the target traffic data, and extracts feature data of the target traffic data, including: and extracting characteristic data of the target flow data through analysis of a link layer, a network layer and a transmission layer of the target flow data by processing the target flow data.
In one embodiment, the characteristic data of the target traffic data includes five-tuple data of the target traffic, a MAC address, a number of session constituent packets, a sequence of packet lengths, a sequence of packet interval times, a session length, a characteristic word, a TTL value, an ICMP command type and command code, a TCP session window, a TCP flag bit, a UD protocol field, and an igmp protocol field.
In one embodiment, the session management module calculates a Hash according to the feature data of the target traffic data, aggregates the same session flow information in the target traffic data according to the Hash, extracts the session data of the session, specifically calculates a Hash according to the MAC address and the five-tuple, aggregates the same session flow information in the target traffic data according to the Hash, extracts the uplink and downlink byte number, the session duration, the session start time and the session end time of the session, and performs timeout analysis on the traffic data.
In the embodiment, the flow receiving module receives target flow data, the flow receiving module sends the target flow data to the transmission layer analysis module, the transmission layer analysis module extracts all relevant fields of protocols in the target flow data, extracts characteristic data of the target flow data, the session management module calculates a Hash according to the characteristic data of the target flow data, aggregates the same session flow information in the target flow data according to the Hash, extracts session data of the session, feeds the session data back to the comprehensive analysis module, the comprehensive analysis module performs rule matching on the session data according to preset behavior rules, and if the matching is hit, judges the target flow data as threat flow data and outputs the hit session data. The method can fill the defect of identifying the network threat in the traditional characteristic mode, and improves the detection capability of threat flow by extracting the behavior elements, so that the flow threat detection is more perfect.
In one embodiment, as shown in FIG. 2, traffic behavior threat detection consists of: the system comprises a flow access module, a session management module, a transport layer packet analysis module and a comprehensive analysis module.
In one embodiment, the main functions and workflow of the various modules in FIG. 2 are summarized as follows:
the flow receiving module is used for: the whole flow behavior detection is aimed at the data type of Ethernet, the flow receiving module adopts a DPDK efficient packet receiving engine, the engine operates in a user space, and utilizes a data plane base provided by the engine to complete the receiving and transmitting of the data packet, so that the processing process of the data packet by a linux kernel protocol stack is bypassed, unnecessary memory copying and system calling are avoided, and the processing speed of the data packet is accelerated, as shown in figure 3.
And a transport layer packet analysis module: the module mainly analyzes a transmission layer protocol, extracts all relevant fields of the protocol, extracts MAC addresses, session constitution packet numbers, packet length sequences, packet interval time sequences, session lengths, characteristic words, TTL values, ICMP command types and command codes, TCP session windows, TCP zone bits, UD protocol fields, igmp protocol fields and the like through the analysis of a link layer, a network layer and a transmission layer by processing the original flow, and provides data support for a later comprehensive analysis module.
Session management module: the session management module firstly calculates a Hash according to the MAC address and the quintuple, and aggregates related information of the same session stream by using the Hash, so as to extract the number of bytes of the uplink and downlink of the session, the duration of the session, the start time and the end time of the session, and perform timeout analysis on stream information at the same time, and feed the information back to the comprehensive analysis module, as shown in fig. 4.
And the comprehensive analysis module is used for: the module is mainly used for analyzing the flow behavior, carrying out rule matching on the flow information output by the session management module through preset or self-defined rules, outputting and warehousing hit rules, and feeding back the hit rules to the interface, as shown in fig. 5.
The embodiment is used for filling the defect of identifying the network threat in the traditional characteristic mode, and behavioral elements are extracted: the protocol types above the transmission layer, the session constitution packet number, the packet length sequence, the packet interval time sequence, the session length, the number of uplink and downlink bytes of the session, the session duration, the session time, the feature words, the TTL value, the ICMP command types and command codes, the TCP session window and the TCP zone bit, and the detection capability of threat traffic is improved, so that the traffic threat detection model is more perfect. The method supports multi-element rule combination matching, and comprises continuous multi-packet element matching and cross-multi-packet element matching in a single session, association matching among continuous multi-session and cross-multi-session association matching, so that a traffic behavior threat detection model is more complete.
It should be understood that, although the steps in the flowchart of fig. 1 are shown in sequence as indicated by the arrows, the steps are not necessarily performed in sequence as indicated by the arrows. The steps are not strictly limited to the order of execution unless explicitly recited herein, and the steps may be executed in other orders. Moreover, at least a portion of the steps in fig. 1 may include a plurality of steps or stages, which are not necessarily performed at the same time, but may be performed at different times, and the order of the steps or stages is not necessarily sequential, but may be performed in rotation or alternatively with at least a portion of the steps or stages in other steps or other steps.
In one embodiment, a network threat detection system based on traffic behavior is provided, comprising the following program modules: wherein:
the flow receiving module is used for: the system comprises a transport layer analysis module, a transmission layer analysis module and a target flow data receiving module, wherein the transport layer analysis module is used for receiving the target flow data and sending the target flow data to the transport layer analysis module;
and a transmission layer analysis module: extracting all protocol related fields in the target flow data, and extracting characteristic data of the target flow data;
session management module: the method comprises the steps of calculating a Hash according to characteristic data of target flow data, aggregating same session flow information in the target flow data according to the Hash, extracting session data of the session, and feeding the session data back to a comprehensive analysis module;
and the comprehensive analysis module is used for: and the method is used for carrying out rule matching on the session data according to a preset behavior rule, and if the matching is hit, judging the target flow data as threat flow data and outputting the session data hit by the matching.
In one embodiment, the flow receiving module includes, prior to receiving the target flow data:
obtaining flow data to be detected and copying the flow data to be detected to generate target flow data; the method comprises the steps of copying the flow data to be detected to generate target flow data, specifically, performing flow beam splitting or flow mirroring on the flow data to be detected to generate target flow data;
the traffic receiving module receives the target traffic data by using a DPDK efficient packet receiving engine, wherein the DPDK efficient packet receiving engine operates in a user space, and utilizes a data plane library provided by the DPDK efficient packet receiving engine to complete the receiving and transmitting of the data packet, thereby bypassing the processing process of the data packet by a linux kernel protocol stack.
In one embodiment, the transport layer parsing module extracts all protocol related fields in the target traffic data, and extracts feature data of the target traffic data, including: extracting characteristic data of target flow data through analysis of a link layer, a network layer and a transmission layer of the target flow data by processing the target flow data;
the characteristic data of the target flow data comprises quintuple data of the target flow, an MAC address, a session constitution packet number, a packet length sequence, a packet interval time sequence, a session length, a characteristic word, a TTL value, an ICMP command type and command code, a TCP session window, a TCP flag bit, a UD protocol field and an igmp protocol field.
In one embodiment, the session management module calculates a Hash according to the feature data of the target traffic data, aggregates the same session flow information in the target traffic data according to the Hash, extracts the session data of the session, specifically calculates a Hash according to the MAC address and the five-tuple, aggregates the same session flow information in the target traffic data according to the Hash, extracts the uplink and downlink byte number, the session duration, the session start time and the session end time of the session, and performs timeout analysis on the traffic data.
In the embodiment, the flow receiving module receives target flow data, the flow receiving module sends the target flow data to the transmission layer analysis module, the transmission layer analysis module extracts all relevant fields of protocols in the target flow data, extracts characteristic data of the target flow data, the session management module calculates a Hash according to the characteristic data of the target flow data, aggregates the same session flow information in the target flow data according to the Hash, extracts session data of the session, feeds the session data back to the comprehensive analysis module, the comprehensive analysis module performs rule matching on the session data according to preset behavior rules, and if the matching is hit, judges the target flow data as threat flow data and outputs the hit session data. The method can fill the defect of identifying the network threat in the traditional characteristic mode, and improves the detection capability of threat flow by extracting the behavior elements, so that the flow threat detection is more perfect.
Specific limitations regarding the traffic behavior-based cyber-threat detection system may be found in the above limitations on the traffic behavior-based cyber-threat detection method, and are not described in detail herein. The various modules in the traffic behavior-based cyber threat detection system described above may be implemented in whole or in part in software, hardware, and combinations thereof. The above modules may be embedded in hardware or may be independent of a processor in the computer device, or may be stored in software in a memory in the computer device, so that the processor may call and execute operations corresponding to the above modules.
The technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.
The above examples merely represent a few embodiments of the present application, which are described in more detail and are not to be construed as limiting the scope of the invention. It should be noted that it would be apparent to those skilled in the art that various modifications and improvements could be made without departing from the spirit of the present application, which would be within the scope of the present application. Accordingly, the scope of protection of the present application is to be determined by the claims appended hereto.

Claims (10)

1. A method for detecting a network threat based on traffic behavior, the method comprising:
the flow receiving module receives target flow data;
the flow receiving module sends the target flow data to a transport layer analyzing module;
the transport layer analysis module extracts all protocol related fields in the target flow data and extracts characteristic data of the target flow data;
the session management module calculates a Hash according to the characteristic data of the target flow data, aggregates the same session flow information in the target flow data according to the Hash, extracts the session data of the session, and feeds the session data back to the comprehensive analysis module;
and the comprehensive analysis module performs rule matching on the session data according to a preset behavior rule, and if the matching hits, the comprehensive analysis module judges that the target flow data is threat flow data and outputs the session data hit by the matching.
2. The method of claim 1, wherein the flow receiving module comprises, prior to receiving the target flow data:
obtaining flow data to be detected and copying the flow data to be detected to generate target flow data; the method comprises the steps of copying the flow data to be detected to generate target flow data, and specifically, performing flow beam splitting or flow mirroring on the flow data to be detected to generate target flow data.
3. The method of claim 1, wherein the traffic receiving module receives the target traffic data using a DPDK efficient packet receiving engine, wherein the DPDK efficient packet receiving engine operates in a user space, and utilizes a data plane library provided by the DPDK efficient packet receiving engine to complete the transceiving of the data packet, thereby bypassing a processing procedure of the linux kernel protocol stack for the data packet.
4. The method of claim 1, wherein the transport layer parsing module extracts all protocol related fields in the target traffic data and extracts feature data of the target traffic data, comprising: and extracting characteristic data of the target flow data through analysis of a link layer, a network layer and a transmission layer of the target flow data by processing the target flow data.
5. The method of claim 4 wherein the characteristic data of the target traffic data comprises five-tuple data of the target traffic, a MAC address, a number of session constitution packets, a sequence of packet lengths, a sequence of packet interval times, a session length, a characteristic word, a TTL value, an ICMP command type and command code, a TCP session window, a TCP flag bit, a UD protocol field, and an igmp protocol field.
6. The method of claim 5 wherein the session management module calculates a Hash according to the characteristic data of the target traffic data, aggregates the same session flow information in the target traffic data according to the Hash, extracts the session data of the session, specifically, the session management module calculates a Hash according to the MAC address and the five-tuple, aggregates the same session flow information in the target traffic data according to the Hash, extracts the number of uplink and downlink bytes, the session duration, the session start and end time of the session, and simultaneously performs timeout analysis on the traffic data.
7. A network threat detection system based on traffic behavior, the system comprising:
the flow receiving module is used for: the system comprises a transport layer analysis module, a transmission layer analysis module and a target flow data receiving module, wherein the transport layer analysis module is used for receiving the target flow data and sending the target flow data to the transport layer analysis module;
and a transmission layer analysis module: extracting all protocol related fields in the target flow data, and extracting characteristic data of the target flow data;
session management module: the method comprises the steps of calculating a Hash according to characteristic data of target flow data, aggregating same session flow information in the target flow data according to the Hash, extracting session data of the session, and feeding the session data back to a comprehensive analysis module;
and the comprehensive analysis module is used for: and the method is used for carrying out rule matching on the session data according to a preset behavior rule, and if the matching is hit, judging the target flow data as threat flow data and outputting the session data hit by the matching.
8. The system of claim 7, wherein the flow receiving module comprises, prior to receiving the target flow data:
obtaining flow data to be detected and copying the flow data to be detected to generate target flow data; the method comprises the steps of copying the flow data to be detected to generate target flow data, specifically, performing flow beam splitting or flow mirroring on the flow data to be detected to generate target flow data;
the traffic receiving module receives the target traffic data by using a DPDK efficient packet receiving engine, wherein the DPDK efficient packet receiving engine operates in a user space, and utilizes a data plane library provided by the DPDK efficient packet receiving engine to complete the receiving and transmitting of the data packet, thereby bypassing the processing process of the data packet by a linux kernel protocol stack.
9. The system of claim 7, wherein the transport layer parsing module extracts all protocol related fields in the target traffic data and extracts feature data of the target traffic data, comprising: extracting characteristic data of target flow data through analysis of a link layer, a network layer and a transmission layer of the target flow data by processing the target flow data;
the characteristic data of the target flow data comprises quintuple data of the target flow, an MAC address, a session constitution packet number, a packet length sequence, a packet interval time sequence, a session length, a characteristic word, a TTL value, an ICMP command type and command code, a TCP session window, a TCP flag bit, a UD protocol field and an igmp protocol field.
10. The system of claim 9 wherein the session management module calculates a Hash according to the characteristic data of the target traffic data, aggregates the same session flow information in the target traffic data according to the Hash, extracts the session data of the session, specifically calculates a Hash according to the MAC address and five-tuple, aggregates the same session flow information in the target traffic data according to the Hash, extracts the number of uplink and downlink bytes, the session duration, the session start and end time of the session, and simultaneously performs timeout analysis on the traffic data.
CN202310112450.9A 2023-02-14 2023-02-14 Network threat detection method and system based on flow behaviors Pending CN116192490A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310112450.9A CN116192490A (en) 2023-02-14 2023-02-14 Network threat detection method and system based on flow behaviors

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310112450.9A CN116192490A (en) 2023-02-14 2023-02-14 Network threat detection method and system based on flow behaviors

Publications (1)

Publication Number Publication Date
CN116192490A true CN116192490A (en) 2023-05-30

Family

ID=86437900

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310112450.9A Pending CN116192490A (en) 2023-02-14 2023-02-14 Network threat detection method and system based on flow behaviors

Country Status (1)

Country Link
CN (1) CN116192490A (en)

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016106592A1 (en) * 2014-12-30 2016-07-07 华为技术有限公司 Method and device for feature information analysis
CN106034056A (en) * 2015-03-18 2016-10-19 北京启明星辰信息安全技术有限公司 Service safety analysis method and system thereof
CN107733851A (en) * 2017-08-23 2018-02-23 刘胜利 DNS tunnels Trojan detecting method based on communication behavior analysis
CN109995740A (en) * 2018-01-02 2019-07-09 国家电网公司 Threat detection method based on depth protocal analysis
CN111277587A (en) * 2020-01-19 2020-06-12 武汉思普崚技术有限公司 Malicious encrypted traffic detection method and system based on behavior analysis
US20210058411A1 (en) * 2018-02-15 2021-02-25 Nippon Telegraph And Telephone Corporation Threat information extraction device and threat information extraction system
CN112822204A (en) * 2021-01-28 2021-05-18 深信服科技股份有限公司 NAT detection method, device, equipment and medium
CN114490302A (en) * 2022-03-04 2022-05-13 大庆火兔网络科技有限公司 Threat behavior analysis method based on big data analysis and server
CN115086242A (en) * 2021-03-12 2022-09-20 天翼云科技有限公司 Encrypted data packet identification method and device and electronic equipment

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016106592A1 (en) * 2014-12-30 2016-07-07 华为技术有限公司 Method and device for feature information analysis
CN106034056A (en) * 2015-03-18 2016-10-19 北京启明星辰信息安全技术有限公司 Service safety analysis method and system thereof
CN107733851A (en) * 2017-08-23 2018-02-23 刘胜利 DNS tunnels Trojan detecting method based on communication behavior analysis
CN109995740A (en) * 2018-01-02 2019-07-09 国家电网公司 Threat detection method based on depth protocal analysis
US20210058411A1 (en) * 2018-02-15 2021-02-25 Nippon Telegraph And Telephone Corporation Threat information extraction device and threat information extraction system
CN111277587A (en) * 2020-01-19 2020-06-12 武汉思普崚技术有限公司 Malicious encrypted traffic detection method and system based on behavior analysis
CN112822204A (en) * 2021-01-28 2021-05-18 深信服科技股份有限公司 NAT detection method, device, equipment and medium
CN115086242A (en) * 2021-03-12 2022-09-20 天翼云科技有限公司 Encrypted data packet identification method and device and electronic equipment
CN114490302A (en) * 2022-03-04 2022-05-13 大庆火兔网络科技有限公司 Threat behavior analysis method based on big data analysis and server

Similar Documents

Publication Publication Date Title
US8474043B2 (en) Speed and memory optimization of intrusion detection system (IDS) and intrusion prevention system (IPS) rule processing
US11290484B2 (en) Bot characteristic detection method and apparatus
KR100862187B1 (en) A Method and a Device for Network-Based Internet Worm Detection With The Vulnerability Analysis and Attack Modeling
CN109117634B (en) Malicious software detection method and system based on network traffic multi-view fusion
CN101547126B (en) Network virus detecting method based on network data streams and device thereof
EP2924943B1 (en) Virus detection method and device
CN101557329B (en) Application layer-based data segmenting method and device thereof
US20030084326A1 (en) Method, node and computer readable medium for identifying data in a network exploit
CN112788034B (en) Processing method and device for resisting network attack, electronic equipment and storage medium
CN112600852B (en) Vulnerability attack processing method, device, equipment and storage medium
CN105592044B (en) Message aggression detection method and device
CN105635170A (en) Method and device for identifying network data packet based on rules
CN115695031A (en) Host computer sink-loss detection method, device and equipment
CN113079150A (en) Intrusion detection method for power terminal equipment
CN113765849B (en) Abnormal network flow detection method and device
KR101488271B1 (en) Apparatus and method for ids false positive detection
CN116192490A (en) Network threat detection method and system based on flow behaviors
CN108650274B (en) Network intrusion detection method and system
CN114050917B (en) Audio data processing method, device, terminal, server and storage medium
CN115065592A (en) Information processing method, device and storage medium
Scheirer et al. Syntax vs. semantics: competing approaches to dynamic network intrusion detection
Schwartzenberg Using machine learning techniques for advanced passive operating system fingerprinting
US7792147B1 (en) Efficient assembly of fragmented network traffic for data security
Grashöfer et al. Attacks on dynamic protocol detection of open source network security monitoring tools
JP4391455B2 (en) Unauthorized access detection system and program for DDoS attack

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination