CN115333801B - Method and system based on bidirectional message intrusion detection - Google Patents
Method and system based on bidirectional message intrusion detection Download PDFInfo
- Publication number
- CN115333801B CN115333801B CN202210890816.0A CN202210890816A CN115333801B CN 115333801 B CN115333801 B CN 115333801B CN 202210890816 A CN202210890816 A CN 202210890816A CN 115333801 B CN115333801 B CN 115333801B
- Authority
- CN
- China
- Prior art keywords
- message
- feature
- session
- time sequence
- module
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/04—Processing captured monitoring data, e.g. for logfile generation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Theoretical Computer Science (AREA)
- General Health & Medical Sciences (AREA)
- Data Mining & Analysis (AREA)
- Biophysics (AREA)
- Mathematical Physics (AREA)
- Biomedical Technology (AREA)
- Evolutionary Computation (AREA)
- Artificial Intelligence (AREA)
- Molecular Biology (AREA)
- General Physics & Mathematics (AREA)
- Computational Linguistics (AREA)
- Software Systems (AREA)
- Life Sciences & Earth Sciences (AREA)
- Virology (AREA)
- Environmental & Geological Engineering (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Abstract
The invention provides a method and a system based on bidirectional message intrusion detection, which are used for carrying out random forest classification by extracting time sequence characteristics and space characteristics of message data, can comprehensively detect and quickly highlight required characteristic vectors, and solve the problem of intrusion detection based on ports or load keywords by using different classification capabilities of integration so as to overcome the problem of using encryption traffic of malicious codes in the prior art; when the time stamp carried by the bidirectional message is calculated and transmitted, the deviation between the time stamp and the estimated time of channel measurement is calculated, and whether the message data of the client is maliciously tampered is judged, so that other detection angles are introduced to assist, and the detection accuracy is improved.
Description
Technical Field
The application relates to the technical field of network security, in particular to a method and a system based on bidirectional message intrusion detection.
Background
With the continuous development of traffic encryption technology, encrypted traffic gradually replaces non-encrypted traffic to become the main stream of the current network, and meanwhile, the encrypted traffic is often used by various malicious software to avoid the traditional intrusion detection system based on ports or load keywords, thereby bringing serious threat to network security.
The conventional encrypted traffic detection method is to use a convolutional neural network model to identify an encrypted feature vector, so that intrusion detection on encrypted traffic can be realized, but a single detection angle is easily influenced by a model training effect. Other detection angles need to be introduced to assist, which helps to improve the accuracy of the detection.
Therefore, a targeted two-way message intrusion detection-based method and system are urgently needed.
Disclosure of Invention
The invention aims to provide a method and a system based on bidirectional message intrusion detection, which solve the problems that malicious codes avoid intrusion detection based on ports or load keywords by means of encrypted messages and a single detection angle is easily influenced by a model training effect.
In a first aspect, the present application provides a method for bidirectional message intrusion detection, where the method includes:
The method comprises the steps of obtaining message data of a client, dividing the network message data into different session messages by taking a session as a unit, extracting feature vectors of the session messages, and respectively inputting a time sequence feature module and a space feature module;
The time sequence characteristic module comprises a plurality of hidden layer neurons, wherein the hidden layer neurons are divided into two groups, one group is a forward feedback line, the other group is a reverse feedback line, a bidirectional feedback loop is formed, the current neuron in each feedback line receives hidden layer information transmitted by the last neuron, receives state information transmitted by neighbor neurons adjacent to the last neuron, outputs hidden layer information at the current moment and state information updated by the current neuron, and outputs the state information to an accumulation unit of the time sequence characteristic module for vector element alignment addition;
The spatial feature module comprises the steps of storing global feature vectors in a plurality of local feature matrixes, capturing time sequence relations among different message loads, obtaining long-distance dependency relations of data among the vectors, endowing the vectors with different weight values to form different weight matrixes Q, K, V, carrying out linear transformation on the weight matrixes Q, K, V in parallel, and merging and outputting global features;
Extracting intermediate layer output of the fully-connected neural network of the time sequence feature module and the space feature module as new time sequence features and space features of the session message, and splicing the new time sequence features and the new space features together to obtain a mixed feature vector of the session message;
Transmitting the mixed feature vector to a random forest of a server for classification, extracting the random forest for n rounds to obtain n training sets, training the extracted n training sets by using a specified quantity feature value randomly through column sampling to obtain n decision trees, and obtaining classification results of the n decision trees according to a voting mode;
The message data of the client carries a first sent time stamp, the response message returned to the client carries a second returned time stamp, and the time for message transmission is calculated according to the first time stamp and the second time stamp;
measuring and estimating a channel, judging whether the deviation between the time of message transmission and the estimated time is within a preset range or not according to the estimated time of message transmission obtained by the result of measurement and estimation, if so, continuing to judge the classification result, otherwise, recognizing that the message data of the client is maliciously tampered;
Judging whether malicious codes exist in the message data of the client according to the classification result, and terminating the TLS1.3 handshake process by the server when the malicious codes exist in the message data of the client.
In a second aspect, the present application provides a system based on bidirectional message intrusion detection, the system comprising:
The preprocessing module is used for acquiring message data of a client, dividing the network message data into different session messages by taking a session as a unit, extracting feature vectors of the session messages, and respectively inputting the feature vectors into the time sequence feature module and the space feature module;
The time sequence feature module comprises a plurality of hidden layer neurons, wherein the hidden layer neurons are divided into two groups, one group is a forward feedback line, the other group is a reverse feedback line, a bidirectional feedback loop is formed by the hidden layer neurons, the current neurons in each feedback line receive hidden layer information transmitted by the last neuron and state information transmitted by neighbor neurons adjacent to the last neuron, the hidden layer information at the current moment and the state information updated by the current neurons are output, and vector element alignment addition is carried out by an accumulation unit of the time sequence feature module;
The spatial feature module comprises a step of storing global feature vectors in a plurality of local feature matrixes, capturing time sequence relations among different message loads, obtaining long-distance dependency relations of data among the vectors, endowing the vectors with different weight values to form different weight matrixes Q, K, V, carrying out linear transformation on the weight matrixes Q, K, V in parallel, and merging and outputting global features;
The classification module is used for extracting the middle layer output of the fully-connected neural network of the time sequence feature module and the space feature module as new time sequence features and space features of the session message, and splicing the new time sequence features and the space features together to obtain a mixed feature vector of the session message; transmitting the mixed feature vector to a random forest of a server for classification, extracting the random forest for n rounds to obtain n training sets, training the extracted n training sets by using a specified quantity feature value randomly through column sampling to obtain n decision trees, and obtaining classification results of the n decision trees according to a voting mode;
The bidirectional message judging module is used for calculating the time consumption of message transmission according to the first time stamp and the second time stamp by utilizing the fact that the message data of the client carries the sent first time stamp and the response message returned to the client carries the returned second time stamp; measuring and estimating a channel, judging whether the deviation between the time of message transmission and the estimated time is within a preset range or not according to the estimated time of message transmission obtained by the result of measurement and estimation, if so, continuing to judge the classification result, otherwise, recognizing that the message data of the client is maliciously tampered;
and the execution module is used for judging whether malicious codes exist in the message data of the client according to the classification result, and if so, the server terminates the TLS1.3 handshake process.
In a third aspect, the present application provides a system based on bidirectional message intrusion detection, the system comprising a processor and a memory:
The memory is used for storing program codes and transmitting the program codes to the processor;
the processor is configured to perform the method according to any one of the four possible aspects of the first aspect according to instructions in the program code.
In a fourth aspect, the present application provides a computer readable storage medium for storing program code for performing the method of any one of the four possibilities of the first aspect.
Advantageous effects
The invention provides a method and a system based on bidirectional message intrusion detection, which are used for carrying out random forest classification by extracting time sequence characteristics and space characteristics of message data, can comprehensively detect and quickly highlight required characteristic vectors, and solve the problem of intrusion detection based on ports or load keywords by using different classification capabilities of integration so as to overcome the problem of using encryption traffic of malicious codes in the prior art; when the time stamp carried by the bidirectional message is calculated and transmitted, the deviation between the time stamp and the estimated time of channel measurement is calculated, and whether the message data of the client is maliciously tampered is judged, so that other detection angles are introduced to assist, and the detection accuracy is improved.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that are needed in the embodiments will be briefly described below, and it will be obvious to those skilled in the art that other drawings can be obtained from these drawings without inventive effort.
FIG. 1 is a schematic flow chart of a method based on two-way message intrusion detection according to the present invention;
fig. 2 is a block diagram of a system based on two-way message intrusion detection according to the present invention.
Detailed Description
The preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby making clear and defining the scope of the present invention.
TLS1.3 is a new transport layer encryption protocol for providing secure communications between web browsers and servers. TLS1.3 has the characteristics of higher speed and higher safety.
TLS1.3 speeds up the encrypted connection by TLS false start and zero round trip time 0-RTT. In short, two round trips are required to complete the handshake in TLS1.2, and only one round trip is required to use TLS1.3, which in turn reduces the encryption delay by half, so the encryption connection is faster. This allows for faster and more efficient detection of the identification in the new encryption protocol TLS1.3 usage scenario, thus discovering the presence of malicious code before the handshake is successful.
Fig. 1 is a general flowchart of a method based on bidirectional message intrusion detection according to the present application, where the method includes:
The method comprises the steps of obtaining message data of a client, dividing the network message data into different session messages by taking a session as a unit, extracting feature vectors of the session messages, judging whether the feature vectors comprise service loads or not, and judging whether handshake information is complete or not;
if the feature vector of the session message does not include the service load, the session message can be considered to be irrelevant to the service, and is likely to be the result of malicious code tampering.
If the handshake information of the session message is incomplete, the session message can be considered to be the result of malicious code tampering.
Judging whether to execute further feature compression according to the number of the session messages obtained by dividing, executing feature compression when the number of the session messages exceeds a preset threshold value, and respectively inputting the feature vectors of the session messages obtained by previous extraction into a time sequence feature module and a space feature module;
if the number of the session messages is smaller than the preset threshold value, the feature vector can be directly input into the time sequence feature module and the space feature module respectively without executing feature compression.
The feature compression refers to selecting a feature quantity with strong part specificity from the extracted feature vectors of the session message, so as to compress the data quantity and improve the operation speed. Feature compression methods common in the art may be employed.
The time sequence characteristic module comprises a plurality of hidden layer neurons, wherein the hidden layer neurons are divided into two groups, one group is a forward feedback line, the other group is a reverse feedback line, a bidirectional feedback loop is formed, the current neuron in each feedback line receives hidden layer information transmitted by the last neuron, receives state information transmitted by neighbor neurons adjacent to the last neuron, outputs hidden layer information at the current moment and state information updated by the current neuron, and outputs the state information to an accumulation unit of the time sequence characteristic module for vector element alignment addition;
The information transmission and long-term memory capacity of the input mixed feature vector are realized through the multi-layer structure formed by the hidden layer neurons.
The spatial feature module comprises the steps of storing global feature vectors in a plurality of local feature matrixes, capturing time sequence relations among different message loads, obtaining long-distance dependency relations of data among the vectors, endowing the vectors with different weight values to form different weight matrixes Q, K, V, carrying out linear transformation on the weight matrixes Q, K, V in parallel, and merging and outputting global features;
Extracting intermediate layer output of the fully-connected neural network of the time sequence feature module and the space feature module as new time sequence features and space features of the session message, and splicing the new time sequence features and the new space features together to obtain a mixed feature vector of the session message;
Transmitting the mixed feature vector to a random forest of a server for classification, extracting the random forest for n rounds to obtain n training sets, training the extracted n training sets by using a specified quantity feature value randomly through column sampling to obtain n decision trees, and obtaining classification results of the n decision trees according to a voting mode;
The message data of the client carries a first sent time stamp, the response message returned to the client carries a second returned time stamp, and the time for message transmission is calculated according to the first time stamp and the second time stamp;
measuring and estimating a channel, judging whether the deviation between the time of message transmission and the estimated time is within a preset range or not according to the estimated time of message transmission obtained by the result of measurement and estimation, if so, continuing to judge the classification result, otherwise, recognizing that the message data of the client is maliciously tampered;
Judging whether malicious codes exist in the message data of the client according to the classification result, and terminating the TLS1.3 handshake process by the server when the malicious codes exist in the message data of the client.
And when the malicious codes do not exist in the message data of the client, the server completes the handshake process according to the handshake execution standard of TLS 1.3.
In some preferred embodiments, after extracting the feature vector of the session packet, the method further includes: judging whether the feature vector comprises a service load or not and judging whether handshake information is complete or not, wherein the judging comprises the following steps: if the feature vector of the session message does not comprise the service load, the session message is determined to be irrelevant to the service and is the result of tampering of malicious codes; if the handshake information of the session message is incomplete, the session message is determined to be the result of malicious code tampering.
In some preferred embodiments, the classification capability of each decision tree has pertinence, the specified quantity feature value is obtained according to different classifications, and the same feature vector matrix is classified according to different angles through the decision tree, namely, the integration function aiming at different classification capabilities is completed. Its classification performance is higher than that of a single classifier.
The average generalization error of a decision tree in a random forest is related to the regression function.
In some preferred embodiments, the voting approach involves weighted accumulation of the output results of each decision tree.
Fig. 2 is a schematic diagram of a system based on bidirectional message intrusion detection according to the present application, where the system includes:
The preprocessing module is used for acquiring message data of a client, dividing the network message data into different session messages by taking a session as a unit, extracting feature vectors of the session messages, and respectively inputting the feature vectors into the time sequence feature module and the space feature module;
The time sequence feature module comprises a plurality of hidden layer neurons, wherein the hidden layer neurons are divided into two groups, one group is a forward feedback line, the other group is a reverse feedback line, a bidirectional feedback loop is formed by the hidden layer neurons, the current neurons in each feedback line receive hidden layer information transmitted by the last neuron and state information transmitted by neighbor neurons adjacent to the last neuron, the hidden layer information at the current moment and the state information updated by the current neurons are output, and vector element alignment addition is carried out by an accumulation unit of the time sequence feature module;
The spatial feature module comprises a step of storing global feature vectors in a plurality of local feature matrixes, capturing time sequence relations among different message loads, obtaining long-distance dependency relations of data among the vectors, endowing the vectors with different weight values to form different weight matrixes Q, K, V, carrying out linear transformation on the weight matrixes Q, K, V in parallel, and merging and outputting global features;
The classification module is used for extracting the middle layer output of the fully-connected neural network of the time sequence feature module and the space feature module as new time sequence features and space features of the session message, and splicing the new time sequence features and the space features together to obtain a mixed feature vector of the session message; transmitting the mixed feature vector to a random forest of a server for classification, extracting the random forest for n rounds to obtain n training sets, training the extracted n training sets by using a specified quantity feature value randomly through column sampling to obtain n decision trees, and obtaining classification results of the n decision trees according to a voting mode;
The bidirectional message judging module is used for calculating the time consumption of message transmission according to the first time stamp and the second time stamp by utilizing the fact that the message data of the client carries the sent first time stamp and the response message returned to the client carries the returned second time stamp; measuring and estimating a channel, judging whether the deviation between the time of message transmission and the estimated time is within a preset range or not according to the estimated time of message transmission obtained by the result of measurement and estimation, if so, continuing to judge the classification result, otherwise, recognizing that the message data of the client is maliciously tampered;
and the execution module is used for judging whether malicious codes exist in the message data of the client according to the classification result, and if so, the server terminates the TLS1.3 handshake process.
The application provides a system based on bidirectional message intrusion detection, which comprises: the system includes a processor and a memory:
The memory is used for storing program codes and transmitting the program codes to the processor;
the processor is configured to perform the method according to any of the embodiments of the first aspect according to instructions in the program code.
The present application provides a computer readable storage medium for storing program code for performing the method of any one of the embodiments of the first aspect.
In a specific implementation, the present invention also provides a computer storage medium, where the computer storage medium may store a program, where the program may include some or all of the steps in the various embodiments of the present invention when executed. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM) or a Random Access Memory (RAM).
It will be apparent to those skilled in the art that the techniques of embodiments of the present invention may be implemented in software plus a necessary general purpose hardware platform. Based on such understanding, the technical solutions in the embodiments of the present invention may be embodied in essence or a part contributing to the prior art in the form of a software product, which may be stored in a storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the method described in the embodiments or some parts of the embodiments of the present invention.
The same or similar parts between the various embodiments of the present description are referred to each other. In particular, for the embodiments, since they are substantially similar to the method embodiments, the description is relatively simple, and reference should be made to the description of the method embodiments for the matters.
The embodiments of the present invention described above do not limit the scope of the present invention.
Claims (7)
1. A method for two-way message-based intrusion detection, the method comprising:
The method comprises the steps of obtaining message data of a client, dividing the network message data into different session messages by taking a session as a unit, extracting feature vectors of the session messages, and respectively inputting a time sequence feature module and a space feature module;
The time sequence characteristic module comprises a plurality of hidden layer neurons, wherein the hidden layer neurons are divided into two groups, one group is a forward feedback line, the other group is a reverse feedback line, a bidirectional feedback loop is formed, the current neuron in each feedback line receives hidden layer information transmitted by the last neuron, receives state information transmitted by neighbor neurons adjacent to the last neuron, outputs hidden layer information at the current moment and state information updated by the current neuron, and outputs the state information to an accumulation unit of the time sequence characteristic module for vector element alignment addition;
The spatial feature module comprises the steps of storing global feature vectors in a plurality of local feature matrixes, capturing time sequence relations among different message loads, obtaining long-distance dependency relations of data among the vectors, endowing the vectors with different weight values to form different weight matrixes Q, K, V, carrying out linear transformation on the weight matrixes Q, K, V in parallel, and merging and outputting global features;
Extracting intermediate layer output of the fully-connected neural network of the time sequence feature module and the space feature module as new time sequence features and space features of the session message, and splicing the new time sequence features and the new space features together to obtain a mixed feature vector of the session message;
Transmitting the mixed feature vector to a random forest of a server for classification, extracting the random forest for n rounds to obtain n training sets, training the extracted n training sets by using a specified quantity feature value randomly through column sampling to obtain n decision trees, and obtaining classification results of the n decision trees according to a voting mode;
The message data of the client carries a first sent time stamp, the response message returned to the client carries a second returned time stamp, and the time for message transmission is calculated according to the first time stamp and the second time stamp;
measuring and estimating a channel, judging whether the deviation between the time of message transmission and the estimated time is within a preset range or not according to the estimated time of message transmission obtained by the result of measurement and estimation, if so, continuing to judge the classification result, otherwise, recognizing that the message data of the client is maliciously tampered;
Judging whether malicious codes exist in the message data of the client according to the classification result, and terminating the TLS1.3 handshake process by the server when the malicious codes exist in the message data of the client.
2. The method according to claim 1, characterized in that: after extracting the feature vector of the session message, the method further comprises: judging whether the feature vector comprises a service load or not and judging whether handshake information is complete or not, wherein the judging comprises the following steps: if the feature vector of the session message does not comprise the service load, the session message is determined to be irrelevant to the service and is the result of tampering of malicious codes; if the handshake information of the session message is incomplete, the session message is determined to be the result of malicious code tampering.
3. The method according to claim 1, characterized in that: the classification capability of each decision tree has pertinence, the specified quantity characteristic values are obtained according to different classifications, and the same characteristic vector matrix is classified according to different angles through the decision tree, so that the integration function aiming at different classification capabilities is completed.
4. A method according to any one of claims 2 or 3, wherein: the voting mode comprises the step of carrying out weighted accumulation on the output result of each decision tree.
5. A system based on two-way message intrusion detection, the system comprising:
The preprocessing module is used for acquiring message data of a client, dividing the network message data into different session messages by taking a session as a unit, extracting feature vectors of the session messages, and respectively inputting the feature vectors into the time sequence feature module and the space feature module;
The time sequence feature module comprises a plurality of hidden layer neurons, wherein the hidden layer neurons are divided into two groups, one group is a forward feedback line, the other group is a reverse feedback line, a bidirectional feedback loop is formed by the hidden layer neurons, the current neurons in each feedback line receive hidden layer information transmitted by the last neuron and state information transmitted by neighbor neurons adjacent to the last neuron, the hidden layer information at the current moment and the state information updated by the current neurons are output, and vector element alignment addition is carried out by an accumulation unit of the time sequence feature module;
The spatial feature module comprises a step of storing global feature vectors in a plurality of local feature matrixes, capturing time sequence relations among different message loads, obtaining long-distance dependency relations of data among the vectors, endowing the vectors with different weight values to form different weight matrixes Q, K, V, carrying out linear transformation on the weight matrixes Q, K, V in parallel, and merging and outputting global features;
The classification module is used for extracting the middle layer output of the fully-connected neural network of the time sequence feature module and the space feature module as new time sequence features and space features of the session message, and splicing the new time sequence features and the space features together to obtain a mixed feature vector of the session message; transmitting the mixed feature vector to a random forest of a server for classification, extracting the random forest for n rounds to obtain n training sets, training the extracted n training sets by using a specified quantity feature value randomly through column sampling to obtain n decision trees, and obtaining classification results of the n decision trees according to a voting mode;
The bidirectional message judging module is used for calculating the time consumption of message transmission according to the first time stamp and the second time stamp by utilizing the fact that the message data of the client carries the sent first time stamp and the response message returned to the client carries the returned second time stamp; measuring and estimating a channel, judging whether the deviation between the time of message transmission and the estimated time is within a preset range or not according to the estimated time of message transmission obtained by the result of measurement and estimation, if so, continuing to judge the classification result, otherwise, recognizing that the message data of the client is maliciously tampered;
and the execution module is used for judging whether malicious codes exist in the message data of the client according to the classification result, and if so, the server terminates the TLS1.3 handshake process.
6. A system based on two-way message intrusion detection, the system comprising a processor and a memory:
The memory is used for storing program codes and transmitting the program codes to the processor;
The processor is configured to perform the method according to any of the claims 1-4 according to instructions in the program code.
7. A computer readable storage medium, characterized in that the computer readable storage medium is for storing a program code for performing a method implementing any of claims 1-4.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210890816.0A CN115333801B (en) | 2022-07-27 | 2022-07-27 | Method and system based on bidirectional message intrusion detection |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210890816.0A CN115333801B (en) | 2022-07-27 | 2022-07-27 | Method and system based on bidirectional message intrusion detection |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115333801A CN115333801A (en) | 2022-11-11 |
| CN115333801B true CN115333801B (en) | 2024-08-16 |
Family
ID=83919807
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210890816.0A Active CN115333801B (en) | 2022-07-27 | 2022-07-27 | Method and system based on bidirectional message intrusion detection |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115333801B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115801459A (en) * | 2023-02-03 | 2023-03-14 | 北京六方云信息技术有限公司 | Message detection method, device, system and storage medium |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115314265A (en) * | 2022-07-27 | 2022-11-08 | 天津市国瑞数码安全系统股份有限公司 | Method and system for identifying TLS encryption application based on flow and time sequence |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2021243663A1 (en) * | 2020-06-04 | 2021-12-09 | 深圳市欢太科技有限公司 | Session detection method and apparatus, and detection device and computer storage medium |
| US11611588B2 (en) * | 2020-07-10 | 2023-03-21 | Kyndryl, Inc. | Deep learning network intrusion detection |
| CN112822167B (en) * | 2020-12-31 | 2023-04-07 | 杭州中电安科现代科技有限公司 | Abnormal TLS encrypted traffic detection method and system |
-
2022
- 2022-07-27 CN CN202210890816.0A patent/CN115333801B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115314265A (en) * | 2022-07-27 | 2022-11-08 | 天津市国瑞数码安全系统股份有限公司 | Method and system for identifying TLS encryption application based on flow and time sequence |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115333801A (en) | 2022-11-11 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Lin et al. | TSCRNN: A novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of IIoT | |
| CN112003870B (en) | Network encryption traffic identification method and device based on deep learning | |
| CN112235264B (en) | Network traffic identification method and device based on deep migration learning | |
| CN111600919B (en) | Method and device for constructing intelligent network application protection system model | |
| Yang et al. | LCCDE: A decision-based ensemble framework for intrusion detection in the Internet of Vehicles | |
| CN111866024B (en) | Network encryption traffic identification method and device | |
| CN112738039A (en) | Malicious encrypted flow detection method, system and equipment based on flow behavior | |
| CN115314265B (en) | Method and system for identifying TLS (transport layer security) encryption application based on traffic and time sequence | |
| CN115333801B (en) | Method and system based on bidirectional message intrusion detection | |
| CN117240524A (en) | A hybrid model-based IoT intrusion detection method and system | |
| CN115314268B (en) | Malicious encryption traffic detection method and system based on traffic fingerprint and behavior | |
| Khan et al. | Long short-term memory neural networks for false information attack detection in software-defined in-vehicle network | |
| CN112364388A (en) | Sensor data authentication method and device based on block chain | |
| Said et al. | Attention-based CNN-BiLSTM deep learning approach for network intrusion detection system in software defined networks | |
| CN114422207B (en) | C & C communication flow detection method and device based on multiple modes | |
| Li et al. | A method for network intrusion detection based on GAN-CNN-BiLSTM | |
| CN113839925A (en) | IPv6 network intrusion detection method and system based on data mining technology | |
| Lee et al. | Malicious traffic compression and classification technique for secure Internet of Things | |
| Liang et al. | Leverage temporal convolutional network for the representation learning of urls | |
| Chelghoum et al. | Blockchain and AI for Collaborative Intrusion Detection in 6G-enabled IoT Networks | |
| CN116321132A (en) | Communication data encryption detection method based on machine learning and related equipment | |
| CN114866279A (en) | Vulnerability attack traffic detection method and system based on HTTP request payload | |
| Liang et al. | Leveraging byte-level features for lstm-based anomaly detection in controller area networks | |
| CN117375855A (en) | Abnormality detection method, model training method and related equipment | |
| CN114238822A (en) | Identification method and device of Web service equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |