CN118264425A - An attack-aware detection method based on threat modeling based on machine learning - Google Patents

Abstract

The present invention provides an attack perception detection method based on machine learning for threat modeling. The attack perception detection method based on machine learning for threat modeling includes: machine learning modeling, and the machine learning modeling includes the following steps: Step 1. Use nPrint representation to represent and encode the captured network traffic data so that the data structure is unified and standardized; Step 2. Set variable parameters for each part of the data structure, and the nPrint data representation can standardize any data packet without loss. The attack perception detection method based on machine learning for threat modeling provided by the present invention can strengthen data analysis and perceive threats. At the same time, by detecting various types of data packets, machine learning can continuously improve the corresponding data model, which achieves the advantages of becoming more and more powerful and accurate over time.

Description

An attack-aware detection method based on threat modeling based on machine learning

Technical Field

The present invention belongs to the field of network security technology, and in particular relates to an attack perception detection method based on machine learning for threat modeling.

Background technique

The threat detection methods on the market often use static means to continuously apply patches and detect the latest possible threats based on the latest vulnerability situations.

After searching, the related art discloses a method for IoT threat detection based on machine learning, which is used to realize threat detection of IoT devices, including the following steps: collecting traffic data in the IoT environment; performing feature processing on the collected traffic data; using the processed traffic data for machine learning model training; deploying the trained model to the IoT environment equipment for threat detection and identification. The method of the present invention uses machine learning to learn known attack types, so as to timely discover the threats of known and unknown attacks suffered by IoT devices, and enables the machine to continuously learn new attack types and timely discover threats so as to take security measures, thereby reducing losses.

After searching, the relevant technologies disclose a network risk assessment method based on network security situation awareness, including a data collection platform that collects data based on threat latent probes and EDR; a big data analysis platform that uses user and entity behavior analysis, threat modeling and machine learning technology to combine feature detection and behavior detection to analyze the data and receive threat intelligence; the big data analysis platform conducts network risk assessment based on the analysis results of the data and the received threat intelligence, and sends the network risk assessment results to the alarm and control center; it can effectively solve the current problems of difficulty in analyzing network security incidents, difficulties in handling security threats, increasingly complex network attacks, and difficulty in detecting security issues.

However, due to insufficient sustainable product R&D capabilities, some manufacturers’ product performance is gradually failing to meet demand.

Therefore, it is necessary to provide a new attack perception detection method based on threat modeling by machine learning to solve the above technical problems.

Summary of the invention

The technical problem solved by the present invention is to provide a method that can enhance data analysis and perceive threats. At the same time, through the detection of various types of data packets, machine learning can continuously improve the corresponding data model. It realizes an attack perception detection method based on machine learning for threat modeling that becomes more and more powerful and accurate over time.

In order to solve the above technical problems, the present invention provides an attack perception detection method based on machine learning for threat modeling, which includes: machine learning modeling, wherein the machine learning modeling includes the following steps:

Step 1. Use nPrint representation to represent and encode the captured network traffic data so that the data structure is unified and standardized;

Step 2. Set variable parameters for each part of the data structure, and the nPrint data representation method can standardize any data packet without loss. Its standardization lies in that it can be represented by the same number of features, and each feature has the same meaning;

Step 3. Based on the above characteristics, the model parameter variables are used to capture the traffic data for analysis and assign values so that it can use the python package module nPrintML;

Step 4. sklearn uses the baseline model for training through the fitting method;

Step 5. Extract multiple threat models from a large amount of traffic packet data;

Step 6. Analyze the data packet.

As a further solution of the present invention, the analysis of the data packet comprises the following steps:

S1. Install nprint, collect traffic in real time, separate and parse various data packets, and then convert various data packets into nprint data representations that can be used for machine learning;

S2. Call the python nPrintML package module to generate a standard fingerprint for the data packet;

S3. Start sklearn for training and parameter adjustment;

S4. Use the feature selection method based on SelectFromModel and LassoCV to load the nPrintml data package, find its features, and select from the model features with the highest score;

S5. Continuously train the model and use the model to try to compare the differences and similarities between the data bits at each position of the malicious traffic packet and the normal data packet;

S6. Evaluate the test results and set the prediction result threshold. If a result reaches the threshold, a real-time alarm is issued and a text message is sent.

S7. Obtain AccessKey ID and AccessKey Secret through the SMS API interface provided by the cloud service provider, access the API provided by the service provider, and send the alarm information to the administrator via SMS.

As a further solution of the present invention, the purpose of separating and parsing various data packets is to separate the request protocol, request header, request body and IP parameter value in the data packets.

As a further solution of the present invention, the various data packets in S3 include TCP packets, ICMP packets and UDP packets.

As a further solution of the present invention, various types of data packets are detected through machine learning modeling, and machine learning modeling can continuously improve the corresponding data model.

As a further solution of the present invention, the machine learning method is rule learning, and the rule learning algorithm is composed of a set of rules in the form of "IF···THEN···".

As a further solution of the present invention, the algorithm uses the maximum FOIL information gain criterion to heuristically select "attribute-value" pairs, uses a sequence covering strategy to grow rules, and uses a repeated incremental pruning error reduction algorithm to search for appropriate hypotheses.

As a further solution of the present invention, the FOIL information gain is defined as:

Where L is the text, R is the rule, _PR and _NR are the number of positive and negative sample constraints of rule R, _PR+L and _NR+L are the number of positive and negative sample constraints of the rule after adding the text L.

Compared with related technologies, the attack perception detection method based on threat modeling based on machine learning provided by the present invention has the following beneficial effects:

1. The method of the present invention is based on machine learning to perform threat modeling to perceive attacks. When using it, you only need to set corresponding parameters for the threat model in this method according to your own experience and relevant information of the latest vulnerabilities, so as to enhance data analysis and perceive threats. At the same time, through the detection of various types of data packets, machine learning can continuously improve the corresponding data model, which becomes more and more powerful and accurate over time.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

Fig. 1 is a flow chart of the analysis of a data packet in the present invention;

FIG. 2 is a schematic diagram showing a comparison between malicious traffic packets and normal data packets in the present invention.

Detailed ways

Please refer to Figures 1 and 2, wherein Figure 1 is a flowchart of the analysis of data packets in the present invention; Figure 2 is a schematic diagram of the comparison of malicious traffic packets and normal data packets in the present invention. The attack perception detection method based on machine learning threat modeling includes: machine learning modeling, and the machine learning modeling includes the following steps:

Step 1. Use nPrint representation to represent and encode the captured network traffic data so that the data structure is unified and standardized;

Step 2. Set variable parameters for each part of the data structure, and the nPrint data representation method can standardize any data packet without loss. Its standardization lies in that it can be represented by the same number of features, and each feature has the same meaning;

Step 3. Based on the above characteristics, the model parameter variables are used to capture the traffic data for analysis and assign values so that it can use the python package module nPrintML;

Step 4. sklearn uses the baseline model for training through the fitting method;

Step 5. Extract multiple threat models from a large amount of traffic packet data;

Step 6. Analyze the data packet.

2. The attack perception detection method based on machine learning for threat modeling according to claim 1, characterized in that the analysis of the data packet comprises the following steps:

S1. Install nprint, collect traffic in real time, separate and parse various data packets, and then convert various data packets into nprint data representations that can be used for machine learning;

S2. Call the python nPrintML package module to generate a standard fingerprint for the data packet;

S3. Start sklearn for training and parameter adjustment;

S4. Use the feature selection method based on SelectFromModel and LassoCV to load the nPrintml data package, find its features, and select from the model features with the highest score;

S5. Continuously train the model and use the model to try to compare the differences and similarities between the data bits at each position of the malicious traffic packet and the normal data packet (as shown in FIG. 2 , the TCP and PayLoad of the above two pieces of data are different in the figure);

S6. Evaluate the test results and set the prediction result threshold. If a result reaches the threshold, a real-time alarm is issued and a text message is sent.

S7. Obtain AccessKey ID and AccessKey Secret through the SMS API interface provided by the cloud service provider, access the API provided by the service provider, and send the alarm information to the administrator via SMS.

The purpose of separating and parsing various data packets is to separate the request protocol, request header, request body and IP parameter value in the data packet.

The various data packets in S3 include TCP packets, ICMP packets and UDP packets.

The various types of data packets are detected through machine learning modeling, and machine learning modeling can continuously improve the corresponding data models.

The machine learning method is rule learning, and the rule learning algorithm consists of a set of rules in the form of "IF···THEN···".

The algorithm uses the maximum FOIL information gain criterion to heuristically select "attribute-value" pairs, uses a sequence covering strategy to grow rules, and uses a repeated incremental pruning error reduction algorithm to search for appropriate hypotheses.

The FOIL information gain is defined as:

Where L is the text, R is the rule, _PR and _NR are the number of positive and negative sample constraints of rule R, _PR+L and _NR+L are the number of positive and negative sample constraints of the rule after adding the text L.

This method uses machine learning to perform threat modeling to perceive attacks. When using it, you only need to set corresponding parameters for the threat model in this method based on your own experience and relevant information on the latest vulnerabilities. This can enhance data analysis and perceive threats. At the same time, through the detection of various types of data packets, machine learning can continuously improve the corresponding data model, making it more powerful and accurate over time.

The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims (8)

1. An attack perception detection method for threat modeling based on machine learning, which is characterized by comprising the following steps:

machine learning modeling, the machine learning modeling comprising the steps of:

Adopting nPrint representation method to represent and encode the grabbed network flow data so as to unify and normalize the data structure;

Setting variable parameters for each part of the data structure, wherein nPrint data representation method can represent any data packet without loss in a standard way, and the standard is that the data packet can be represented by the same number of characteristics, and each characteristic has the same meaning;

according to the characteristics, the flow data are grabbed and analyzed by using the model parameter variable representation, and the assignment is carried out, so that the flow data can be used by using a python packet module nPrintML;

sklearn training by adopting a baseline model through a fitting method;

fifthly, extracting a plurality of threat models through a large amount of flow packet data;

and step six, analyzing the data packet.

2. The attack awareness detection method for threat modeling based on machine learning of claim 1, wherein: the analysis of the data packet comprises the following steps:

S1, installing nprint, collecting flow in real time, separating and analyzing various data packets, and converting the various data packets into nprint data representation usable by machine learning;

S2, calling a nPrintML packet module of python to generate a standard fingerprint for the data packet;

s3, starting sklearn to perform training and parameter adjustment;

S4, loading nPrintml data packets by adopting a feature selection method based on SelectFromModel and LassoCV, finding the features of the data packets, and selecting from model features with highest scores;

S5, continuously performing model training, and using the model to try to compare different points and the same points represented by data bits at each position of the malicious traffic packet and the normal data packet;

S6, evaluating the detection result, setting a prediction result threshold value, and if a certain result reaches the threshold value, alarming in real time and sending a mobile phone short message;

S7, acquiring ACCESSKEY ID and ACCESSKEY SECRET through a short message API interface provided by a cloud service provider, accessing an API provided by the service provider, and sending alarm information to an administrator in a short message mode.

3. The attack awareness detection method for threat modeling based on machine learning of claim 2, wherein: the purpose of the separation and analysis of various data packets is to separate out the request protocol, the request header, the request body and the ip parameter values in the data packets.

4. The attack awareness detection method for threat modeling based on machine learning of claim 2, wherein: and the various data packets in the S3 comprise TCP (transmission control protocol) messages, ICMP messages and UDP (user datagram protocol) message data packets.

5. The attack awareness detection method for threat modeling based on machine learning of claim 1, wherein: the various types of data packets are detected through machine learning modeling, and the machine learning modeling can continuously perfect corresponding data models.

6. The attack awareness detection method for threat modeling based on machine learning of claim 1, wherein: the machine learning mode is rule learning, and the algorithm of the rule learning consists of a form rule set of IF.

7. The attack awareness detection method for threat modeling based on machine learning of claim 1, wherein: the algorithm selects an attribute-value pair by utilizing the maximum FOIL information gain rule heuristic, covers a strategy growth rule by using a sequence, and searches by adopting a repeated increment pruning error reduction algorithm to obtain a proper hypothesis.

8. The attack awareness detection method for threat modeling based on machine learning of claim 1, wherein: the FOIL information gain is defined as:

Wherein L is a word, R is a rule, P _R and N _R are respectively the positive and negative sample constraint numbers of the rule R, and P _R+L and N _R+L are respectively the positive and negative sample constraint numbers of the rule after the word L is added.