基于载荷特征与统计特征的Shodan流量识别

doi:10.19678/j.issn.1000-3428.0056888

摘要/Abstract

摘要： 针对Shodan扫描流量对工业控制系统产生的不安全问题，结合载荷特征与统计特征，构建一种将确定性有限自动机（DFA）与支持向量机（SVM）相结合的流量识别DFA-SVM模型。通过分析应用层的流量特征，以提取协议功能码序列作为载荷特征，并结合传统的流量统计特征对流量进行识别。采用VPS部署6个分布式蜜罐系统对处理后的32 522个样本进行Shodan流量识别。实验结果表明，相比仅使用单一特征的模型，该模型可有效识别出27个Shodan扫描器IP，识别精度达到99.38%。

关键词: 载荷特征, 统计特征, 确定性有限自动机, 支持向量机, Shodan流量

Abstract: To address the security risk caused by Shodan scanning traffic in industrial control systems,this paper proposes a traffic recognition DFA-SVM model combining Deterministic Finite Automata(DFA) and Support Vector Machine(SVM) based on the load characteristics and statistical characteristics.By analyzing the traffic characteristics of the application layer,the model extracts the protocol function code sequence as the load feature,and combines the traditional statistical characteristics of traffic to identify it.Six distributed honeypot systems are deployed by VPS to identify the Shodan traffic in 32 522 samples.The experimental results show that compared with the model that only uses a single feature,the proposed model can effectively identify 27 Shodan scanner IPs from Shodan scanning traffic,with a recognition accuracy of 99.38%.

Key words: load characteristics, statistical characteristics, Deterministic Finite Automation(DFA), Support Vector Machine (SVM), Shodan traffic

中图分类号:

TP309

连晓伟, 马垚, 陈永乐, 张壮壮, 王建华. 基于载荷特征与统计特征的Shodan流量识别[J]. 计算机工程, 2021, 47(1): 117-122.

LIAN Xiaowei, MA Yao, CHEN Yongle, ZHANG Zhuangzhuang, WANG Jianhua. Shodan Traffic Identification Based on Load Characteristics and Statistical Characteristics[J]. Computer Engineering, 2021, 47(1): 117-122.

https://www.ecice06.com/CN/Y2021/V47/I1/117

图/表 8

20210125163621

20210125163625

20210125163628

20210125163631

20210125163635

20210125163638

20210125163641

20210125163644

参考文献

[1] LI Qiang,JIA Yuxuan,SONG Jinke,et al.Search of Internet of thing information in the cyberspace[J].Journal of Cyber Security,2018,3(5):38-53.(in Chinese)李强,贾煜璇,宋金珂,等.网络空间物联网信息搜索[J].信息安全学报,2018,3(5):38-53.
[2] WANG Xiaoshan,YANG An,SHI Zhiqiang,et al.New trends of information security in industrial control systems[J].Netinfo Security,2015,15(1):6-11.(in Chinese)王小山,杨安,石志强,等.工业控制系统信息安全新趋势[J].信息网络安全,2015,15(1):6-11.
[3] TAO Yaodong,LI Ning,ZENG Guangsheng.Review of industrial control systems security[J].Computer Engineering and Applications,2016,52(13):8-18.(in Chinese)陶耀东,李宁,曾广圣.工业控制系统安全综述[J].计算机工程与应用,2016,52(13):8-18.
[4] BODENHEIM R,BUTTS J,DUNLAP S,et al.Evaluation of the ability of the Shodan search engine to identify Internet-facing industrial control devices[J].International Journal of Critical Infrastructure Protection,2014,7(2):114-123.
[5] YU Bofei.Search engine safety and equipment protection security based on Internet of things technology[J].Metal World,2015(1):47-50.(in Chinese)于博菲.基于物联网技术的搜索引擎与设备安全[J].金属世界,2015(1):47-50.
[6] MA Cheng.The principles and security usages of cyberspace search engine[J].Information Security and Technology,2016,7(5):6-10.(in Chinese)马程.网络空间搜索引擎的原理研究及安全应用[J].网络空间安全,2016,7(5):6-10.
[7] KLIMBURG A. National cyber security framework manual[EB/OL].[2019-11-10]. https://www.researchgate.net/profile/Eric_Luiijf/publication/261984536_Organisational_Structures_Considerations/links/544f5c6e0cf2bca5ce90e65d.pdf.
[8] GOLDMAN D.Shodan:the scariest search engine on the Internet[EB/OL].[2019-11-10].https://money.cnn.com/2013/04/08/technology/security/shodan/.
[9] ALEXANDRU V S,OBERMEIER S,YU D Y.ICS threat analysis using a large-scale honeynet[C]//Proceedings of the 3rd International Symposium for ICS & SCADA Cyber Security Research.Washington D.C.,USA:IEEE Press,2015:20-30.
[10] PENG Lizhi.A survey of Internet traffic identification[J].Journal of University of Jinan (Science and Technology),2016,30(2):95-104.(in Chinese)彭立志.互联网流量识别研究综述[J].济南大学学报(自然科学版),2016,30(2):95-104.
[11] GRIMAUDO L,MELLIA M,BARALIS E.Hierarchical learning for fine grained Internet traffic classification[C]//Proceedings of the 8th International Wireless Communications and Mobile Computing Conference.Washington D.C.,USA:IEEE Press,2012:1-6.
[12] FU Wenliang,SONG Tian,ZHOU Zhou.RocketTC:a high throughput traffic classification architecture on FPGA[J].Chinese Journal of Computers,2014,37(2):158-166.(in Chinese)付文亮,嵩天,周舟.RocketTC:一个基于FPGA的高性能网络流量分类架构[J].计算机学报,2014,37(2):158-166.
[13] HUANG Jianwen.Development and design of traffic identification system based on DPI[J].Electronic Design Engineering,2017,25(11):14-18.(in Chinese)黄健文.基于DPI的流量识别系统的开发与设计[J].电子设计工程,2017,25(11):14-18.
[14] MOORE A W,ZUEV D.Internet traffic classification using Bayesian analysis techniques[J].ACM SIGMETRICS Performance Evaluation Review,2005,33(1):50-60.
[15] GHOFRANI F,KESHAVARZ-HADDAD A,JAMSHIDI A.Internet traffic classification using multiple classifiers[C]//Proceedings of the 7th Conference on Information and Knowledge Technology.Washington D.C.,USA:IEEE Press,2015:1-8.
[16] QIAN Yaguan,GUAN Xiaohui,YUN Bensheng,et al.Internet traffic classification using SVM with flexible feature space[J].Telecommunications Science,2016, 32(5):105-113.(in Chinese)钱亚冠,关晓惠,云本胜,等.基于可变特征空间SVM的互联网流量分类[J].电信科学,2016,32(5):105-113.
[17] WU D,CHEN X,CHEN C,et al.On addressing the imbalance problem:a correlated KNN approach for network traffic classification[M].Berlin,Germany:Springer,2014:138-151.
[18] CHENG Hua,XIE Jinxin,CHEN Lihuang.CNN-based encrypted C&C communication traffic identification method[J].Computer Engineering,2019,45(8):31-34,41.(in Chinese)程华,谢金鑫,陈立皇.基于CNN的加密C&C通信流量识别方法[J].计算机工程,2019,45(8):31-34,41.
[19] WANG Shan,CHEN Jian,HUANG Zhigen.Protocol identification method and content analysis of application protocol based on finite automaton[J].Electronic Measurement Technology,2011,34(12):109-112.(in Chinese)王珊,陈健,黄志根.基于状态机的应用层协议识别和内容分析[J].电子测量技术,2011,34(12):109-112.
[20] HUANG Xiaojuan.Research on relief algorithm for feature selection[D].Suzhou:Soochow University,2018.(in Chinese)黄晓娟.面向特征选择的Relief算法研究[D].苏州:苏州大学,2018.
[21] ESTE A,GRINGOLI F,SALGARELLI L.Support vector machines for TCP traffic classification[J].Computer Networks,2009,53(14):2476-2490.
[22] Conpot[EB/OL].[2019-11-10].https://plcscan.org/blog/tools/conpot/.

选择文件类型/文献管理软件名称

选择包含的内容