面向后渗透攻击行为的网络恶意流量检测研究

doi:10.19678/j.issn.1000-3428.0067968

摘要/Abstract

摘要： 现有的后渗透行为研究主要针对主机端进行攻击与防御反制,缺乏对流量侧的模式分析与检测方法。随着后渗透攻击框架与攻击工具的快速发展与广泛使用,基于统计特征或原始流量输入的恶意流量检测模型难以应对复杂多变场景下的后渗透攻击行为恶意流量,存在泛化能力弱、检测精度低、误报率高等问题。通过深入分析后渗透攻击恶意流量样本与正常网络流量会话流,提出后渗透攻击恶意流量的会话流级别粒度划分方法,挖掘后渗透攻击恶意流量在时间尺度上的交互行为与语义表示。引入一种基于马尔可夫模型的时间向量特征提取方法表征流序列的行为相似度,对会话流进行全局行为建模,解决单一粒度特征学习能力不足的问题,进而构建基于多粒度特征融合的后渗透攻击恶意流量检测框架。实验结果表明,该方法在后渗透攻击行为恶意流量多分类检测任务上达到了99.98%的准确率,具有较高的分类准确性与较低的误报率。

关键词: 后渗透攻击, 流量分析, 多特征融合, 特征提取, 恶意流量检测

Abstract: Existing post-exploitation behavior studies mainly focus on the host side of the attack and defense countermeasures, and lack pattern analysis and detection methods for the traffic side. With the rapid development and widespread use of post-exploitation attack frameworks and tools, it is difficult for malicious traffic detection models based on statistical features or raw traffic input to cope with the malicious traffic of post-exploitation attack behaviors in complex and variable scenarios, with weak generalization capabilities, low detection accuracies, and high false alarm rates. By deeply analyzing the post-exploitation attack malicious traffic samples and normal network traffic session flow, this study proposes a session flow-level granularity classification method for post-exploitation attack malicious traffic, mining the interaction behavior and semantic representation of post-exploitation attack malicious traffic on a time scale, and modeling the global behavior of the session flow by introducing a Markov model-based time vector feature extraction method to characterize the behavioral similarity of the flow sequence. The problem of insufficient learning capability of single granularity features is addressed, and a malicious traffic detection framework based on multi-granularity feature fusion for post-exploitation attacks is constructed. The experimental results demonstrate that the method has higher classification accuracies and lower false alarm rates, which achieves accuracy of 99.98% in post-exploitation attack malicious traffic detection.

Key words: post-exploitation attack, traffic analysis, multi-feature fusion, feature extraction, malicious traffic detection

中图分类号:

TP393

梁松林, 林伟, 王珏, 杨庆. 面向后渗透攻击行为的网络恶意流量检测研究[J]. 计算机工程, 2024, 50(5): 128-138.

LIANG Songlin, LIN Wei, WANG Jue, YANG Qing. Research on Network Malicious Traffic Detection for Post-Exploitation Attack Behavior[J]. Computer Engineering, 2024, 50(5): 128-138.

https://www.ecice06.com/CN/Y2024/V50/I5/128

参考文献

[1] STIAWAN D, IDRIS M Y, ABDULLAH A H, et al. Cyber-attack penetration test and vulnerability analysis[J]. International Journal of Online Engineering, 2017, 13(1):125-134.
[2] SCHNEIDER D, FRAUNHOLZ D, KROHMER D. A qualitative empirical analysis of human post-exploitation behavior[EB/OL].[2023-04-11]. https://arxiv.org/abs/2101.02102.
[3] CAPABILITIES C. Cyber capabilities and national power:a net assessment[M]. London, UK:The International Institute for Strategic Studies, 2021.
[4] SHARAFALDIN I, HABIBI LASHKARI A, GHORBANI A A. Toward generating a new intrusion detection dataset and intrusion traffic characterization[C]//Proceedings of the 4th International Conference on Information Systems Security and Privacy. Funchal, Portugal:ScitePress, 2018:108-116.
[5] MADDALA S, PATIL S. Agentless automation model for post exploitation penetration testing[C]//Proceedings of International Conference on Intelligent Computing, Information and Control Systems. Berlin, Germany:Springer, 2020:529-539.
[6] MAEDA R, MIMURA M. Automating post-exploitation with deep reinforcement learning[J]. Computers & Security, 2021, 100:102108.
[7] 王硕. 面向多阶段渗透攻击的网络欺骗防御方法研究[D]. 郑州:战略支援部队信息工程大学, 2020. WANG S. Research on deception-based cyber defense against multi-stage penetration attack[D].Zhengzhou:Information Engineering University, 2020. (in Chinese)
[8] 陈晋音, 胡书隆, 邢长友, 等. 面向智能渗透攻击的欺骗防御方法[J]. 通信学报, 2022, 43(10):106-120. CHEN J Y, HU S L, XING C Y, et al. Deception defense method against intelligent penetration attack[J]. Journal on Communications, 2022, 43(10):106-120.(in Chinese)
[9] YU T X, XIN Y, ZHU H L, et al. Network penetration intrusion prediction based on attention Seq2Seq model[J]. Security and Communication Networks, 2022(May.31):6012232.
[10] SALMAN O, ELHAJJ I H, CHEHAB A, et al. A machine learning based framework for IoT device identification and abnormal traffic detection[J]. Transactions on Emerging Telecommunications Technologies, 2022, 33(3):37-43.
[11] SHAHHOSSEINI M, MASHAYEKHI H, REZVANI M. A deep learning approach for botnet detection using raw network traffic data[J]. Journal of Network and Systems Management, 2022, 30(3):44-51.
[12] 邹福泰, 俞汤达, 许文亮. 基于隐马尔可夫模型的加密恶意流量检测[J]. 软件学报, 2022, 33(7):2683-2698. ZOU F T, YU T D, XU W L. Encrypted malicious traffic detection based on hidden Markov model[J]. Journal of Software, 2022, 33(7):2683-2698.(in Chinese)
[13] 蒋彤彤, 尹魏昕, 蔡冰, 等. 基于层次时空特征与多头注意力的恶意加密流量识别[J]. 计算机工程, 2021, 47(7):101-108. JIANG T T, YIN W X, CAI B, et al. Encrypted malicious traffic identification based on hierarchical spatiotemporal feature and multi-head attention[J]. Computer Engineering, 2021, 47(7):101-108.(in Chinese)
[14] NARTENI S, VACCARI I, MONGELLI M, et al. Evaluating the possibility to perpetrate tunneling attacks exploiting short-message-service[J]. Journal of Internet Services & Information Security, 2021, 11(3):30-46.
[15] ZAHARIA M, XIN R S, WENDELL P, et al. Apache spark[J]. Communications of the ACM, 2016, 59(11):56-65.
[16] Brad. Malware-traffic-analysis.net[EB/OL].[2023-04-11]. https://www.malware-traffic-analysis.net/.
[17] SHIRAVI A, SHIRAVI H, TAVALLAEE M, et al. Toward developing a systematic approach to generate benchmark datasets for intrusion detection[J]. Computers & Security, 2012, 31(3):357-374.
[18] GARCÍA S, GRILL M, STIBOREK J, et al. An empirical comparison of botnet detection methods[J]. Computers & Security, 2014, 45:100-123.
[19] BANSAL S, BANSAL N. Scapy-a Python tool for security testing[J]. Journal of Computer Science & Systems Biology, 2015, 8(3):140.
[20] 凌玥, 刘玉岭, 姜波, 等. 基于双层异质集成学习器的入侵检测方法[J]. 信息安全学报, 2021, 6(3):16-28. LING Y, LIU Y L, JIANG B, et al. Intrusion detection method based on double-layer heterogeneous ensemble learner[J]. Journal of Cyber Security, 2021, 6(3):16-28.(in Chinese)
[21] SWAMI A, JAIN R. Scikit-learn:machine learning in Python[J]. Journal of Machine Learning Research, 2013, 12(10):2825-2830.
[22] SAHOO K S, TRIPATHY B K, NAIK K, et al. An evolutionary SVM model for DDOS attack detection in software defined networks[J]. IEEE Access, 2020, 8:132502-132513.
[23] MANCHALA Y, NAYAK J, BEHERA H S. Detection of malicious traffic in IoMT environment using intelligent XGBoost approach[C]//Proceedings of the OPJU International Technology Conference on Emerging Technologies for Sustainable Development. Washington D. C., USA:IEEE Press, 2023:1-6.
[24] DAI R, GAO C, LANG B, et al. SSL malicious traffic detection based on multi-view features[C]//Proceedings of the 9th International Conference on Communication and Network Security. New York, USA:ACM Press, 2019:40-46.
[25] GAO M H, MA L, LIU H, et al. Malicious network traffic detection based on deep neural networks and association analysis[J]. Sensors, 2020, 20(5):1452-1459.
[26] LUO W, LIU Z H, ZHAO R, et al. Malicious HTTPS traffic classification algorithm based on DCGAN1D-CNN[C]//Proceedings of IEEE Conference on Telecommunications, Optics and Computer Science. Washington D. C., USA:IEEE Press, 2021:20-25.
[27] YIN F. Identification and detection of malicious traffic in communication networks with a deep learning algorithm[J]. International Journal of Network Security, 2022, 24(4):727-732.
[28] LI Y M, XU Y Y, CAO Y K, et al. One-class LSTM network for anomalous network traffic detection[J]. Applied Sciences, 2022, 12(10):5051-5053.
[29] HALBOUNI A, GUNAWAN T S, HABAEBI M H, et al. CNN-LSTM:hybrid deep neural network for network intrusion detection system[J]. IEEE Access, 2022, 10:99837-99849.

选择文件类型/文献管理软件名称

选择包含的内容