一种基于多模型融合的隐蔽隧道和加密恶意流量检测方法

A Covert Tunnel and Encrypted Malicious Traffic Detection Method Based on Multi-Model Fusion

高级持续威胁APT攻击为了躲避检测,攻击者往往采用加密恶意流量和隐蔽隧道等策略隐匿恶意行为,从而增加检测的难度。目前大多数检测DNS隐蔽隧道的方法基于统计、频率、数据包等特征,这种方法不能很好地进行实时检测,从而导致数据泄露,因此,需要根据单个DNS请求进行检测而不是对流量进行统计后再检测,才能够实现实时且可靠的检测,当系统判定单个DNS请求为隧道流量,便可做出响应,进而避免数据泄露。而现有的加密恶意检测方法存在无法完整提取流量特征信息、提取特征手段单一、特征利用少等问题。因此,文章提出了基于多模型融合的隐蔽隧道加密恶意流量检测方法。对于DNS隐蔽隧道,文章提出了MLP、1D-CNN、RNN模型融合的检测方法并根据提出的数学模型计算融合结果,该方法能够对隐蔽隧道实时监测,进一步提高检测的整体准确率。对于加密恶意流量,文章提出了1D-CNN、LSTM模型的并行融合的检测方法,并行融合模型能够更加全面地提取特征信息,反应流量数据的全貌,进而提高模型的检测精度。

To evade detection,advanced persistent threat(APT)attackers often employ strategies such as encrypted malicious traffic and covert tunnels to conceal malicious activities,thereby increasing the difficulty of detection.Currently,most methods for detecting DNS covert tunnels are based on characteristics such as statistics,frequency,and packets.These methods are not well-suited for real-time detection,which can lead to data leaks.Therefore,it is necessary to detect based on individual DNS requests rather than performing statistical analysis on traffic,to achieve real-time and reliable detection.When the system determines that a single DNS request is tunnel traffic,it can respond accordingly to prevent data leaks.However,existing methods for detecting encrypted malicious traffic have issues such as the inability to fully extract traffic feature information,limited means of feature extraction,and underutilization of features.Thus,this paper proposed a method for detecting covert tunnel malicious encrypted traffic based on multi-model fusion.For DNS covert tunnels,the paper proposed a detection method that fused MLP,1D-CNN,and RNN models and calculates the fusion results based on a proposed mathematical model.This method can monitor covert tunnels in real-time,further improving the overall detection accuracy.For encrypted malicious traffic,the paper proposed a parallel fusion detection method combining 1D-CNN and LSTM models.The parallel fusion model can more comprehensively extract feature information and reflect the full scope of the traffic data,thereby enhancing the detection accuracy of the model.