A Proxy User Detection Method Based on Communication Behavior Profile

Abstract

The invention discloses an agent user detection method based on a communication behavior portrait. The method comprises the following steps: constructing a portrait model based on the communication behavior; preprocessing the input real traffic data, and aggregating the network traffic according to organized user IP attributes and time attributes in a specified time window to obtain traffic data of each user; extracting communication object stability characteristics and communication object quantity characteristics of a user in a specified time window based on the flow data, and then filteringand screening the two characteristics based on a threshold value to obtain IP information of a suspected proxy user; performing machine learning detection classification on the network flow of each suspected proxy user; and marking the IP of which the flow judgment result satisfies the threshold setting as the IP of the proxy user. The detection method provided by the invention is high in universality, can meet the data volume in the current big data network environment, adopts the portrait model based on the communication behavior, and is low in detection false alarm rate.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a proxy user detection method based on a communication behavior portrait. Background technique [0002] A network proxy is a special network service that allows the client to connect indirectly to the server. It is a service that acts as a proxy for the host in the local area network to obtain web pages or obtain information from the Internet. It can not only help users break through the organization's IP access restrictions and content filtering mechanism to access prohibited websites, but also hide the client IP and cover the client's network activities to ensure the privacy or security of network terminals. However, while proxy services bring convenience to users, they are also accompanied by hidden threats. On the one hand, the unknown identity of the proxy server brings potential network threats to internal asset protection. Some proxies will monitor the data flow...

AI Technical Summary

Problems solved by technology

[0004] The existing research difficulties mainly include: (1) Proxy detection based on data packet analysis has low versatility and is only suitable for Web proxies and PHP proxies with obvious marks in the data packets, and the established rule base cannot adapt to the requirements of proxy services. Dynamic update; (2) Proxy detection based on data packet analysis cannot meet the data scale in the current big data network environment, and packet-by-packet analysis at the network egress will cause a large amount of resource occupation and performance loss; (3) Based on The proxy detection method of network traffic files uses machine learning algorithms for automatic proxy traffic identification, which is highly dependent on the feature space. communication detection, but the detection false positive rate is high; (4) the current existing proxy detection method only detects proxy traffic, and does not care about the client and network users behind the traffic, but for the internal security defense of the organization, the proxy user It is particularly important to discover proxy users in a timely manner to eliminate potential threats within the organization and strengthen internal network asset protection and security supervision.

Images