Encrypted network abnormal flow detection method based on knowledge graph

Abstract

The invention discloses an encrypted network abnormal flow detection method based on a knowledge graph. The method comprises the following steps: capturing a message and a secret key in an encryption protocol negotiation stage by using packet capturing software; decrypting the encrypted traffic by using the secret key to obtain a plaintext data message; acquiring various data messages generated in a communication network in real time; constructing a knowledge graph by taking each entity in the data messages as a vertex and taking a relationship attribute among the entities as an edge; according to the relation between two entities in the knowledge graph, counting the number of connections, the number of interaction information, the proportion of real connections and the proportion of virtual connections between the two entities; and carrying out statistical analysis on final detection values of all the entities; judging whether each detection value is greater than a corresponding threshold value or not; if yes, judging that abnormal traffic exists in the communication network, and sending out abnormal traffic early warning. According to the method, the internal messages of the data stream are detected by taking the data stream as an object, and the flow behavior is described by using the knowledge graph, so that the detection efficiency and accuracy are improved.

Description

technical field [0001] The invention belongs to the field of network abnormal traffic detection in network security, and in particular relates to a method for detecting abnormal traffic of an encrypted network based on a knowledge graph. Background technique [0002] With the increasing awareness of network security prevention, encrypted communication has become the mainstream. While protecting privacy, traffic encryption also conceals illegal attempts. While changing the form of threats, it also brings huge challenges to network security defense. Abnormal encrypted traffic detection is a key issue in the field of Internet security. How to realize real-time and accurate identification of network encrypted traffic is a key issue in the field of cyberspace security in my country. focus of model research. [0003] Knowledge graph is a structured semantic knowledge base, which is used to describe concepts and their relationships in the physical world in symbolic form. Its basic ...

AI Technical Summary

Problems solved by technology

[0010] In order to solve the problem of the accuracy and timeliness of encrypted abnormal traffic detection, the present invention provides a method for detecting abnormal encrypted network traffic based on a knowledge map, which describes the network communication process based on the knowledge map, and compares the data packets in the network The source and destination IP addresses in the entity are extracted to obtain the vertex, and the relationship between the source and destination entities is constructed according to the flag bit or interaction information of the data message, and the proportion of the number of interactive communications between the entities and the number of connections between the two entities are counted Proportion, to judge whether the network communication traffic is normal or not

Images