An abnormal traffic detection method for encrypted network based on knowledge graph

Abstract

The invention discloses a method for detecting abnormal traffic in an encrypted network based on a knowledge map, comprising the following steps: using packet capture software to capture messages and keys in the negotiation phase of an encryption protocol; using the key to decrypt the encrypted traffic to obtain plain text Data message; real-time acquisition of various data messages generated in the communication network; each entity in the data message is used as a vertex, and the relationship attributes between entities are used as edges to construct a knowledge graph; Relationship, count the number of connections, the number of interactive information, the proportion of real connections, and the proportion of virtual connections between two entities; count the final detection values ​​of all entities, and judge whether each detection value is greater than its corresponding threshold. If it is greater than the threshold, then Judging that there is abnormal traffic in the communication network, and issuing an abnormal traffic warning. The invention takes the data flow as the object, detects the internal message of the data flow, and uses the knowledge map to describe the traffic behavior, thereby improving the detection efficiency and accuracy.

Description

technical field [0001] The invention belongs to the field of network abnormal traffic detection in network security, and in particular relates to a method for detecting abnormal traffic of an encrypted network based on a knowledge graph. Background technique [0002] With the increasing awareness of network security prevention, encrypted communication has become the mainstream. While protecting privacy, traffic encryption also conceals illegal attempts. While changing the form of threats, it also brings huge challenges to network security defense. Abnormal encrypted traffic detection is a key issue in the field of Internet security. How to realize real-time and accurate identification of network encrypted traffic is a key issue in the field of cyberspace security in my country. focus of model research. [0003] Knowledge graph is a structured semantic knowledge base, which is used to describe concepts and their relationships in the physical world in symbolic form. Its basic ...

AI Technical Summary

Problems solved by technology

[0010] In order to solve the problem of the accuracy and timeliness of encrypted abnormal traffic detection, the present invention provides a method for detecting abnormal encrypted network traffic based on a knowledge map, which describes the network communication process based on the knowledge map, and compares the data packets in the network The source and destination IP addresses in the entity are extracted to obtain the vertex, and the relationship between the source and destination entities is constructed according to the flag bit or interaction information of the data message, and the proportion of the number of interactive communications between the entities and the number of connections between the two entities are counted Proportion, to judge whether the network communication traffic is normal or not

Images