RU2696296C1 - Method of detecting anomalies in traffic of main internet networks based on multifractal heuristic analysis - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: invention relates to a method of detecting anomalies in main Internet traffic based on multifractal heuristic analysis. Method includes multifractal heuristic analysis of time series generated from parameters of network traffic collected from backbone routers and having undergone preliminary processing. At that, time series are formed from such parameters of network traffic as network packet size, number of network packets in stream, type of network protocol of transport level, number of network protocol packets of each type, number of outgoing and incoming connections for a host. Table with normal multifractal characteristics for each time series is generated in a database located on a database server. For each multifractal characteristic of each time series, the value of the maximum permissible deviation from the normal value is recorded in the database, after which the time series are distributed between the simultaneously operating computational nodes of the high-performance server. At each server computer unit, over each time series, multifractal characteristics are calculated, such as the width of the multifractal spectrum, the width of the left spectrum "branch", the width of right spectrum "branch", height of left spectrum "branch", height of right spectrum "branch". At that, for each time series there performed is checking for deviation of multifractal characteristics values from normal values. If the values of three or more multifractal characteristics deviate from the normal values by more than the value of the maximum allowable deviation, an anomaly warning is generated.

EFFECT: high accuracy of detecting network attacks owing to parallel calculation of multifractal characteristics of network traffic, which enable to estimate changes in main traffic, typical for different types of network attacks.

1 cl, 2 dwg, 1 tbl

Description

The invention relates to the field of computer systems, namely, to the backbone networks of the Internet and the detection of anomalies in network traffic.

A known method for detecting anomalies in network streams (Chinese patent No. CN101895420, published on November 24, 2010 according to IPC classes H04L12 / 24; H04L12 / 26) and solving the problem of detecting anomalies by calculating the Hurst coefficient for a network traffic stream and comparing the obtained value with a predetermined threshold value. The method provides obtaining information about all network devices in the system, receiving all data streams for each device, extracting the network packet arrival time and information about its size, generating a time series from these data, calculating the Hurst coefficient by constructing an autocorrelation function for the time series, comparing the calculated values of the Hurst coefficient with a threshold value and the decision on the presence / absence of an anomaly based on the comparison.

The disadvantages of the analogue are:

1. A small number of parameters extracted from network packets (only the size of the packet and the time it arrived). This is not enough to detect various network attacks, since each type of network attack has its own distinctive features, and in order to ensure its detection with high probability, it is necessary to extract from the network traffic various parameters that are “sensitive” to various types of attacks (for example, the number of packets of a certain network protocol or the number of packets with the SYN or ACK flags set).

2. Calculation of only the Hurst coefficient, which allows analyzing the frequency or fractality of network traffic. The traffic of real networks does not always have the property of fractality, especially if we consider it on a small scale. Research [Vieira, F. H. T .; Bianchi, G. R. and Lee, L.L. A Network Traffic Prediction Approach Based on Multifractal Modeling. J. High Speed Netw, vol 17 (2), pp. 83-96, 2010] shows that much more often network traffic has the multifractality property, that is, the behavior of network traffic can be described by several successive fractal algorithms. Therefore, if we analyze network traffic for anomalies only using the Hurst fractal coefficient, a large number of errors of the first (false positives) and second type errors (skipping anomalies) are possible.

A known method for detecting botnets in peer-to-peer (P2P) networks (China Patent No. CN105516164A, published April 20, 2016 according to IPC class H04L29 / 06), which is based on the combined use of the multifractal approach and the principle of self-adaptation. The method solves the problem of detecting botnets by analyzing network traffic for the presence of monofractality (that is, evaluating the self-similarity of traffic over large time intervals) and multifractality (evaluating the self-similarity of traffic over small time intervals). Using the Kalman filter, the obtained self-similarity estimates are considered normal or abnormal.

The claimed method for detecting botnets in peer-to-peer (P2P) networks has the following disadvantages:

1. Monofractal analysis of network traffic using the Hurst coefficient. Research [Vieira, F. H. T .; Bianchi, G. R. and Lee, L.L. A Network Traffic Prediction Approach Based on Multifractal Modeling. J. High Speed Netw, vol 17 (2), pp 83-96, 2010] shows that the traffic of real networks is not always monofractal (periodic for long time periods), therefore, monofractality assessment can give false positives. Since the invention implements the detection of anomalies based on the combined monofractal and multifractal analysis, errors of the first and second kind in monofractal analysis can affect the correctness of the resulting detection of anomalies.

2. For multifractal analysis, the inventors calculate the Holder index (Holder index, Holder exponent, paragraphs [0010] SUMMARY, [0046], [0047] DETAILED DESCRIPTION). This indicator relative to the multifractal spectrum of Legendre, which is the basis of multifractal analysis, can only characterize the shift of the spectrum relative to the abscissa axis. Whereas when the behavior of network traffic changes, the multifractal spectrum can also shift along the ordinate axis. In addition, studies [Moreno G., Álvarez D., Requejo S., et al. Multifractal analysis of soil surface roughness. Vadose Zone Journal, 7 (2): p. 512-520, 2007 and Diosdado A., Ramirez-Hernandez L. et al. Multifractal analysis and the NYHA index. AIP Conference Proceedings 1626 (1): p. 155-158, 2014] demonstrate that changes in the data also cause changes in the lengths of the left and right “branches” of the multifractal spectrum. Such changes Hölder indicator calculated by the claimed method will not reflect. Therefore, anomalies can be skipped.

The technical problem of the claimed invention is the development of a method for detecting anomalies in the traffic of the Internet backbone networks in real time in order to detect network attacks.

The technical result consists in increasing the accuracy of detecting network attacks due to the parallel calculation of the multifractal characteristics of network traffic, allowing to evaluate the changes in the main traffic that are typical for various types of network attacks.

The solution to this problem is provided by the fact that in the method for detecting anomalies in the traffic of the Internet backbones based on multifractal heuristic analysis, a parallel calculation of a set of five multifractal characteristics is implemented: the width of the multifractal spectrum, the width and height of its left and right “branches”. Various multifractal characteristics are sensitive to various types of network attacks, mainly to attacks such as denial of service, which together provides high accuracy of detection of attacks.

The invention is illustrated in FIG. 1, depicting a multifractal spectrum with multifractal characteristics marked on it, corresponding to the width of the spectrum and the parameters of its “branches”. Figure 2 shows a General block diagram of the parallel calculation of multifractal characteristics.

The term "heuristic", in accordance with the source [Ozhegov SI, Shvedova N.Yu. Explanatory dictionary of the Russian language: 72,500 words and 7,500 phraseological expressions / Ros. AN, Inst. lang., Ros. cultural fund. - M .: Az, 1992. - 955 p.] Is a set of research methods that contribute to the detection of previously unknown. In information security, heuristics were first used when detecting computer viruses. Antivirus tools that use heuristics have detected malware by analyzing their structure and behavior. Thus, heuristics for detecting anomalies in the traffic of the Internet backbone networks are the characteristics and invariants of network traffic, the values of which change during the implementation of a network attack. In this regard, multifractal analysis, which involves the calculation of characteristics that describe the behavior of traffic, is heuristic.

A multifractal is a set of fractals, each of which is characterized by its own dimension. A multifractal is defined by several successively changing algorithms, each of which generates a template with its own fractal dimension. The multifractality of network traffic suggests that traffic can be divided into parts, and for each part its own self-similarity properties will be observed. Thus, multifractal characteristics are invariants of network traffic.

If a fractal can be represented by one quantity - a fractal dimension D, then a multitude of such dimensions is required to describe a multifractal. In this regard, to describe a multifractal, the multifractal spectrum is widely used, which is a function calculated on the basis of a number of fractal dimensions included in the multifractal [Bozhokin, C. Fractals and multifractals / S. Bozhokin, D. Parshin. - Izhevsk, - p. 67-70, 2001].

выполняется переход от переменных

и

к новым переменным

и

:To calculate the multifractal spectrum function, denoted by f (α), it is necessary to calculate the scaling function τ (q) and implement the Legendre transform on it. When implementing the Legendre transform over a function

transition from variables

and

to new variables

and

:

(one)

может быть получено из выражения

, где

– момент распределения точек по ячейкам фрактального объекта, вся область которого разбита на кубы со стороной

, а показатель

может принимать любые действительные значения (

).Function value

can be obtained from expression

where

- the moment of distribution of points in the cells of a fractal object, the entire area of which is divided into cubes with side

, and the indicator

can take any valid values (

)

вычисляется над временными рядами, сформированными из различных параметров сетевого трафика: размер сетевого пакета, число сетевых пакетов в потоке, тип сетевого протокола транспортного уровня, число сетевых пакетов протоколов каждого типа, число исходящих и входящих подключений для хоста. Выбор параметров обоснован тем, что, по данным «Лаборатории Касперского», число атак отказа в обслуживании (Denial of Service, DoS) стремительно растет [DDoS attacks in Q1 2018 [сайт], URL: https://securelist.com/ddos-report-in-q1-2018/85373/], и именно выделенные параметры сетевого трафика чувствительны к изменениям, характерным для DoS-атак. DoS-атаки в общем случае характеризуются увеличением объема поступающего трафика, что отразится на количестве сетевых пакетов и подключений – исходящих в случае атакующего узла или входящих в случае узла-жертвы. Помимо этого, реализация DoS-атак некоторых типов проявляется в росте числа пакетов определенного протокола, а, следовательно, и на числе флагов (например, SYN и ACK в случае атаки SYN-flood).Multifractal Spectrum Function

it is calculated over time series formed from various parameters of network traffic: the size of the network packet, the number of network packets in the stream, the type of network protocol of the transport layer, the number of network packets of protocols of each type, the number of outgoing and incoming connections for the host. The choice of parameters is justified by the fact that, according to Kaspersky Lab, the number of Denial of Service (DoS) attacks is growing rapidly [DDoS attacks in Q1 2018 [site], URL: https://securelist.com/ddos- report-in-q1-2018 / 85373 /], and it is the selected parameters of network traffic that are sensitive to changes characteristic of DoS attacks. DoS attacks are generally characterized by an increase in the amount of incoming traffic, which will affect the number of network packets and connections - outgoing in the case of an attacking node or incoming in the case of a victim node. In addition, the implementation of certain types of DoS attacks manifests itself in an increase in the number of packets of a certain protocol, and, consequently, in the number of flags (for example, SYN and ACK in case of a SYN flood attack).

и

в скользящем окне позволяет получить информацию об изменении структуры наблюдаемого временного ряда. Изменение мультифрактальных свойств, проявляющихся в изменении мультифрактальных инвариантов, свидетельствует об изменении в поведении сетевого трафика, что характеризует атаку или неполадки в сети.Observing Values

and

in a sliding window allows you to get information about changes in the structure of the observed time series. A change in multifractal properties, manifested in a change in multifractal invariants, indicates a change in the behavior of network traffic, which characterizes an attack or a network malfunction.

Figure 1 presents the image of the multifractal spectrum with the marked multifractal characteristics:

, вычисляемое по формуле

;1) the value of the width of the spectrum indicated

calculated by the formula

;

, вычисляемое по формуле

;2) the value of the width of the right "branch"

calculated by the formula

;

, вычисляемое по формуле

;3) the value of the width of the left "branch"

calculated by the formula

;

, вычисляемое по формуле

);4) the value of the height of the left "branch"

calculated by the formula

);

, вычисляемое по формуле

.5) the value of the height of the right "branch"

calculated by the formula

.

Experimental studies have demonstrated the effectiveness of the proposed characteristics in detecting anomalies in network traffic. For research, we used simulated trunk traffic containing both normal traffic and traffic with various DoS attacks (SlowLoris, DoS Hulk, DoS GoldenEye). The results of the detection of attacks using the proposed characteristics are presented in table 1.

Table 1. DoS Attack Detection Results

Type of DoS Attack / Metric Slowlow Dos hulk DoS GoldenEye

;Multifractal Spectrum Width

; discovers does not detect does not detect Width of the right “branch”

discovers does not detect discovers The width of the left "branch"

discovers does not detect discovers The height of the right "branch"

discovers discovers does not detect The height of the left "branch"

) discovers does not detect discovers

Based on the results of experimental studies, we can conclude that, in the aggregate, the proposed metrics found all conducted denial of service attacks. At the same time, the parameters forming the time series to which multifractal heuristic analysis is also important. In the case of DoS attacks at the HTTP level, the indicative metrics are the number of TCP packets, the number of TCP packets with SYN flags, and the number of HTTP packets.

Experimental studies have shown that the parameters used to form the time series are also important for detecting attacks. For example, in the case of DoS attacks at the HTTP level, the indicative parameters are the number of TCP packets, the number of TCP packets with SYN flags, and the number of HTTP packets.

The implementation of the proposed method is as follows:

1. Real-time acquisition of time series generated from the following parameters extracted from Internet backbone traffic collected from network routers:

1.1 network packet size;

1.2 the number of network packets in the stream;

1.3 type of network protocol transport layer;

1.4 the number of network protocol packets of each type;

1.5 the number of outgoing connections for the host;

1.6 the number of incoming connections for the host.

2. Formation in the database located on the database server, tables with normal values of multifractal characteristics for each time series. The table includes the following multifractal characteristics:

2.1 width of the multifractal spectrum;

2.2 the width of the left “branch” of the spectrum;

2.3 the width of the right “branch” of the spectrum;

2.4 the height of the left "branch" of the spectrum;

2.5 the height of the right “branch” of the spectrum.

3. Formation in a database located on the database server, a table for recording the results of multifractal heuristic analysis.

4. The distribution of time series between parallel computing nodes of a high-performance server, each node is associated with some set of time series.

5. Parallel calculation on each node of multifractal characteristics.

6. Writing the results of multifractal heuristic analysis into a table in the database. The table for each time series contains the values of the calculated multifractal characteristics.

7. For each time series, a check is made for the deviation of the values of multifractal characteristics from normal values.

8. If the values of three or more multifractal characteristics deviate from the normal values stored in the database, an anomaly warning is generated. The permissible deviation value is set by the researcher or is obtained as a result of training on the samples of normal trunk traffic.

As a result, a parallel multifractal heuristic analysis will be performed on time series generated from network traffic. In this case, an increase in the accuracy of detecting network attacks will be ensured, since five multifractal characteristics are applied simultaneously to the time series, which together will allow us to consider the behavior of the time series from different sides. In addition, the accuracy of detecting network attacks is also ensured by the fact that it considers a large number of different time series generated from the traffic parameters of the Internet backbone networks. Since various types of traffic (network packet size, number of packets, set flags, etc.) change during network attacks of various types, it is necessary to control the change in various parameters. This allows you to detect network attacks of various types.

Also, the speed of detection of network attacks will be increased. This is ensured by the fact that multifractal heuristic analysis of time series is performed in parallel: not every time series, but only some part of them comes to each computing node. In conditions of intensively incoming traffic of the Internet backbone networks this allows you to speed up the analysis process.

Claims (1)

A method for detecting anomalies in the traffic of Internet backbone networks based on multifractal heuristic analysis, including multifractal heuristic analysis of time series generated from network traffic parameters collected from the main network routers and subjected to preliminary processing, characterized in that time series are formed from such network traffic parameters, as the size of the network packet, the number of network packets in the stream, the type of network protocol of the transport layer, the number of network packets in the protocols of each type, the number of outgoing and incoming connections for the host, then in the database located on the database server, a table is formed with normal values of multifractal characteristics for each time series and a table for recording the results of multifractal heuristic analysis for each time series, then for of each multifractal characteristic of each time series, the value of the maximum permissible deviation from the normal value is written to the database, after which time the series are distributed between simultaneously working computing nodes of a high-performance server, while each node is assigned a certain set of time series, then on each computing node of the server over each time series multifractal characteristics are calculated, such as the width of the multifractal spectrum, the width of the left “branch” of the spectrum, the width of the right branches ”of the spectrum, the height of the left“ branch ”of the spectrum, the height of the right“ branch ”of the spectrum, then the values of the calculated multifractal characteristics for each of the time series are recorded in the table for the results of multifractal heuristic analysis, located in the database on the database server, for each time series, a check is made for the deviation of the values of multifractal characteristics from normal values stored in a table with normal values of multifractal characteristics in the database on the database server data, after which the number of multifractal characteristics is checked for each time series deviating from normal values Nij, which resulted in rejecting the values of three or more multifractal characteristics from normal values stored in the database, more than the value of the maximum permissible deviation from the normal value, a warning is generated on the availability abnormalities displayed on the operator panel screen.

Images