TWI724734B - Method of building and applying an attack identification data model - Google Patents

Abstract

A method of building and applying an attack identification data model is provided. Under a training mode, the method is performed to execute statistics on a plurality of sample traffic for obtaining a plurality of characteristic values, executes an algorithm of classification and training to build the attack identification data model which can include a plurality of identification features. Under an identification mode, an identification module classifies a plurality of undefined data traffic based on the attack identification data model to one of the traffic categories of whitelist or blacklist. The present disclosed example can identify more different traffic categories, and accurately determine that each undefined data traffic belongs to whitelist or blacklist.

Description

Generation and application method of attack identification data model

The present invention is related to the identification of network attacks, in particular to the generation and application methods of attack identification data models.

In a communication network (such as the Internet or a local area network), computer devices communicate through data traffic. However, malicious traffic (ie, attacking behavior) may cause the computer device to malfunction.

In order to detect attacks from the Internet, the existing attack identification technology collects the value of known traffic (such as packets) in advance, and compares the value of the unfamiliar traffic with the value of the known traffic when the unfamiliar traffic is received. If the value of the flow matches the value of any known flow, the purpose of the unfamiliar flow (such as normal flow or attack flow) can be determined.

The disadvantage of the existing attack identification technology is that it can only identify the strange traffic that is exactly the same as the known traffic. Once the strange traffic is different from the known traffic, it will not be able to effectively and successfully identify the purpose of the strange traffic.

Therefore, the existing network attack identification technology has the above-mentioned problems, and a more effective solution is urgently required.

The main purpose of the present invention is to provide a method for generating and applying an attack identification data model, which can identify more types of traffic based on the same amount of sample traffic.

To achieve the above objective, the present invention provides an attack identification data model generation and application method, which is used in an automatic control system. The attack identification system includes a control device, a controlled device and an identification module, and an attack identification data model generation and application method It includes the following steps: in the training mode, perform statistics on multiple values of multiple sample flows of the whitelist or blacklist to obtain multiple sample values, wherein a first number of multiple traffic categories can be identified based on all sample values; Based on multiple sample values and corresponding multiple traffic categories, a classification learning algorithm is executed to classify values other than multiple sample values to generate an attack identification data model. The attack identification data model includes multiple identification features based on all The identification feature can identify a second number of multiple traffic categories, the second number is greater than the first number; the control identification module is responsible for receiving multiple unfamiliar traffic in the identification mode; and, multiple identification features based on the attack identification data model And the numerical classification of each unfamiliar traffic to a whitelisted traffic category or a blacklisted traffic category, where multiple unfamiliar traffic is sent from the control device to the controlled device, or from the controlled device to the control device.

The present invention can identify a variety of traffic categories based on a small amount of sample traffic, and can accurately determine that undefined unfamiliar traffic belongs to a white list or a black list.

100-102: Attack traffic

11: Attack detection system

110-111: sample

120: Whitelist

121: Blacklist

20: control equipment

21: controlled equipment

200, 210, 300, 31: identification module

30: Relay device

400: Processing device

401: storage device

402: Human-Machine Interface

403: Transmission Device

404: functional device

500: Whitelist sample value

501: Blacklist sample value

51: Classification learning algorithm

52: Whitelist

53: Blacklist

54: Attack Identification Data Model

60-63: Traffic category

70-73: Identify features

S100-S103: training steps

S104-S108: The first identification step

S20-S21: Steps to obtain the first sample value

S22: Steps to obtain the second sample value

S30-S33: Classification steps

S400-S409: Second identification step

S500-S509: Second identification step

Figure 1 is a schematic diagram of the operation of an existing attack detection system.

Fig. 2 is a structural diagram of an automatic control system according to an embodiment of the present invention.

Fig. 3 is a structural diagram of an automatic control system according to an embodiment of the present invention.

FIG. 4 is a structural diagram of a computer device according to an embodiment of the present invention.

FIG. 5 is a flowchart of the method for generating and applying an attack identification data model according to the first embodiment of the present invention.

6 is a partial flowchart of the method for generating and applying an attack identification data model according to the second embodiment of the present invention.

FIG. 7 is a flowchart of the classification learning algorithm according to the third embodiment of the present invention.

FIG. 8 is a flowchart of a method for generating and applying an attack identification data model according to a fourth embodiment of the present invention.

Fig. 9 is a flowchart of a method for generating and applying an attack identification data model according to a fifth embodiment of the present invention.

FIG. 10 is a schematic diagram of generating an attack identification data model according to an embodiment of the present invention.

FIG. 11 is a schematic diagram of the execution of a single-column-based decision tree algorithm according to an embodiment of the present invention.

FIG. 12 is a schematic diagram of the execution of a decision tree algorithm based on multiple fields according to an embodiment of the present invention.

FIG. 13 is a schematic diagram of multiple fields of multiple unfamiliar traffic according to an embodiment of the present invention.

With regard to a preferred embodiment of the present invention, the detailed description is given below in conjunction with the drawings.

Please refer to FIG. 1, which is a schematic diagram of the operation of the existing attack detection system, which is used to more clearly illustrate the technical problem to be solved by the present invention.

As shown in FIG. 1, the attack detection system 11 is pre-stored with a plurality of samples 110-111 of the blacklist 121, the values of which are A and B respectively, that is, the attack detection system 11 can only identify two types of traffic.

When performing attack detection, the attack detection system 11 compares the value of each unfamiliar traffic received (take the attack traffic 100-102 as an example, the values are A, B, C) and all samples 100-111 The values are compared to determine that each flow belongs to the flow of the white list 120 or the flow of the black list 121.

In the example in Figure 1, the attack traffic 100-101 has the same value as the samples 110-111 of the blacklist 121, and will be identified as the traffic of the blacklist 121. However, the attack traffic 102 is different from the samples 110-111. Value, and will be misjudged as the traffic of the whitelist 120.

Therefore, the existing attack detection system can only identify the unfamiliar traffic that is exactly the same as the known sample, and the attack sample that has not had an attack or is not in the record will not be successfully identified, which makes the probability of identification failure or misjudgment too high, and Reduce the reliability of the system.

In addition, in different types of automatic control systems (such as different application purposes or different network protocols), the content of the traffic delivered will also be different, and different detection rules are required, and a system that can be automatically trained and used according to the application type is required. Solutions for attack detection.

However, industrial control network protocols are not as common as IPv4. Different industrial control networks often use different industrial control network protocols, and there is no attack identification data model that can be applied to all types of industrial control networks at the same time. What is needed is a solution that can automatically perform training and attack detection with the current type of industrial control network.

In order to solve the above problems, the present invention mainly provides a method for generating and applying an attack identification data model. A set of attack identification data models can be generated by learning and training multiple sample flows, and the attack identification data model can be used to attack the network. Road traffic is detected to identify the purpose of each network traffic category (such as normal traffic, suspicious traffic, or attack traffic). Since the aforementioned attack identification data model is generated through learning and training and adopts a classification and identification method of different thinking, the number of recognizable traffic categories is expanded to a traffic category larger than the sample traffic used for training.

Please refer to FIG. 2, which is a structural diagram of an automatic control system according to an embodiment of the present invention. The method for generating and applying the attack identification data model of the present invention can be applied to the automatic control system 2 shown in FIG. 2.

Specifically, the automatic control system 2 mainly includes a control device 20 (such as a server or a control host) and one or more controlled devices 21 (such as a robot, an IoT node, an industrial automation device, an end device, etc.). The control device 20 is connected to each controlled device 21 via the network, and can transmit control instructions (that is, flow) to the controlled device 21 to control the controlled device 21 to perform specified operations, or receive return data (that is, flow) from the controlled device 21 ).

In an implementation aspect, the control device 20 includes an identification module 200. The identification module 200 is used to identify the traffic received by the control device 20 based on the aforementioned attack identification data model, so as to determine the identity of each received traffic. Traffic category. In this way, the present invention can realize network attack detection on the control device 20.

In an implementation aspect, the controlled device 21 includes an identification module 210. The identification module 210 is used to identify the traffic received by the controlled device 21 based on the aforementioned attack identification data model to determine the received data. The traffic category to which the traffic belongs. In this way, the present invention can realize network attack detection on the controlled device 21.

It is worth mentioning that the attack identification data model of the present invention can be used to classify each unfamiliar traffic into one of a plurality of predefined traffic categories, and each traffic category can be assigned to a whitelist or a blacklist in advance. Therefore, in the present invention, when each unfamiliar traffic is classified, it can be determined as a whitelist or a blacklist according to the traffic category to which it belongs.

Please also refer to FIG. 3, which is a structural diagram of an automatic control system according to an embodiment of the present invention. The control device 20 and the controlled device 21 in FIG. 3 are the same as or similar to those shown in FIG. 2 and will not be repeated here.

In the implementation aspect of FIG. 3, the automatic control system 3 further includes a relay device 30 (such as a network switch, a router, a bridge, etc.). The control device 20 is connected to the controlled device via the relay device 30 21, that is, the relay device 30 is used to forward the traffic sent by the control device 20 to the controlled device 21, or forward the traffic sent by the controlled device 21 to the control device 20.

In an implementation aspect, the relay device 30 includes an identification module 300. The identification module 300 is used to identify the traffic received by the relay device 30 (that is, the forwarded traffic) based on the aforementioned attack identification data model. Decide which traffic category each received traffic belongs to. In this way, the present invention only needs to set up the identification module 300 on the relay device 30 to realize the attack detection of the entire network.

In one implementation aspect, the identification module 31 is an independent device (such as an independent computer host or server), and the relay device 30 is connected to the identification module 31 via a network, and when the relay device 30 receives unfamiliar traffic, The unfamiliar traffic (or a copy of the unfamiliar traffic) can be transmitted to the identification module 31, and then the identification module 31 determines the traffic category to which each received traffic belongs. Thereby, the present invention can reduce the burden of the relay device.

Please also refer to FIG. 4, which is a structural diagram of a computer device according to an embodiment of the present invention. The aforementioned control device 20, controlled device 21, relay device 30, and identification module 31 may be the computer device 4 as shown in FIG. 4.

Specifically, the computer device 4 may include a storage device 401, a human-machine interface 402, a transmission device 403, a functional device 404, and a processing device 400 electrically connected to the foregoing devices.

The storage device 401 is used to store data, such as an attack identification data model, or a program used to control the functional device 404, and so on. The man-machine interface 402 is used to accept user input and output information. The human-machine interface 402 may include any combination of various input devices and output devices, such as a touch screen, a button set, a mouse, a display, an indicator light, a speaker, etc., and is not limited. The transmission device 403 is used to connect to a network, such as an Ethernet network module, a Wi-Fi network module, or a mobile network module, etc.

The function device 404 is used to implement the equipment designated function. For example, taking the controlled device 21 as an automatic manufacturing device as an example, the functional device 404 may be a conveyor belt, a robotic arm, or other devices for automatic manufacturing. Taking the controlled device 21 as an automatic detection device as an example, the functional device 404 may be a camera, a camera or a moving device of an object, or other devices for automatic detection. Work with control equipment 20 Take the business management host as an example, the functional device 404 can be a management system or a backup device. Taking the relay device 30 as a network switch or router as an example, the functional device 404 may be a switch module or a router module.

In an implementation aspect, the storage device 401 may store a computer program, and the computer program records a computer executable program code. When the processing device 400 executes the above-mentioned computer program, the method for generating and applying the attack identification data model of the subsequent embodiments of the present invention can be realized.

Please also refer to FIG. 5, which is a flowchart of the method for generating and applying an attack identification data model according to the first embodiment of the present invention. In the corresponding description of FIG. 5, the method of generating and applying the attack identification data model is applied to the automatic control system 3 shown in FIG. 3, but it is not limited thereto.

In one embodiment, the method for generating and applying the attack identification data model can also be applied to the automatic control system 2 shown in FIG. 2 for implementation.

The method for generating and applying the attack identification data model of the present invention is mainly divided into two stages, a training mode and an identification mode. In the training mode, the present invention can train known traffic to generate an attack identification data model. In the identification mode, the present invention uses the attack identification data model to identify unfamiliar traffic.

It is worth mentioning that although the training mode and the recognition mode are executed by the recognition module 31 in the following description, it is not limited thereto.

In an embodiment, the present invention can also be modified by the recognition module 200, the recognition module 210, and/or the recognition module 300 to execute the training mode and the recognition mode.

In one embodiment, the training mode and the recognition mode can be executed by different computer devices. For example, the recognition module 31 executes the training mode, and transmits the generated attack recognition data model to other recognition modules (such as the recognition module 300 or the recognition modules 200 and 210) for execution by the other recognition modules Identification mode. In this way, the present invention can disperse the training load and the identification load.

First, the identification module 31 executes steps S100-S103 to generate an attack identification data model in the training mode.

Step S100: The identification module 31 switches to the training mode according to user operations or automatic control, so as to prepare to perform learning training.

Step S101: The identification module 31 obtains a plurality of sample flows, and performs statistics on a plurality of values of the plurality of sample flows to obtain a plurality of sample values. The foregoing multiple sample traffic is traffic with a known purpose (such as whitelisted traffic or blacklisted traffic), or traffic with high credibility (such as traffic sent from a trusted device, which can be directly presumed to be Whitelisted traffic). In addition, the first number (for example, 800 or 1000) traffic types can be identified based on all the determined sample values.

In one embodiment, each sample traffic includes multiple fields (such as packet length, protocol code, function code, number of packets per second, and/or sending timestamp, etc.), and the identification module 31 selects multiple fields All or part of the bits are used as designated fields, and the values of the designated fields of all sample flows are counted to obtain one or more sample values of each designated field.

In one embodiment, the identification module 31 uses all the values that have appeared in each designated field as the sample value of the designated field, but it is not limited thereto.

In one embodiment, the identification module 31 performs a statistical analysis on all the values that have appeared in each designated field to obtain a sample value. For example, if a value with a number of occurrences greater than a preset number (for example, 5 times) is used as the sample value, Multiple values that appear regularly (such as in continuous flow) are used as multiple sample values, or values with a higher frequency (such as the top 30%) are used as sample values, and so on.

In one embodiment, the identification module 31 continuously captures the transmission traffic between the control device 20 and the controlled device 21 through the relay device 30 under the normal working state of the automatic control system 3 as the sample traffic (such as capturing Continuous flow for 10 minutes).

Step S102: The identification module 31 executes a classification learning algorithm based on the plurality of sample values and the corresponding plurality of traffic categories to classify values other than the plurality of sample values, and generate an attack identification data model.

In addition, the aforementioned attack identification data model may include multiple identification features, and a second number of multiple traffic categories can be identified based on all the identification features. The aforementioned second number is greater than the aforementioned first number, that is, the attack identification data model can be expanded The number of traffic types that can be identified.

It is worth mentioning that the present invention mainly provides a solution for applying existing machine learning technology to network attack detection.

Regarding how to perform machine learning training on sample values to generate attack identification data models, there have been many related documents in the field of machine learning technology, so I will not repeat them here.

For example, a classification algorithm can be used, such as an unsupervised classification algorithm or a supervised classification algorithm. The aforementioned unsupervised classification algorithm can be K-means, Neural Network, and Balanced Iterative Reduction Clustering Algorithm (BIRCH), etc. The aforementioned supervised classification algorithm can be a Decision Tree (Decision Tree), a Support Vector Machine (SVM), a Bayesian algorithm (Naïve-Bayes), and so on.

In one embodiment, the aforementioned classification learning algorithm analyzes the correlation between multiple sample values in the same column or multiple sample values across columns, and can further combine the extreme values of each column (as in general experience) Minimum allowable value or maximum allowable value) to calculate the aforementioned multiple identification features.

In one embodiment, the aforementioned multiple identification features respectively correspond to multiple types of traffic. In addition, multiple traffic categories belong to one of the whitelist or blacklist respectively. In this way, when any unfamiliar traffic meets one of the multiple identification features, the unfamiliar traffic belongs to the traffic category corresponding to the matching identification feature, and the unfamiliar traffic can be further determined based on whether the traffic category belongs to the whitelist or blacklist. The traffic is normal or suspicious.

Step S103: The identification module 31 outputs the attack identification data model. For example, the attack identification data model is exported as a file, stored in the storage device 401 or transmitted to other identification modules via the transmission device 403.

In this way, the present invention can quickly train an attack identification data model specific to the current network environment through the input sample traffic, and can be applied to different types of network environments or automatic control systems.

Then, the identification module 31 can perform steps S104-S108 to detect network traffic attacks in the identification mode.

Step S104: The identification module 31 switches to the identification mode according to user operations or automatic control, so as to prepare to perform attack detection.

Step S105: The identification module 31 loads the attack identification data model output in step S103.

Step S106: The identification module 31 starts to receive a plurality of unfamiliar traffic. The aforementioned unfamiliar traffic may be sent by the control device 20 to the controlled device 21 and/or sent by the controlled device 21 to the control device 20.

Step S107: The identification module 31 classifies each unfamiliar traffic based on the multiple identification features of the attack identification data model and the value of each unfamiliar traffic to identify the traffic category to which the unfamiliar traffic belongs.

Furthermore, since each traffic category has been pre-classified to one of the whitelist and the blacklist, the identification module 31 can determine that the strange traffic belongs to the whitelist according to the traffic category to which each strange traffic belongs (that is, normal Behavior) or blacklisted traffic (that is, suspicious behavior or offensive behavior).

In one embodiment, as with each sample flow, each unfamiliar flow may include multiple fields. In step S107, the identification module 31 compares the multiple identification features of the attack identification data model with the values of multiple fields of each unfamiliar traffic, and when the value of the field matches any identification feature, the identification The traffic category locked by the feature is used as the traffic category of this unfamiliar traffic. In order to realize the classification of unfamiliar traffic.

Step S108: The identification module 31 determines whether to end the flow identification. Specifically, the identification module 31 automatically ends the flow identification when the preset end condition is met, that is, ends the attack detection.

In one embodiment, the aforementioned end condition may be that the user manually disables the traffic recognition function, continues to receive no unfamiliar traffic for a preset end time, or controls the release of processing resources to other programs or applications, etc., and is not limited. .

If the identification module 31 determines that the termination condition is satisfied, the flow identification is terminated. Otherwise, the identification module 31 continues to perform steps S106-S107 to continue the flow identification.

The invention can identify more types of traffic based on the same number of sample traffic, and can accurately determine that undefined unfamiliar traffic belongs to the whitelist or blacklist.

In one embodiment, the aforementioned sample traffic may be offline traffic or real-time traffic.

Taking the sample flow as offline flow as an example, the identification module 31 obtains flow (such as from the offline state) in the offline state (such as interrupting the connection with the control device 20 and the controlled device 21, or interrupting the network connection) in step S101. Other computer devices receive the flow or read the flow from the storage device 401) and use it as a sample flow. In addition, the identification module 31 obtains the traffic in the online state (such as connecting the control device 20 and the controlled device 21, or restoring the network connection) in step S106, and treats it as an unfamiliar traffic.

Taking the sample flow as the real-time flow as an example, the identification module 31 continuously receives multiple flows from the control device 20 and the controlled device 21, and in step S101, is the first part of the continuous multiple flows (as shown in the previous three minutes). The received traffic, or the first half of the same file/command) is used as the sample traffic. In steps S102 and S103, the attack identification data model is generated and output in real time, and the attack identification data model is used in steps S104-S107 to combine the continuous The second part of multiple traffic (such as traffic after the third minute, or the second half of the same file/command) is classified as unfamiliar traffic to determine whether each traffic of the second part of the continuous multiple traffic belongs to the whitelist or blacklist. In this way, since multiple consecutive flows usually have high correlation or similar formats, the present invention uses one part of the same set of flows to identify another part in real time, which not only saves offline training time and sample flow, but also has Higher recognition accuracy.

Please refer to FIG. 5 and FIG. 6 together. FIG. 6 is a partial flowchart of the method for generating and applying an attack identification data model according to the second embodiment of the present invention. Compared with the embodiment shown in FIG. 5, this embodiment further provides a sample value amplification function, which can increase the number of sample values before performing training, so as to improve the accuracy of the attack identification data model.

Specifically, in this embodiment, step S101 includes steps S20-S21 and/or step S22. Furthermore, the multiple sample values obtained through statistics in step S101 may include only whitelist sample values (that is, sample flows are all whitelist flows) or both whitelist sample values and blacklist sample values (that is, sample flows include Whitelist traffic and blacklist traffic).

In the foregoing first case, due to the lack of blacklist sample values, the trained attack identification data model has a poor ability to recognize blacklists; in the foregoing second case, because the number of whitelist sample values and blacklist sample values may not be To be equal, the trained attack identification data model may have poor identification ability for either the white list or the black list.

In this regard, the present invention provides a sample value amplification function, which can solve the problem of lack of blacklist sample values through the following steps S20-S21.

Step S20: The identification module 31 performs statistics on multiple values of the multiple sample flows of the whitelist to obtain multiple whitelist sample values.

Step S21: The identification module 31 performs a reverse analysis process on the obtained multiple whitelist sample values to obtain the corresponding multiple blacklist sample values.

In one embodiment, the aforementioned reverse analysis processing is based on the transmission limits of currently used network protocols (such as Modbus and other industrial control protocols), customary values (such as maximum length, common length, commonly used function codes, defined function codes, etc.) Etc.) and/or the range of values not covered by the whitelist sample value to generate the blacklist sample value.

In one embodiment, in order to balance the number of whitelist samples and blacklist samples for training, after the aforementioned reverse analysis process, the original sample values are copied to make the numbers of blacklist samples and whitelist samples consistent.

In one embodiment, the foregoing reverse analysis processing may increase the maximum value of the whitelist sample value by a certain amount as the blacklist sample value, or decrease the minimum value by a certain amount as the whitelist sample value.

Moreover, when the multiple flows include the sample flows of the blacklist, the present invention can obtain the corresponding blacklist sample values through the following step S22.

Step S22: The identification module 31 performs statistics on multiple values of the multiple sample flows of the blacklist to obtain multiple blacklist sample values.

It is worth mentioning that, in the present invention, the execution of step S22 is mainly used to increase the number of blacklist sample values to further improve the accuracy of the blacklist identification of the attack identification data model, which is not a necessary step of the present invention.

In one embodiment, even if there is a sample traffic of the blacklist, step S22 may not be performed, and only the attack identification data trained by the whitelist sample value obtained in steps S20-S21 and the blacklist sample value after reverse analysis model. Moreover, the aforementioned attack identification data model also has the ability to distinguish unusual traffic outside the whitelist.

Moreover, when the obtained sample flow lacks blacklist flow, only steps S20-S21 are executed to generate blacklist flow; when the obtained sample flow only includes blacklist flow, only step S22 may be executed to obtain the corresponding Blacklist sample value.

In this way, the present invention can increase the number of sample values, and can improve the classification accuracy of the attack identification data model.

It is worth mentioning that it is impossible to obtain all the blacklist sample values in practice, that is, the values that do not meet the blacklist sample values may be whitelist sample values or blacklist sample values. If reverse analysis is performed on incomplete blacklist samples, wrong whitelist sample values may be obtained, causing the attack identification data model to misjudge the unknown attack traffic as normal traffic, resulting in inaccurate attack detection.

In this regard, the present invention does not perform reverse analysis on the blacklist sample value to obtain the whitelist sample value that may be wrong, so as to avoid the above-mentioned attack detection inaccurate situation.

Please also refer to FIG. 10, which is a schematic diagram of generating an attack identification data model of an implementation aspect of the present invention, which is used to briefly explain how the present invention constructs an attack identification data model 54.

As shown in FIG. 10, when training is to be performed, the user can input multiple whitelist sample values 500 and blacklist sample values 501 into the classification learning algorithm 51.

Next, the present invention can generate multiple identification features 70-71 of the white list 52 and multiple identification features 72-73 of the black list 53 by executing the classification learning algorithm 51. In addition, the aforementioned multiple identification features 70-71 are respectively associated with multiple traffic categories 60-61 of the white list 52, and are used to identify whether the unfamiliar traffic belongs to the corresponding traffic category 60-61; the aforementioned multiple identification features 72-73 They are respectively associated with multiple traffic categories 62-63 of the blacklist 53, and used to identify whether unfamiliar traffic belongs to the corresponding traffic categories 62-63.

It is worth mentioning that the aforementioned traffic categories 60-61 and 62-63 can be understood as classifying network behaviors, that is, the present invention classifies different network behaviors (such as traffic with different field values) To different traffic types, it can be judged that this network behavior belongs to the whitelist (goodwill behavior or normal behavior) or blacklist (suspicious behavior or offensive behavior).

Finally, the present invention encapsulates a plurality of identification features 70-71, 72-73 and the above-mentioned association into an attack identification data model 54.

Please refer to FIG. 5 and FIG. 7 together. FIG. 7 is a flowchart of the classification learning algorithm according to the third embodiment of the present invention. In addition to using the existing algorithm as the classification learning algorithm of the present invention, in this embodiment, the present invention further proposes a novel and advanced classification learning algorithm. The foregoing classification The learning algorithm is based on the decision tree algorithm to construct a decision tree (that is, a tree-like classification structure). The multiple leaf nodes of the decision tree (that is, the nodes corresponding to the subgroups that meet the preset purity described later) correspond to the aforementioned multiple Traffic category, and multiple classification conditions of multiple branches of the decision tree constitute the aforementioned multiple identification features.

Specifically, the classification learning algorithm of this embodiment (ie, "execute the classification learning algorithm" shown in step S102 in FIG. 5) includes the following steps.

Step S30: The identification module 31 executes the decision tree algorithm to determine the classification conditions. The foregoing classification condition is to divide a plurality of sample flows into a plurality of subgroups (each subgroup includes part of the sample flow).

In one embodiment, the aforementioned classification condition is the value or value range of one of the multiple fields of the sample traffic, and is based on the whitelist sample value (that is, the classification condition for generating the whitelist) or the blacklist based on this field The sample value (that is, the classification condition for generating the blacklist) is determined.

Step S31: Calculate the purity of each subgroup, that is, the credibility index of this classification (that is, evaluate the classification based on the classification conditions corresponding to each subgroup, and what is the credibility of the classification results).

Moreover, based on the corresponding classification conditions (for example, whitelist classification conditions or blacklist classification conditions), each subgroup is respectively corresponding to the traffic category of the whitelist or the traffic category of the blacklist.

There are many ways to calculate purity in the prior art, such as calculating information gain (Information gain), calculating entropy (Entropy) or calculating Gini index (Gini index), which will not be repeated here.

It is worth mentioning that although in this embodiment, the calculation of subgroup purity is described, those skilled in the art to which the present invention belongs should understand that the "calculation of subgroup purity" in the present invention should actually include calculation Purity and calculated impurity (because impurity is only a reverse indicator of purity, its calculation is still related to the calculation of purity).

Step S32: The identification module 31 obtains the preset purity, and judges whether the purity of any subgroup does not meet the preset purity, such as judging whether the purity of the subgroup is higher than the preset purity or lower than the preset purity.

If the identification module 31 determines that the purity of all subgroups meets the preset purity, the classification is completed, that is, the construction of the decision tree is completed.

If the identification module 31 determines that the purity of any subgroup does not meet the preset purity, step S33 is executed: the aforementioned decision tree algorithm is executed again on the subgroup whose purity does not meet the preset purity to determine another classification condition. The aforementioned another classification condition is to subdivide the subgroups whose purity does not meet the preset purity into multiple subgroups.

Then, the identification module 31 executes step S32 again to determine whether the newly divided multiple subgroups meet the preset purity, and so on, until the purity of all the subgroups meet the preset purity.

Then, the identification module 31 (in step S102 of FIG. 5) further sets all the classification conditions corresponding to each leaf node of the decision tree (that is, each subgroup whose purity meets the preset purity) as the identification of the corresponding traffic category feature.

In this way, the present invention can effectively and accurately classify the sample value and the values other than the sample value, and generate multiple identification features that attack the identification data model.

Please refer to FIG. 11 and FIG. 12. FIG. 11 is a schematic diagram of the execution of a decision tree algorithm based on a single field in an embodiment of the present invention, and FIG. 12 is a decision tree algorithm based on multiple fields in an embodiment of the present invention Schematic diagram of the implementation. Figures 11 and 12 are used to exemplarily illustrate the aforementioned decision tree algorithm.

In the examples in Fig. 11 and Fig. 12, the decision tree algorithm is the Classification And Regression Tree Algorithm, and the purity is the Gini Index. In addition, X[n] represents the value of the flow field [n]; gini represents impurity, when its value is 0.0 (preset purity), it means that all sample values can be classified correctly; value[a,b] represents Among the a+b sample values, there are a whitelist sample values (for the flow field), and b blacklist sample values (for the flow field). The whitelist sample value and/or the blacklist sample value can be obtained from the sample flow or obtained through the aforementioned reverse analysis process.

As shown in Figure 11, this example is to input 1256 sample values (including 1000 whitelist sample values and 256 blacklist sample values). First, at node 80 (root node), take the score of "Field X[2]<=4.5" For classification under the class condition (1), two subgroups can be obtained (ie, the node 81 when the classification condition (1) is met and the node 82 when the classification condition (1) is not met).

The subgroup of node 82 includes a total of 253 sample values, and all of them are blacklist sample values, so the gini of node 82 is 0, and this subgroup has been correctly classified (that is, node 82 is a leaf node).

The subgroup of node 81 includes a total of 1003 sample values (1000 whitelist sample values, 3 blacklist sample values), and the gini of node 81 is 0.006, that is, this subgroup has not been correctly classified.

In this regard, the decision tree algorithm will classify the node 81 according to the classification condition (2) of "Field X[2]<=2.5", and obtain two subgroups (that is, the node 83 and the node 83 when the classification condition (2) is met. The node 84 when the classification condition (2) is not met).

The subgroup of node 83 includes a total of 3 sample values, all of which are blacklist sample values, so the gini of node 83 is 0, and this subgroup has been correctly classified (that is, node 83 is a leaf node).

The subgroup of node 84 includes a total of 1000 sample values, and all of them are whitelist sample values, so the gini of node 84 is 0, and this subgroup has been correctly classified (that is, node 84 is a leaf node).

Since the purity of all subgroups meets the preset purity, the classification is completed. In this classification, there are 3 traffic categories, namely nodes 82-84. In addition, the identification feature corresponding to the node 82 belonging to the blacklist is: the classification condition (1) does not match; the identification feature corresponding to the node 83 belonging to the blacklist is: the classification condition (1) is met and the classification condition (2) is met; The identification feature corresponding to the node 84 of the whitelist is: the classification condition (1) is met and the classification condition (2) is not met.

In this way, the present invention can plan multiple traffic categories and calculate the identification characteristics of all traffic categories.

It is worth mentioning that although in the example of FIG. 11, the sample value of a single field is classified, but it is not limited by this.

The user can select multiple fields as required to execute the aforementioned decision-making algorithm to improve the accuracy of subsequent classification. In order to solve the problem of inaccurate classification due to too little sample flow.

For example, the example in FIG. 12 is to input 2280 sample values (including 1000 whitelist sample values and 1280 blacklist sample values). First, perform classification at node 90 (root node) with the classification condition (1) of "Field X[2]<=4.5", and obtain two subgroups (i.e., node 91 and classification condition when the classification condition (1) is met (1) Node 92 at the time of discrepancy).

The subgroup of node 92 includes a total of 915 sample values (all of which are blacklist sample values), so gini is 0.

The subgroup of node 91 includes a total of 1365 sample values (1000 whitelist sample values, 365 blacklist sample values, and the gini of node 91 is 0.392 (not correctly classified). For this, the decision tree algorithm will use the "field X[3]<=2.5" classification condition (2) classify the node 91 (the selection of its field and threshold can be calculated through the sacrificial learning method) to obtain two subgroups (that is, the classification condition (2) meets The node 93 at time does not match the classification condition (2) at the time node 94).

The subgroup of node 94 includes a total of 262 sample values (all blacklist sample values), so gini is 0.

The subgroup of node 93 includes a total of 1103 sample values (1000 whitelist sample values, 103 blacklist sample values, and the gini of node 93 is 0.169 (not correctly classified). For this, the decision tree algorithm will use the "column X[0]<=32774.0" classification condition (3) classifies the node 93 to obtain two subgroups (ie, the node 95 when the classification condition (3) is met and the node 96 when the classification condition (3) does not match).

The subgroup of node 96 includes 100 sample values (all blacklist sample values), so gini is 0.

The subgroup of node 95 includes a total of 1003 sample values (1000 whitelist sample values, 3 blacklist sample values, and the gini of node 95 is 0.006 (not correctly classified). For this, the decision tree algorithm will use the "field X[2]<=2.5" The classification condition (4) classifies the node 95 to obtain two subgroups (ie, the node 97 when the classification condition (4) is met and the node 98 when the classification condition (4) is inconsistent).

The subgroup of node 97 includes 3 sample values (all blacklist sample values), so gini is 0.

The subgroup of node 98 includes a total of 1000 sample values (all are whitelist sample values), so gini is 0.

Since the purity of all subgroups meets the preset purity, the classification is completed. In this classification, there are 4 traffic categories, namely nodes 92, 94, 96-98. In addition, the identification feature corresponding to the node 92 belonging to the blacklist is: the classification condition (1) does not match; the identification feature corresponding to the node 94 belonging to the blacklist is: the classification condition (1) meets and the classification condition (2) does not meet; The identification feature corresponding to the node 96 of the blacklist is: the classification conditions (1) and (2) meet and the classification condition (3) does not meet; the identification feature corresponding to the node 97 of the blacklist is: the classification condition (1)-( 4) All meet; the identification feature corresponding to the node 98 belonging to the whitelist is: the classification condition (1)-(3) is met and the classification condition (4) is not met.

In this way, the present invention can plan the traffic categories associated with multiple fields, and can effectively improve the classification accuracy.

Please refer to FIGS. 3 and 8 together. FIG. 8 is a flowchart of a method for generating and applying an attack identification data model according to a fourth embodiment of the present invention. In the embodiment of FIG. 8, the generated attack identification data model is used in an intrusion detection system (Intrusion Detection System, IDS), that is, only identifying strange traffic belonging to a whitelist or blacklist, even if the strange traffic belongs to a blacklist. It will not block the transmission of unfamiliar traffic.

Specifically, the method for generating and applying the attack identification data model of this embodiment includes the following identification steps.

Step S400: The identification module 31 switches to the identification mode according to user operations or automatic control, so as to prepare to perform attack detection.

Step S401: The identification module 31 loads the attack identification data model.

Step S402: The relay device 30 judges whether any traffic is received. If the relay device 30 does not receive any traffic, step S402 is executed again to continue the detection.

If the relay device 30 receives the traffic, step S403 is executed: the relay device 30 generates a copy of the received traffic, and transmits the generated copy to the identification module 31 as an unfamiliar traffic.

Step S404: The relay device 30 forwards the traffic to the indicated control device 20 or controlled device 21 according to the destination field of the traffic.

Step S405: The identification module 31 receives the unfamiliar traffic from the relay device 30.

It is worth mentioning that the relay device 30 can instantly send a copy of the received traffic to the identification module 31, or it can accumulate a fixed amount of traffic and then send it to the identification module 31 again, or send it to the identification module at regular intervals. Group 31 is not limited.

Step S406: The identification module 31 classifies the received unfamiliar traffic based on the attack identification data model to determine the traffic category of the unfamiliar traffic.

Step S407: The identification module 31 determines whether the unfamiliar traffic belongs to the traffic category of the whitelist or the traffic category of the blacklist. If the unfamiliar traffic belongs to the whitelist, step S409 is executed.

If the unfamiliar traffic belongs to the blacklist, step S408 is executed: the identification module 31 issues an alert via the man-machine interface 402 to notify the user, and/or makes a record and stores it in the storage device 401 for the user to review in the future or for the next training The sample traffic of the attack identification data model.

Step S409: Determine whether to end the flow identification. If the identification module 31 determines that the termination condition is satisfied, the flow identification is terminated. Otherwise, step S402 is executed again to continue the flow identification.

In this way, the present invention can effectively realize intrusion detection and reduce the load of the relay device 30.

Please refer to FIG. 3 and FIG. 9 together. FIG. 9 is a flowchart of a method for generating and applying an attack identification data model according to a fifth embodiment of the present invention. In the embodiment of Figure 9, the generated attack identification data model is used in an intrusion prevention system (Intrusion Prevention System, IPS), that is, real-time identification of strangers. The raw traffic belongs to the whitelist or blacklist, and the unfamiliar traffic belongs to the blacklist in real time. In the following, the identification module 300 of the relay device 30 executes intrusion prevention as an example for description, but it is not limited to this, and the identification module 200, 210, or 31 can also execute it instead.

Specifically, the method for generating and applying the attack identification data model of this embodiment includes the following identification steps.

Step S500: The identification module 300 switches to the identification mode according to user operations or automatic control, so as to prepare to perform attack prevention.

Step S501: The identification module 300 loads the attack identification data model.

Step S502: The relay device 30 judges whether any traffic is received. If the relay device 30 does not receive any traffic, step S502 is executed again to continue the detection.

If the relay device 30 receives the traffic, step S503 is executed: the traffic is transmitted to the identification module 300 as unfamiliar traffic.

Step S504: The identification module 300 receives unfamiliar traffic from the relay device 30.

Step S505: The identification module 300 classifies the received unfamiliar traffic based on the attack identification data model to determine the traffic category of the unfamiliar traffic.

Step S506: The identification module 300 determines whether the unfamiliar traffic belongs to the traffic category of the whitelist or the traffic category of the blacklist.

If the unfamiliar traffic belongs to the blacklist, step S507 is executed: the identification module 300 blocks the transmission of the unfamiliar traffic, that is, the unfamiliar traffic will not be transmitted to the destination. To prevent attacks from reaching the destination device.

If the unfamiliar traffic belongs to the whitelist, step S508 is executed: the identification module 300 forwards the unfamiliar traffic to the control device 20 or the controlled device 21 indicated by the destination field.

Step S509: Determine whether to end the flow identification. If the identification module 300 determines that the termination condition is satisfied, the flow identification is terminated. Otherwise, step S502 is executed again to continue the flow identification.

In this way, the present invention can effectively realize intrusion prevention and detection.

Please continue to refer to FIG. 13, which is a schematic diagram of multiple fields of multiple unfamiliar traffic according to an embodiment of the present invention. FIG. 13 is used to exemplarily illustrate the progress of the present invention compared with the prior art.

Figure 13 shows the field data of 21 unfamiliar traffic (respectively traffic 1-21) and the identification results generated by the present invention. The traffic 1-6 is used as the sample traffic of the whitelist in advance and trained as an attack classification model. , Where the traffic 1-11 belongs to the whitelisted traffic category 0-4 after identification, and the traffic 12-21 belongs to the blacklisted traffic category 5-14 after identification.

In the example in FIG. 13, the attack identification data model is generated based on the length field, the function code field and the forwarding rate field, which are three fields for attack detection. The whitelist sample values for the length field are 11 and 12; the whitelist sample values for the function code field are 3 and 4; the whitelist sample values for the forwarding rate field are 1 and 2.

During the identification process, since the value of each field of the flow 1-10 is the same as the sample value of the whitelist, the flow type 0-3 to which it belongs can be judged as the whitelist.

Although the length field of traffic 11 (value 13) does not exist in the whitelist sample value, most of the features still meet the whitelist and are within the empirical allowable range, so the trained attack identification data model will Traffic type 4 is judged as a whitelist.

The length field (value of 16) of traffic 12 does not match the whitelist sample value, and has clearly exceeded the empirical allowable range. Therefore, the trained attack identification data model will determine the traffic category 5 to which it belongs as a blacklist.

Although all the fields of traffic 13 meet the whitelist sample value, the combination of the function code field (value 3) and the forwarding rate field (value 0) is a combination that is rare or will not appear in experience. Therefore, the trained attack identification data model will determine the traffic category 6 to which it belongs as a blacklist.

The function code field of traffic 14-21 (values are 2, 5-11) does not match the whitelist sample value, and has clearly exceeded the allowable range of experience, so the trained attack identification data model will be the traffic type 7- 14 judged as a blacklist.

Therefore, the present invention can further improve the accuracy of attack detection because the whitelist sample value and the value other than the blacklist sample value can be judged.

The above are only preferred specific examples of the present invention, and are not limited to the scope of the patent of the present invention. Therefore, all equivalent changes made by using the content of the present invention are included in the scope of the present invention in the same way. Bright.

S100-S103: training steps

S104-S108: The first identification step

Claims (14)

An attack identification data model generation and application method for an automatic control system. The attack identification system includes a control device, a controlled device and an identification module. The attack identification data model generation and application method includes the following steps : A) In a training mode, perform statistics on multiple values of multiple sample flows in the whitelist or blacklist to obtain multiple sample values, where a first number of multiple traffic categories can be performed based on all the sample values Identification; b) performing a classification learning algorithm based on the plurality of sample values and the corresponding plurality of traffic categories to classify values other than the plurality of sample values to generate an attack identification data model, wherein the attack identification The data model includes a plurality of identification features, based on all the identification features, a second number of the plurality of traffic types can be identified, the second number is greater than the first number; c) controlling the identification module in an identification mode Receiving a plurality of unfamiliar traffic; and d) classifying each of the unfamiliar traffic to the traffic category in the whitelist or the traffic category in the blacklist based on the identification characteristics of the attack identification data model and the numerical value of each of the unfamiliar traffic, wherein the A plurality of unfamiliar traffic is sent by the control device to the controlled device, or sent by the controlled device to the control device; wherein, each of the sample traffic and each of the unfamiliar traffic includes a plurality of fields, and the classification learning algorithm It includes the following steps: e1) Execute a decision tree algorithm to determine a classification condition, wherein the classification condition divides the multiple sample flows into multiple subgroups, and each of the subgroups corresponds to a whitelist of the traffic category or a blacklist. For the traffic category of the list, the classification condition is the value or value range of one of the multiple fields, and is determined based on at least one whitelist sample value or at least one blacklist sample value of the field; e2) Calculate a purity of each subgroup; e3) When the purity of any one of the subgroups does not meet a preset purity, the decision tree algorithm is executed on the subgroup to determine another classification condition, wherein another classification condition subdivides the subgroup into the subgroup Multiple subgroups; and e4) repeating step e2) and step e3) until the purity of all the subgroups meets the preset purity. The method for generating and applying an attack identification data model according to claim 1, wherein the multiple sample values include multiple whitelist sample values and multiple blacklist sample values, and the step a) includes the following steps: a11) whitelist Perform statistics on the multiple values of the multiple sample flows to obtain multiple whitelist sample values; and a12) perform a reverse analysis process on the multiple whitelist sample values to obtain the multiple blacklist sample values. According to the method for generating and applying the attack identification data model described in claim 1, the multiple sample values include multiple whitelist sample values and multiple blacklist sample values, wherein the step a) includes a step a21) pairing the blacklist Perform statistics on the multiple values of the multiple sample flows to obtain multiple blacklist sample values. The method for generating and applying an attack identification data model according to claim 1, wherein each of the sample traffic and each of the unfamiliar traffic includes a plurality of fields, and the plurality of identification features are respectively used to identify the plurality of different traffic types; The step a) is to select at least one of the multiple fields, and perform statistics on all the values of the selected fields of all the sample flows to obtain at least one of the selected fields The sample value; the step d) is to determine whether the value of at least one of the plurality of fields of each of the strange traffic meets any of the identification characteristics to determine that each of the strange traffic is the corresponding traffic category. The method for generating and applying an attack identification data model as described in claim 1, wherein the step b) is to set all the classification conditions corresponding to each subgroup whose purity meets the preset purity to the corresponding traffic The identifying characteristics of the category. The method for generating and applying an attack identification data model as described in claim 1, wherein the multiple classification conditions are the numerical values or numerical ranges of the multiple fields. The method for generating and applying an attack identification data model as described in claim 1, wherein the decision tree algorithm is Classification And Regression Tree Algorithm, and the purity is Gini Index. The method for generating and applying an attack identification data model according to claim 1, wherein the attack identification system includes a relay device, and the method for generating and applying the attack identification data model further includes the following steps before step c): f1 ) When the relay device receives any traffic, a copy of the traffic is generated; f2) the copy is transmitted to the identification module as the strange traffic; and f3) the traffic is forwarded to a destination of the traffic The control device or the controlled device indicated by the field. The method for generating and applying an attack identification data model as described in claim 1, wherein the method for generating and applying the attack identification data model further includes a step g) after step d): determining that any of the strange traffic is black When the traffic category of the list is issued an alert or make a record. The method for generating and applying an attack identification data model according to claim 1, wherein the attack identification system includes a relay device, and the method for generating and applying the attack identification data model further includes a step h) before the step c) When the relay device receives any traffic, it transmits the traffic to the identification module as the unfamiliar traffic. The method for generating and applying an attack identification data model as described in claim 10, which further includes the following steps after step d): i1) When it is judged that the unfamiliar traffic belongs to the traffic category of the blacklist, block the transmission of the traffic; and i2) When it is judged that the unfamiliar traffic belongs to the traffic category of the whitelist, forward the traffic to a destination of the traffic The control device or the controlled device indicated by the field. The method for generating and applying an attack identification data model as described in claim 1, wherein the sample traffic is offline traffic or real-time traffic. The method for generating and applying an attack identification data model according to claim 12, wherein the sample traffic is offline traffic; the step a) is to use the traffic obtained in the offline state as the sample traffic; and the step c) is to The traffic received in the online state is regarded as the multiple unfamiliar traffic. The method for generating and applying an attack identification data model according to claim 12, wherein the sample traffic is real-time traffic; the step a) is to receive the first part of the continuous unfamiliar traffic as the sample traffic; the step b) The attack identification data model is generated in real time; the step c) is to receive the second part of the continuous unfamiliar traffic; the step d) is to classify the second part of the plurality of unfamiliar traffic.

Images