TWI913616B - Detection method and detection device for abnormal network traffic - Google Patents

Abstract

A detection method and a detection device for abnormal network traffic are disclosed. The method includes: determining a first time range according to system time of an electronic device; extracting first connection data from connection log data of the electronic device according to the first time range; analyzing the first connection data to obtain connection count information and connection target information related to a first internet protocol address during the first time range; establishing a first decision condition according to the connection count information; establishing a second decision condition according to the connection target information; extracting second connection data from the connection log data according to a second time range; and analyzing the second connection data according to the first decision condition and the second decision condition to detect the abnormal network traffic of the electronic device.

Description

Methods and devices for detecting abnormal network traffic

This invention relates to a technique for detecting abnormal network traffic, and more particularly to a method and device for detecting abnormal network traffic.

Traditionally, abnormal network traffic detection technology primarily attempts to detect and defend against malicious network attacks by detecting large amounts of network traffic occurring within a short period. Generally, a traffic limit can be established using empirical rules. Once an electronic device's network traffic exceeds this limit within a specific time frame, it is considered abnormal network traffic. However, for large security platforms managing hundreds or even thousands of server hosts simultaneously, each server host has a different operating mode and service type, resulting in different applicable traffic limits for each server host. Therefore, a new method is needed to develop customized abnormal network traffic detection mechanisms for each server host.

This invention provides a method and device for detecting abnormal network traffic, which can establish customized decision conditions for electronic devices, thereby improving the detection efficiency of abnormal network traffic of electronic devices.

Embodiments of the present invention provide a method for detecting abnormal network traffic, comprising: determining a first time range based on the system time of an electronic device; filtering first connection data from connection log data of the electronic device according to the first time range; analyzing the first connection data to obtain connection frequency information and connection target information related to a first Internet Protocol address within the first time range; establishing a first decision condition based on the connection frequency information; establishing a second decision condition based on the connection target information; filtering second connection data from the connection log data according to a second time range, wherein the first time range is different from the second time range; and analyzing the second connection data according to the first decision condition and the second decision condition to detect abnormal network traffic of the electronic device.

Embodiments of the present invention also provide an abnormal network traffic detection device, which includes a storage circuit and a processor. The storage circuit is used to store connection log data of an electronic device. The processor is coupled to the storage circuit. The processor is configured to: determine a first time range based on the system time of the electronic device; filter first connection data from the connection log data based on the first time range; analyze the first connection data to obtain connection count information and connection target information related to a first Internet Protocol address within the first time range; establish a first decision condition based on the connection count information; establish a second decision condition based on the connection target information; filter second connection data from the connection log data based on a second time range, wherein the first time range is different from the second time range; and analyze the second connection data based on the first decision condition and the second decision condition to detect abnormal network traffic of the electronic device.

Based on the above, after determining the first time range according to the system time of the electronic device, the first connection data can be filtered from the connection log data of the electronic device according to the first time range. By analyzing the first connection data, connection frequency information and connection target information related to the first Internet Protocol address within the first time range can be obtained. Simultaneously, multiple customized decision conditions can be established separately based on the connection frequency information and connection target information. These decision conditions can then be used to detect abnormal network traffic of the electronic device within a second time range. Therefore, by establishing customized decision conditions for the electronic device, the detection efficiency of abnormal network traffic of the electronic device can be improved.

Figure 1 is a schematic diagram of a detection device according to an embodiment of the present invention.

Referring to Figure 1, the detection device 11 can be used to detect abnormal network traffic of the electronic device 12. In one embodiment, the detection device 11 is independent of the electronic device 12. For example, the detection device 11 can be implemented in a smartphone, laptop, desktop computer, server, or other type of computer device. The electronic device 12 can also include a smartphone, laptop, desktop computer, server, or other type of computer device. This invention does not limit the types of detection device 11 and electronic device 12. In one embodiment, the detection device 11 can also be installed inside the electronic device 12 in the form of software or hardware.

In one embodiment, electronic device 12 may be connected to at least one of servers 13(1) to 13(n) via Internet 10. For example, electronic device 12 may send network packets to and/or receive network packets from server 13(i) based on the domain name or Internet Protocol (IP) address of server 13(i).

In one embodiment, the detection device 11 includes a network interface 111, storage circuitry 112, and a processor 113. The network interface 111 can be used to connect to an electronic device 12. For example, the network interface 111 may include a network interface card or other types of communication interface circuitry.

Storage circuit 112 is used to store data. For example, storage circuit 112 may include volatile storage circuitry and non-volatile storage circuitry. Volatile storage circuitry is used to store data volatilely. For example, volatile storage circuitry may include random access memory (RAM) or similar volatile storage media. Non-volatile storage circuitry is used to store data non-volatilely. For example, non-volatile storage circuitry may include read-only memory (ROM), solid-state disk (SSD), hard disk drive (HDD), or similar non-volatile storage media.

Processor 113 is coupled to network interface 111 and storage circuit 112. Processor 113 is used to perform overall or partial operation of detection device 11. For example, processor 113 may include central processing unit (CPU), or other programmable general-purpose or special-purpose microprocessor, digital signal processor (DSP), programmable controller, application-specific integrated circuit (ASIC), programmable logic device (PLD), or other similar device or combination of these devices.

In one embodiment, processor 113 can obtain connection log data 101 of electronic device 12 via network interface 111. Processor 113 can store connection log data 101 in storage circuit 112. For example, connection log data 101 may record network connection data associated with one or more connections, such as source Internet Protocol address, destination Internet Protocol address, source Internet Protocol port, destination Internet Protocol port, transmission protocol used, and connection time. In particular, the connection log data 101 may record network connection data related to the Internet Protocol address (also known as the first Internet Protocol address) of the electronic device 12.

In one embodiment, processor 113 may use a packet sniffing tool (such as Zeek) to monitor the network connection behavior of electronic device 12 and record relevant information about the monitored network connection behavior in connection log data 101. In another embodiment, processor 113 may also directly obtain the connection log data 101 of electronic device 12 from the memory or other storage space of electronic device 12.

In one embodiment, processor 113 may determine a time range (also referred to as a first time range) based on the system time of electronic device 12. For example, the system time of electronic device 12 may reflect a specific point in time (e.g., February 1, 2022). In the following embodiments, for ease of explanation, a day (i.e., 24 hours) is used as a unit of time, and the first time range includes multiple units of time (also referred to as first time units). However, in one embodiment, the duration of a unit of time may be longer (e.g., multiple days) or shorter (e.g., 6 hours or 12 hours), and the present invention does not impose any limitations on this.

In one embodiment, processor 113 can set a first time range based on the first N time units of the system time of electronic device 12. For example, assuming the time point reflected by the system time of electronic device 12 (also known as the target time) is February 1, 2022 and N is 30, then processor 113 can set the time range of 30 days prior to February 1, 2022 (i.e., January 1, 2022 to January 30, 2022) as the first time range. Furthermore, the value of N can be adjusted according to practical needs, and the present invention is not limited thereto.

In one embodiment, processor 113 may filter data (also known as first connection data) that meet certain conditions from connection log data 101 based on a first time range. For example, the first connection data may reflect the network connection behavior of electronic device 12 within a first time range.

In one embodiment, processor 113 may analyze the first connection data to obtain connection count information and connection target information related to the Internet Protocol address (IPA) of electronic device 12 (i.e., the first IPA) within a first time period. This connection count information may reflect the number of connections made by the first IPA in the plurality of first time units. Furthermore, this connection target information may reflect the total number of (different) IPA addresses (also referred to as second IPA addresses) connected by the first IPA in the plurality of first time units.

Figure 2 is a schematic diagram illustrating the number of connections according to an embodiment of the present invention. Figure 3 is a schematic diagram illustrating the connection target information according to an embodiment of the present invention.

Referring to Figure 2, assume the first time period R(1) is from January 1, 2022 to January 30, 2022. By analyzing the first connection data, the obtained connection count information can reflect the number of connections of the first Internet Protocol address on each day from January 1, 2022 to January 30, 2022. For example, in Figure 2, the length of each arrow can be used to represent the (total) number of connections corresponding to the first Internet Protocol address on a specific date. Alternatively, from another perspective, this connection count information can reflect the number of outbound connections of the electronic device 12 on each day within the first time period R(1).

Referring to Figure 3, by analyzing the first connection data, the obtained connection target information can reflect the total number of non-repeating Internet Protocol addresses (i.e., second Internet Protocol addresses) connected to the first Internet Protocol address on each day from January 1, 2022 to January 30, 2022. For example, in Figure 3, the length of each arrow can be used to represent the number of different IPs connected to the first Internet Protocol address on a specific date. Alternatively, from another perspective, this connection target information can reflect the number of different external IPs connected to by the electronic device 12 on each day within the first time range R(1).

In one embodiment, processor 113 may establish a decision condition (also referred to as a first decision condition) based on the connection count information. The first decision condition may be used to detect abnormal network traffic of electronic device 12.

In one embodiment, the first decision condition includes one or more critical values (also referred to as first critical values). The processor 113 may perform logical operations (also referred to as first logical operations) on the connection count information to determine the first critical value. For example, the first logical operations may include performing logical operations such as averaging and/or calculating the standard deviation on the connection count information. Taking Figure 2 as an example, the first critical value can reflect the average number of connections per day for each of the 30 days from January 1, 2022 to January 30, 2022 for the first Internet Protocol address, a multiple of this average number of connections (e.g., 1.5 times, 2 times, or 3 times), the standard deviation of this average number of connections, and/or a multiple of this standard deviation (e.g., 1.5 times, 2 times, or 3 times). Subsequently, the first critical value can be used to detect abnormal network traffic of the electronic device 12.

In one embodiment, processor 113 may establish another decision condition (also referred to as a second decision condition) based on the connection target information. The second decision condition may also be used to detect abnormal network traffic of electronic device 12.

In one embodiment, the second decision condition includes one or more critical values (also referred to as second critical values). The processor 113 may perform logical operations (also referred to as second logical operations) on the connected target information to determine the second critical value. For example, the second logical operations may include performing logical operations such as averaging and/or calculating the standard deviation on the connected target information. Taking Figure 3 as an example, the second critical value can reflect the average number of outbound IPs (i.e., the second Internet Protocol address) for each day during the 30 days from January 1, 2022 to January 30, 2022, the multiple of this average number of IPs (e.g., 1.5 times, 2 times, or 3 times), the standard deviation of this average number of IPs, and/or the multiple of this standard deviation (e.g., 1.5 times, 2 times, or 3 times). Subsequently, the second critical value can be used to detect abnormal network traffic of electronic device 12.

In one embodiment, processor 113 may filter connection data (also known as second connection data) that meet certain conditions from connection log data 101 based on another time range (also known as a second time range). In particular, the first time range is different from the second time range. Taking Figures 2 and 3 as examples, assuming that the first time range R(1) is from January 1, 2022 to January 30, 2022, then the second time range R(2) may be February 1, 2022. The system time corresponding to the second time range R(2) (e.g., February 1, 2022) is later than the system time corresponding to the first time range R(1) (e.g., from January 1, 2022 to January 30, 2022). In addition, the second connection data can reflect the network connection behavior of the electronic device 12 within a second time range.

In one embodiment, processor 113 may analyze second connection data based on a first decision condition and a second decision condition to detect abnormal network traffic of electronic device 12. For example, processor 113 may analyze the second connection data to obtain a first evaluation value and a second evaluation value. The first evaluation value may reflect the (total) number of connections made by the first Internet Protocol address in a second time unit. The second evaluation value may reflect the total number of (different or non-repeating) Internet Protocol addresses (also referred to as third Internet Protocol addresses) connected to the first Internet Protocol address in the second time unit. Then, processor 113 may detect abnormal network traffic of electronic device 12 based on the first evaluation value, the second evaluation value, the first decision condition, and the second decision condition.

Taking Figures 2 and 3 as examples, assume the second time range R(2) is February 1, 2022. The first evaluation value reflects the total number of connections made by the first Internet Protocol address on February 1, 2022 (i.e., within one time unit). The second evaluation value reflects the number of different IPs connected to by the first Internet Protocol address on February 1, 2022 (i.e., within one time unit).

In one embodiment, processor 113 may compare a first evaluation value with a first decision condition and a second evaluation value with a second decision condition. Then, processor 113 may detect abnormal network traffic of electronic device 12 based on the comparison results. For example, in response to a first evaluation value being greater than a set first threshold and/or a second evaluation value being greater than a set second threshold, processor 113 may determine that abnormal network traffic related to electronic device 12 has been detected within a second time period. Alternatively, if the first evaluation value is not greater than the set first threshold and/or the second evaluation value is not greater than the set second threshold, processor 113 may determine that no abnormal network traffic related to electronic device 12 has been detected within the second time period.

Taking Figures 2 and 3 as examples, assume that the first critical value includes four times the standard deviation and two times the average number of connections per day for the first Internet Protocol address during the 30 days from January 1, 2022 to January 30, 2022, and the second critical value is four times the standard deviation and two times the average number of outgoing IP connections per day for the first Internet Protocol address during the 30 days from January 1, 2022 to January 30, 2022. If the first assessment value is greater than 4 times the standard deviation of the average number of connections, the first assessment value is greater than 2 times the average number of connections, the second assessment value is greater than 4 times the standard deviation of the average number of outgoing IPs, and/or the second assessment value is greater than 2 times the average number of outgoing IPs, it indicates that the electronic device 12 exhibited connection behavior exceeding a reasonable range on February 1, 2022. Therefore, the processor 113 can determine that abnormal network traffic of the electronic device 12 was detected on February 1, 2022. Conversely, the processor 113 can determine that abnormal network traffic of the electronic device 12 was not detected on February 1, 2022.

In one embodiment, the storage circuit 112 may also store a prediction model 102. The prediction model 102 may include a trained artificial intelligence model, a machine learning model, and/or a deep learning model. After obtaining a first critical value and a second critical value, the processor 113 may update the corresponding decision parameters in the prediction model 102 based on the first critical value and the second critical value. Then, the processor 113 may input the first evaluation value and the second evaluation value into the prediction model 102. After the prediction model 102 makes its judgment, the processor 113 may determine whether to detect abnormal network traffic of the electronic device 12 based on the output of the prediction model 102. In terms of training the prediction model 102, the processor 113 can use a large amount of training data to train the prediction model 102 and use corresponding validation data to validate the prediction results of the prediction model 102, so as to improve the default accuracy of the prediction model 102.

In one embodiment, after detecting abnormal network traffic on electronic device 12, processor 113 can generate a corresponding detection report. For example, this detection report may include information related to the Internet Protocol address (IPA) of electronic device 12 (i.e., a first IPA) and the time (e.g., a second time range) when the abnormal network traffic was detected. Administrators can use this detection report to immediately detect abnormal network traffic on electronic device 12 and perform relevant processing.

In one embodiment, the times (e.g., dates) included in both the first and second time ranges change over time. This change causes subsequent calculations of the first decision condition (e.g., the first critical value) and the second decision condition (e.g., the second critical value) to adapt to the latest network connection behavior or habits of the electronic device 12. Furthermore, the determination or setting of various parameters used in the aforementioned embodiments, such as the first time range, the second time range, the first critical value, the second critical value, the first evaluation value, and the second evaluation value, can be adjusted according to practical needs, and this invention does not impose any limitations on this.

Figure 4 is a flowchart illustrating a method for detecting abnormal network traffic according to an embodiment of the present invention.

Referring to Figure 4, in step S401, a first time range is determined based on the system time of the electronic device. In step S402, first connection data is filtered from the connection log data of the electronic device based on the first time range. In step S403, the first connection data is analyzed to obtain connection frequency information and connection target information related to the first Internet Protocol address within the first time range. In step S404, a first decision condition is established based on the connection frequency information. In step S405, a second decision condition is established based on the connection target information. In step S406, second connection data is filtered from the connection log data based on the second time range, wherein the first time range is different from the second time range. In step S407, the second connection data is analyzed based on the first decision condition and the second decision condition to detect abnormal network traffic of the electronic device.

In summary, compared to the traditional use of fixed decision conditions, the embodiments of the present invention can effectively improve the detection accuracy of abnormal network traffic of electronic devices by dynamically adjusting the first and second decision conditions.

Although the above-disclosed examples are provided in this case, they are not intended to limit the scope of this case. Anyone with ordinary knowledge in the relevant technical field may make some modifications and embellishments without departing from the spirit and scope of this case. Therefore, the scope of protection of this case shall be determined by the scope of the attached patent application.

10: Internet 11: Detection device 111: Network interface 112: Storage circuit 113: Processor 12: Electronic device 13(1)~13(n): Server 101: Connection log data 102: Prediction model R(1): First time range R(2): Second time range S401~S407: Steps

Figure 1 is a schematic diagram of a detection device according to an embodiment of the present invention. Figure 2 is a schematic diagram of connection count information according to an embodiment of the present invention. Figure 3 is a schematic diagram of connection target information according to an embodiment of the present invention. Figure 4 is a flowchart of a method for detecting abnormal network traffic according to an embodiment of the present invention.

S401~S407: Steps

Claims (14)

A method for detecting abnormal network traffic includes: determining a first time range and a second time range based on the system time of an electronic device, wherein the first time range is different from the second time range; filtering first connection data from connection log data of the electronic device based on the first time range; analyzing the first connection data to obtain connection frequency information and connection target information related to a first Internet Protocol address within the first time range; establishing a first decision condition based on the connection frequency information; establishing a second decision condition based on the connection target information; filtering second connection data from the connection log data based on the second time range; and The second connection data is analyzed based on the first decision condition and the second decision condition to detect abnormal network traffic of the electronic device. The method for detecting abnormal network traffic as described in claim 1, wherein the step of determining the first time range based on the system time of the electronic device includes: setting the first time range based on the first N time units of the system time, where N is a positive integer. The abnormal network traffic detection method as described in claim 1, wherein the first time range includes multiple first time units, the connection count information reflects the number of connections made by the first Internet Protocol address in the multiple first time units, and the connection target information reflects the total number of second Internet Protocol addresses connected by the first Internet Protocol address in the multiple first time units. The abnormal network traffic detection method as described in claim 3, wherein the first decision condition includes a first critical value, and the step of establishing the first decision condition based on the connection count information includes: performing a first logical operation on the connection count information to determine the first critical value. The abnormal network traffic detection method as described in claim 3, wherein the second decision condition includes a second critical value, and the step of establishing the second decision condition based on the connection target information includes: performing a second logical operation on the connection target information to determine the second critical value. The method for detecting abnormal network traffic as described in claim 1, wherein the second time range includes a second time unit, and the step of analyzing the second connection data according to the first decision condition and the second decision condition to detect the abnormal network traffic of the electronic device includes: analyzing the second connection data to obtain a first evaluation value and a second evaluation value, wherein the first evaluation value reflects the number of connections of the first Internet Protocol address in the second time unit, and the second evaluation value reflects the total number of third Internet Protocol addresses connected to the first Internet Protocol address in the second time unit; and detecting the abnormal network traffic of the electronic device according to the first evaluation value, the second evaluation value, the first decision condition, and the second decision condition. The method for detecting abnormal network traffic as described in claim 6, wherein the step of detecting the abnormal network traffic of the electronic device based on the first assessment value, the second assessment value, the first decision condition, and the second decision condition includes: comparing the first assessment value with the first decision condition; comparing the second assessment value with the second decision condition; and detecting the abnormal network traffic of the electronic device based on the comparison result. An abnormal network traffic detection device includes: a storage circuit for storing connection log data of an electronic device; and a processor coupled to the storage circuit, wherein the processor is configured to: determine a first time range and a second time range based on the system time of the electronic device, wherein the first time range is different from the second time range; filter first connection data from the connection log data based on the first time range; analyze the first connection data to obtain connection frequency information and connection target information related to a first Internet Protocol address within the first time range; establish a first decision condition based on the connection frequency information; and establish a second decision condition based on the connection target information. Filter second connection data from the connection log data according to the second time range; and analyze the second connection data according to the first decision condition and the second decision condition to detect abnormal network traffic of the electronic device. The abnormal network traffic detection device as described in claim 8, wherein the operation of the processor determining the first time range based on the system time of the electronic device includes: setting the first time range based on the first N time units of the system time, where N is a positive integer. The abnormal network traffic detection device as described in claim 8, wherein the first time range includes multiple first time units, the connection count information reflects the number of connections made by the first Internet Protocol address in the multiple first time units, and the connection target information reflects the total number of second Internet Protocol addresses connected by the first Internet Protocol address in the multiple first time units. The abnormal network traffic detection device as described in claim 10, wherein the first decision condition includes a first critical value, and the operation of the processor to establish the first decision condition based on the connection count information includes: performing a first logical operation on the connection count information to determine the first critical value. The abnormal network traffic detection device as described in claim 10, wherein the second decision condition includes a second critical value, and the operation of the processor to establish the second decision condition based on the connection target information includes: performing a second logical operation on the connection target information to determine the second critical value. The abnormal network traffic detection device as described in claim 8, wherein the second time range includes a second time unit, and the processor analyzes the second connection data according to the first decision condition and the second decision condition to detect the abnormal network traffic of the electronic device, the operation of which includes: analyzing the second connection data to obtain a first evaluation value and a second evaluation value, wherein the first evaluation value reflects the number of connections of the first Internet Protocol address in the second time unit, and the second evaluation value reflects the total number of third Internet Protocol addresses connected to the first Internet Protocol address in the second time unit; and detecting the abnormal network traffic of the electronic device according to the first evaluation value, the second evaluation value, the first decision condition, and the second decision condition. The abnormal network traffic detection device as described in claim 13, wherein the processor's operation of detecting the abnormal network traffic of the electronic device based on the first evaluation value, the second evaluation value, the first decision condition, and the second decision condition includes: comparing the first evaluation value with the first decision condition; comparing the second evaluation value with the second decision condition; and detecting the abnormal network traffic of the electronic device based on the comparison result.