基于流谱理论的SSL/TLS协议攻击检测方法

郭世泽; 张帆; 宋卓学; 赵子鸣; 赵新杰; 王小娟; 罗向阳

doi:10.11959/j.issn.2096-109x.2022004

您当前的位置：

首页 >

文章列表页 >

基于流谱理论的SSL/TLS协议攻击检测方法

专栏：安全感知与检测方法 | 更新时间：2024-06-03

- 基于流谱理论的SSL/TLS协议攻击检测方法
- Detection of SSL/TLS protocol attacks based on flow spectrum theory
- 网络与信息安全学报 2022年8卷第1期页码：30-40
- 作者机构：
  
  1. 浙江大学计算机科学与技术学院，浙江杭州 310027
  2. 浙江大学网络空间安全学院，浙江杭州 310027
  3. 浙江大学控制科学与工程学院，浙江杭州 310027
  4. 浙江省区块链与网络空间治理重点实验室，浙江杭州 310027
  5. 移动终端安全浙江省工程实验室，浙江杭州 310027
  6. 北京邮电大学电子工程学院，北京 100876
  7. 信息工程大学河南省网络空间态势感知重点实验室，河南郑州 450001
- 作者简介：
  
  [ "郭世泽（1969− ），男，河北石家庄人，浙江大学教授，主要研究方向为网络空间安全" ]
  [ "张帆（1978− ），男，浙江杭州人，浙江大学教授、博士生导师，主要研究方向为网络安全、硬件安全、系统安全" ]
  [ "宋卓学（1998− ），男，浙江衢州人，浙江大学硕士生，主要研究方向为网络空间安全" ]
  [ "赵子鸣（1998− ），男，河北邢台人，浙江大学博士生，主要研究方向为网络空间安全" ]
  [ "赵新杰（1986− ），男，河南开封人，浙江大学高级工程师，主要研究方向为网络与信息安全" ]
  [ "王小娟（1985− ），女，河北保定人，北京邮电大学副教授，主要研究方向为计算机网络安全" ]
  [ "罗向阳（1978− ），男，湖北钟祥人，信息工程大学教授、博士生导师，主要研究方向为网络与信息安全" ]
- 基金信息：
  
  科技创新2030——“新一代人工智能”重大项目;The National Key Research and Development Project(2020AAA0107700);国家自然科学基金;TheNational Natural Science Foundation of China(62072398);国家自然科学基金;The National Natural Science Foundation of China(U1804263);国家自然科学基金;TheNational Natural Science Foundation of China(62172435);信息系统安全技术重点实验室基金;National Key Laboratory of Science and Technology on Information System Securitya;浙江省重点研发计划;Zhejiang Key R＆D Program(2021C01116);浙江省引进培育领军型创新创业团队;Leading Innovative and Entrepreneur Team Introduction Program of Zhejiang Province(2018R01005);网络空间国际治理研究基地;Research Institute of Cyberspace Governance in Zhejiang University;中原科技创新领军人才计划;Zhongyuan Science and Technology Innovation Leading Talent Project(214200510019)
- DOI：10.11959/j.issn.2096-109x.2022004
  中图分类号： TP393
- 网络首发：2022-02，
  
  纸质出版：2022-02-15
- 稿件说明：
移动端阅览
郭世泽, 张帆, 宋卓学, 等. 基于流谱理论的SSL/TLS协议攻击检测方法[J]. 网络与信息安全学报, 2022,8(1):30-40.

Shize GUO, Fan ZHANG, Zhuoxue SONG, et al. Detection of SSL/TLS protocol attacks based on flow spectrum theory[J]. Chinese Journal of Network and Information Security, 2022, 8(1): 30-40.
郭世泽, 张帆, 宋卓学, 等. 基于流谱理论的SSL/TLS协议攻击检测方法[J]. 网络与信息安全学报, 2022,8(1):30-40. DOI： 10.11959/j.issn.2096-109x.2022004.

Shize GUO, Fan ZHANG, Zhuoxue SONG, et al. Detection of SSL/TLS protocol attacks based on flow spectrum theory[J]. Chinese Journal of Network and Information Security, 2022, 8(1): 30-40. DOI： 10.11959/j.issn.2096-109x.2022004.

摘要

网络攻击检测在网络安全中扮演着重要角色。网络攻击检测的对象主要为僵尸网络、SQL 注入等攻击行为。随着安全套接层/安全传输层（SSL/TLS）加密协议的广泛使用，针对 SSL/TLS 协议本身发起的SSL/TLS攻击日益增多，因此通过搭建网络流采集环境，构建了包含4种SSL/TLS攻击网络流与正常网络流的网络流数据集。针对当前网络攻击流检测的可观测性有限、网络流原始时空域分离性有限等问题，提出流谱理论，将网络空间中的威胁行为通过“势变”过程从原始时空域空间映射到变换域空间，具象为“势变谱”，形成可分离、可观测的特征表示集合，实现对网络流的高效分析。流谱理论在实际网络空间威胁行为检测中的应用关键是在给定变换算子的情况下，针对特定威胁网络流找到势变基底矩阵。由于 SSL/TLS 协议在握手阶段存在着强时序关系与状态转移过程，同时部分 SSL/TLS 攻击间存在相似性，因此对于 SSL/TLS攻击的检测不仅需要考虑时序上下文信息，还需要考虑对 SSL/TLS 网络流的高分离度的表示。基于流谱理论，采用威胁模板思想提取势变基底矩阵，使用基于长短时记忆单元的势变基底映射，将 SSL/TLS 攻击网络流映射到流谱域空间。在自建SSL/TLS攻击网络流数据集上，通过分类性能对比、势变谱降维可视化、威胁行为特征权重评估、威胁行为谱系划分评估、势变基底矩阵热力图可视化等手段，验证了流谱理论的有效性。

Abstract

Network attack detection plays a vital role in network security.Existing detection approaches focus on typical attack behaviors

such as Botnets and SQL injection.The widespread use of the SSL/TLS encryption protocol arises some emerging attack strategies against the SSL/TLS protocol.With the network traffic collection environment that built upon the implements of popular SSL/TLS attacks

a network traffic dataset including four SSL/TLS attacks

as well as benign flows was controlled.Considering the problems that limited observability of existing detection and limited separation of the original-flow spatiotemporal domains

a flow spectrum theory was proposed to map the threat behavior in the cyberspace from the original spatiotemporal domain to the transformed domain through the process of “potential change” and obtain the “potential variation spectrum”.The flow spectrum theory is based on a set of separable and observable feature representations to achieve efficient analysis of network flows.The key to the application of flow spectrum theory in actual cyberspace threat behavior detection is to find the potential basis matrix for a specific threat network flow under the condition of a given transformation operator.Since the SSL/TLS protocol has a strong timing relationship and state transition process in the handshake phase

and there are similarities between some SSL/TLS attacks

the detection of SSL/TLS attacks not only needs to consider timing context information

but also needs to consider the high-separation representation of TLS network flows.Based on the flow spectrum theory

the threat template idea was used to extract the potential basis matrix

and the potential basis mapping based on the long-short-term memory unit was used to map the SSL/TLS attack network flow to the flow spectrum domain space.On the self-built SSL/TLS attack network flow data set

the validity of the flow spectrum theory is verified by means of classification performance comparison

potential variation spectrum dimensionality reduction visualization

threat behavior feature weight evaluation

threat behavior spectrum division assessment

and potential variation base matrix heatmap visualization.

关键词

Keywords

references

GURUBARAN S . Cisco encrypted traffic analytics white paper [EB ] .

SHEFFER Y , HOLZ R , SAINT-ANDRE P , . Summarizing known attacks on transport layer security (TLS) and datagram TLS (DTLS) [J ] . Internet Engineering Task Force Request for Comments,2015 , 7457 .

MCPHERSON J , MA K L , KRYSTOSK P , et al . Portvis:a tool for port-based detection of security events [C ] // Proceedings of the 2004 ACM workshop on Visualization and Data Mining for Computer Security . 2004 : 73 - 81 .

FINSTERBUSCH M , RICHTER C , ROCHA E , et al . A survey of payload-based traffic classification approaches [J ] . IEEE Communications Surveys ＆ Tutorials , 2013 , 16 ( 2 ): 1135 - 1156 .

CAO Z , XIONG G , ZHAO Y , et al . A survey on encrypted traffic classification [C ] // International Conference on Applications and Techniques in Information Security . 2014 : 73 - 81 .

FREIER A , KARLTON P , KOCHER P . The secure sockets layer (SSL) protocol version 3.0 [R ] . RFC 6101 , 2011 .

RESCORLA E , DIERKS T . The transport layer security (TLS) protocol version 1.3 [J ] . 2018 .

MÖLLER B , DUONG T , KOTOWICZ K . This POODLE bites:exploiting the SSL 3.0 fallback [J ] . Security Advisory , 2014 , 21 : 34 - 58 .

GLUCK Y , HARRIS N , PRADO A . BREACH:reviving the CRIME attack [J ] . Unpublished manuscript , 2013 .

VANHOEF M , PIESSENS F . All your biases belong to us:Breaking RC4 in WPA-TKIP and TLS [C ] // 24th USENIX Security Symposium {USENIX} Security . 2015 : 97 - 112 .

KORCZYŃSKI M , DUDA A . Markov chain fingerprinting to classify encrypted traffic [C ] // IEEE INFOCOM 2014-IEEE Conference on Computer Communications . 2014 : 781 - 789 .

SHEN M , WEI M , ZHU L , et al . Classification of encrypted traffic with second-order markov chains and application attribute bigrams [J ] . IEEE Transactions on Information Forensics and Security , 2017 , 12 ( 8 ): 1830 - 1843 .

LIU C , HE L , XIONG G , et al . Fs-net:a flow sequence network for encrypted traffic classification [C ] // IEEE INFOCOM 2019-IEEE Conference on Computer Communications . 2019 : 1171 - 1179 .

RADFORD B J , APOLONIO L M , Trias A J , et al . Network traffic anomaly detection using recurrent neural networks [J ] . arXiv pre print arXiv:1803.10769 , 2018 .

MIRSKY Y , DOITSHMAN T , ELOVICI Y , et al . Kitsune:an ensemble of autoencoders for online network intrusion detection [J ] . arXiv preprint arXiv:1802.09089 , 2018 .

FU C , LI Q , SHEN M , et al . Realtime robust malicious traffic detection via frequency domain analysis [C ] // Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . 2021 : 3431 - 3446 .

HOCHREITER S , SCHMIDHUBER J . Long short-term memory [J ] . Neural Computation , 1997 , 9 ( 8 ): 1735 - 1780 .

SNELL J , SWERSKY K , ZEMEL R . Prototypical networks for few-shot learning [C ] // Proceedings of the 31st International Conference on Neural Information Processing Systems . 2017 : 4080 - 4090 .

VAN DER MAATEN L , HINTON G . Visualizing data using t-SNE [J ] . Journal of Machine Learning Research , 2008 , 9 ( 11 ).

HOLMES A , KELLOGG M . Automating functional tests using selenium [C ] // AGILE 2006 (AGILE'06) . 2006 .

MERINO B . Instant traffic analysis with Tshark how-to [M ] . Packt Publishing Ltd , 2013 .

PASZKE A , GROSS S , MASSA F , et al . Pytorch:an imperative style,high-performance deep learning library [J ] . Advances in neural Information Processing Systems , 2019 , 32 : 8026 - 8037 .

PEDREGOSA F , VAROQUAUX G , GRAMFORT A , et al . Scikit-learn:machine learning in Python [J ] . The Journal of Machine Learning Research , 2011 , 12 : 2825 - 2830 .

浏览量

507

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据