基于网络流量的用户网络行为被害性分析模型

doi:10.11959/j.issn.1000-0801.2021041

摘要/Abstract

摘要：

网络行为被害性分析对于电信网络诈骗犯罪的防控具有深远意义。通过研究用户与网站交互产生的网络流量，提出一种基于网络流量分析的电信网络诈骗犯罪用户网络行为被害性识别模型，分析不同网络行为特征之间的关联规则，重构网络行为序列特征，同时结合随机森林算法评估网络行为的被害性。在被害人网络行为数据集基础上进行实验，证明模型能够有效提升网络行为被害性识别准确率。

关键词: 网络流量, 网络行为编码, 关联规则挖掘, 被害性分析

Abstract:

The analysis of network victimization is of great significance to the prevention and control of telecom fraud.By studying the network traffic generated by the interaction between users and websites, a victimization identification model of telecom fraud crime based on network behavior flow analysis was proposed, the association rules between different behavior characteristics were analyzed, the behavior sequence features were reconstructed, and the victimization of network behavior sequence with random forest algorithm was evaluated.Based on the network behavior data set of public security organs, the experiment proves that the model can effectively improve the recognition accuracy of network behavior victimization.

Key words: network traffic, network behavior coding, association rules mining, victimization analysis

中图分类号:

TP311

周胜利, 徐啸炀. 基于网络流量的用户网络行为被害性分析模型[J]. 电信科学, 2021, 37(2): 125-134.

Shengli ZHOU, Xiaoyang XU. Victimization analysis model of user network behavior based on network traffic[J]. Telecommunications Science, 2021, 37(2): 125-134.

图/表 9

图1

表1

图2

图3

表2

表3

图4

表4

表5

参考文献 26

[1]	佟晖, 唐卫中, 蔡家艳 ,等. 电信诈骗态势与反诈新思路研究[J]. 北京警察学院学报, 2021(1): 1-14.
	TONG H , TANG W Z , CAI J Y ,et al. Research on the situation of telecom fraud and new ideas of anti fraud[J]. Journal of Beijing Police College, 2021(1): 1-14.
[2]	周坚, 石永革, 何美斌 . 基于A-D模型的K-means算法在通话异常客户挖掘中的应用[J]. 电信科学, 2018,34(4): 81-89.
	ZHOU J , SHI Y G , HE M B . Application of K-means algorithm based on A-D model in calling abnormal customer mining[J]. Telecommunications Science, 2018,34(4): 81-89.
[3]	李力卡, 马泽雄, 陈庆年 ,等. 电话诈骗防治技术解决方案与运维对策研究[J]. 电信科学, 2014,30(11): 166-172.
	LI L K , MA Z X , CHEN Q N ,et al. Research of technology solutions and operation countermeasures to telephone fraud prevention and control[J]. Telecommunications Science, 2014,30(11): 166-172.
[4]	王海坤, 潘嘉, 刘聪 . 语音识别技术的研究进展与展望[J]. 电信科学, 2018,34(2): 1-11.
	WANG H K , PAN J , LIU C . Research development and forecast of automatic speech recognition technologies[J]. Telecommunications Science, 2018,34(2): 1-11.
[5]	张蕾, 张鹏, 孙伟 ,等. 面向高速网络流量的恶意镜像网站识别方法[J]. 通信学报, 2019,40(7): 87-94.
	ZHANG L , ZHANG P , SUN W ,et al. IMM4HT:an identification method of malicious mirror website for high-speed network traffic[J]. Journal on Communications, 2019,40(7): 87-94.
[6]	韩浩, 刘博文, 林果园 . 基于改进的 TrustRank 算法的钓鱼网站检测[J]. 电信科学, 2018,34(3): 86-94.
	HAN H , LIU B W , LIN G Y . Detection of phishing websites based on the improved TrustRank algorithm[J]. Telecommunications Science, 2018,34(3): 86-94.
[7]	臧小东, 龚俭 , 胡晓艳 . 基于AGD的恶意域名检测[J]. 通信学报, 2018,39(7): 15-25.
	ZANG X D , GONG J , HU X Y . Detecting malicious domain names based on AGD[J]. Journal on Communications, 2018,39(7): 15-25.
[8]	韩春雨, 张永铮, 张玉 . Fast-flucos:基于DNS流量的Fast-flux恶意域名检测方法[J]. 通信学报, 2020,41(5): 37-47.
	HAN C Y , ZHANG Y Z , ZHANG Y . Fast-flucos:malicious domain name detection method for Fast-flux based on DNS traffic[J]. Journal on Communications, 2020,41(5): 37-47.
[9]	ZHOU S L , WANG X , YANG Z R . Monitoring and early warning of new cyber-telecom crime platform based on BERT migration learning[J]. China Communications, 2020,17(3): 140-148.
[10]	ZOLOTUKHIN M , H?M?L?INEN T , KOKKONEN T ,et al. Analysis of http requests for anomaly detection of Web attacks[C]// Proceedings of 2014 IEEE 12th International Conference on Dependable,Autonomic and Secure Computing. Piscataway:IEEE Press, 2014: 406-411.
[11]	YU Y , LIU G , YAN H ,et al. Attention-based Bi-LSTM model for anomalous HTTP traffic detection[C]// Proceedings of 2018 15th International Conference on Service Systems and Service Management. Piscataway:IEEE Press, 2018: 1-6.
[12]	YANG W , ZUO W , CUI B . Detecting malicious URLS via a keyword-based convolutional gated-recurrent-unit neural network[J]. IEEE Access, 2019(7): 29891-29900.
[13]	PARK S , KIM M , LEE S . Anomaly detection for HTTP using convolutional autoencoders[J]. IEEE Access, 2018(6): 70884-70901.
[14]	ARZHAKOV A V , TROITSKIY S S , VASILYEV N P ,et al. Development and implementation a method of detecting an attacker with use of HTTP network protocol[C]// Proceedings of 2017 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering. Piscataway:IEEE Press, 2017: 100-104.
[15]	THANG T M , KIM J . The anomaly detection by using DBSCAN clustering with multiple parameters[C]// Proceedings of 2011 International Conference on Information Science and Applications. Piscataway:IEEE Press, 2011: 1-5
[16]	ZHANG M , LU S , XU B . An anomaly detection method based on multi-models to detect Web attacks[C]// Proceedings of 2017 10th International Symposium on Computational Intelligence and Design. Piscataway:IEEE Press, 2017(2): 404-409.
[17]	ERFANI S M , RAJASEGARAR S , KARUNASEKERA S ,et al. High-dimensional and large-scale anomaly detection using a linear one-class SVM with deep learning[J]. Pattern Recognition, 2016(58): 121-134.
[18]	连一峰, 戴英侠, 王航 . 基于模式挖掘的用户行为异常检测[J]. 计算机学报, 2002(3): 325-330.
	LIAN Y F , DAI Y X , WANG H . Anomaly detection of user behaviors based on profile mining[J]. Chinese Journal of Computers, 2002(3): 325-330.
[19]	田新广, 孙春来, 段洣毅 ,等. 基于机器学习的用户行为异常检测模型[J]. 计算机工程与应用, 2006(19): 101-103,111.
	TIAN X G , SUN C L , DUAN M Y ,et al. Model of anomaly detection of users behaviors based on machine learning[J]. Computer Engineering and Applications, 2006(19): 101-103,111.
[20]	陈胜, 朱国胜, 祁小云 ,等. 基于深度神经网络的自定义用户异常行为检测[J]. 计算机科学, 2019,46(S2): 442-445,472.
	CHEN S , ZHU G S , QI X Y ,et al. Custom user anomaly behavior detection based on deep neural network[J]. Computer Science, 2019,46(S2): 442-445,472.
[21]	胡富增, 王勇军 . 基于数据挖掘的计算机用户行为分析与识别[J]. 自动化技术与应用, 2020,39(6): 42-47.
	HU F Z , WANG Y J . Analysis and recognition of computer user behavior based on data mining[J]. Techniques of Automation and Applications, 2020,39(6): 42-47.
[22]	WANG S , CAO L , WANG Y . A survey on session-based recommender systems[J]. arXiv:1902.04864, 2019.
[23]	TANG J , WANG K . Personalized top-n sequential recommendation via convolutional sequence embedding[C]// Proceedings of the Eleventh ACM International Conference on Web Search and Data Mining. New York:ACM Press, 2018: 565-573.
[24]	SUN F , LIU J , WU J ,et al. BERT4Rec:sequential recommendation with bidirectional encoder representations from transformer[C]// Proceedings of the 28th ACM International Conference on Information and Knowledge Management. New York:ACM Press, 2019: 1441-1450.
[25]	HIDASI B , KARATZGLOU A , BALTRNAS L ,et al. Session-based recommendations with recurrent neural networks[J]. arXiv:1511.06939, 2015.
[26]	KANG W C , MCAULEY J . Self-attentive sequential recommendation[C]// Proceedings of 2018 IEEE International Conference on Data Mining (ICDM). Piscataway:IEEE Press, 2018.

行为特征参数	描述
Srcip	源地址
Dstip	目标地址
final_byte_number	总字节
packet_number	总分组数
Dstport	目标端口
Keep_time	持续时长
send_packet	发送分组数
receive_packet	接收分组数
send_len	发送分组长度
receive_len	接收分组长度
sender_header_len	发送tcp头部信息长度
receiver_header_len	接收tcp头部信息长度
Load_size	负载总大小
Send_Load_size	发送负载大小
rec_Load_size	接收负载大小
Feature	行为特征

诈骗类		非诈骗类
种类	数量	种类	数量
博彩	534	网页游戏	453
虚假投资	730	金融投资	323
虚假论坛	364	生活交友	467
虚假借贷	507	彩票	156

关联规则参数	描述
Antecedents	规则前项
Consequents	规则后项
antecedent support	前项支持度
consequent support	后向支持度
Support	前项对后项支持度
Confidence	置信度
Lift	提升度
Leverage	关联性参数1
Conviction	关联性参数2

决策树参数		分类效果变量
Numfeature	Numtree	TP	FP	Precision	Recall	F-Measure	MCC
0	100	0.964	0.095	0.965	0.964	0.964	0.959
2	100	0.963	0.096	0.964	0.963	0.963	0.958
4	100	0.964	0.095	0.965	0.964	0.964	0.959
6	100	0.963	0.096	0.964	0.963	0.963	0.956
8	100	0.963	0.096	0.964	0.963	0.963	0.956
4	20	0.962	0.097	0.963	0.962	0.962	0.955
4	40	0.964	0.095	0.965	0.964	0.964	0.959
4	60	0.965	0.094	0.966	0.965	0.965	0.960
4	80	0.964	0.095	0.965	0.964	0.964	0.959
4	100	0.964	0.095	0.965	0.964	0.964	0.959

Confusion Matrix		VIM-TFCN预测值		C45模型预测值		朴素贝叶斯预测值
Confusion Matrix		TRUE	FALSE	TRUE	FALSE	TRUE	FALSE
真实值	TRUE	2 005	46	1 648	403	1 372	679
	FALSE	32	2 254	443	1 843	359	1 927