Granted Patent B2

US 12,598,200 · App. 17/994,944 · Granted Apr 7, 2026

Inventors: Jing Peng (Shenzhen, CN); Yong Yang (Shenzhen, CN); Xiang Gan (Shenzhen, CN); Xing Zheng (Shenzhen, CN); Aisi Xu (Shenzhen, CN); Shanshan Hua (Shenzhen, CN); Jing Guo (Shenzhen, CN); You Chang (Shenzhen, CN); Yuhe Fan (Shenzhen, CN); Wentao Tang (Shenzhen, CN); Junli Shen (Shenzhen, CN); Shu He (Shenzhen, CN); Yue Wang (Shenzhen, CN); Yu Liu (Shenzhen, CN)

Assignee: Tencent Technology (Shenzhen) Company Limited

H04L63/1425H04L63/0236H04L63/20

Abstract

Claims (106)

1 . A method for detecting abnormal network data, the method comprising:

obtaining a network data packet;

for each of two or more protocol types corresponding to the network data packet:

extracting one or more feature fields from the network data packet based on at least one fingerprint generation algorithm that corresponds to the respective protocol type; and

generating, according to the at least one fingerprint generation algorithm and the extracted one or more feature fields, one or more data packet fingerprints;

obtaining a data packet fingerprint set corresponding to the network data packet that includes the data packet fingerprints generated for the two or more protocol types;

matching at least one data packet fingerprint in the data packet fingerprint set and a reference data packet fingerprint in a reference data packet fingerprint library;

calculating a confidence corresponding to the network data packet based on confidence correlation information corresponding to each of the at least one matched data packet fingerprint;

obtaining a reference confidence; and

determining an abnormality detection result of the network data packet based on the reference confidence and the calculated confidence.

2 . The method according to claim 1 , wherein the method further comprises:

before the obtaining the network data packet,

obtaining a candidate network data packet set, wherein the candidate network data packet set comprises a plurality of candidate network data packets acquired within a time window;

performing feature extraction on each of the candidate network data packets according to one or more candidate protocol types corresponding to the respective candidate network data packet, and generating a corresponding candidate data packet fingerprint set, wherein the candidate data packet fingerprint set comprises candidate data packet fingerprints corresponding to respective ones of the candidate network data packets;

clustering the candidate data packet fingerprints in the candidate data packet fingerprint set based on fingerprint correlation information, to obtain plural clusters of the candidate data packet fingerprints; and

identifying reference data packet fingerprints in the candidate data packet fingerprint set by selecting one or more clusters, and generating the reference data packet fingerprint library by combining the reference data packet fingerprints.

3 . The method according to claim 2 , wherein

the fingerprint correlation information comprises a candidate protocol type and a fingerprint generation algorithm corresponding to each of the candidate data packet fingerprints, and

the clustering comprises:

clustering candidate data packet fingerprints that were generated for a same protocol type, to obtain the plural clusters, and counting a quantity of candidate data packet fingerprints in a same cluster, to obtain statistical values corresponding to the clusters; and

the identifying the reference data packet fingerprints comprises:

identifying candidate data packet fingerprints of clusters whose statistical values are greater than a statistical threshold as the reference data packet fingerprints.

4 . The method according to claim 1 , wherein the matching comprises:

comparing each of the at least one data packet fingerprint with a current reference data packet fingerprint, to obtain a data packet fingerprint comparison result;

comparing fingerprint correlation information corresponding to the respective one of the at least one data packet fingerprint with fingerprint correlation information corresponding to the current reference data packet fingerprint, to obtain a fingerprint correlation information comparison result; and

determining, in response to a determination that the data packet fingerprint comparison result and the fingerprint correlation information comparison result indicate a match, that the respective one of the at least one data packet fingerprint matches the current reference data packet fingerprint.

5 . The method according to claim 1 , wherein the calculating comprises:

obtaining a protocol confidence corresponding to a protocol type of the at least one data packet fingerprint matched to the reference data packet fingerprint;

obtaining an algorithm confidence based on a fingerprint generation algorithm corresponding to the at least one data packet fingerprint matched to the reference data packet fingerprint; and

obtaining the confidence based on the protocol confidence and the algorithm confidence.

6 . The method according to claim 5 , wherein

the protocol types comprise an application layer protocol type and another layer protocol type, and

the obtaining the confidence based on the protocol confidence and the algorithm confidence comprises:

sorting algorithm confidences corresponding to each of the protocol types in a descending order, to obtain a sorting result corresponding to each layer protocol type;

obtaining a first confidence corresponding to each layer protocol type by combining algorithm confidences sorted first and sorted second in the sorting result corresponding to the respective protocol type;

sorting remaining algorithm confidences in the sorting result corresponding to the respective protocol type and the first confidence corresponding to the respective protocol type in the descending order, to obtain an updated sorting result corresponding to each layer protocol type;

returning to obtaining the first confidence corresponding to each layer protocol type according to algorithm confidences sorted first and sorted second in the updated sorting result corresponding to the respective protocol type, until all algorithm confidences corresponding to the respective protocol type each participate in calculating the first confidence;

obtaining a second confidence corresponding to each layer protocol type; and

obtaining an intermediate confidence corresponding to each layer protocol type based on the protocol confidence and the second confidence corresponding to the respective protocol type, and obtaining the confidence according to one or more of the intermediate confidences.

7 . The method according to claim 6 , wherein the obtaining the first confidence comprises:

obtaining merge weights corresponding to algorithm confidences currently sorted first and second, wherein a merge weight corresponding to the algorithm confidence currently sorted second is determined based on the algorithm confidence currently sorted first; and

merging the algorithm confidences sorted first and sorted second in the sorting result corresponding to the respective protocol type based on the obtained merge weights, to obtain the first confidence corresponding to each layer protocol type.

8 . The method according to claim 1 , wherein the determining the abnormality detection result comprises:

determining, in response to a determination that the confidence is greater than the reference confidence, that the network data packet is abnormal; and

determining, in response to a determination that the confidence is less than or equal to the reference confidence, that the network data packet is normal.

9 . The method according to claim 1 , further comprising:

when the network data packet is determined as abnormal,

obtaining a blocking data packet; and

transmitting the blocking data packet to a receiving party corresponding to the network data packet, to cause the receiving party to stop a communication connection with a transmitting party corresponding to the network data packet.

10 . The method according to claim 1 , further comprising:

monitoring matching success rates corresponding to each reference data packet fingerprint in the reference data packet fingerprint library; and

filtering out reference data packet fingerprints whose matching success rates are less than a preset threshold from the reference data packet fingerprint library.

11 . An apparatus for detecting abnormal network data, comprising:

processing circuitry configured to

obtain a network data packet;

for each of two or more protocol types corresponding to the network data packet:

extract one or more feature fields from the network data packet based on at least one fingerprint generation algorithm that corresponds to the respective protocol type; and

generate, according to the at least one fingerprint generation algorithm and the extracted one or more feature fields, one or more data packet fingerprints;

obtain a data packet fingerprint set corresponding to the network data packet that includes the data packet fingerprints generated for the two or more protocol types;

match at least one data packet fingerprint in the data packet fingerprint set and a reference data packet fingerprint in a reference data packet fingerprint library;

calculate a confidence corresponding to the network data packet based on confidence correlation information corresponding to each of the at least one matched data packet fingerprint;

obtain a reference confidence; and

determine an abnormality detection result of the network data packet based on the reference confidence and the calculated confidence.

12 . The apparatus according to claim 11 , wherein the processing circuitry is further configured to:

obtain a candidate network data packet set, wherein the candidate network data packet set comprises a plurality of candidate network data packets acquired within a time window;

perform feature extraction on each of the candidate network data packets according to two or more candidate protocol types corresponding to the respective candidate network data packet, and generate, for each candidate network data packet, a corresponding candidate data packet fingerprint set, wherein the candidate data packet fingerprint set comprises candidate data packet fingerprints generated for the candidate network data packets;

cluster the candidate data packet fingerprints in the candidate data packet fingerprint set based on fingerprint correlation information, to obtain plural clusters of the candidate data packet fingerprints; and

identify reference data packet fingerprints from the candidate data packet fingerprint set by selecting one or more clusters, and generate the reference data packet fingerprint library by combining the reference data packet fingerprints.

13 . The apparatus according to claim 12 , wherein

the fingerprint correlation information comprises the candidate protocol type and a fingerprint generation algorithm corresponding to each of the candidate data packet fingerprints, and

the processing circuitry is further configured to

cluster candidate data packet fingerprints that were generated for a same protocol type corresponding to a same fingerprint generation algorithm, to obtain the plural clusters, and count a quantity of candidate data packet fingerprints in a same cluster, to obtain statistical values corresponding to the clusters; and

identify candidate data packet fingerprints of clusters whose statistical values are greater than a statistical threshold as the reference data packet fingerprints.

14 . The apparatus according to claim 11 , wherein the processing circuitry is further configured to

compare each of the at least one data packet fingerprint with a current reference data packet fingerprint, to obtain a data packet fingerprint comparison result;

compare fingerprint correlation information corresponding to the respective one of the at least one data packet fingerprint with fingerprint correlation information corresponding to the current reference data packet fingerprint, to obtain a fingerprint correlation information comparison result; and

determine, in response to a determination that the data packet fingerprint comparison result and the fingerprint correlation information comparison result indicate a match, that the respective one of the at least one data packet fingerprint matches the current reference data packet fingerprint.

15 . The apparatus according to claim 11 , wherein the processing circuitry is further configured to

obtain a protocol confidence corresponding to a protocol type of the at least one data packet fingerprint matched to the reference data packet fingerprint;

obtain an algorithm confidence based on a fingerprint generation algorithm corresponding to the at least one data packet fingerprint matched to the reference data packet fingerprint; and

obtain the confidence based on the protocol confidence and the algorithm confidence.

16 . The apparatus according to claim 15 , wherein

the protocol types comprise an application layer protocol type and another layer protocol type; and

the processing circuitry is further configured to

sort algorithm confidences corresponding to each of the protocol types in a descending order, to obtain a sorting result corresponding to each layer protocol type;

obtain a first confidence corresponding to each layer protocol type by combining algorithm confidences sorted first and sorted second in the sorting result corresponding to the respective protocol type;

sort remaining target algorithm confidences in the sorting result corresponding to the respective protocol type and the first confidence corresponding to the respective protocol type in the descending order, to obtain an updated sorting result corresponding to each layer protocol type;

return to obtaining the first confidence corresponding to each layer protocol type according to algorithm confidences sorted first and sorted second in the updated sorting result corresponding to the respective protocol type, until all algorithm confidences corresponding to the respective protocol type each participate in calculating the first confidence;

obtain a second confidence corresponding to each layer protocol type; and

obtain an intermediate confidence corresponding to each layer protocol type based on the protocol confidence and the second confidence corresponding to the respective protocol type, and obtain the confidence according to the intermediate confidences.

17 . The apparatus according to claim 16 , wherein the processing circuitry is further configured to

obtain merge weights corresponding to the algorithm confidences currently sorted first and second, wherein a merge weight corresponding to the algorithm confidence currently sorted second is determined based on the algorithm confidence currently sorted first; and

merge the algorithm confidences sorted first and sorted second in the sorting result corresponding to the respective protocol type based on the obtained merge weights, to obtain the first confidence corresponding to each layer protocol type.

18 . The apparatus according to claim 11 , wherein the processing circuitry is further configured to:

determine, in response to a determination that the confidence is greater than the reference confidence, that the network data packet is abnormal; and

determine, in response to a determination that the confidence is less than or equal to the reference confidence, that the network data packet is normal.

19 . A non-transitory computer-readable storage medium storing computer-readable instructions thereon, which, when executed by a computer device, cause the computer device to perform a method for detecting abnormal network data, the method comprising:

obtaining a network data packet;

for each of two or more protocol types corresponding to the network data packet:

extracting one or more feature fields from the network data packet based on at least one fingerprint generation algorithm that corresponds to the respective protocol type; and

generating, according to the at least one fingerprint generation algorithm and the extracted one or more feature fields, one or more data packet fingerprints;

obtaining a data packet fingerprint set corresponding to the network data packet that includes the data packet fingerprints generated for the two or more protocol types;

matching at least one data packet fingerprint in the data packet fingerprint set and a reference data packet fingerprint in a reference data packet fingerprint library;

calculating a confidence corresponding to the network data packet based on confidence correlation information corresponding to each of the at least one matched data packet fingerprint;

obtaining a reference confidence; and

determining an abnormality detection result of the network data packet based on the reference confidence and the calculated confidence.

Assignments (2)

Priority Claims (1)

Continuity (2)

References Cited (24)