Network traffic attack detection method and device, storage medium and computer equipment

Abstract

The invention discloses a network traffic attack detection method and device, a storage medium and computer equipment, and is applied to an edge router, the method comprises the following steps: a feature mining module of the edge router obtains target network traffic, and extracts target network traffic feature information of the target network traffic; a multi-task processing module of the edge router carries out attack detection on the target network traffic through a network traffic attack detection model and the target network traffic feature information, and the network traffic attack detection model is established based on a convolutional neural network and a long and short term memory network; and when the multi-task processing module of the edge router detects that the target network traffic is attacked, the attack is suppressed based on the attack suppression scheme corresponding to the target network traffic, and the target network traffic after attack suppression is forwarded to the client corresponding to the target network traffic. Network attack detection is carried out through the multi-level coupled convolutional neural network and the long-short-term memory network, and the network flow attack detection precision can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a network traffic attack detection method and device, a storage medium, and a computer device. Background Art

[0002] The rapid development of network technology has brought many conveniences to people and has been widely used in daily life and production, but at the same time, network attacks also threaten Internet hosts and network infrastructure. Network Trojans, DDoS attacks, website backdoors, counterfeiting and tampering and other security incidents are emerging in an endless stream. Key industries such as power systems have high-risk vulnerabilities. The Internet is facing many security threats. Summary of the invention

[0003] In view of this, the present application provides a network traffic attack detection method and device, storage medium, and computer equipment, which are applied to edge routers. The edge routers are deployed with feature mining modules and multi-task processing modules. The feature mining module of the edge router obtains the target network traffic and extracts the target network traffic feature information of the target network traffic; the multi-task processing module of the edge router performs attack detection on the target network traffic through the network traffic attack detection model and the target network traffic feature information, wherein the network traffic attack detection model is established based on a convolutional neural network and a long short-term memory network; when the multi-task processing module of the edge router detects that there is an attack on the target network traffic, the attack is contained based on the attack containment scheme corresponding to the target network traffic, and the target network traffic after the attack is contained is forwarded to the client corresponding to the target network traffic. By performing network attack detection through multi-level coupled convolutional neural networks and long short-term memory networks, the accuracy of network traffic attack detection can be improved.

[0004] According to one aspect of the present application, a network traffic attack detection method is provided, which is applied to an edge router, wherein the edge router is deployed with a feature mining module and a multi-task processing module, and the method comprises:

[0005] The feature mining module of the edge router obtains the target network traffic and extracts the target network traffic feature information of the target network traffic;

[0006] The multi-task processing module of the edge router performs attack detection on the target network traffic through the network traffic attack detection model and the target network traffic characteristic information, wherein the network traffic attack detection model is established based on a convolutional neural network and a long short-term memory network;

[0007] When the multi-task processing module of the edge router detects that there is an attack on the target network traffic, it performs attack containment based on the attack containment plan corresponding to the target network traffic under attack, and forwards the target network traffic after the attack is contained to the client corresponding to the target network traffic.

[0008] Optionally, the target network traffic feature information includes a client address, a network traffic generation time period, and a feature vector length; the target network traffic corresponds to a plurality of clients; the convolutional neural network includes a one-dimensional convolutional layer and a two-dimensional convolutional layer; the multi-task processing module of the edge router performs attack detection on the target network traffic through a network traffic attack detection model and the target network traffic feature information, including:

[0009] The multi-task processing module of the edge router sequentially obtains first feature correlation information between target network flows sent to the same client based on a one-dimensional convolutional layer in a convolutional neural network according to the time sequence of the network flow generation time period of the target network flows, and obtains second feature correlation information between the target network flows sent to each client based on a two-dimensional convolutional layer in the convolutional neural network.

[0010] The multi-task processing module of the edge router performs attack detection on the target network traffic based on the long short-term memory network, the first feature association information and the second feature association information.

[0011] Optionally, the multi-task processing module of the edge router performs attack detection on the target network traffic based on the long short-term memory network, the first feature association information and the second feature association information, including:

[0012] When the multi-task processing module of the edge router detects that the first feature association information and / or the second feature association information do not have association dependency based on the long short-term memory network, the target network traffic has an attack;

[0013] When the multi-task processing module of the edge router detects that the first feature association information and / or the second feature association information have association dependency based on the long short-term memory network, there is no attack on the target network traffic.

[0014] Optionally, before the multi-task processing module of the edge router performs attack containment based on the attack containment solution corresponding to the target network traffic under attack, the method further includes:

[0015] The multi-task processing module of the edge router obtains an attack containment solution corresponding to the attack mode from a preset attack containment solution library based on the attack mode of the target network traffic under attack.

[0016] Optionally, the method further comprises:

[0017] When the attack containment solution corresponding to the attack mode is not obtained, the multi-task processing module of the edge router intercepts the target network traffic and sends the target network traffic feature information corresponding to the intercepted target network traffic to a preset recipient terminal.

[0018] Optionally, the method further comprises:

[0019] If the attack method for which no attack containment plan is obtained is successfully contained, the successfully contained attack containment plan is added to the preset attack containment plan library, and the target network traffic after the attack is successfully contained is forwarded to the client corresponding to the target network traffic.

[0020] Optionally, the network traffic attack detection model is trained based on a cross entropy loss function, wherein, when it is detected during the training of the network traffic attack detection model that the network traffic of the client is attacked, the loss is calculated based on the cross entropy loss function.

[0021] According to another aspect of the present application, a network traffic attack detection device is provided, the device comprising:

[0022] A feature extraction module is used to obtain target network traffic and extract target network traffic feature information of the target network traffic;

[0023] An attack detection module, used to perform attack detection on the target network traffic through a network traffic attack detection model and the target network traffic characteristic information, wherein the network traffic attack detection model is established based on a convolutional neural network and a long short-term memory network;

[0024] The attack containment module is used to contain the attack based on the attack containment scheme corresponding to the target network traffic under attack when an attack is detected in the target network traffic, and forward the target network traffic after the attack is contained to the client corresponding to the target network traffic.

[0025] Optionally, the target network traffic feature information includes a client address, a network traffic generation time period, and a feature vector length; the target network traffic corresponds to a plurality of clients; the convolutional neural network includes a one-dimensional convolutional layer and a two-dimensional convolutional layer; and the attack detection module is further used to:

[0026] According to the time sequence of the network traffic generation time period of the target network traffic, first feature correlation information between target network traffic sent to the same client is obtained based on the one-dimensional convolution layer in the convolutional neural network for the target network traffic belonging to the same network traffic generation time period, and second feature correlation information between the target network traffic sent to each client is obtained based on the two-dimensional convolution layer in the convolutional neural network;

[0027] Attack detection is performed on target network traffic based on the long short-term memory network, the first feature association information and the second feature association information.

[0028] Optionally, the attack detection module is further used to:

[0029] When it is detected based on the long short-term memory network that the first feature association information and / or the second feature association information do not have association dependency, the target network traffic has an attack;

[0030] When it is detected based on the long short-term memory network that the first feature association information and / or the second feature association information have association dependency, there is no attack on the target network traffic.

[0031] Optionally, the attack containment module is further used to:

[0032] Based on the attack mode of the target network traffic under attack, an attack containment solution corresponding to the attack mode is obtained from a preset attack containment solution library.

[0033] Optionally, the device further comprises: a flow cut-off module, configured to:

[0034] When the attack containment solution corresponding to the attack mode is not obtained, the target network traffic is intercepted, and the target network traffic feature information corresponding to the intercepted target network traffic is sent to a preset recipient terminal.

[0035] Optionally, the device further includes: a traffic forwarding module, configured to:

[0036] If the attack method for which no attack containment plan is obtained is successfully contained, the successfully contained attack containment plan is added to the preset attack containment plan library, and the target network traffic after the attack is successfully contained is forwarded to the client corresponding to the target network traffic.

[0037] Optionally, the network traffic attack detection model is trained based on a cross entropy loss function, wherein, when it is detected during the training of the network traffic attack detection model that the network traffic of the client is attacked, the loss is calculated based on the cross entropy loss function.

[0038] According to another aspect of the present application, a storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the above-mentioned network traffic attack detection method is implemented.

[0039] According to another aspect of the present application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the above-mentioned network traffic attack detection method when executing the program.

[0040] By means of the above technical scheme, the present application provides a network traffic attack detection method and device, storage medium, and computer equipment, wherein the feature mining module of the edge router obtains the target network traffic and extracts the target network traffic feature information of the target network traffic; the multi-task processing module of the edge router performs attack detection on the target network traffic through the network traffic attack detection model and the target network traffic feature information, wherein the network traffic attack detection model is established based on a convolutional neural network and a long short-term memory network; when the multi-task processing module of the edge router detects that there is an attack on the target network traffic, the attack is contained based on the attack containment scheme corresponding to the target network traffic, and the target network traffic after the attack is contained is forwarded to the client corresponding to the target network traffic. By performing network attack detection through multi-level coupling of convolutional neural networks and long short-term memory networks, the accuracy of network traffic attack detection can be improved.

[0041] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0043] Figure 1 A schematic diagram of a flow chart of a network traffic attack detection method provided in an embodiment of the present application is shown;

[0044] Figure 2 A schematic diagram of edge router deployment provided by an embodiment of the present application is shown;

[0045] Figure 3 A schematic diagram of a flow chart of another network traffic attack detection method provided in an embodiment of the present application is shown;

[0046] Figure 4 A schematic diagram of a network traffic attack detection model provided by an embodiment of the present application is shown;

[0047] Figure 5 A schematic diagram of the structure of a network traffic attack detection device provided in an embodiment of the present application is shown;

[0048] Figure 6 A schematic diagram of the structure of another network traffic attack detection device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0049] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0050] In this embodiment, a network traffic attack detection method is provided. Figure 1 As shown, it is applied to an edge router, and the edge router is deployed with a feature mining module and a multi-task processing module. The method includes:

[0051] Step 101: A feature mining module of an edge router obtains target network traffic and extracts target network traffic feature information of the target network traffic.

[0052] At present, the main way to protect network security is to detect network attacks from the network traffic side. Detecting abnormal traffic in important business systems on the Internet can enhance the system's defense capabilities, identify malicious behavior in a timely manner, and take further defense measures to effectively maintain network security. At the same time, traffic detection can also discover traffic development trends, help optimize network resources, and defend against possible threats in the future.

[0053] There are mainly the following methods for network traffic detection: statistical methods, machine learning methods, and deep learning methods. The first is statistical methods. Statistical models have been widely used in the field of anomaly detection. The core is that abnormal network traffic will change dramatically, and learning normal traffic data can detect a small number of abnormal data. One technology is to use the 3σ model of normal distribution to model various indicators in network traffic. The model first calculates the mean and variance of historical data, and then uses the range of 3 standard deviations above and below the mean as the value range of normal traffic indicators. If it exceeds this range, it is judged as a positioning anomaly. In addition, there are statistical features such as quartiles and covariance matrices for anomaly detection. These technologies require simple calculations, but the disadvantages are that they can only be applied in scenarios with relatively stable traffic changes, are difficult to adapt to complex scenarios, and have a high false alarm rate; they cannot handle extreme outliers in historical data, and the detection results will have large deviations; they have poor adaptability to high-dimensional data, etc.

[0054] The second is a method based on machine learning, which uses feature engineering and machine learning methods to detect anomalies in time series traffic. One technology is abnormal traffic detection based on Light GBM. The model first uses KPCA to extract the key features of abnormal traffic, reduces the dimension of high-dimensional data, and then uses the Light GBM model for detection. However, the generalization ability of this model is insufficient and it cannot detect unknown abnormal attack traffic. One technology uses the PSO-XGBoost model, which uses the good search ability of the particle swarm algorithm to adaptively optimize the XGBo ost related parameters, which can effectively improve the efficiency and accuracy of network intrusion detection; however, the particle swarm algorithm has large fluctuations and is prone to produce local optimal solutions or long detection time. Another technology uses the classic K-mean clustering algorithm in intrusion detection. For the IEC61850 smart substation proprietary protocol, a feature selection method based on information entropy is used, and then the K-means clustering algorithm is used to complete the detection analysis set correlation analysis of abnormal traffic. Although the principle of the K-means algorithm is simple, it has the problems of slow convergence speed and high algorithm time complexity, and is very sensitive to noise and outliers. Although these detection technologies based on traditional machine learning methods have improved accuracy, they have great limitations. They find it difficult to capture deep information, cannot fully explore the features and correlations between data, and have weak generalization capabilities.

[0055] The mainstream detection method today is based on deep learning. Deep learning algorithms can fully mine and extract potential features between data. They are widely used in the field of traffic anomaly detection and show good performance. The industrial Internet control traffic has periodic and sequential characteristics. In this regard, a technology based on the long short-term memory network (LSTM) is used to identify and detect abnormal traffic. This method predicts the traffic data value in advance, and then supervises the learning through the LSTM network to detect whether the traffic is abnormal. The detection accuracy and efficiency of this technology are good, but it needs to rely on manual feature extraction, and feature processing is complex and time-consuming.

[0056] To this end, in the above embodiment of the present application, it is applied to an edge router, and the edge router is deployed with a feature mining module and a multi-task processing module, such as Figure 2As shown in the figure, when network traffic reaches the edge computing platform, it first passes through the edge router and is then forwarded to each client in the network. The detection mechanism is deployed on the edge router to detect attacks on network traffic and detect whether there are attacks, malicious packets, etc. in the traffic; at the same time, it locates the attack, locates the attacked client, and selects the method of containing the attack, so as to instruct the administrator to take given containment and defense measures to effectively contain the attack. In particular, the detection mechanism is composed of a deep learning model, which is trained and tested on the server in advance using existing network traffic attack packets, and the trained model is deployed on the router, which can be applied to the detection task. Specifically, the feature mining module of the edge router obtains the target network traffic and extracts the target network traffic feature information of the target network traffic.

[0057] Step 102: The multi-task processing module of the edge router performs attack detection on the target network traffic through a network traffic attack detection model and the target network traffic characteristic information, wherein the network traffic attack detection model is established based on a convolutional neural network and a long short-term memory network.

[0058] Next, the multi-task processing module of the edge router performs attack detection on the target network traffic through the network traffic attack detection model and the target network traffic feature information. The network traffic attack detection model is based on convolutional neural networks and long short-term memory networks. Using CNN (Convolutional Neural Networks) can deeply mine network traffic features of different scales, and then combine CNN and LSTM (Long Short-Term Memory) network structures to mine hidden traffic data features and time features to improve detection accuracy.

[0059] Step 103, when the multi-task processing module of the edge router detects that there is an attack on the target network traffic, it performs attack containment based on the attack containment solution corresponding to the target network traffic under attack, and forwards the target network traffic after the attack is contained to the client corresponding to the target network traffic.

[0060] Finally, when the multi-task processing module of the edge router detects that there is an attack on the target network traffic, it will contain the attack based on the attack containment scheme corresponding to the target network traffic, and forward the target network traffic after the attack is contained to the client corresponding to the target network traffic. To this end, the multi-task processing module is committed to solving three key tasks: attack detection, attack location, and attack containment method selection. The attack detection task is to detect whether the network is under attack through the network traffic attack detection model and output a value of 0 or 1; attack location can be regarded as a multi-label classification task, detecting which client or clients are under attack, locating the client and outputting it; the task of selecting the attack containment method is to select the most appropriate defense method according to the current situation. This module uses the extracted deep feature input through convolutions of different sizes to extract features of different granularities to obtain the results of different tasks, and finally outputs the results, reporting whether it is under attack, the attacked client, and the containment operation to be performed.

[0061] By applying the technical solution of this embodiment, the feature mining module of the edge router obtains the target network traffic and extracts the target network traffic feature information of the target network traffic; the multi-task processing module of the edge router performs attack detection on the target network traffic through the network traffic attack detection model and the target network traffic feature information, wherein the network traffic attack detection model is established based on a convolutional neural network and a long short-term memory network; when the multi-task processing module of the edge router detects that there is an attack on the target network traffic, the attack is contained based on the attack containment scheme corresponding to the target network traffic, and the target network traffic after the attack is contained is forwarded to the client corresponding to the target network traffic. By coupling convolutional neural networks and long short-term memory networks at multiple levels, the accuracy of detecting malicious traffic and attacks can be improved, and multiple clients can be detected at the same time, and multi-task requirements can be realized at the same time.

[0062] Further, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, another network traffic attack detection method is provided, such as Figure 3 As shown, it is applied to an edge router, and the edge router is deployed with a feature mining module and a multi-task processing module. The method includes:

[0063] Step 201, the feature mining module of the edge router obtains the target network traffic and extracts the target network traffic feature information of the target network traffic, wherein the target network traffic feature information includes the client address, the network traffic generation time period and the feature vector length, and the target network traffic corresponds to multiple clients.

[0064] In the above embodiment of the present application, the feature mining module of the edge router obtains the target network traffic and extracts the target network traffic feature information of the target network traffic. The target network traffic feature information includes the client address, the network traffic generation time period and the feature vector length. The target network traffic corresponds to multiple clients. Specifically, the network traffic of each client is used as a three-dimensional input and input into the network traffic attack detection model, such as Figure 4 As shown, the input data is a three-dimensional matrix of client N, time step (network traffic generation time period) T, and feature length (feature vector length) L. In the feature mining module, the hidden features of each client's network traffic are effectively extracted from the training data. The clients are in similar states and perform similar tasks under normal working conditions. Therefore, when not affected by the attack, each client has similar pattern information, and its network traffic has potential temporal and spatial correlation dependencies. After being attacked, the affected clients will break this dependency, while the unaffected clients will continue to maintain the original pattern information, so effective detection can be performed. In particular, collecting the network traffic of multiple clients at the same time can meet the needs of multi-target detection, that is, detecting the network traffic of multiple network devices at the same time, and locating devices with traffic threats.

[0065] In step 202, the multi-task processing module of the edge router obtains first feature association information between target network flows sent to the same client based on the one-dimensional convolutional layer in the convolutional neural network in accordance with the time sequence of the network flow generation time periods of the target network flows, and obtains second feature association information between the target network flows sent to each client based on the two-dimensional convolutional layer in the convolutional neural network for the target network flows belonging to the same network flow generation time period.

[0066] Next, the multi-task processing module of the edge router obtains the first feature correlation information between the target network flows sent to the same client based on the one-dimensional convolutional layer in the convolutional neural network in accordance with the time sequence of the network flow generation time period of the target network flow, and obtains the second feature correlation information between the target network flows sent to each client based on the two-dimensional convolutional layer in the convolutional neural network for the target network flows belonging to the same network flow generation time period.

[0067] Specifically, Figure 4 The feature mining module shown includes CNN Block and LSTM Block, which jointly perform the work of spatiotemporal information extraction. After the network traffic of each client is input into the network traffic attack detection model as three-dimensional input data, it is first processed by CNN Block, which is dedicated to exploring the association of features on a single client in a single time step (first feature association information) and the association of features between different clients (second feature association information).

[0068] CNN Block processes the network traffic data received by the client in each time step in chronological order. Considering the different granularity requirements for spatial information in the three tasks of attack detection, attack location and attack containment, the idea of ​​feature pyramid is adopted in CNN Block, and three convolution branches with different structures are set up to obtain high-dimensional hidden spatial features of different granularity contained in the data using different receptive fields and convolution kernel numbers. In these paths, one-dimensional convolution layer Conv 1D and two-dimensional convolution layer Conv 2D are used as basic units, respectively. One-dimensional convolution uses the client dimension N as the processing unit, and processes one row of the input data Input Data each time, that is, the network traffic of the same client in the current time step (time period), which can be expressed as:

[0069] Hidden Vector i =Conv1D(Input Data[i,:]),i=1,2,…,N;

[0070] After processing the data of all clients row by row, each hidden vector Hidden Vector obtained is recombined into a two-dimensional matrix Hidden Matrix according to the processing order, which can be expressed as:

[0071] Hidden Matrix=[Hidden Vector1,…,Hidden Vector N ] T ;

[0072] The two-dimensional convolution focuses on exploring the hidden correlations between different client traffic. The first dimension of each two-dimensional convolution kernel is set to N. The two-dimensional convolution in branch one (P1) directly uses the input data as input, and the processing results of the one-dimensional convolution are used as input in branches two (P2) and three (P3). The last three branches and the original data are connected after flattening to generate a high-dimensional feature vector of the network traffic of client i at time t.

[0073]

[0074] Next, LSTM Block is used to further extract the fused spatiotemporal features across the time dimension. LSTM Block has L layers, each with T neurons, and two memories C are maintained in each neuron. n and H n . Among them, H n Represents the hidden state of the neuron, which is used to represent the content currently memorized in the neuron; Cn Represents the neuron state and is used to mark the importance of different regions of the hidden state during the forward propagation process. The feature vector extracted by CNN is used as the serialized input of LSTM Block and can be expressed as:

[0075]

[0076] After Sequence Input is passed into LSTM Block, the C value of the last neuron in the Lth layer is obtained. n With H n , the two have the same dimension, and the two are stacked to obtain the representation matrix of the fusion features contained in the sample:

[0077] Spatiotemporal Feature i =[C n H n ] T

[0078] Finally, the result is passed to the next module.

[0079] Step 203: When the multi-task processing module of the edge router detects that the first feature association information and / or the second feature association information has no association dependency based on the long short-term memory network, there is an attack on the target network traffic.

[0080] Step 204: When the multi-task processing module of the edge router detects that the first feature association information and / or the second feature association information have an associated dependency based on the long short-term memory network, there is no attack on the target network traffic, wherein the network traffic attack detection model is established based on a convolutional neural network and a long short-term memory network, and the convolutional neural network includes a one-dimensional convolutional layer and a two-dimensional convolutional layer. The network traffic attack detection model is trained based on a cross-entropy loss function. When the network traffic of the client is detected to be under attack during the training of the network traffic attack detection model, the loss is calculated based on the cross-entropy loss function.

[0081] Next, when the multi-task processing module of the edge router detects that the first feature association information and / or the second feature association information do not have association dependency based on the long short-term memory network, the target network traffic has an attack. When the multi-task processing module of the edge router detects that the first feature association information and / or the second feature association information do not have association dependency based on the long short-term memory network, the target network traffic does not have an attack. To this end, by complexly coupling the two neural network structures of CNN and LSTM in a multi-level manner, different sizes of convolution kernels are deployed on different branches to extract features from shallow to deep layers, so that the potential spatiotemporal features of traffic data can be more deeply mined, thereby achieving a more accurate detection effect. In particular, the network traffic attack detection model is trained based on the cross entropy loss function. When the network traffic of the client is detected to be attacked during the training of the network traffic attack detection model, the loss is calculated based on the cross entropy loss function. In the process of training the network traffic attack detection model, the cross entropy loss function is used to adapt to multi-classification tasks. In addition, the introduction of a multi-label mutual authentication mechanism can not only reduce the probability of false positive judgment results, but also play a role in the calculation of the loss function. Only when the label indicates that the i-th client is affected by the attack or the model prediction result indicates that the i-th client is affected by the attack, the loss about it in the attack detection vector is further calculated. After the accuracy of the model is trained and tested to meet the standard, the model can be deployed on the router to perform network traffic detection tasks.

[0082] Step 205, when the multi-task processing module of the edge router detects that there is an attack on the target network traffic, the multi-task processing module of the edge router obtains an attack containment solution corresponding to the attack method in a preset attack containment solution library based on the attack method of the target network traffic under attack.

[0083] Step 206: The multi-task processing module of the edge router performs attack containment based on the attack containment solution corresponding to the target network traffic under attack, and forwards the target network traffic after the attack is contained to the client corresponding to the target network traffic.

[0084] Next, when the multi-task processing module of the edge router detects that the target network traffic has an attack, the multi-task processing module of the edge router obtains an attack containment plan corresponding to the attack mode based on the attack mode of the target network traffic under attack. After the multi-task processing module of the edge router contains the attack of the target network traffic based on the obtained attack containment plan, the target network traffic after the attack is contained is forwarded to the client corresponding to the target network traffic.

[0085] Specifically, a hierarchical forward propagation structure is designed in the multi-task processing module, and three output heads are set to output the attack detection vector V D, attack positioning vector V P and select the containment solution vector V C . From top to bottom, they are: the first layer, the attack detection task layer composed of Inception Block 1 and Output Block 1; the second layer, the attack location task layer composed of I B2 and I B3; the third layer, the attack containment task layer composed of I B3 and OB3. In the forward transmission process, I B1 receives the feature matrix (composed of the first feature association information and the second feature association information) output by the feature mining module, and passes its output to OB1 and I B2 after processing, where OB1 is responsible for generating the attack detection vector. After processing, I B2 passes the result to OB2 and I B3, and OB2 is responsible for generating the attack location vector. Finally, I B3 passes its own processing result to OB3, and OB3 generates the attack containment scheme selection vector.

[0086] Each Inception Block has the same structure and configuration except for the different number of channels of input data and output data. Inception Block contains four branches. There is only one convolution layer on the first and fourth branches, and two convolution layers on the third and fourth branches. In the first branch, a maximum pooling layer with a receptive field size of 2 is connected in series before the convolution layer. In addition, in order to expand the receptive field, dilated convolution is used in the second convolution layer of the third branch. In the four branches, although different convolution or pooling operations are used, it is necessary to ensure that the processing results obtained by each branch have the same length and width, so that the processing results of all branches can be superimposed in the channel dimension. Inception Block can extract features at different levels by running convolution kernels of different sizes in parallel, and the convolution layers contained in each branch usually have convolution kernels of different sizes and different depths. In Output Block, one-dimensional average pooling, flattening, and full connection are used in sequence to map the output of each Inception Block to the output dimension of the corresponding task.

[0087] By introducing a scenario where multiple clients work together in the network, the network traffic detection problem is divided into three subtasks: detecting whether there is an attack, locating the attacked client, and selecting a containment plan. Since the complexity of the three tasks is gradually increasing, the multi-level model is used to mine data features from shallow to deep. Through the shared feature mining layer and hierarchical output, prediction results are generated for the three subtasks respectively, thereby realizing a multi-task learning algorithm. That is, only one model is used to achieve multi-task goals. The model structure is designed to extract features of each scale according to task requirements, output the results of different tasks respectively, and combine the task relevance to further ensure the accuracy of the results, so as to complete different tasks such as identifying whether there is an attack and locating the attacking device at one time.

[0088] Step 207, when the attack containment solution corresponding to the attack mode is not obtained, the multi-task processing module of the edge router intercepts the target network traffic, and sends the target network traffic feature information corresponding to the intercepted target network traffic to the preset recipient terminal.

[0089] Step 208: If the attack mode for which no attack containment solution is obtained is successfully contained, the successfully contained attack containment solution is added to a preset attack containment solution library, and the target network traffic after the attack is successfully contained is forwarded to the client corresponding to the target network traffic.

[0090] Next, when the attack containment solution corresponding to the attack method is not obtained, the multi-task processing module of the edge router intercepts the target network traffic and sends the target network traffic feature information corresponding to the intercepted target network traffic to the preset recipient terminal. To this end, by intercepting the attacked target network traffic, the client can be protected from attack. If the attack method for which the attack containment solution is not obtained is successfully contained, the successfully contained attack containment solution is added to the preset attack containment solution library, and the target network traffic after the attack is successfully contained is forwarded to the client corresponding to the target network traffic.

[0091] By applying the technical solution of this embodiment, the feature mining module of the edge router obtains the target network traffic to extract the target network traffic feature information, and according to the time sequence of the network traffic generation time period of the target network traffic, sequentially for the target network traffic belonging to the same network traffic generation time period, obtains the first feature association information between the target network traffic sent to the same client based on the one-dimensional convolution layer in the convolutional neural network, and obtains the second feature association information between the target network traffic sent to each client based on the two-dimensional convolution layer in the convolutional neural network. When the multi-task processing module of the edge router detects that the first feature association information and / or the second feature association information do not have association dependency based on the long short-term memory network, the target network traffic has an attack. When the multi-task processing module of the edge router detects that the first feature association information and / or the second feature association information do have association dependency based on the long short-term memory network, the target network traffic does not have an attack. When it is detected that the target network traffic has an attack, based on the attack mode of the target network traffic with the attack, the attack containment scheme corresponding to the attack mode is obtained in the preset attack containment scheme library. After the multi-task processing module of the edge router contains the attack of the target network traffic based on the acquired attack containment scheme, the target network traffic after the attack is contained is forwarded to the client corresponding to the target network traffic. When the attack containment scheme corresponding to the attack method is not obtained, the multi-task processing module of the edge router intercepts the target network traffic and sends the target network traffic feature information corresponding to the intercepted target network traffic to the preset recipient terminal. If the attack method for which the attack containment scheme is not obtained is successfully contained, the successfully contained attack containment scheme is added to the preset attack containment scheme library, and the target network traffic after the attack is successfully contained is forwarded to the client corresponding to the target network traffic.

[0092] To this end, the feature mining module combines one-dimensional convolution with two-dimensional convolution, which greatly enhances the feature mining capability. One-dimensional convolution can extract traffic features in the time dimension, thereby detecting malicious traffic more accurately than the traditional CNN structure; two-dimensional convolution takes into account the feature correlation between clients and can accurately locate the attacked client. At the same time, the feature pyramid technology is used to extract hidden features of different granularities using different receptive fields and convolution kernel numbers, which improves training efficiency and can also mine the deep correlation between features to improve detection accuracy.

[0093] A hierarchical forward propagation structure is designed in the multi-task processing module. The shallow layer of the model can effectively predict some simple and macro results, directly predicting whether it is attacked and whether there is malicious traffic; at the same time, the deeper forward propagation process can reveal precise details, so that the attack location and the selection of containment methods can be achieved at the same time. These tasks share some features in the hierarchical structure. It can be seen that the output of the shallow Inception Block is also used as the input of the deep layer, making the results of more complex tasks more accurate, while also reducing the pressure of model training and improving training efficiency.

[0094] During the training process, since the Inception Block allows the calculation of gradients on multiple branches, this structure can alleviate the gradient vanishing problem on traditional convolutional networks to a certain extent as the network becomes deeper. At the same time, the label authentication mechanism uses the attack location results to assist the detection results, prevent false positives, and help improve accuracy.

[0095] Further, as Figure 1 The specific implementation of the method, the embodiment of the present application provides a network traffic attack detection device, such as Figure 5 As shown, the device comprises:

[0096] The feature extraction module 301 is used to obtain target network traffic and extract target network traffic feature information of the target network traffic;

[0097] An attack detection module 302 is used to perform attack detection on the target network traffic through a network traffic attack detection model and the target network traffic characteristic information, wherein the network traffic attack detection model is established based on a convolutional neural network and a long short-term memory network;

[0098] The attack containment module 303 is used to contain the attack based on the attack containment scheme corresponding to the target network traffic under attack when an attack is detected in the target network traffic, and forward the target network traffic after the attack is contained to the client corresponding to the target network traffic.

[0099] Optionally, the target network traffic feature information includes a client address, a network traffic generation time period, and a feature vector length; the target network traffic corresponds to a plurality of clients; the convolutional neural network includes a one-dimensional convolutional layer and a two-dimensional convolutional layer; and the attack detection module 302 is further used to:

[0100] According to the time sequence of the network traffic generation time period of the target network traffic, first feature correlation information between target network traffic sent to the same client is obtained based on the one-dimensional convolution layer in the convolutional neural network for the target network traffic belonging to the same network traffic generation time period, and second feature correlation information between the target network traffic sent to each client is obtained based on the two-dimensional convolution layer in the convolutional neural network;

[0101] Attack detection is performed on target network traffic based on the long short-term memory network, the first feature association information and the second feature association information.

[0102] Optionally, the attack detection module 302 is further configured to:

[0103] When it is detected based on the long short-term memory network that the first feature association information and / or the second feature association information do not have association dependency, the target network traffic has an attack;

[0104] When it is detected based on the long short-term memory network that the first feature association information and / or the second feature association information have association dependency, there is no attack on the target network traffic.

[0105] Optionally, the attack containment module 303 is further configured to:

[0106] Based on the attack mode of the target network traffic under attack, an attack containment solution corresponding to the attack mode is obtained from a preset attack containment solution library.

[0107] Optionally, the attack containment module 303 is further configured to:

[0108] If the attack method for which no attack containment plan is obtained is successfully contained, the successfully contained attack containment plan is added to the preset attack containment plan library, and the target network traffic after the attack is successfully contained is forwarded to the client corresponding to the target network traffic.

[0109] Optionally, the network traffic attack detection model is trained based on a cross entropy loss function, wherein, when it is detected during the training of the network traffic attack detection model that the network traffic of the client is attacked, the loss is calculated based on the cross entropy loss function.

[0110] Furthermore, the present application embodiment provides another network traffic attack detection device, such as Figure 6 As shown, the device comprises:

[0111] The feature extraction module 401 is used to obtain target network traffic and extract target network traffic feature information of the target network traffic;

[0112] An attack detection module 402 is used to perform attack detection on the target network traffic through a network traffic attack detection model and the target network traffic characteristic information, wherein the network traffic attack detection model is established based on a convolutional neural network and a long short-term memory network;

[0113] The attack containment module 403 is used to contain the attack based on the attack containment scheme corresponding to the target network traffic under attack when an attack is detected in the target network traffic, and forward the target network traffic after the attack is contained to the client corresponding to the target network traffic;

[0114] The traffic interception module 404 is used to intercept the target network traffic when the attack containment solution corresponding to the attack mode is not obtained, and send the target network traffic characteristic information corresponding to the intercepted target network traffic to a preset recipient terminal;

[0115] The traffic forwarding module 405 is used to add the successfully contained attack containment solution to the preset attack containment solution library if the attack mode for which no attack containment solution is obtained is successfully contained, and forward the target network traffic after the attack is successfully contained to the client corresponding to the target network traffic.

[0116] Optionally, the target network traffic feature information includes a client address, a network traffic generation time period, and a feature vector length; the target network traffic corresponds to a plurality of clients; the convolutional neural network includes a one-dimensional convolutional layer and a two-dimensional convolutional layer; and the attack detection module 402 is further used to:

[0117] According to the time sequence of the network traffic generation time period of the target network traffic, first feature correlation information between target network traffic sent to the same client is obtained based on the one-dimensional convolution layer in the convolutional neural network for the target network traffic belonging to the same network traffic generation time period, and second feature correlation information between the target network traffic sent to each client is obtained based on the two-dimensional convolution layer in the convolutional neural network;

[0118] Attack detection is performed on target network traffic based on the long short-term memory network, the first feature association information and the second feature association information.

[0119] Optionally, the attack detection module 402 is further configured to:

[0120] When it is detected based on the long short-term memory network that the first feature association information and / or the second feature association information do not have association dependency, the target network traffic has an attack;

[0121] When it is detected based on the long short-term memory network that the first feature association information and / or the second feature association information have association dependency, there is no attack on the target network traffic.

[0122] Optionally, the attack containment module 403 is further configured to:

[0123] Based on the attack mode of the target network traffic under attack, an attack containment solution corresponding to the attack mode is obtained from a preset attack containment solution library.

[0124] Optionally, the network traffic attack detection model is trained based on a cross entropy loss function, wherein, when it is detected during the training of the network traffic attack detection model that the network traffic of the client is attacked, the loss is calculated based on the cross entropy loss function.

[0125] It should be noted that for other corresponding descriptions of the functional units involved in the network traffic attack detection device provided in the embodiment of the present application, reference can be made to Figure 1 and Figure 3 The corresponding description in the method will not be repeated here.

[0126] Based on the above Figure 1 and Figure 3 The method shown in the embodiment of the present application is accordingly provided with a storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned Figure 1 and Figure 3 The network traffic attack detection method shown.

[0127] Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each implementation scenario of the present application.

[0128] Based on the above Figure 1 and Figure 3 The method shown, and Figure 5 and Figure 6 In order to achieve the above-mentioned purpose, the embodiment of the present application further provides a computer device, which can be a personal computer, a server, a network device, etc. The computer device includes a storage medium and a processor; the storage medium is used to store a computer program; the processor is used to execute the computer program to achieve the above-mentioned Figure 1 and Figure 3 The network traffic attack detection method shown.

[0129] Optionally, the computer device may also include a user interface, a network interface, a camera, a radio frequency (RF) circuit, a sensor, an audio circuit, a WI-FI module, etc. The user interface may include a display screen (Displ ay), an input unit such as a keyboard (Keyboard), etc., and the optional user interface may also include a USB interface, a card reader interface, etc. The network interface may optionally include a standard wired interface, a wireless interface (such as a Bluetooth interface, a WI-FI interface), etc.

[0130] Those skilled in the art will appreciate that the computer device structure provided in this embodiment does not limit the computer device, and may include more or fewer components, or a combination of certain components, or different component arrangements.

[0131] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages and saves the hardware and software resources of the computer device, and supports the operation of information processing programs and other software and / or programs. The network communication module is used to realize communication between the components inside the storage medium, and communication with other hardware and software in the physical device.

[0132] Through the description of the above implementation methods, the technicians in this field can clearly understand that the present application can be implemented by means of software plus necessary general hardware platforms, or by hardware to implement the feature mining module of the edge router to obtain the target network traffic and extract the target network traffic feature information of the target network traffic; the multi-task processing module of the edge router performs attack detection on the target network traffic through the network traffic attack detection model and the target network traffic feature information, wherein the network traffic attack detection model is established based on the convolutional neural network and the long short-term memory network; when the multi-task processing module of the edge router detects that there is an attack on the target network traffic, the attack is contained based on the attack containment scheme corresponding to the target network traffic, and the target network traffic after the attack is contained is forwarded to the client corresponding to the target network traffic. By coupling the convolutional neural network and the long short-term memory network at multiple levels to perform network attack detection, the accuracy of network traffic attack detection can be improved.

[0133] Those skilled in the art will appreciate that the accompanying drawings are only schematic diagrams of a preferred implementation scenario, and the modules or processes in the accompanying drawings are not necessarily necessary for implementing the present application. Those skilled in the art will appreciate that the modules in the devices in the implementation scenario can be distributed in the devices of the implementation scenario according to the description of the implementation scenario, or can be changed accordingly and located in one or more devices different from the present implementation scenario. The modules of the above-mentioned implementation scenario can be combined into one module, or can be further split into multiple submodules.

[0134] The above serial numbers of this application are only for description and do not represent the advantages and disadvantages of the implementation scenarios. The above disclosure is only a few specific implementation scenarios of this application, but this application is not limited to them, and any changes that can be thought of by technicians in this field should fall within the scope of protection of this application.

Claims

1. A network traffic attack detection method, It is characterized in that Applied to an edge router, the edge router is deployed with a feature mining module and a multi-task processing module, and the method includes: The feature mining module of the edge router obtains the target network traffic and extracts the target network traffic feature information of the target network traffic; The multi-task processing module of the edge router performs attack detection on the target network traffic through the network traffic attack detection model and the target network traffic characteristic information, wherein the network traffic attack detection model is established based on a convolutional neural network and a long short-term memory network; When the multi-task processing module of the edge router detects that there is an attack on the target network traffic, it performs attack containment based on the attack containment plan corresponding to the target network traffic under attack, and forwards the target network traffic after the attack is contained to the client corresponding to the target network traffic.

2. The method according to claim 1, It is characterized in that The target network traffic feature information includes a client address, a network traffic generation time period, and a feature vector length; the target network traffic corresponds to a plurality of clients; the convolutional neural network includes a one-dimensional convolutional layer and a two-dimensional convolutional layer; the multi-task processing module of the edge router performs attack detection on the target network traffic through a network traffic attack detection model and the target network traffic feature information, including: The multi-task processing module of the edge router sequentially obtains first feature correlation information between target network flows sent to the same client based on a one-dimensional convolutional layer in a convolutional neural network according to the time sequence of the network flow generation time period of the target network flows, and obtains second feature correlation information between the target network flows sent to each client based on a two-dimensional convolutional layer in the convolutional neural network. The multi-task processing module of the edge router performs attack detection on the target network traffic based on the long short-term memory network, the first feature association information and the second feature association information.

3. The method according to claim 2, It is characterized in that The multi-task processing module of the edge router performs attack detection on the target network traffic based on the long short-term memory network, the first feature association information and the second feature association information, including: When the multi-task processing module of the edge router detects that the first feature association information and / or the second feature association information do not have association dependency based on the long short-term memory network, the target network traffic has an attack; When the multi-task processing module of the edge router detects that the first feature association information and / or the second feature association information have association dependency based on the long short-term memory network, there is no attack on the target network traffic.

4. The method according to claim 1, It is characterized in that Before the multi-task processing module of the edge router performs attack containment based on the attack containment scheme corresponding to the target network traffic where the attack exists, the method further includes: The multi-task processing module of the edge router obtains an attack containment solution corresponding to the attack mode from a preset attack containment solution library based on the attack mode of the target network traffic under attack.

5. The method according to claim 4, It is characterized in that The method further comprises: When the attack containment solution corresponding to the attack mode is not obtained, the multi-task processing module of the edge router intercepts the target network traffic and sends the target network traffic feature information corresponding to the intercepted target network traffic to a preset recipient terminal.

6. The method according to claim 5, It is characterized in that The method further comprises: If the attack method for which no attack containment plan is obtained is successfully contained, the successfully contained attack containment plan is added to the preset attack containment plan library, and the target network traffic after the attack is successfully contained is forwarded to the client corresponding to the target network traffic.

7. The method according to any one of claims 1 to 6, It is characterized in that The network traffic attack detection model is trained based on a cross entropy loss function, wherein when it is detected during the network traffic attack detection model training that the network traffic of the client is attacked, the loss is calculated based on the cross entropy loss function.

8. A network traffic attack detection device, It is characterized in that The device comprises: A feature extraction module is used to obtain target network traffic and extract target network traffic feature information of the target network traffic; An attack detection module, used to perform attack detection on the target network traffic through a network traffic attack detection model and the target network traffic characteristic information, wherein the network traffic attack detection model is established based on a convolutional neural network and a long short-term memory network; The attack containment module is used to contain the attack based on the attack containment scheme corresponding to the target network traffic under attack when an attack is detected in the target network traffic, and forward the target network traffic after the attack is contained to the client corresponding to the target network traffic.

9. A storage medium having a computer program stored thereon, It is characterized in that When the computer program is executed by a processor, the method for detecting network traffic attacks as described in any one of claims 1 to 7 is implemented.

10. A computer device comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, It is characterized in that When the processor executes the computer program, the method for detecting network traffic attacks described in any one of claims 1 to 7 is implemented.

Images