Network information security detection method and device, equipment and storage medium

Abstract

The invention discloses a network information security detection method and device, equipment and a storage medium, and the method comprises the steps: obtaining network flow data, network log data and user behavior data, and carrying out the data preprocessing operation, and obtaining multi-dimensional network time sequence data; according to the multi-dimensional network time sequence data, performing multi-scale feature extraction through a pre-training model to obtain multi-scale feature data, and inputting the multi-scale feature data into a multi-scale normalized stream model to obtain multi-scale normalized stream data; inputting the multi-scale normalized stream data into a hyperspherical support vector machine model, and performing multi-dimensional time series data anomaly classification to obtain classified time series data; according to the time sequence data, abnormal score calculation of the time sequence data is carried out, and a real-time abnormal score of each time sequence data is obtained; and when it is judged that the real-time abnormal score is greater than a preset abnormal threshold value, generating an early warning signal, and sending the early warning signal to a user side. According to the method, real-time detection and accurate early warning of network information security can be realized.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method, device, equipment and storage medium for detecting network information security. Background Art

[0002] With the acceleration of the global informatization process, the network has become an important infrastructure in all fields of society. The information data in the network is constantly increasing. At the same time, the means of network attacks are becoming increasingly complex and diverse, which has brought severe challenges to information security. Effective network security detection methods are needed to prevent data leakage, illegal intrusion, malicious attacks and other incidents. This demand not only includes protection against known threats, but also requires the ability to identify new attacks and zero-day vulnerabilities to ensure the stability of network operation and the confidentiality, integrity and availability of information. Therefore, how to detect and prevent potential security threats in real time in a complex and changing network environment has become a core demand in the current field of network information security.

[0003] Traditional network security detection technologies mainly rely on feature libraries and rule matching methods, such as signature-based intrusion detection systems (IDS), firewalls, and antivirus software. These technologies usually analyze network traffic and data through pre-defined attack feature libraries and detection rules to identify potential attack behaviors.

[0004] Traditional detection methods usually perform offline analysis of network traffic data and lack real-time and dynamic response capabilities. Faced with large-scale and complex network environments, it is difficult to promptly detect and prevent potential network attacks. Summary of the invention

[0005] The present invention provides a method, device, equipment and storage medium for detecting network information security, so as to realize real-time detection and accurate early warning of network information security.

[0006] In a first aspect, in order to solve the above technical problems, the present invention provides a method for detecting network information security, comprising:

[0007] Obtain network traffic data, network log data, and user behavior data;

[0008] Performing data preprocessing operations according to the network traffic data, the network log data, and the user behavior data to obtain processed multi-dimensional network time series data;

[0009] According to the multi-dimensional network time series data, multi-scale feature extraction is performed through a pre-trained model to obtain multi-scale feature data;

[0010] Inputting the multi-scale feature data into a multi-scale normalized flow model to obtain multi-scale normalized flow data;

[0011] Inputting the multi-scale normalized flow data into a hypersphere support vector machine model to perform multi-dimensional time series data anomaly classification to obtain classified time series data;

[0012] Calculate the abnormality score of the time series data according to the time series data to obtain a real-time abnormality score for each time series data;

[0013] When it is determined that the real-time anomaly score is greater than a preset anomaly threshold, a warning signal is generated and sent to the user terminal.

[0014] As an optional implementation manner, performing data preprocessing operations according to the network traffic data, the network log data, and the user behavior data to obtain processed multi-dimensional network time series data includes:

[0015] Performing data denoising according to the network traffic data, the network log data and the user behavior data to obtain smoothed network data;

[0016] Performing data standardization processing according to the smoothed network data to obtain standard network data;

[0017] According to the standard network data, sliding window processing is performed to obtain processed multi-dimensional network time series data.

[0018] As an optional implementation, the multi-scale feature extraction is performed through a pre-trained model according to the multi-dimensional network time series data to obtain multi-scale feature data, including:

[0019] According to the multi-dimensional network time series data, the features of the spatial dimension are extracted by a convolutional neural network to obtain network spatial features;

[0020] According to the multi-dimensional network time series data, extracting the characteristics of the time dimension through a gated recurrent unit to obtain a network time feature;

[0021] A multi-scale convolution operation is performed according to the network spatial characteristics and the network temporal characteristics to obtain multi-scale feature data.

[0022] As an optional implementation manner, the step of inputting the multi-scale feature data into a multi-scale normalized flow model to obtain multi-scale normalized flow data includes:

[0023] Performing a scale unification operation according to the multi-scale feature data to obtain unified scale data;

[0024] Performing a reversible mapping operation on the unified scale data to obtain low-dimensional feature data;

[0025] According to the unified scale data, a multi-scale data enhancement operation is performed to obtain enhanced distribution data;

[0026] A multi-distribution fusion operation is performed according to the low-dimensional feature data and the enhanced distribution data to obtain multi-scale normalized flow data.

[0027] As an optional implementation, the calculation formula of the reversible mapping operation is:

[0028]

[0029] Wherein, x represents the input unified scale data, such as the network traffic data, the network log data and the user behavior data obtained by the scale unification operation; z represents the latent space data after the transformation by the multi-scale normalized flow model; f(x) represents the reversible mapping function of the normalized flow model; f -1 (z) represents the inverse operation of the mapping, that is, mapping the representation z of the latent space back to the input space x; g n Represents the nth layer mapping operation of the flow model, which is usually a reversible affine transformation; Indicates g n The corresponding inverse transformation.

[0030] As an optional implementation manner, the performing of multi-scale data enhancement operation according to the unified-scale data to obtain enhanced feature data includes:

[0031] Based on the unified scale data, a probability density estimation of the data distribution is performed to obtain probability distribution data;

[0032] According to the probability distribution data, a layer-by-layer normalization operation is performed to obtain enhanced distribution data;

[0033] The calculation formula of the probability density estimate is as follows:

[0034]

[0035] Wherein, x represents the input unified scale data, such as the network traffic data, the network log data and the user behavior data obtained by the scale unification operation; z represents the latent space data converted by the multi-scale normalized flow model; f(x) represents the reversible mapping function of the normalized flow model; p(z) represents the probability density of z in the latent space, and it is generally assumed that z obeys a simple known distribution, such as the standard normal distribution; Represents the determinant of the Jacobian matrix, which is used to describe the change in the feature space volume during the mapping process.

[0036] As an optional implementation, the calculation formula of the multi-distribution fusion operation is:

[0037]

[0038] Among them, pfus e (x) represents the fused multi-scale normalized flow data; p i (x) represents the probability distribution of the i-th feature dimension; α i Denotes each distribution p i (x) is the weight parameter used to adjust the contribution of each distribution in the fusion process; n is the number of distributions that need to be fused.

[0039] As an optional implementation, the multi-scale normalized flow data is input into a hypersphere support vector machine model to perform multi-dimensional time series data anomaly classification to obtain classified time series data, including:

[0040] According to the multi-scale normalized flow data, a hypersphere is constructed in a feature space to obtain hypersphere data;

[0041] According to the multi-scale normalized flow data and the hypersphere data, a data projection operation is performed and the distance between the data point and the sphere center is calculated to obtain sphere center distance data;

[0042] According to the spherical center distance data, multi-dimensional time series data anomaly classification is performed to obtain classified time series data.

[0043] As an optional implementation, performing anomaly score calculation of the time series data according to the time series data to obtain a real-time anomaly score for each time series data point includes:

[0044] According to the time series data, the mean of the normal time series data is calculated to obtain a normal center point;

[0045] According to the time series data and the normal center point, the Euclidean distance between each time series data and the normal center point is calculated to obtain the deviation distance;

[0046] According to the deviation distance, an abnormality score calculation of the time series data is performed to obtain a real-time abnormality score of each time series data.

[0047] In a second aspect, the present invention provides a network information security detection device, comprising:

[0048] A data acquisition module, used to acquire network traffic data, network log data and user behavior data;

[0049] A data preprocessing module, used to perform data preprocessing operations according to the network traffic data, the network log data and the user behavior data to obtain processed multi-dimensional network time series data;

[0050] A feature extraction module, used to extract multi-scale features through a pre-trained model according to the multi-dimensional network time series data to obtain multi-scale feature data;

[0051] A multi-scale normalized flow module, used for inputting the multi-scale feature data into a multi-scale normalized flow model to obtain multi-scale normalized flow data;

[0052] A hypersphere support vector machine module, used for inputting the multi-scale normalized flow data into a hypersphere support vector machine model, performing multi-dimensional time series data anomaly classification, and obtaining classified time series data;

[0053] An anomaly assessment module, used to calculate an anomaly score of the time series data according to the time series data, and obtain a real-time anomaly score for each time series data;

[0054] The abnormality warning module is used to generate a warning signal when it is determined that the real-time abnormality score is greater than a preset abnormality threshold, and send the warning signal to the user end.

[0055] In a third aspect, the present invention further provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the network information security detection methods described above.

[0056] Compared with the prior art, the present invention has the following beneficial effects:

[0057] The present invention provides a method for detecting network information security, comprising: acquiring network flow data, network log data and user behavior data; performing data preprocessing operations according to the network flow data, the network log data and the user behavior data to obtain processed multi-dimensional network time series data; performing multi-scale feature extraction through a pre-training model according to the multi-dimensional network time series data to obtain multi-scale feature data; inputting the multi-scale feature data into a multi-scale normalized flow model to obtain multi-scale normalized flow data; inputting the multi-scale normalized flow data into a hypersphere support vector machine model to perform multi-dimensional time series data anomaly classification to obtain classified time series data; performing anomaly score calculation of the time series data according to the time series data to obtain a real-time anomaly score of each time series data; when it is determined that the real-time anomaly score is greater than a preset anomaly threshold, generating an early warning signal, and sending the early warning signal to a user end. In the present invention, multi-scale feature extraction is performed through a pre-trained model, and a multi-scale normalized flow model is combined to perform deep feature analysis. A hypersphere support vector machine (QSSVM) model is used to classify the normalized multi-scale data, which can accurately identify abnormal behaviors in multi-dimensional space and improve the accuracy and real-time performance of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 It is a flow chart of a method for detecting network information security provided by an embodiment of the present invention;

[0059] Figure 2 It is a schematic diagram of a multi-scale normalized flow model processing flow provided by an embodiment of the present invention;

[0060] Figure 3 The present invention provides a flow chart of a device for detecting network information security. DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] Reference Figure 1 The first embodiment of the present invention provides a method for detecting network information security, comprising the following steps:

[0063] S11, obtaining network traffic data, network log data and user behavior data;

[0064] S12, performing data preprocessing operations according to the network traffic data, the network log data and the user behavior data to obtain processed multi-dimensional network time series data;

[0065] S13, performing multi-scale feature extraction through a pre-trained model according to the multi-dimensional network time series data to obtain multi-scale feature data;

[0066] S14, inputting the multi-scale feature data into a multi-scale normalized flow model to obtain multi-scale normalized flow data;

[0067] S15, inputting the multi-scale normalized flow data into a hypersphere support vector machine model to perform multi-dimensional time series data anomaly classification to obtain classified time series data;

[0068] S16, calculating anomaly scores of the time series data according to the time series data to obtain real-time anomaly scores of each time series data;

[0069] S17, when it is determined that the real-time abnormality score is greater than a preset abnormality threshold, a warning signal is generated and sent to a user terminal.

[0070] In step S11, network traffic data, network log data and user behavior data are obtained.

[0071] It should be noted that network traffic data, network log data and user behavior data are very critical basic data sources in the process of network information security detection. Network traffic data usually includes data packets, session information, etc., which can reflect the actual communication situation in the network. It is an important basis for detecting abnormal traffic and attack behavior in the network. By analyzing the traffic data, abnormally high traffic or suspicious communication patterns, such as DDoS attacks or data leaks, can be found. Network log data comes from the operation records of network devices (such as routers, firewalls, servers, etc.) and applications, and records information such as users' network access behavior and device operation status. Log data is the main basis for analyzing network events. By comparing historical logs, abnormal access behavior or precursors to equipment failure can be found. User behavior data refers to the user's operation behavior in the network, usually including login records, operation logs, accessed resources, time, etc. These data can help analyze whether the user has abnormal behavior, such as unauthorized access, frequent password attempts or remote logins, thereby improving the detection ability of internal threats and malicious behaviors. These three types of data complement each other, providing multi-dimensional information sources, which help to comprehensively analyze activities and potential threats in the network. Through in-depth analysis of these data, more accurate and intelligent network security monitoring can be achieved, thereby ensuring the security of the entire network system.

[0072] In step S12, data preprocessing operations are performed according to the network traffic data, the network log data, and the user behavior data to obtain processed multi-dimensional network time series data, including:

[0073] Performing data denoising according to the network traffic data, the network log data and the user behavior data to obtain smoothed network data;

[0074] Performing data standardization processing according to the smoothed network data to obtain standard network data;

[0075] According to the standard network data, sliding window processing is performed to obtain processed multi-dimensional network time series data.

[0076] Among them, data denoising is to remove noise information in network data, such as communication interference, packet loss, abnormal signals, etc., based on network traffic data, network log data and user behavior data. By using filtering algorithms or other denoising methods, such as wavelet denoising, Kalman filtering, etc., unnecessary data fluctuations and noise can be effectively removed to obtain smooth network data. This step ensures the stability and accuracy of the data in the subsequent processing process. Exemplarily, in an embodiment of the present invention, Kalman filtering is used to implement the data denoising process. Of course, other denoising methods can also be adopted according to different actual application situations, and the present invention is not limited to this.

[0077] It should be noted that data standardization is a preprocessing technique for unifying the dimensions of different feature data, and its main purpose is to scale the numerical range of each feature to the same scale, usually within [0, 1] or other fixed ranges. Standardization is particularly suitable for data modeling and analysis when the range of feature values ​​varies greatly. Data standardization can use Z-score standardization or minimum and maximum normalization methods to map data of different scales to the same range. This step can effectively balance the influence of different features and prevent certain features from dominating the training process of the model due to their large magnitude, thereby obtaining standardized network data. Exemplarily, the normalization algorithm used in the present invention is the Z-score normalization algorithm. Of course, depending on the actual application situation, the normalization algorithm can also use the minimum-maximum normalization algorithm, the nonlinear normalization algorithm, etc., and the present invention is not limited to this.

[0078] It is worth noting that the sliding window technology segments the network traffic data, log data, and user behavior data by setting a time window of a certain length to generate continuous data blocks with time association. This method can extract the local features of time series data, which is helpful for analyzing the time series change trend in the network and capturing potential abnormal behaviors, and obtaining processed multi-dimensional network time series data. Among them, the choice of sliding window size has an important impact on the accuracy and efficiency of the detection results. If the window size is too large, it may cause a lag in anomaly detection; if the window is too small, some potential attack modes may be missed. Therefore, the window size should be dynamically adjusted according to the specific application scenario to improve the effectiveness of data analysis and anomaly detection. Exemplarily, in an embodiment of the present invention, the sliding window size is set to 10 byte Of course, depending on the specific application scenario, the sliding window size can also be set to 5, 20 byte The present invention is not limited to this.

[0079] In step S13, the multi-scale feature extraction is performed based on the multi-dimensional network time series data through a pre-trained model to obtain multi-scale feature data, including:

[0080] According to the multi-dimensional network time series data, the features of the spatial dimension are extracted by a convolutional neural network to obtain network spatial features;

[0081] According to the multi-dimensional network time series data, extracting the characteristics of the time dimension through a gated recurrent unit to obtain a network time feature;

[0082] A multi-scale convolution operation is performed according to the network spatial characteristics and the network temporal characteristics to obtain multi-scale feature data.

[0083] Among them, the pre-trained model is a deep learning model that has been pre-trained on a large data set. After training with a large amount of data, it can learn a wide range of common features. Pre-trained models are usually applied to problems in specific fields, especially when data is limited or training resources are insufficient. The pre-trained model has learned effective feature expressions from a large amount of data. In network information security, the pre-trained model can learn the spatiotemporal features of network data and extract effective spatial and temporal features from it to identify potential network attacks or abnormal behaviors. Since the pre-trained model has been trained on big data in related fields, the use of the pre-trained model can greatly speed up the convergence of the model, reduce training time, and improve the performance of the model. In addition, by using the pre-trained model, the model can be more accurate in smaller data sets or specific tasks with the help of the features learned by the model on large data sets. For example, in network information security detection, the pre-trained model can be used to extract global features of network behavior and improve the accuracy of anomaly detection.

[0084] It should be noted that convolutional neural networks are good at processing local patterns of data. For example, in network traffic data, the convolution layer can capture the spatial dependencies and local patterns between network packets, thereby revealing local correlations at different time points. In the spatial dimension, the convolution layer can effectively extract network features at different scales, such as identifying specific patterns and abnormal behaviors in network packets or data streams. These patterns can help locate potential attack behaviors or abnormal traffic. The gated recurrent unit GRU is a recurrent neural network that can process time series data. It effectively remembers long-term and short-term time dependency information through a gating mechanism to avoid the gradient vanishing problem. In the time dimension, GRU can effectively capture the dynamic changes of network behavior over time, and is particularly suitable for processing long-term network behavior data streams. By extracting features in the time dimension through GRU, the occurrence patterns and trends of abnormal events can be revealed, especially in detecting long-lasting network attacks.

[0085] It is worth noting that multi-scale convolution operation refers to the use of convolution kernels of different scales in the neural network to perform convolution operations on the input data to extract features of different levels and ranges. By using convolution kernels of different sizes (such as 3x3, 5x5, 7x7, etc.), the network can simultaneously extract features on local details and global information. This operation can capture the features of different spatial or temporal dimensions of the data, thereby improving the model's ability to understand complex data patterns. In network information security detection, multi-scale convolution operations can help the model simultaneously capture fine-grained attack features and overall traffic pattern changes in network traffic, thereby improving the accuracy and robustness of anomaly detection. Through this multi-scale feature extraction method, the temporal and spatial correlation of network data can be comprehensively considered, effectively enhancing the model's ability to detect complex network attacks and its ability to perceive multi-dimensional anomalies.

[0086] Reference Figure 2 In step S14, the multi-scale feature data is input into a multi-scale normalized flow model to obtain multi-scale normalized flow data, including:

[0087] S141, performing a scale unification operation according to the multi-scale feature data to obtain unified scale data;

[0088] S142, performing a reversible mapping operation according to the unified scale data to obtain low-dimensional feature data;

[0089] S143, performing a multi-scale data enhancement operation according to the unified-scale data to obtain enhanced distribution data;

[0090] S144, performing a multi-distribution fusion operation according to the low-dimensional feature data and the enhanced distribution data to obtain multi-scale normalized flow data.

[0091] It should be noted that in step S141, the scale unification operation refers to converting features with different scales or units into the same scale when processing the input data, so that subsequent calculations and processing processes can be performed on a unified basis. Specifically, different data features may have different ranges, units or distributions in their original form. Through the scale unification operation, these features can be mapped to the same scale range through standardization, normalization or other transformation methods, so that the model can use these features more efficiently during training or reasoning, avoiding numerical deviations or instabilities caused by different scales. In network information security detection, the scale unification operation helps to standardize multidimensional time series data, so that the model can have consistent performance when processing different feature dimensions, thereby improving the accuracy and performance of the overall detection.

[0092] Wherein, in step S142, the calculation formula of the reversible mapping operation is:

[0093]

[0094] Wherein, x represents the input unified scale data, such as the network traffic data, the network log data and the user behavior data obtained by the scale unification operation; z represents the latent space data after the transformation by the multi-scale normalized flow model; f(x) represents the reversible mapping function of the normalized flow model; f -1 (z) represents the inverse operation of the mapping, that is, mapping the representation z of the latent space back to the input space x; g n Represents the nth layer mapping operation of the flow model, which is usually a reversible affine transformation; Indicates g n The corresponding inverse transformation.

[0095] It is worth noting that the reversible mapping operation refers to mapping high-dimensional data to low-dimensional space through a series of transformations, while ensuring the reversibility of the mapping process, that is, the original high-dimensional data can be accurately restored from the low-dimensional data. The core of this operation is to minimize information loss and ensure that the important features of the original data are retained in the process of reducing the data dimension. Exemplarily, in an embodiment of the present invention, the reversible mapping operation adopts the flow model technology and is implemented by continuous bidirectional transformation (forward transformation is used for dimensionality reduction, and inverse transformation is used for recovery). In network information security detection, the use of reversible mapping operations can effectively compress complex multi-dimensional network traffic features into low-dimensional data to reduce computational complexity, and can be restored when necessary for more accurate anomaly detection and feature analysis. This operation ensures the efficiency and accuracy of data processing.

[0096] In step S143, the multi-scale data enhancement operation is performed according to the unified scale data to obtain enhanced feature data, including:

[0097] Based on the unified scale data, a probability density estimation of the data distribution is performed to obtain probability distribution data;

[0098] According to the probability distribution data, a layer-by-layer normalization operation is performed to obtain enhanced distribution data;

[0099] The calculation formula of the probability density estimate is as follows:

[0100]

[0101] Wherein, x represents the input unified scale data, such as the network traffic data, the network log data and the user behavior data obtained by the scale unification operation; z represents the latent space data converted by the multi-scale normalized flow model; f(x) represents the reversible mapping function of the normalized flow model; p(z) represents the probability density of z in the latent space, and it is generally assumed that z obeys a simple known distribution, such as the standard normal distribution; Represents the determinant of the Jacobian matrix, which is used to describe the change in the feature space volume during the mapping process.

[0102] It should be noted that the multi-scale data enhancement operation includes two steps: probability density estimation and layer-by-layer normalization. The probability density estimation step is used to estimate the probability distribution of data of different scales, model the distribution of data through statistical methods, and determine the probability of occurrence of each eigenvalue at different scales. This helps to identify abnormal data points, because abnormal points usually have lower density values ​​in the probability distribution. Through accurate probability density estimation, the model can effectively distinguish between normal and abnormal data patterns and improve the accuracy of detection. The layer-by-layer normalization step ensures that different features are of the same numerical magnitude by normalizing each layer of multi-scale data. Layer-by-layer normalization can avoid the adverse effects of the order of magnitude difference of eigenvalues ​​on the model learning process, while enhancing the stability and robustness of the model when processing data of different scales. This step usually adjusts the data to a uniform range through a standardized or normalized formula to ensure that the model can better utilize these enhanced feature data in subsequent multi-distribution fusion operations.

[0103] In step S144, the calculation formula of the multi-distribution fusion operation is:

[0104]

[0105] Among them, pfus e (x) represents the fused multi-scale normalized flow data; p i (x) represents the probability distribution of the i-th feature dimension; α i Denotes each distribution p i (x) is the weight parameter used to adjust the contribution of each distribution in the fusion process; n is the number of distributions that need to be fused.

[0106] It should be noted that the multi-distribution fusion operation is to fuse the data distributions of multiple different feature dimensions in a weighted manner to form a comprehensive probability distribution, which represents the final multi-scale normalized stream data. In this operation, the probability distribution p of each feature dimension is i (x) according to its weight parameter α i To adjust its contribution to the overall distribution. By weighting each distribution by power and then multiplying them, we finally get the fused distribution pfuse (x), which ensures that the influence of different feature dimensions can be dynamically adjusted during the fusion process. The core role of the multi-distribution fusion operation is to integrate the information of multiple feature dimensions to generate a unified probability model. This model can more accurately represent the overall data distribution, help capture cross-dimensional correlation features during anomaly detection, and improve the detection ability of complex network behaviors and potential threats. In addition, the weight parameter α i This makes the operation flexible and can adaptively adjust the contribution of each distribution according to the importance of different features, further improving the detection accuracy.

[0107] In step S15, the multi-scale normalized flow data is input into a hypersphere support vector machine model to perform multi-dimensional time series data anomaly classification to obtain classified time series data, including:

[0108] According to the multi-scale normalized flow data, a hypersphere is constructed in a feature space to obtain hypersphere data;

[0109] According to the multi-scale normalized flow data and the hypersphere data, a data projection operation is performed and the distance between the data point and the sphere center is calculated to obtain sphere center distance data;

[0110] According to the spherical center distance data, multi-dimensional time series data anomaly classification is performed to obtain classified time series data.

[0111] Among them, in machine learning, feature space refers to the high-dimensional space to which the original data is mapped through some transformation (such as kernel function). In this space, data points can be more easily distinguished by linear or nonlinear models. Through the kernel function, the original data can be mapped to a high-dimensional feature space, so that the nonlinear relationship of the data in the original space becomes linearly separable in the feature space. In high-dimensional space, a hypersphere is a geometric shape, similar to a circle in two-dimensional space or a ball in three-dimensional space. The center of the hypersphere is a certain center point of all data points in the feature space (such as the mean point), and the radius is determined according to the distance between the data point and the center point. In the feature space, a hypersphere is constructed by calculating the center and radius of the data point so that the normal data point is contained inside the hypersphere as much as possible. The sphere center distance refers to the distance between the data point and the center point of the hypersphere in the feature space. This distance can be used to measure the degree of deviation of the data point from the normal data distribution.

[0112] It should be noted that the hypersphere support vector machine is a support vector machine model based on hypersphere geometry. Unlike the traditional support vector machine (SMM), the hypersphere support vector machine distinguishes normal data from abnormal data by constructing a hypersphere in the feature space. The hypersphere support vector machine is mainly used for anomaly detection and classification tasks, especially in multidimensional time series data. It can effectively process multidimensional time series data, identify abnormal points that deviate from the normal data distribution, and has good robustness and classification performance.

[0113] In step S16, the abnormality score calculation of the time series data is performed according to the time series data to obtain a real-time abnormality score for each time series data point, including:

[0114] According to the time series data, the mean of the normal time series data is calculated to obtain a normal center point;

[0115] According to the time series data and the normal center point, the Euclidean distance between each time series data and the normal center point is calculated to obtain the deviation distance;

[0116] According to the deviation distance, an abnormality score calculation of the time series data is performed to obtain a real-time abnormality score of each time series data.

[0117] It should be noted that the normal center point is obtained by calculating the mean value of normal time series data. The normal center point represents the center position of normal data and is used to subsequently calculate the degree of deviation of each time series data point from the normal data center. The deviation distance is obtained by calculating the Euclidean distance between each time series data point and the normal center point. The deviation distance is used to measure the degree of deviation of each time series data point from the normal data center. The larger the deviation distance, the more the data point deviates from the normal data distribution. The real-time anomaly score is calculated based on the deviation distance. The real-time anomaly score is used to quantify the degree of anomaly of each time series data point. The higher the score, the more likely the data point is an anomaly. These steps work together to effectively identify anomalies that deviate from the normal data distribution and provide a real-time anomaly score for each time series data point to help users discover and handle anomalies in a timely manner.

[0118] In step S17, when it is determined that the real-time abnormality score is greater than the preset abnormality threshold, a warning signal is generated and sent to the user terminal.

[0119] It should be noted that the process of generating early warning signals is to identify potential network security threats in a timely manner. By calculating the real-time anomaly score of each time series data, the system can dynamically monitor abnormal behavior in the network. When the anomaly score exceeds the preset threshold, it means that the system has detected a possible security threat, such as a network attack, data leakage, or other abnormal activity. At this point, the system will immediately generate an early warning signal. The early warning signal will contain detailed information about the abnormal behavior, such as the anomaly score, the timestamp of the abnormal event, the associated data characteristics, etc., to ensure that the user end can quickly take corresponding protective measures. This operation improves the response speed of the detection system through a real-time feedback mechanism, reduces the time that potential threats stay in the system, and thus improves the overall level of protection of network information security.

[0120] Among them, the preset abnormal threshold is a reference value set by the system when performing abnormal detection, which is used to determine whether the network behavior or data is abnormal. Specifically, the abnormal score quantifies the degree of abnormality of each time series data. When the score exceeds the preset threshold, the system will consider the current behavior or data to have abnormal characteristics, thereby triggering an early warning signal. The setting of the preset abnormal threshold is usually optimized and adjusted based on historical data, system security requirements, and specific application scenarios. A low threshold may lead to a high false alarm rate (i.e., normal behavior is mistaken for abnormality), while a high threshold may lead to missed alarms (i.e., the real abnormality is not detected in time). Therefore, it is very important to reasonably set the abnormal threshold to balance the sensitivity and accuracy of detection, ensuring that the system can respond quickly to potential threats and avoid unnecessary false alarm warnings. Exemplarily, in an embodiment of the present invention, the preset abnormal threshold is set to 80. When the real-time abnormal score is greater than the preset abnormal threshold, the server will generate an early warning signal and send it to the user end. Of course, according to different actual application scenarios, the preset abnormal threshold can also be set to 75, 90, etc., and the present invention is not limited to this.

[0121] Reference Figure 3 The second embodiment of the present invention provides a network information security detection device, including:

[0122] A data acquisition module, used to acquire network traffic data, network log data and user behavior data;

[0123] A data preprocessing module, used to perform data preprocessing operations according to the network traffic data, the network log data and the user behavior data to obtain processed multi-dimensional network time series data;

[0124] A feature extraction module, used to extract multi-scale features through a pre-trained model according to the multi-dimensional network time series data to obtain multi-scale feature data;

[0125] A multi-scale normalized flow module, used for inputting the multi-scale feature data into a multi-scale normalized flow model to obtain multi-scale normalized flow data;

[0126] A hypersphere support vector machine module, used for inputting the multi-scale normalized flow data into a hypersphere support vector machine model, performing multi-dimensional time series data anomaly classification, and obtaining classified time series data;

[0127] An anomaly assessment module, used to calculate an anomaly score of the time series data according to the time series data, and obtain a real-time anomaly score for each time series data;

[0128] The abnormality warning module is used to generate a warning signal when it is determined that the real-time abnormality score is greater than a preset abnormality threshold, and send the warning signal to the user end.

[0129] It should be noted that a network information security detection device provided in an embodiment of the present invention is used to execute all process steps of a network information security detection method in the above embodiment, and the working principles and beneficial effects of the two correspond one to one, so they will not be repeated.

[0130] In summary, the present invention provides a method for detecting network information security, including: acquiring network traffic data, network log data and user behavior data; performing data preprocessing operations according to the network traffic data, the network log data and the user behavior data to obtain processed multi-dimensional network time series data; performing multi-scale feature extraction through a pre-trained model according to the multi-dimensional network time series data to obtain multi-scale feature data; inputting the multi-scale feature data into a multi-scale normalized flow model to obtain multi-scale normalized flow data; inputting the multi-scale normalized flow data into a hypersphere support vector machine model to perform multi-dimensional time series data anomaly classification to obtain classified time series data; performing anomaly score calculation of the time series data according to the time series data to obtain a real-time anomaly score of each time series data; when it is determined that the real-time anomaly score is greater than a preset anomaly threshold, generating a warning signal, and sending the warning signal to a user terminal. In the present invention, multi-scale feature extraction is performed through a pre-trained model, and a multi-scale normalized flow model is combined to perform deep feature analysis. A hypersphere support vector machine (QSSVM) model is used to classify the normalized multi-scale data, which can accurately identify abnormal behaviors in multi-dimensional space and improve the accuracy and real-time performance of detection.

[0131] The embodiment of the present invention further provides a terminal device. The terminal device includes: a processor, a memory, and a computer program stored in the memory and executable on the processor, such as a network information security detection program. When the processor executes the computer program, the steps in the above-mentioned network information security detection method embodiments are implemented, such as Figure 1 Alternatively, the processor implements the functions of each module / unit in the above-mentioned system embodiments when executing the computer program.

[0132] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, which are used to describe the execution process of the computer program in the terminal device.

[0133] The terminal device may be a computing device such as a desktop computer, a notebook, a PDA, and a smart tablet. The terminal device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the above components are merely examples of terminal devices and do not constitute a limitation on the terminal device. The terminal device may include more or fewer components than the above components, or may combine certain components, or different components. For example, the terminal device may also include input and output devices, network access devices, buses, etc.

[0134] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the terminal device, and uses various interfaces and lines to connect various parts of the entire terminal device.

[0135] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the terminal device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0136] Wherein, if the module / unit integrated in the terminal device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or system capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0137] It should be noted that the system embodiment described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the system embodiment provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0138] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting network information security, characterized in that: Executed by the server, including: Obtain network traffic data, network log data, and user behavior data; Performing data preprocessing operations according to the network traffic data, the network log data, and the user behavior data to obtain processed multi-dimensional network time series data; According to the multi-dimensional network time series data, multi-scale feature extraction is performed through a pre-trained model to obtain multi-scale feature data; Inputting the multi-scale feature data into a multi-scale normalized flow model to obtain multi-scale normalized flow data; Inputting the multi-scale normalized flow data into a hypersphere support vector machine model to perform multi-dimensional time series data anomaly classification to obtain classified time series data; Calculate the abnormality score of the time series data according to the time series data to obtain a real-time abnormality score for each time series data; When it is determined that the real-time anomaly score is greater than a preset anomaly threshold, a warning signal is generated and sent to the user terminal.

2. The method for detecting network information security according to claim 1, characterized in that: The data preprocessing operation is performed according to the network traffic data, the network log data and the user behavior data to obtain processed multi-dimensional network time series data, including: Performing data denoising according to the network traffic data, the network log data and the user behavior data to obtain smoothed network data; Performing data standardization processing according to the smoothed network data to obtain standard network data; According to the standard network data, sliding window processing is performed to obtain processed multi-dimensional network time series data.

3. The method for detecting network information security according to claim 1, characterized in that: The method of extracting multi-scale features through a pre-trained model according to the multi-dimensional network time series data to obtain multi-scale feature data includes: According to the multi-dimensional network time series data, the features of the spatial dimension are extracted by a convolutional neural network to obtain network spatial features; According to the multi-dimensional network time series data, extracting the characteristics of the time dimension through a gated recurrent unit to obtain a network time feature; A multi-scale convolution operation is performed according to the network spatial characteristics and the network temporal characteristics to obtain multi-scale feature data.

4. The method for detecting network information security according to claim 1, characterized in that: The step of inputting the multi-scale feature data into a multi-scale normalized flow model to obtain multi-scale normalized flow data comprises: Performing a scale unification operation according to the multi-scale feature data to obtain unified scale data; Performing a reversible mapping operation on the unified scale data to obtain low-dimensional feature data; According to the unified scale data, a multi-scale data enhancement operation is performed to obtain enhanced distribution data; A multi-distribution fusion operation is performed according to the low-dimensional feature data and the enhanced distribution data to obtain multi-scale normalized flow data.

5. The method for detecting network information security according to claim 4, characterized in that: The calculation formula of the reversible mapping operation is: Wherein, x represents the input unified scale data, such as the network traffic data, the network log data and the user behavior data obtained by the scale unification operation; z represents the latent space data after the transformation by the multi-scale normalized flow model; f(x) represents the reversible mapping function of the normalized flow model; f -1 (z) represents the inverse operation of the mapping, that is, mapping the representation z of the latent space back to the input space x; g n Represents the nth layer mapping operation of the flow model, which is usually a reversible affine transformation; Indicates g n The corresponding inverse transformation.

6. The method for detecting network information security according to claim 4, characterized in that: The step of performing a multi-scale data enhancement operation according to the unified-scale data to obtain enhanced feature data includes: Based on the unified scale data, a probability density estimation of the data distribution is performed to obtain probability distribution data; According to the probability distribution data, a layer-by-layer normalization operation is performed to obtain enhanced distribution data; The calculation formula of the probability density estimate is as follows: Wherein, x represents the input unified scale data, such as the network traffic data, the network log data and the user behavior data obtained by the scale unification operation; z represents the latent space data converted by the multi-scale normalized flow model; f(x) represents the reversible mapping function of the normalized flow model; p(z) represents the probability density of z in the latent space, and it is generally assumed that z obeys a simple known distribution, such as the standard normal distribution; Represents the determinant of the Jacobian matrix, which is used to describe the change in the feature space volume during the mapping process.

7. The method for detecting network information security according to claim 4, characterized in that: The calculation formula of the multi-distribution fusion operation is: Among them, pfus e (x) represents the fused multi-scale normalized flow data; p i (x) represents the probability distribution of the i-th feature dimension; α i Denotes each distribution p i (x) is the weight parameter used to adjust the contribution of each distribution in the fusion process; n is the number of distributions that need to be fused.

8. The method for detecting network information security according to claim 1, characterized in that: The multi-scale normalized flow data is input into the hypersphere support vector machine model to perform multi-dimensional time series data anomaly classification to obtain classified time series data, including: According to the multi-scale normalized flow data, a hypersphere is constructed in a feature space to obtain hypersphere data; According to the multi-scale normalized flow data and the hypersphere data, a data projection operation is performed and the distance between the data point and the center of the sphere is calculated to obtain the center-of-sphere distance data; According to the spherical center distance data, multi-dimensional time series data anomaly classification is performed to obtain classified time series data.

9. The method for detecting network information security according to claim 1, characterized in that: The step of calculating the abnormality score of the time series data according to the time series data to obtain a real-time abnormality score for each time series data point includes: According to the time series data, the mean of the normal time series data is calculated to obtain a normal center point; According to the time series data and the normal center point, the Euclidean distance between each time series data and the normal center point is calculated to obtain the deviation distance; According to the deviation distance, an abnormality score calculation of the time series data is performed to obtain a real-time abnormality score of each time series data.

10. A network information security detection device, characterized in that: include: A data acquisition module, used to acquire network traffic data, network log data and user behavior data; A data preprocessing module, used to perform data preprocessing operations according to the network traffic data, the network log data and the user behavior data to obtain processed multi-dimensional network time series data; A feature extraction module, used to extract multi-scale features through a pre-trained model according to the multi-dimensional network time series data to obtain multi-scale feature data; A multi-scale normalized flow module, used for inputting the multi-scale feature data into a multi-scale normalized flow model to obtain multi-scale normalized flow data; A hypersphere support vector machine module, used for inputting the multi-scale normalized flow data into a hypersphere support vector machine model, performing multi-dimensional time series data anomaly classification, and obtaining classified time series data; An anomaly assessment module, used to calculate an anomaly score of the time series data according to the time series data, and obtain a real-time anomaly score for each time series data; The abnormality warning module is used to generate a warning signal when it is determined that the real-time abnormality score is greater than a preset abnormality threshold, and send the warning signal to the user end.

Images