Network data leakage monitoring system and method

Abstract

The invention relates to a network data leakage monitoring system and method, and the system comprises a data collection module, a data preprocessing module, an anomaly detection module, a risk assessment module and an alarm module. The data acquisition module is used for acquiring network data from a network data source in real time; the data preprocessing module is used for cleaning and standardizing the acquired network data to obtain preprocessed network data; the anomaly detection module identifies an anomaly mode and calculates a confidence score according to the preprocessed network data by using a pre-trained neural network model; the risk assessment module assesses the potential data leakage risk in real time based on the type of the abnormal mode and the confidence score, and generates a comprehensive risk assessment result; and the alarm module generates and sends alarm information when the comprehensive risk assessment result exceeds a preset threshold value. The system can accurately detect and evaluate the network data leakage risk in real time, and provides effective security alarm.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and in particular to a network data leakage monitoring system and method. Background Art

[0002] In the prior art, network data leakage monitoring systems usually monitor network data through modules such as real-time data collection, data preprocessing, and anomaly detection. These systems use rule matching or simple statistical analysis methods to identify potential abnormal patterns, such as a sudden increase in data transmission volume or frequent access to sensitive data, so as to issue timely alarms when potential data leakage occurs.

[0003] However, there are some major problems in the existing technologies. These methods often rely on predefined rules and thresholds, which are difficult to cope with complex and changing network environments. In addition, traditional statistical analysis and rule matching methods often show low detection accuracy and high false alarm rate when facing advanced persistent threats and zero-day attacks. In addition, the existing systems also lack effective mechanisms in risk assessment, making it difficult to accurately assess the actual risk level of detected abnormal patterns, resulting in insufficient reliability of alarm information.

[0004] Therefore, there is an urgent need for an improved network data leakage monitoring system that can solve the above problems. Summary of the invention

[0005] The present application provides a network data leakage monitoring system and method to improve the reliability of network data leakage monitoring.

[0006] The present application provides a network data leakage monitoring system, comprising: A data collection module is used to collect network data from network data sources in real time; A data preprocessing module is used to clean and standardize the network data collected by the data collection module to obtain preprocessed network data; An anomaly detection module, used to obtain an abnormal pattern of network data and a confidence score of the abnormal pattern based on the pre-processed network data using a pre-trained neural network model, wherein the abnormal pattern includes an abnormal increase in data transmission volume, an abnormal frequency of access to specific sensitive data, an abnormal network connection behavior, and a network behavior matching a known attack pattern; A risk assessment module, which performs real-time assessment of potential data leakage risks based on the type and confidence score of the abnormal pattern to obtain a comprehensive risk assessment result; The alarm module is used to generate and send an alarm message when the comprehensive risk assessment result exceeds a preset threshold. The alarm message includes an abnormal pattern description, risk level and recommended response measures.

[0007] Furthermore, the neural network model used in the anomaly detection module includes an input layer, a feature extraction layer, a feature fusion layer, a graph convolutional network layer, an abnormal pattern recognition layer and an abnormal verification layer; wherein the input layer is used to receive the preprocessed network data; the feature extraction layer includes multiple parallel convolutional neural network sublayers, and the input of each convolutional neural network sublayer is the preprocessed data provided by the input layer; each convolutional neural network sublayer processes the input data to obtain a feature vector; the feature fusion layer is implemented by an attention mechanism, which is used to fuse the feature vectors provided by multiple convolutional neural network sublayers to generate a fused comprehensive feature vector; the graph convolutional network layer is implemented by a graph convolutional network, which is used to process and capture the complex dependencies and topological relationships between the fused comprehensive feature vectors in a non-Euclidean way to generate a high-dimensional feature vector; the abnormal pattern recognition layer is implemented by a recurrent neural network, which is used to perform time series analysis on the high-dimensional feature vector, identify potential abnormal patterns, and assign a preliminary confidence score to each potential abnormal pattern; the abnormal verification layer is implemented by a generative adversarial network, which obtains abnormal patterns and confidence scores according to the potential abnormal patterns and preliminary confidence scores provided by the abnormal pattern recognition layer.

[0008] Furthermore, the feature extraction layer includes the following multiple parallel convolutional neural network sub-layers: The first convolutional neural network sublayer is used to extract short-term traffic features from the input preprocessed network data, including the first convolution layer, the first pooling layer, and the first activation layer; wherein the convolution kernel size used in the first convolution layer is 3×3, and the step size is 1; the pooling kernel size used in the first pooling layer is 2×2, and the step size is 2; the first activation layer uses the ReLU activation function; The second convolutional neural network sublayer is used to extract long-term behavioral features from the input preprocessed network data, including a second convolutional layer, a second pooling layer, and a second activation layer; wherein the convolution kernel size used in the second convolutional layer is 5×5, and the step size is 1; the pooling kernel size used in the second pooling layer is 2×2, and the step size is 2; the second activation layer uses a Leaky ReLU activation function; The third convolutional neural network sublayer is used to extract the frequency characteristics of specific sensitive data access from the input preprocessed network data, including a third convolution layer, a third pooling layer and a third activation layer; wherein the convolution kernel size used in the third convolution layer is 1×1 and the step size is 1; the third pooling layer uses global maximum pooling; and the third activation layer uses a Sigmoid activation function; The fourth convolutional neural network sublayer is used to extract abnormal network connection behavior features from the input preprocessed network data, including a fourth convolutional layer, a fourth pooling layer and a fourth activation layer; wherein the convolution kernel size used in the fourth convolutional layer is 3×3 and the step size is 1; the fourth pooling layer uses random pooling; and the fourth activation layer uses an ELU activation function.

[0009] Furthermore, the feature fusion layer includes a feature weighting module, a feature fusion module and a feature transformation module; wherein the feature weighting module uses a fully connected layer and a Softmax function to calculate the weight of each feature vector to obtain multiple weighted feature vectors; the feature fusion module combines multiple weighted feature vectors in a splicing manner to generate multiple fused preliminary comprehensive feature vectors; the feature transformation module performs a linear transformation on each preliminary comprehensive feature vector through a fully connected layer and a ReLU activation function to obtain a fused comprehensive feature vector.

[0010] Furthermore, the graph convolutional network layer includes a graph construction module, a graph convolution layer and a feature transformation module; wherein the graph construction module is used to construct a graph structure representing the relationship between the comprehensive feature vectors and generate an adjacency matrix; the graph convolution layer is used to perform a convolution operation on the input comprehensive feature vector and the adjacency matrix to generate a preliminary high-dimensional feature vector; the feature transformation module is used to transform the preliminary high-dimensional feature vector output by the graph convolution layer through a fully connected layer and a nonlinear activation function to obtain a high-dimensional feature vector.

[0011] Furthermore, the abnormal pattern recognition layer includes a time series data preprocessing module, a recurrent neural network layer, an abnormal pattern detection module and a recognition output module; wherein the time series data preprocessing module is used to segment the high-dimensional feature vector in time order to form multiple time series segments; the recurrent neural network layer is used to process the time series segments to capture the dependencies and patterns in the time series segments; wherein the recurrent neural network layer includes a first layer of recurrent neural network and a second layer of recurrent neural network, the first layer of recurrent neural network is implemented using long short-term memory units, and the second layer of recurrent neural network is implemented using gated recurrent units; the abnormal pattern detection module detects potential abnormal patterns and assigns preliminary confidence scores based on the output of the recurrent neural network layer; the recognition output module is used to output the detected potential abnormal patterns and the preliminary confidence scores of the potential abnormal patterns.

[0012] Furthermore, the anomaly verification layer includes a generator network, a discriminator network, an anomaly verification module and a verification output module; wherein the generator network is used to generate new feature samples according to potential anomaly patterns; the discriminator network is used to discriminate between the generated new feature samples and the real feature samples, and evaluate their authenticity; the anomaly verification module is used to integrate the results of the generator network and the discriminator network, verify the potential anomaly patterns and assign confidence scores; the verification output module is used to output the verified anomaly patterns and the confidence scores of the anomaly patterns.

[0013] Furthermore, the risk assessment module calculates the comprehensive risk assessment result according to the following formula 1: in, The results of the comprehensive risk assessment; is the total number of abnormal patterns detected; For the Risk weights for each type of abnormal pattern; For the confidence scores of the anomaly patterns; For the A severity score for each abnormal pattern, ranging from 1 to 10, set by the system based on historical data and expert judgment; For the The frequency of an abnormal pattern, which indicates the number of times the pattern is detected within a certain period of time; For the the duration of the abnormal pattern; is a specific threshold used to normalize the The duration of the abnormal pattern.

[0014] Furthermore, the data acquisition module includes: Deep packet inspection engine, used to deeply analyze the content of network data packets and extract traffic information and data packet characteristics; A real-time traffic monitoring unit is used to monitor real-time traffic in the network, including HTTP requests, FTP transfers, email communications, and instant messages; Data mirroring module, used to mirror network data flow in real time without affecting the normal operation of the network for subsequent analysis; The data cache module is used to temporarily store the collected network data so as to quickly access the data before the data preprocessing module performs cleaning and standardization processing.

[0015] The present application provides a network data leakage monitoring method, comprising: Collect network data from network data sources in real time; Cleaning and standardizing the network data collected in the data collection step to obtain pre-processed network data; According to the preprocessed network data, using a pre-trained neural network model, obtaining abnormal patterns of the network data and confidence scores of the abnormal patterns, wherein the abnormal patterns include abnormal increase in data transmission volume, abnormal frequency of access to specific sensitive data, abnormal network connection behavior, and network behavior matching a known attack pattern; Based on the type and confidence score of the abnormal pattern, a real-time assessment of the potential data leakage risk is performed to obtain a comprehensive risk assessment result; When the comprehensive risk assessment result exceeds a preset threshold, an alarm message is generated and sent, and the alarm message includes an abnormal pattern description, a risk level, and suggested countermeasures.

[0016] The beneficial effects of the present application mainly include: (1) The anomaly detection module uses a pre-trained neural network model to accurately identify various abnormal patterns, including abnormal increases in data transmission volume, abnormal access frequencies to specific sensitive data, abnormal network connection behaviors, and behaviors that match known attack patterns. Through the deep learning capabilities of the neural network model, the accuracy and coverage of anomaly detection are significantly improved, reducing false positives and missed negatives. (2) The risk assessment module conducts a comprehensive assessment of potential data leakage risks based on the type and confidence score of the detected abnormal pattern. The real-time assessment function ensures that the system can identify and quantify risks in a timely manner, generate comprehensive risk assessment results, and provide managers with intuitive risk assessment information to facilitate decision-making. (3) When the comprehensive risk assessment results exceed the preset threshold, the alarm module generates and sends an alarm message containing an abnormal pattern description, risk level, and recommended response measures. Multi-level alarms and detailed response suggestions can help security personnel quickly take appropriate defensive measures to reduce the harm of data leakage. (4) The system forms a complete security monitoring chain through the collaborative work of multiple modules, from data collection to anomaly detection, and then to risk assessment and alarm. The professional design and high integration of each module ensure the overall performance and reliability of the system, and can provide continuous and stable security protection in complex and changing network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of a network data leakage monitoring system provided in the first embodiment of the present application.

[0018] Figure 2 This is a flow chart of a network data leakage monitoring method provided in the second embodiment of the present application. DETAILED DESCRIPTION

[0019] Many specific details are described in the following description to facilitate a full understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present application, so the present application is not limited by the specific implementation disclosed below.

[0020] The first embodiment of the present application provides a network data leakage monitoring system. Figure 1 , which is a schematic diagram of the first embodiment of the present application. Figure 1 A network data leakage monitoring system is provided in detail for the first embodiment of the present application.

[0021] The network data leakage monitoring includes a data collection module 101 , a data preprocessing module 102 , an anomaly detection module 103 , a risk assessment module 104 and an alarm module 105 .

[0022] The data collection module 101 is used to collect network data from network data sources in real time.

[0023] The data acquisition module 101 plays a vital role in the network data leakage monitoring system. It is responsible for collecting network data from network data sources in real time to ensure the real-time and accuracy of subsequent analysis. The implementation of the data acquisition module 101 includes the following aspects: First, the data acquisition module 101 uses a deep packet inspection engine to deeply analyze the content of the network data packet. The deep packet inspection engine extracts various characteristic information of the data packet by parsing each network data packet, including but not limited to the source address, destination address, data packet size, transmission protocol, timestamp, etc. These characteristic information provide basic data for subsequent data preprocessing and anomaly detection.

[0024] Secondly, the data acquisition module 101 is equipped with a real-time traffic monitoring unit for monitoring various real-time traffic in the network. The real-time traffic monitoring unit can capture various types of network traffic such as HTTP requests, FTP transmissions, email communications, and instant messages. By capturing these traffic in real time, the system can ensure comprehensive coverage of various possible network activities and avoid potential risks of data leakage.

[0025] In order to ensure that the normal operation of the network is not affected during the collection process, the data collection module 101 also includes a data mirroring module. The data mirroring module can mirror the network data stream in real time without interfering with network communication. The mirrored data stream is copied for subsequent analysis and processing, while the original data stream continues to maintain normal transmission and processing. This non-intrusive data collection method ensures the transparency and security of the system.

[0026] In the data collection process, in order to improve the efficiency of data processing, the data collection module 101 is also provided with a data cache module. The data cache module is used to temporarily store the collected network data so that the data can be quickly accessed and processed when needed. The data cache module adopts an efficient cache strategy, which can effectively manage the cache space and ensure the efficient transmission of data between collection and preprocessing.

[0027] In addition, the implementation of the data acquisition module 101 also takes into account the scalability and adaptability of the system. The module is designed as a configurable structure, allowing users to customize settings according to specific network environments and requirements. For example, users can configure different collection rules and filtering conditions to capture only specific types of network data. This flexibility enables the data acquisition module 101 to adapt to a variety of different application scenarios, thereby improving the practicality of the system.

[0028] The data collection module 101 ensures the real-time, accurate and comprehensive collection of network data from network data sources through the above-mentioned multiple technical means and functional designs, providing a reliable data basis for subsequent data preprocessing, anomaly detection, risk assessment and alarm.

[0029] The data preprocessing module 102 is used to clean and standardize the network data collected by the data collection module to obtain preprocessed network data.

[0030] The data preprocessing module 102 plays a key role in the network data leakage monitoring system. It cleans and standardizes the network data obtained by the data acquisition module 101 to ensure the accuracy and effectiveness of subsequent analysis.

[0031] First, the data preprocessing module 102 includes a data cleaning unit. The main task of this unit is to remove noise data, repair damaged data packets and fill in missing data to ensure the integrity and quality of the data. Noise data is usually irrelevant or misleading information. The cleaning unit will filter and remove these useless data according to predefined rules and filtering conditions. At the same time, for data packets that may be damaged during transmission, the cleaning unit will try to repair or reconstruct these data packets to ensure the accuracy of the data. In addition, for some missing data caused by network jitter or other reasons, the cleaning unit will fill in the missing data through interpolation or other data recovery techniques to make the data set more complete.

[0032] After cleaning is completed, the data preprocessing module 102 also includes a data standardization unit. The function of this unit is to unify data from different sources into a consistent format for subsequent processing and analysis. Standardization processing includes operations such as timestamp synchronization, protocol standardization, and data field alignment. Timestamp synchronization is to ensure that the time records of all data packets are on the same time base, thereby ensuring the timing of the data. Protocol standardization converts data packets of different protocols into a unified representation form for subsequent unified processing. Data field alignment is to unify the field names and field orders of different data sources to ensure that each field has a clear and unified meaning in the data set.

[0033] In addition, the data preprocessing module 102 is also provided with a data deduplication unit for detecting and deleting duplicate data packets to prevent redundant data from affecting subsequent analysis. This process is usually implemented through a hash algorithm or other fast comparison algorithms to ensure efficient identification and deletion of duplicate data packets.

[0034] Another important component is the feature extraction unit, which extracts key features from the cleaned and standardized data. Feature extraction is to convert the original data into more representative and analyzable feature data, including but not limited to packet size, transmission speed, source address and destination address. These features will serve as the basis for pattern recognition and analysis by the subsequent anomaly detection module 103. The feature extraction unit can use a variety of algorithms and techniques, such as principal component analysis (PCA), cluster analysis, etc., to ensure that the extracted features can accurately reflect the nature of the data and the characteristics of abnormal behavior.

[0035] Preprocessed network data includes a variety of features and indicators extracted from network traffic. These data are processed by the data acquisition module and the data preprocessing module to ensure their quality and consistency, thereby providing reliable input for the training and reasoning of the neural network model. Preprocessed network data usually includes the following: 1. Basic network traffic characteristics: Packet Size: The size of each packet in bytes.

[0036] Number of packets: The number of packets captured within a certain time window.

[0037] Transfer Rate: The rate at which data is transferred in bytes per second over a specific period of time.

[0038] Traffic Direction: The direction in which the data packet is transmitted (inbound or outbound).

[0039] 2. Time characteristics: Timestamp: The timestamp of each data packet captured is used to record the arrival time of the data packet.

[0040] Interval: The time interval between consecutive data packets.

[0041] 3. Network protocol characteristics: Transport protocol: The type of transport protocol used by the data packet (such as TCP, UDP, ICMP, etc.).

[0042] Application protocol: The type of application layer protocol used by the data packet (such as HTTP, FTP, DNS, etc.).

[0043] 4. Connection characteristics: Source IP address and port: The source IP address and source port number of the data packet.

[0044] Destination IP address and port: The destination IP address and destination port number of the data packet.

[0045] Connection duration: The duration from when the connection is established to when it is disconnected.

[0046] 5. Content features: HTTP request and response: HTTP request method, URL, response status code, etc.

[0047] DNS query and response: DNS query domain name, response IP address, etc.

[0048] FTP commands and responses: Command and response codes in FTP sessions.

[0049] 6. Statistical characteristics: Packets per Second (PPS): The number of packets received or sent per second.

[0050] Bytes per Second (BPS): The number of bytes received or sent per second.

[0051] Number of sessions: The number of active sessions within a certain time window.

[0052] 7. Behavioral characteristics: Packet arrival pattern: the arrival pattern of the packet, such as burst transmission, periodic transmission, etc.

[0053] Access frequency: The frequency of access to a specific target, such as sensitive data or a specific service.

[0054] 8. Safety-related features: Encryption status: whether the data packet is transmitted encrypted.

[0055] Attack signature: Whether it contains known attack signatures or malicious code fragments.

[0056] This pre-processed network data provides a comprehensive view of network activity, covering everything from basic traffic statistics to advanced protocol analysis.

[0057] Through the collaborative work of the above units, the data preprocessing module 102 can efficiently and accurately process the collected network data, ensure the quality and consistency of the data, and provide a reliable basis for subsequent anomaly detection, risk assessment and alarm generation.

[0058] The anomaly detection module 103 is used to obtain the abnormal pattern of the network data and the confidence score of the abnormal pattern based on the pre-processed network data using a pre-trained neural network model, wherein the abnormal pattern includes an abnormal increase in data transmission volume, an abnormal frequency of access to specific sensitive data, abnormal network connection behavior, and network behavior matching a known attack pattern.

[0059] The anomaly detection module 103 is the core component of the network data leakage monitoring system, which is responsible for detecting abnormal patterns from pre-processed network data and calculating the confidence score of each abnormal pattern. This module uses a pre-trained neural network model to ensure efficient and accurate identification of various potential threats.

[0060] In specific implementation, the anomaly detection module 103 first receives the preprocessed network data provided by the data preprocessing module 102. These data have been cleaned and standardized to ensure the quality and consistency of the input data. After receiving the preprocessed data, the anomaly detection module 103 processes it through a series of neural network layers, which may include convolutional neural networks (CNNs), recurrent neural networks (RNNs) or other deep learning models. These neural network models have been pre-trained with a large amount of historical network data and can identify complex abnormal patterns.

[0061] The first step of the anomaly detection module 103 is to extract features and recognize patterns from the input data through a neural network model. The convolutional layer of the model can identify local features in the data, such as an abnormal increase in the amount of data transmitted, an abnormal frequency of access to specific sensitive data, etc. The convolutional layer scans the data through a filter to extract low-level features, and then performs dimensionality reduction and feature aggregation through a pooling layer. This step can effectively extract important features from the data and reduce the amount of data.

[0062] Next, the features are further processed by a recurrent neural network layer or a long short-term memory network (LSTM) layer to capture time series information and long-term dependencies in the data. This is particularly important for detecting abnormal network connection behaviors such as persistent or network behaviors that match known attack patterns. Through its cyclic structure, the recurrent neural network can remember and utilize the relevant time series information before and after to identify complex abnormal patterns.

[0063] After completing feature extraction and pattern recognition, the anomaly detection module 103 calculates the confidence score of each detected abnormal pattern. The confidence score is calculated by the output layer of the neural network and represents the probability that each abnormal pattern is judged to be a true anomaly. The calculation of the confidence score involves the activation function and the fully connected layer of the neural network. Through these calculation steps, the system can give an accuracy assessment of each abnormal pattern.

[0064] Finally, the anomaly detection module 103 outputs the detected anomaly patterns and their confidence scores. The output anomaly patterns include abnormal increase in data transmission volume, abnormal access frequency of specific sensitive data, abnormal network connection behavior, and network behavior matching known attack patterns. These output results will be passed to the risk assessment module 104 for further analysis and processing.

[0065] Through the above steps, the anomaly detection module 103 can efficiently and accurately detect abnormal patterns in network data and provide a confidence score for each abnormal pattern.

[0066] Furthermore, the neural network model used in the anomaly detection module includes an input layer, a feature extraction layer, a feature fusion layer, a graph convolutional network layer, an abnormal pattern recognition layer and an abnormal verification layer; wherein the input layer is used to receive the preprocessed network data; the feature extraction layer includes multiple parallel convolutional neural network sublayers, and the input of each convolutional neural network sublayer is the preprocessed data provided by the input layer; each convolutional neural network sublayer processes the input data to obtain a feature vector; the feature fusion layer is implemented by an attention mechanism, which is used to fuse the feature vectors provided by multiple convolutional neural network sublayers to generate a fused comprehensive feature vector; the graph convolutional network layer is implemented by a graph convolutional network, which is used to process and capture the complex dependencies and topological relationships between the fused comprehensive feature vectors in a non-Euclidean way to generate a high-dimensional feature vector; the abnormal pattern recognition layer is implemented by a recurrent neural network, which is used to perform time series analysis on the high-dimensional feature vector, identify potential abnormal patterns, and assign a preliminary confidence score to each potential abnormal pattern; the abnormal verification layer is implemented by a generative adversarial network, which obtains abnormal patterns and confidence scores according to the potential abnormal patterns and preliminary confidence scores provided by the abnormal pattern recognition layer.

[0067] The neural network model used in the anomaly detection module includes input layer, feature extraction layer, feature fusion layer, graph convolutional network layer, anomaly pattern recognition layer and anomaly verification layer.

[0068] First, the input layer is designed to receive preprocessed network data. These data come from the data preprocessing module and have been cleaned and standardized to ensure the quality and consistency of the input data. After receiving this data, the input layer passes it to multiple parallel convolutional neural network sublayers.

[0069] The feature extraction layer consists of multiple parallel convolutional neural network sublayers. The input of each convolutional neural network sublayer is the preprocessed network data, and these sublayers process the input data independently. Each sublayer extracts features at different levels through a series of convolution operations. The convolution operation involves scanning the input data with a filter, extracting local features, and then performing dimensionality reduction and feature aggregation through pooling operations. This structure can effectively capture the spatial features in the data and generate a set of feature vectors, one for each convolutional neural network sublayer.

[0070] These feature vectors are then passed to the feature fusion layer. The feature fusion layer uses an attention mechanism to fuse the feature vectors provided by multiple convolutional neural network sublayers. The attention mechanism calculates the importance weight of each feature vector, dynamically adjusts the contribution of each feature vector, and generates a fused comprehensive feature vector. This approach ensures that the most important feature information is retained during the fusion process, improving the quality and robustness of feature representation.

[0071] The fused comprehensive feature vector then enters the graph convolutional network layer. The main function of the graph convolutional network layer is to process and capture the complex dependencies and topological relationships between feature vectors in a non-Euclidean way. The graph convolutional network adopts a graph structure, where nodes represent feature vectors and edges represent the relationship between them. Through a series of graph convolution operations, these feature vectors propagate and aggregate information in the graph structure to generate high-dimensional feature vectors. Graph convolution operations can effectively capture the global relationship and contextual information between feature vectors, further improving the ability of feature representation.

[0072] The high-dimensional feature vector is then passed to the abnormal pattern recognition layer. This layer uses a recurrent neural network (RNN) structure, specifically a long short-term memory network (LSTM) or a gated recurrent unit (GRU). The recurrent neural network processes the temporal information in the high-dimensional feature vector through time series analysis. It is able to capture the temporal dependencies in the data and identify potential abnormal patterns. Each identified abnormal pattern is assigned a preliminary confidence score, indicating the likelihood that the pattern is detected as an abnormality.

[0073] Finally, the anomaly verification layer uses a generative adversarial network (GAN) structure to verify the potential anomaly patterns and preliminary confidence scores provided by the anomaly pattern recognition layer. The generative adversarial network consists of a generator and a discriminator. The generator tries to generate anomaly patterns similar to real data, while the discriminator tries to distinguish between the generated anomaly patterns and real anomaly patterns. Through this adversarial training, the generative adversarial network is able to improve the detection accuracy of anomaly patterns and the reliability of confidence scores. Finally, the anomaly verification layer outputs the verified anomaly pattern and its final confidence score.

[0074] Furthermore, the feature extraction layer includes the following multiple parallel convolutional neural network sub-layers: The first convolutional neural network sublayer is used to extract short-term traffic features from the input preprocessed network data, including the first convolution layer, the first pooling layer, and the first activation layer; wherein the convolution kernel size used in the first convolution layer is 3×3, and the step size is 1; the pooling kernel size used in the first pooling layer is 2×2, and the step size is 2; the first activation layer uses the ReLU activation function; The second convolutional neural network sublayer is used to extract long-term behavioral features from the input preprocessed network data, including a second convolutional layer, a second pooling layer, and a second activation layer; wherein the convolution kernel size used in the second convolutional layer is 5×5, and the step size is 1; the pooling kernel size used in the second pooling layer is 2×2, and the step size is 2; the second activation layer uses a Leaky ReLU activation function; The third convolutional neural network sublayer is used to extract the frequency characteristics of specific sensitive data access from the input preprocessed network data, including a third convolution layer, a third pooling layer and a third activation layer; wherein the convolution kernel size used in the third convolution layer is 1×1 and the step size is 1; the third pooling layer uses global maximum pooling; and the third activation layer uses a Sigmoid activation function; The fourth convolutional neural network sublayer is used to extract abnormal network connection behavior features from the input preprocessed network data, including a fourth convolutional layer, a fourth pooling layer and a fourth activation layer; wherein the convolution kernel size used in the fourth convolutional layer is 3×3 and the step size is 1; the fourth pooling layer uses random pooling; and the fourth activation layer uses an ELU activation function.

[0075] The feature extraction layer includes multiple parallel convolutional neural network sublayers, each of which is responsible for extracting different types of features from the input preprocessed network data. Specifically, these sublayers include the first convolutional neural network sublayer, the second convolutional neural network sublayer, the third convolutional neural network sublayer, and the fourth convolutional neural network sublayer.

[0076] First, the first convolutional neural network sublayer is designed to extract short-term traffic features from preprocessed network data. This sublayer includes the first convolutional layer, the first pooling layer, and the first activation layer. The first convolutional layer uses a convolution kernel of size 3×3 with a step size of 1 to extract local traffic features by scanning the input data. These features are reduced in dimension and aggregated by the first pooling layer, with a pooling kernel size of 2×2 and a step size of 2, which reduces the dimensionality of the data while retaining important features. Subsequently, the first activation layer uses the ReLU activation function to convert the linear output into nonlinearity, enhancing the network's expressiveness and the model's training effect.

[0077] The second convolutional neural network sublayer is designed to extract long-term behavioral features from the preprocessed network data. This sublayer includes the second convolutional layer, the second pooling layer, and the second activation layer. The second convolutional layer uses a 5×5 convolution kernel with a step size of 1 to capture behavioral features over a long period of time through a larger receptive field. The second pooling layer also uses a 2×2 pooling kernel with a step size of 2 for dimensionality reduction. In order to adapt to the complexity of long-term behavioral features, the second activation layer uses the Leaky ReLU activation function, which allows small negative outputs, solves the "dead ReLU" problem of the standard ReLU, and enhances the robustness of the model.

[0078] The third convolutional neural network sublayer is designed to extract the frequency features of specific sensitive data access from the preprocessed network data. This sublayer includes the third convolutional layer, the third pooling layer, and the third activation layer. The third convolutional layer uses a 1×1 convolution kernel with a step size of 1, which is mainly used to extract the features of each data packet without changing the spatial dimension. The third pooling layer uses global maximum pooling to reduce the entire feature map to a single value, which highlights the most significant features. In order to map the output to between 0 and 1, the third activation layer uses the Sigmoid activation function, which is particularly suitable for representing frequency features.

[0079] The fourth convolutional neural network sublayer is designed to extract abnormal network connection behavior features from preprocessed network data. This sublayer includes the fourth convolutional layer, the fourth pooling layer, and the fourth activation layer. The fourth convolutional layer uses a 3×3 convolution kernel with a step size of 1 to extract local features by scanning the input data. The fourth pooling layer uses random pooling, which increases the robustness of the model and prevents overfitting by randomly selecting some pooling units. The fourth activation layer uses the ELU (Exponential Linear Unit) activation function, which can not only reduce the gradient vanishing problem, but also provide higher scalability in negative areas to adapt to complex network connection behavior characteristics.

[0080] Through these parallel convolutional neural network sublayers, the feature extraction layer can extract features of different time scales and types from the preprocessed network data. These features include traffic features in a short period of time, behavior features in a long period of time, frequency features of specific sensitive data access, and abnormal network connection behavior features, providing rich information for subsequent feature fusion and anomaly detection.

[0081] The following is the reference implementation code of the input layer and feature extraction layer in the neural network model. The code uses the popular deep learning framework Keras.

[0082] import tensorflow as tf from tensorflow.keras.layers import Input, Conv2D, MaxPooling2D,GlobalMaxPooling2D, Dense, Flatten, LeakyReLU, ELU, concatenate from tensorflow.keras.models import Model # Input layer, used to receive preprocessed network data # Assume that the input data is a 3D tensor with shape (time step, number of features, 1) input_layer = Input(shape=(None, None, 1), name='input_layer') # The first convolutional neural network sublayer is used to extract traffic features in a short period of time # Includes a convolution layer, a pooling layer and an activation layer conv1 = Conv2D(filters=32, kernel_size=(3, 3), strides=(1, 1),padding='same', name='conv1')(input_layer) pool1 = MaxPooling2D(pool_size=(2, 2), strides=(2, 2), padding='same', name='pool1')(conv1) act1 = tf.keras.layers.ReLU(name='act1')(pool1) # The second convolutional neural network sublayer is used to extract behavioral features over a long period of time # Includes a convolution layer, a pooling layer and an activation layer conv2 = Conv2D(filters=64, kernel_size=(5, 5), strides=(1, 1),padding='same', name='conv2')(input_layer) pool2 = MaxPooling2D(pool_size=(2, 2), strides=(2, 2), padding='same', name='pool2')(conv2) act2 = LeakyReLU(alpha=0.1, name='act2')(pool2) # The third convolutional neural network sublayer is used to extract the frequency characteristics of specific sensitive data access # Includes a convolution layer, a pooling layer and an activation layer conv3 = Conv2D(filters=128, kernel_size=(1, 1), strides=(1, 1),padding='same', name='conv3')(input_layer) pool3 = GlobalMaxPooling2D(name='pool3')(conv3) act3 = tf.keras.layers.Activation('sigmoid', name='act3')(pool3) # The fourth convolutional neural network sublayer is used to extract abnormal network connection behavior features # Includes a convolution layer, a pooling layer and an activation layer conv4 = Conv2D(filters=256, kernel_size=(3, 3), strides=(1, 1),padding='same', name='conv4')(input_layer) # Assume we use a custom random pooling layer class RandomPooling2D(tf.keras.layers.Layer): def __init__(self, pool_size=(2, 2), strides=(2, 2), padding='same', **kwargs): super(RandomPooling2D, self).__init__(**kwargs) self.pool_size = pool_size self.strides = strides self.padding = padding def call(self, inputs): batch, height, width, channels = tf.shape(inputs) pooled_height = height / / self.pool_size[0] pooled_width = width / / self.pool_size[1] pooled = tf.image.random_crop(inputs, [batch, pooled_height,pooled_width, channels]) return pooled pool4 = RandomPooling2D(pool_size=(2, 2), strides=(2, 2), padding='same', name='pool4')(conv4) act4 = ELU(name='act4')(pool4) # Build the model model = Model(inputs=input_layer, outputs=feature_vectors, name='network_data_leakage_detection_model') # Print the model summary model.summary() Furthermore, the feature fusion layer includes a feature weighting module, a feature fusion module and a feature transformation module; wherein the feature weighting module uses a fully connected layer and a Softmax function to calculate the weight of each feature vector to obtain multiple weighted feature vectors; the feature fusion module combines multiple weighted feature vectors in a splicing manner to generate multiple fused preliminary comprehensive feature vectors; the feature transformation module performs a linear transformation on each preliminary comprehensive feature vector through a fully connected layer and a ReLU activation function to obtain a fused comprehensive feature vector.

[0083] The feature fusion layer includes feature weighting module, feature fusion module and feature transformation module. These modules work together to generate a more representative comprehensive feature vector from multiple feature vectors, enhancing the detection capability and accuracy of the system.

[0084] First, the main function of the feature weighting module is to calculate the weight of each feature vector through a fully connected layer and a Softmax function. Specifically, the input feature vector first passes through a fully connected layer, which generates a weight vector. Then, this weight vector is normalized by the Softmax function so that the sum of all weights is 1. This step ensures that the contribution of different feature vectors can be dynamically adjusted according to their importance. In this way, the system can automatically learn and identify which features are more important in detecting data leaks, thereby giving them higher weights.

[0085] Next, the feature fusion module is responsible for combining the weighted feature vectors to generate multiple fused preliminary comprehensive feature vectors. In the specific implementation process, the feature fusion module uses a splicing method to splice all weighted feature vectors in a specific dimension. The splicing operation merges multiple feature vectors into a larger vector, retaining the information of all original features. This method can not only effectively integrate features from different sources, but also enhance the richness of feature representation without losing information.

[0086] Finally, the feature transformation module performs a linear transformation on each preliminary comprehensive feature vector through a fully connected layer and a ReLU activation function. The function of the fully connected layer is to perform a linear transformation on the concatenated preliminary comprehensive feature vectors to generate a new feature representation. After the fully connected layer, the ReLU activation function is used to perform nonlinear processing on the results of the linear transformation. The ReLU activation function can introduce nonlinear factors, improve the expressive power of the model, and solve the gradient vanishing problem. Through this step, the preliminary comprehensive feature vectors are converted into more abstract and high-dimensional comprehensive feature vectors, which will be used for more in-depth analysis in the subsequent graph convolutional network layer and abnormal pattern recognition layer.

[0087] The feature weighting module dynamically adjusts the weight of the feature vector through the fully connected layer and the Softmax function to ensure that important features receive higher attention. The feature fusion module combines the weighted feature vectors in a splicing manner to generate a preliminary comprehensive feature vector. The feature transformation module further linearly transforms the preliminary comprehensive feature vector through the fully connected layer and the ReLU activation function to generate the final comprehensive feature vector. These steps work together to ensure that the feature fusion layer can effectively integrate and enhance feature representation, providing strong support for subsequent anomaly detection.

[0088] The following is the detailed code for implementing the feature fusion layer in the neural network model, including the feature weighting module, feature fusion module, and feature transformation module.

[0089] import tensorflow as tf from tensorflow.keras.layers import Dense, Softmax, Concatenate, ReLU # Example tensor of input feature vectors # Assume there are 4 eigenvectors, each with a length of 128 feature_vector1 = tf.random.normal(shape=(1, 128)) feature_vector2 = tf.random.normal(shape=(1, 128)) feature_vector3 = tf.random.normal(shape=(1, 128)) feature_vector4 = tf.random.normal(shape=(1, 128)) # Feature weighting module # Use the fully connected layer to calculate the weight of each feature vector and normalize it through the Softmax function def weight_features(feature_vector): #Fully connected layer generates weights dense_layer = Dense(units=128, activation=None) weighted_vector = dense_layer(feature_vector) # Calculate the Softmax of the weight vector softmax_layer = Softmax(axis=-1) weighted_vector = softmax_layer(weighted_vector) return weighted_vector # Perform weighted calculation on each eigenvector weighted_feature1 = weight_features(feature_vector1) weighted_feature2 = weight_features(feature_vector2) weighted_feature3 = weight_features(feature_vector3) weighted_feature4 = weight_features(feature_vector4) # Feature fusion module # Concatenate the weighted feature vectors in a specific dimension to generate a preliminary comprehensive feature vector concatenated_features = Concatenate(axis=-1)([weighted_feature1,weighted_feature2, weighted_feature3, weighted_feature4]) # Feature transformation module # Use the fully connected layer to perform linear transformation on the concatenated preliminary comprehensive feature vector, and perform nonlinear processing through the ReLU activation function dense_transform = Dense(units=512, activation=None)(concatenated_features) relu_transform = ReLU()(dense_transform) # Final fused comprehensive feature vector fused_feature_vector = relu_transform # Print the shape of the fused comprehensive feature vector to ensure correct implementation print(fused_feature_vector.shape) Through the above detailed code, we can fully understand and implement the design and function of the feature fusion layer. The feature weighting module, feature fusion module and feature transformation module work together to ensure that the feature fusion layer can effectively integrate and enhance feature representation, providing strong support for subsequent anomaly detection.

[0090] Furthermore, the graph convolutional network layer includes a graph construction module, a graph convolution layer and a feature transformation module; wherein the graph construction module is used to construct a graph structure representing the relationship between the comprehensive feature vectors and generate an adjacency matrix; the graph convolution layer is used to perform a convolution operation on the input comprehensive feature vector and the adjacency matrix to generate a preliminary high-dimensional feature vector; the feature transformation module is used to transform the preliminary high-dimensional feature vector output by the graph convolution layer through a fully connected layer and a nonlinear activation function to obtain a high-dimensional feature vector.

[0091] In the network data leakage monitoring system, the graph convolutional network layer is an important component for processing and capturing the complex dependencies and topological relationships between comprehensive feature vectors. The implementation of the graph convolutional network layer includes a graph building module, a graph convolutional layer, and a feature transformation module, which work together to extract higher-level feature representations from the input comprehensive feature vector.

[0092] First, the graph construction module is responsible for constructing a graph structure that represents the relationship between the comprehensive feature vectors. This module generates an adjacency matrix by analyzing the relationship between the comprehensive feature vectors. The adjacency matrix is ​​a binary matrix whose elements indicate whether there is a connection between the feature vectors. Specifically, the graph construction module can determine the connection relationship between the feature vectors based on the similarity measure between the feature vectors (such as Euclidean distance, cosine similarity, etc.) and generate the corresponding adjacency matrix. This step ensures that the relationship between the comprehensive feature vectors can be fully considered and utilized in the subsequent convolution operation.

[0093] Next, the graph convolution layer performs convolution operations on the input comprehensive feature vector and adjacency matrix. The main function of the graph convolution layer is to propagate and aggregate feature vector information in the graph structure through graph convolution operations. In the specific implementation process, the graph convolution layer receives the comprehensive feature vector and adjacency matrix as input, and through multi-layer graph convolution operations, performs weighted averaging on the neighbor information of each feature vector, and merges the result with its own features to generate a preliminary high-dimensional feature vector. This graph convolution operation can effectively capture the global dependencies and contextual information between feature vectors, making the generated feature vector more expressive and robust.

[0094] Finally, the feature transformation module transforms the preliminary high-dimensional feature vector output by the graph convolution layer through a fully connected layer and a nonlinear activation function. The function of the fully connected layer is to perform a linear transformation on the preliminary high-dimensional feature vector to generate a new feature representation. After the fully connected layer, a nonlinear activation function is used to perform nonlinear processing on the result of the linear transformation. Commonly used activation functions include ReLU, Leaky ReLU, ELU, etc. These activation functions can introduce nonlinear factors, improve the expressive power of the model, and solve the gradient disappearance problem. Through the feature transformation module, the preliminary high-dimensional feature vector is converted into a more abstract and high-dimensional feature representation, which will be used for a more in-depth analysis in the subsequent abnormal pattern recognition layer.

[0095] Through the above detailed implementation steps, the graph convolutional network layer can efficiently process and capture the complex dependencies and topological relationships between comprehensive feature vectors. The graph construction module generates an adjacency matrix to ensure that the relationship between feature vectors can be fully represented in the graph structure. The graph convolution layer propagates and aggregates feature vectors in the graph structure through graph convolution operations to generate preliminary high-dimensional feature vectors. The feature transformation module further performs linear transformation and nonlinear processing on the preliminary high-dimensional feature vectors through fully connected layers and nonlinear activation functions to generate the final high-dimensional feature vectors. These steps work together to ensure that the graph convolutional network layer can effectively improve feature representation and provide strong support for subsequent anomaly detection.

[0096] The following is the detailed code for implementing the graph convolutional network layer in the neural network model, including the graph building module, graph convolution layer, and feature transformation module.

[0097] import tensorflow as tf from tensorflow.keras.layers import Dense, ReLU import numpy as np # Assume that the input comprehensive feature vector is a two-dimensional tensor with shape (num_nodes, feature_dim) # num_nodes represents the number of nodes, feature_dim represents the dimension of each feature vector input_features = tf.random.normal(shape=(10, 128)) # Graph building blocks # Generate a random adjacency matrix of shape (num_nodes, num_nodes) # The elements of the adjacency matrix indicate whether there is a connection between nodes, 1 indicates connection, 0 indicates no connection adjacency_matrix = np.random.randint(0, 2, size=(10, 10)) # Convert the adjacency matrix to a tensor adjacency_matrix = tf.convert_to_tensor(adjacency_matrix, dtype=tf.float32) # Graph Convolutional Layer # Define a graph convolutional layer function that accepts the comprehensive feature vector and adjacency matrix as input def graph_convolution(features, adjacency, output_dim): # Feature conversion matrix, initially random values W = tf.Variable(tf.random.truncated_normal([features.shape[1],output_dim], stddev=0.1)) # Perform graph convolution operation, A_hat = D^(-1 / 2) * A * D^(-1 / 2) is the normalized adjacency matrix D = tf.linalg.diag(tf.reduce_sum(adjacency, axis=1)) D_inv_sqrt = tf.linalg.diag(1.0 / tf.sqrt(tf.reduce_sum(adjacency, axis=1) + 1e-5)) A_hat = tf.matmul(tf.matmul(D_inv_sqrt, adjacency), D_inv_sqrt) # Feature convolution, H' = A_hat * H * W features_transformed = tf.matmul(tf.matmul(A_hat, features), W) return features_transformed # Perform graph convolution operations to generate preliminary high-dimensional feature vectors graph_conv_output = graph_convolution(input_features, adjacency_matrix, output_dim=256) # Feature transformation module # Use the fully connected layer to perform linear transformation on the preliminary high-dimensional feature vector output by the graph convolution layer, and use the ReLU activation function for nonlinear processing dense_transform = Dense(units=512, activation=None)(graph_conv_output) relu_transform = ReLU()(dense_transform) # Final high-dimensional feature vector high_dimensional_features = relu_transform # Print the shape of the high-dimensional feature vector to ensure correct implementation print(high_dimensional_features.shape) Through the above code, we can fully understand and implement the design and function of the graph convolutional network layer. The graph construction module, graph convolutional layer and feature transformation module work together to ensure that the graph convolutional network layer can effectively process and capture the complex dependencies and topological relationships between comprehensive feature vectors, providing strong support for subsequent anomaly detection.

[0098] Furthermore, the abnormal pattern recognition layer includes a time series data preprocessing module, a recurrent neural network layer, an abnormal pattern detection module and a recognition output module; wherein the time series data preprocessing module is used to segment the high-dimensional feature vector in time order to form multiple time series segments; the recurrent neural network layer is used to process the time series segments to capture the dependencies and patterns in the time series segments; wherein the recurrent neural network layer includes a first layer of recurrent neural network and a second layer of recurrent neural network, the first layer of recurrent neural network is implemented using long short-term memory units, and the second layer of recurrent neural network is implemented using gated recurrent units; the abnormal pattern detection module detects potential abnormal patterns and assigns preliminary confidence scores based on the output of the recurrent neural network layer; the recognition output module is used to output the detected potential abnormal patterns and the preliminary confidence scores of the potential abnormal patterns.

[0099] In the network data leakage monitoring system, the abnormal pattern recognition layer plays a key role. This layer effectively identifies potential abnormal patterns and assigns confidence scores through the collaborative work of the time series data preprocessing module, the recurrent neural network layer, the abnormal pattern detection module, and the recognition output module.

[0100] First, the main function of the time series data preprocessing module is to segment the high-dimensional feature vector in time order to form multiple time series segments. This step analyzes the input high-dimensional feature vector and divides the continuous data into segments of fixed length according to timestamps or other time markers. For example, if the high-dimensional feature vector is a network traffic feature generated once per second, the feature vector within one minute can be divided into sixty time series segments. This process ensures that the subsequent time series analysis can be performed based on the accurate time order.

[0101] Next, the RNN layer is used to process these time series segments to capture the dependencies and patterns therein. The RNN layer consists of two different layers of RNNs. The first layer of RNN is implemented using Long Short-Term Memory (LSTM). LSTM can effectively capture long-term dependencies in time series data and avoid the gradient vanishing problem in traditional RNN. Each time series segment is input into the LSTM unit, and features reflecting the time series dependencies are extracted through processing by multiple layers of LSTM units.

[0102] After the LSTM layer, the processed feature vectors are passed to the second layer of the recurrent neural network. The second layer of the recurrent neural network is implemented using a gated recurrent unit (GRU). GRU is similar to LSTM, but its structure is simpler and computationally more efficient. Through the processing of GRU units, the dependencies and patterns in the time series data are further extracted and enhanced. GRU can effectively capture short-term and medium-term dependencies, and work together with LSTM to comprehensively analyze various dependencies in time series data.

[0103] Subsequently, the abnormal pattern detection module detects potential abnormal patterns based on the output of the recurrent neural network layer. This module identifies possible abnormal behaviors by analyzing the feature vectors generated by the LSTM and GRU layers. For example, an abnormal surge in network traffic in a certain time series segment, or frequent access to sensitive data, may be marked as an abnormal pattern. For each detected abnormal pattern, the abnormal pattern detection module assigns a preliminary confidence score. The confidence score reflects the likelihood that the pattern is judged to be abnormal, and the higher the score, the greater the likelihood of an abnormality.

[0104] Finally, the identification output module is used to output the detected potential abnormal patterns and their preliminary confidence scores. This module organizes and formats the results of the abnormal pattern detection module for output. The output information includes a detailed description of each potential abnormal pattern, the time of occurrence, and the preliminary confidence score. This information will be passed to other parts of the system for further analysis and countermeasures.

[0105] Through these steps, the abnormal pattern recognition layer can efficiently and accurately identify potential abnormal patterns and assign a confidence score to each pattern.

[0106] The following is the detailed code for implementing the abnormal pattern recognition layer in the neural network model, including the time series data preprocessing module, the recurrent neural network layer, the abnormal pattern detection module, and the recognition output module.

[0107] import tensorflow as tf from tensorflow.keras.layers import LSTM, GRU, Dense import numpy as np # Time series data preprocessing module # Divide the high-dimensional feature vector into segments in chronological order to form multiple time series segments def preprocess_time_series(features, segment_length): num_segments = features.shape[0] / / segment_length time_series_segments = [] for i in range(num_segments): segment = features[i*segment_length:(i+1)*segment_length] time_series_segments.append(segment) return np.array(time_series_segments) # Assume that the input high-dimensional feature vector is a two-dimensional tensor with a shape of (600, 128) # Where 600 represents the time step and 128 represents the feature dimension input_features = tf.random.normal(shape=(600, 128)) # Divide the high-dimensional feature vector into segments per minute (60 seconds) segment_length = 60 time_series_segments = preprocess_time_series(input_features,segment_length) # Convert time series segments to TensorFlow tensors time_series_segments = tf.convert_to_tensor(time_series_segments,dtype=tf.float32) # Recurrent Neural Network Layer # The first layer of recurrent neural network is implemented using LSTM lstm_layer = LSTM(units=64, return_sequences=True, name='lstm_layer') lstm_output = lstm_layer(time_series_segments) # The second layer of recurrent neural network is implemented using GRU gru_layer = GRU(units=64, return_sequences=False, name='gru_layer') gru_output = gru_layer(lstm_output) # Abnormal pattern detection module # Based on the output of the recurrent neural network layer, detect potential abnormal patterns and assign preliminary confidence scores class AnomalyDetectionModule(tf.keras.layers.Layer): def __init__(self, units=1): super(AnomalyDetectionModule, self).__init__() self.dense = Dense(units, activation='sigmoid') def call(self, inputs): confidence_scores = self.dense(inputs) return confidence_scores # Create an instance of the anomaly detection module anomaly_detection_module = AnomalyDetectionModule(units=1) # Perform anomaly detection on the output of the GRU layer anomaly_scores = anomaly_detection_module(gru_output) # Identify output modules # Output the detected potential abnormal patterns and their preliminary confidence scores class RecognitionOutputModule(tf.keras.layers.Layer): def __init__(self): super(RecognitionOutputModule, self).__init__() def call(self, scores): # For simplicity, the anomaly score is returned directly here. In actual applications, further processing and formatting of the output may be required. return scores # Create an instance of the recognition output module recognition_output_module = RecognitionOutputModule() # Get the final output abnormal mode and its confidence score final_output = recognition_output_module(anomaly_scores) # Print the shape of the final output to ensure correct implementation print(final_output.shape) Through the above detailed code, we can fully understand and implement the design and function of the abnormal pattern recognition layer. The time series data preprocessing module, recurrent neural network layer, abnormal pattern detection module and recognition output module work together to ensure that the abnormal pattern recognition layer can efficiently and accurately identify potential abnormal patterns and assign confidence scores, providing support for subsequent abnormal verification and processing.

[0108] Furthermore, the anomaly verification layer includes a generator network, a discriminator network, an anomaly verification module and a verification output module; wherein the generator network is used to generate new feature samples according to potential anomaly patterns; the discriminator network is used to discriminate between the generated new feature samples and the real feature samples, and evaluate their authenticity; the anomaly verification module is used to integrate the results of the generator network and the discriminator network, verify the potential anomaly patterns and assign confidence scores; the verification output module is used to output the verified anomaly patterns and the confidence scores of the anomaly patterns.

[0109] In the network data leakage monitoring system, the anomaly verification layer plays a vital role. This layer ensures further verification and assignment of confidence scores for the detected potential anomaly patterns through the collaborative work of the generator network, the discriminator network, the anomaly verification module, and the verification output module, thereby improving the accuracy and reliability of anomaly detection.

[0110] First, the main function of the generator network is to generate new feature samples based on potential abnormal patterns. The generator network usually adopts the architecture of generative adversarial network (GAN), receives potential abnormal patterns as input, and generates new feature samples similar to real feature samples through multi-layer neural network transformation. The purpose of the generator network design is to capture the feature distribution of potential abnormal patterns and verify the authenticity of these patterns through generated samples.

[0111] Next, the discriminator network is used to discriminate between the generated new feature samples and the real feature samples to evaluate their authenticity. The discriminator network is also part of the generative adversarial network (GAN). It accepts the samples generated by the generator network and the real feature samples as input and outputs a probability value to indicate the authenticity of the input sample. After training, the discriminator network can effectively distinguish between real samples and generated samples, thus providing a reliable evaluation basis for anomaly verification.

[0112] The anomaly verification module is the result of the integrated generator network and the discriminator network, verifying the potential anomaly patterns and assigning confidence scores. Specifically, the anomaly verification module evaluates each potential anomaly pattern by analyzing the output of the discriminator network. If the discriminator network believes that the generated sample is very similar to the real sample, it means that the authenticity of the potential anomaly pattern is high, and the anomaly verification module will assign it a higher confidence score. On the contrary, if the generated sample is very different from the real sample, the confidence score of the potential anomaly pattern is low. In this way, the anomaly verification module can effectively screen out the real anomaly patterns and quantify their confidence.

[0113] Finally, the verification output module is used to output the verified anomaly patterns and their confidence scores. This module organizes and formats the results of the anomaly verification module, including a detailed description of each verified anomaly pattern, the time of occurrence, and the final confidence score. The output information will be passed to other parts of the system for further analysis and countermeasures.

[0114] Through the above detailed implementation steps, the anomaly verification layer can efficiently verify potential anomaly patterns and assign confidence scores. The generator network generates new feature samples based on potential anomaly patterns, the discriminator network evaluates these samples, and the anomaly verification module combines the results of the two for verification, and outputs the final anomaly pattern and its confidence score through the verification output module.

[0115] The following is the detailed code for implementing the anomaly verification layer in the neural network model, including the generator network, the discriminator network, the anomaly verification module, and the verification output module.

[0116] import tensorflow as tf from tensorflow.keras.layers import Dense, LeakyReLU,BatchNormalization, Input from tensorflow.keras.models import Model # Generator Network # Generate new feature samples based on potential abnormal patterns def build_generator(input_dim, output_dim): input_layer = Input(shape=(input_dim,)) x = Dense(128)(input_layer) x = LeakyReLU(alpha=0.2)(x) x = BatchNormalization(momentum=0.8)(x) x = Dense(256)(x) x = LeakyReLU(alpha=0.2)(x) x = BatchNormalization(momentum=0.8)(x) x = Dense(512)(x) x = LeakyReLU(alpha=0.2)(x) x = BatchNormalization(momentum=0.8)(x) output_layer = Dense(output_dim, activation='tanh')(x) return Model(input_layer, output_layer, name='Generator') # Discriminator network # Distinguish the generated new feature samples and real feature samples to evaluate their authenticity def build_discriminator(input_dim): input_layer = Input(shape=(input_dim,)) x = Dense(512)(input_layer) x = LeakyReLU(alpha=0.2)(x) x = Dense(256)(x) x = LeakyReLU(alpha=0.2)(x) output_layer = Dense(1, activation='sigmoid')(x) return Model(input_layer, output_layer, name='Discriminator') # Exception verification module # Combine the results of the generator network and the discriminator network to verify potential abnormal patterns and assign confidence scores class AnomalyValidationModule(tf.keras.layers.Layer): def __init__(self, generator, discriminator): super(AnomalyValidationModule, self).__init__() self.generator = generator self.discriminator = discriminator def call(self, potential_anomaly): # Generator generates new feature samples generated_sample = self.generator(potential_anomaly) # Discriminator evaluates the generated samples real_score = self.discriminator(potential_anomaly) fake_score = self.discriminator(generated_sample) # Calculate confidence score confidence_score = real_score - fake_score return confidence_score # Verify output module # Output the verified abnormal pattern and its confidence score class ValidationOutputModule(tf.keras.layers.Layer): def __init__(self): super(ValidationOutputModule, self).__init__() def call(self, confidence_scores): # For simplicity, the confidence score is returned directly. In actual applications, further processing and formatting of the output may be required. return confidence_scores # Assume that the input potential abnormal pattern is a 2D tensor with shape (10, 100) # 10 represents the number of samples, and 100 represents the dimension of the potential abnormal pattern potential_anomalies = tf.random.normal(shape=(10, 100)) # Build the generator and discriminator generator = build_generator(input_dim=100, output_dim=128) discriminator = build_discriminator(input_dim=128) # Create an exception verification module instance anomaly_validation_module = AnomalyValidationModule(generator,discriminator) # Verify potential abnormal patterns and generate confidence scores confidence_scores = anomaly_validation_module(potential_anomalies) # Create a verification output module instance validation_output_module = ValidationOutputModule() # Get the final output abnormal mode and its confidence score final_output = validation_output_module(confidence_scores) # Print the shape of the final output to ensure correct implementation print(final_output.shape) Through the above detailed code, you can fully understand and implement the design and function of the anomaly verification layer. The generator network generates new feature samples based on potential anomaly patterns, the discriminator network evaluates these samples, and the anomaly verification module verifies the results of both, and outputs the final anomaly pattern and its confidence score through the verification output module, thereby improving the detection accuracy and reliability of the network data leakage monitoring system.

[0117] In the network data leakage monitoring system, the training of the neural network model is a multi-stage, iterative process involving a series of steps from data collection to model deployment. This process ensures that the model can effectively learn and adapt to the dynamic changes of network data to achieve optimized anomaly detection and protection. The following are the specific steps of model training: First, the system needs to collect various data in network operation, including network traffic data, access logs, user behavior records, etc. These data are collected in real time through the data acquisition module, and are cleaned, denoised, and normalized through the data preprocessing module to ensure data quality and consistency, laying a solid foundation for subsequent model training.

[0118] During the feature extraction layer training phase, the system uses multiple parallel convolutional neural network sublayers to process preprocessed network data. Each convolutional neural network sublayer focuses on extracting different types of features, such as traffic features in a short period of time, behavioral features in a long period of time, frequency features of access to specific sensitive data, abnormal network connection behavior features, etc. In this way, the system can fully capture various complex patterns in network data and generate multiple feature vectors.

[0119] During the feature fusion layer training phase, the system uses the attention mechanism to weightedly fuse the feature vectors extracted by multiple convolutional neural network sublayers. The feature weighting module uses the fully connected layer and the Softmax function to calculate the weight of each feature vector and weight the feature vectors according to the weight. The weighted feature vectors are concatenated through the feature fusion module to generate multiple preliminary comprehensive feature vectors. Then, the feature transformation module performs linear transformation and nonlinear processing on the preliminary comprehensive feature vectors through the fully connected layer and the ReLU activation function to generate the final fused comprehensive feature vector.

[0120] During the training phase of the graph convolutional network layer, the system first uses the graph construction module to generate a graph structure that represents the relationship between the comprehensive feature vectors and generates an adjacency matrix. The graph convolution layer performs convolution operations on the input comprehensive feature vectors and adjacency matrix, captures the complex dependencies and topological relationships between feature vectors through graph convolution operations, and generates a preliminary high-dimensional feature vector. Then, the feature transformation module performs further linear transformation and nonlinear processing on the preliminary high-dimensional feature vector output by the graph convolution layer to generate a high-dimensional feature vector.

[0121] During the training phase of the abnormal pattern recognition layer, the system uses a recurrent neural network layer to perform time series analysis on high-dimensional feature vectors. The first layer of the recurrent neural network is implemented using long short-term memory units (LSTM), which can capture long-term dependencies in time series data. The second layer of the recurrent neural network is implemented using gated recurrent units (GRU) to further extract and enhance dependencies and patterns in time series data. The abnormal pattern detection module detects potential abnormal patterns and assigns preliminary confidence scores based on the output of the recurrent neural network layer.

[0122] During the training phase of the anomaly verification layer, the system uses a generative adversarial network (GAN) to verify potential anomaly patterns. The generator network generates new feature samples based on potential anomaly patterns, and the discriminator network discriminates between the generated samples and real samples to evaluate their authenticity. The anomaly verification module combines the results of the generator network and the discriminator network to verify the potential anomaly pattern and assign a final confidence score. The verification output module outputs the verified anomaly pattern and its confidence score.

[0123] After training is completed, the model needs to undergo rigorous evaluation and testing, using cross-validation and various performance indicators (such as accuracy, response time, etc.) to verify the effectiveness and reliability of the model to ensure that its performance in actual applications meets system requirements.

[0124] The models that have been evaluated and tested will be deployed into the network data leakage monitoring system to process network traffic and user behavior data in real time, and dynamically detect and protect against potential data leakage risks based on the model's predicted results.

[0125] After deployment, the system will continuously monitor the performance and actual application effects of the model, collect new operating data for iterative updates and optimization of the model, ensure that the model can adapt to environmental changes and new threats, and continue to provide efficient and accurate network data leakage protection solutions.

[0126] Through this detailed training and implementation process, the network data leakage monitoring system can fully utilize the powerful learning and prediction capabilities of neural networks, continuously optimize and improve the system's detection and protection performance, and achieve efficient protection of network security.

[0127] The risk assessment module 104 performs real-time assessment of potential data leakage risks according to the type and confidence score of the abnormal pattern to obtain a comprehensive risk assessment result.

[0128] The risk assessment module 104 plays a vital role in the network data leakage monitoring system. It is responsible for analyzing and evaluating the detected abnormal patterns, thereby determining the severity of the potential data leakage risk and generating a comprehensive risk assessment result. This module uses the abnormal patterns and their confidence scores provided by the abnormal detection module 103, and ensures the accuracy and real-time nature of the risk assessment through complex algorithms and multi-dimensional analysis.

[0129] First, the risk assessment module 104 receives inputs from the anomaly detection module 103, which include the detected anomaly patterns and their corresponding confidence scores. Each anomaly pattern is accompanied by a confidence score, indicating the credibility of the anomaly pattern. The risk assessment module needs to comprehensively consider this information and conduct a detailed analysis of each anomaly pattern.

[0130] In the specific implementation process, the risk assessment module 104 first assigns a risk weight to each type of abnormal pattern. The risk weight is pre-defined according to the type of abnormal pattern, indicating the degree of impact of the type of abnormal pattern on the overall network security. For example, an abnormal increase in data transmission volume may have a higher risk weight, while an abnormal frequency of access to specific sensitive data may have a higher weight because the latter may directly involve the leakage of sensitive information.

[0131] Next, the risk assessment module calculates the comprehensive risk value of each abnormal pattern. This calculation process not only considers the confidence score and risk weight of the abnormal pattern, but also comprehensively considers other relevant factors, such as the access frequency, duration, user impact coefficient, priority coefficient and detection difficulty coefficient of the abnormal pattern. The access frequency reflects the number of times the abnormal pattern is detected within a certain period of time, the duration indicates the duration of the abnormal behavior, the user impact coefficient evaluates the potential impact of the abnormal pattern on the user, the priority coefficient determines the priority of handling the abnormal pattern, and the detection difficulty coefficient reflects the difficulty of detecting the abnormal pattern.

[0132] By combining these factors, the risk assessment module can calculate a weighted comprehensive risk value to ensure the comprehensiveness and accuracy of the assessment results. For example, the calculation of the comprehensive risk value can be achieved through a polynomial formula, which weights and sums all relevant parameters to obtain the final risk assessment result. The higher the calculated comprehensive risk value, the greater the potential risk of data leakage.

[0133] Finally, the risk assessment module summarizes the comprehensive risk values ​​of all detected abnormal patterns and generates an overall comprehensive risk assessment result. This result not only provides an overall assessment of the current network security status, but also divides the risk level according to the specific comprehensive risk value, such as low risk, medium risk and high risk, to facilitate subsequent decision-making and processing.

[0134] The risk assessment module 104 ensures that the assessment of potential data leakage risks is highly accurate and real-time through the above detailed and clear steps.

[0135] Furthermore, the risk assessment module calculates the comprehensive risk assessment result according to the following formula 1: in, The results of the comprehensive risk assessment; is the total number of abnormal patterns detected; For the Risk weights for each type of abnormal pattern; For the confidence scores of the anomaly patterns; For the A severity score for each abnormal pattern, ranging from 1 to 10, set by the system based on historical data and expert judgment; For the The frequency of an abnormal pattern, which indicates the number of times the pattern is detected within a certain period of time; For the the duration of the abnormal pattern; is a specific threshold used to normalize the The duration of the abnormal pattern.

[0136] In the network data leakage monitoring system, the risk assessment module is responsible for calculating the comprehensive risk assessment results based on the detected abnormal patterns. This module uses formula (1) to perform calculations to ensure that different types of abnormal patterns are comprehensively evaluated, thereby providing an accurate risk score. The following is a detailed description of the formula and the meaning and calculation method of each item.

[0137] Comprehensive risk assessment results : This is the final calculated comprehensive risk assessment result, which is used to represent the overall risk level under the current network status. It is obtained by summing up the risk values ​​of all detected abnormal patterns.

[0138] Total number of abnormal patterns detected : This is the total number of all anomalous patterns detected by the system within a specific time window.

[0139] No. Risk weights for abnormal pattern types : This is a preset constant used to represent the The risk weight of an abnormal pattern. The weight is usually set based on experience and historical data, indicating the impact of the abnormal pattern on the overall network security. The higher the weight, the greater the threat of this type of abnormal pattern to network security.

[0140] No. Confidence scores of abnormal patterns : This is the system detecting the After an abnormal pattern is detected, the model assigns a confidence score to the pattern, which usually ranges from 0 to 1. The higher the confidence score, the greater the possibility that the abnormal pattern is detected as a true anomaly.

[0141] No. Severity score of abnormal patterns : This is a score based on historical data and expert judgment that indicates The severity of the abnormal pattern is scored on a scale of 1 to 10. The higher the score, the greater the potential harm of the abnormal pattern to the system.

[0142] No. The frequency of abnormal patterns : This is the The number of times an abnormal pattern is detected within a certain period of time. The higher the frequency, the more frequently the abnormal pattern appears, and the greater the impact it may have on the system.

[0143] No. The duration of the abnormal pattern : This is the The duration of each occurrence of an abnormal mode, which can be in seconds, minutes or other appropriate time units. The longer the duration, the longer the impact of the abnormal mode on the system.

[0144] Specific threshold : This is used to normalize The threshold value of the duration of abnormal patterns, in units of The normalization process ensures that abnormal patterns of different durations can be treated fairly in the evaluation.

[0145] The calculation methods of the parameters of the formula are as follows: 1. Risk Weight Determination of: It can be set based on the analysis of historical security events, expert experience, and the evaluation of different types of abnormal patterns. For example, the risk weight for network attacks may be higher than that for general access anomalies.

[0146] 2. Confidence score Calculation: The output of the anomaly detection module based on the pre-trained neural network model indicates the credibility of the currently detected anomaly pattern. The specific calculation method is the output score of the detection model.

[0147] 3. Severity score Settings: The score is set by analyzing historical data, event impact, and expert evaluation. For abnormal patterns that have caused serious consequences in history, the score will be set higher.

[0148] 4. Frequency Calculation: Statistics within a specific time window, The number of times the abnormal pattern was detected.

[0149] 5. Duration Measurements: Each time an abnormal pattern is detected, its start and end times are recorded and its duration is calculated.

[0150] 6. Specific Threshold Settings: According to historical data and experience, a benchmark value is set for normalization. For example, if most abnormalities last for 5 minutes, you can set = 300 sec.

[0151] Through these steps and calculations, the system can accurately assess the overall risk level in the current network environment and take appropriate protective measures.

[0152] The alarm module 105 is used to generate and send an alarm message when the comprehensive risk assessment result exceeds a preset threshold, and the alarm message includes an abnormal pattern description, a risk level, and recommended countermeasures.

[0153] The alarm module 105 plays a key role in the network data leakage monitoring system. When the comprehensive risk assessment result exceeds the preset threshold, the module is responsible for generating and sending alarm information so that timely countermeasures can be taken to prevent further spread and damage of data leakage. Its implementation requires the combination of multiple technical means to ensure the accuracy, timeliness and operability of the alarm information.

[0154] The alarm module 105 first receives the comprehensive risk assessment result from the risk assessment module 104. When the comprehensive risk assessment result exceeds the preset threshold, the alarm module starts to operate. The preset threshold is defined according to the system's security policy and specific application environment, and can be a fixed value or adjusted according to historical data and dynamic analysis results.

[0155] When generating the alarm information, the alarm module 105 will describe the detected abnormal pattern in detail, including the type of abnormal pattern, specific manifestations, and the time of detection, etc. For example, if an abnormal increase in the amount of data transmission is detected, the alarm information will include a detailed description of the abnormal pattern, such as the specific value of the abnormal transmission amount, the source and destination addresses involved, the transmission protocol, etc.

[0156] At the same time, the warning information also includes the risk level. The risk level is determined based on the comprehensive risk assessment results and can be divided into multiple levels such as low, medium and high. Each level represents a different degree of risk severity. Low risks may only require monitoring and recording, while high risks require immediate response measures. The division of risk levels makes the warning information more operational and helps relevant personnel take appropriate actions based on the level of risk.

[0157] In addition, the alarm module 105 also provides recommended countermeasures. These measures are predefined action plans based on the type and risk level of the abnormal pattern. For example, for high-risk abnormal data transmission behavior, the recommended countermeasures may include immediately isolating the affected network nodes, conducting detailed traffic analysis, checking system logs for more clues, etc. Providing specific countermeasures can help relevant personnel respond quickly and avoid delays in processing time due to information asymmetry.

[0158] The alarm module 105 not only generates alarm information, but is also responsible for sending this information through various channels. The sending channels may include email, SMS, instant messaging applications, system notifications, etc. Selecting a suitable sending channel can ensure that the alarm information can be quickly transmitted to the relevant personnel, so that necessary countermeasures can be taken in time. Different sending channels can be configured according to actual application scenarios to meet the needs of different environments.

[0159] In order to ensure the integrity and traceability of the alarm information, the alarm module 105 also records the detailed information of each alarm, including the generation time, sending channel, recipient, feedback, etc. These records are not only helpful for subsequent security audits and analysis, but also can serve as an important reference for improving system security strategies and optimizing alarm mechanisms.

[0160] Through the above detailed implementation method, the alarm module 105 can effectively generate and send alarm information, ensuring that the network data leakage monitoring system can take timely response measures when potential risks are detected.

[0161] In the above-mentioned embodiment, a network data leakage monitoring system is provided. Correspondingly, the present application also provides a network data leakage monitoring method. Figure 2 , which is a flow chart of an embodiment of a network data leakage monitoring method of the present application. Since this embodiment, i.e., the second embodiment, is basically similar to the first embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the first embodiment. The method embodiment described below is only illustrative.

[0162] A network data leakage monitoring method provided in the second embodiment of the present application includes: Step S201: collecting network data from network data sources in real time; Step S202: cleaning and standardizing the network data collected in the data collection step to obtain pre-processed network data; Step S203: obtaining an abnormal pattern of the network data and a confidence score of the abnormal pattern according to the preprocessed network data using a pre-trained neural network model, wherein the abnormal pattern includes an abnormal increase in data transmission volume, an abnormal frequency of access to specific sensitive data, an abnormal network connection behavior, and a network behavior matching a known attack pattern; Step S204: Based on the type and confidence score of the abnormal pattern, a real-time assessment of the potential data leakage risk is performed to obtain a comprehensive risk assessment result; Step S205: When the comprehensive risk assessment result exceeds a preset threshold, an alarm message is generated and sent, wherein the alarm message includes an abnormal pattern description, a risk level, and suggested countermeasures.

[0163] Although the present application is disclosed as above in the form of a preferred embodiment, it is not intended to limit the present application. Any technical personnel in this field may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

Claims

1. A network data leakage monitoring system, characterized in that: include: A data collection module is used to collect network data from network data sources in real time; A data preprocessing module is used to clean and standardize the network data collected by the data collection module to obtain preprocessed network data; An anomaly detection module, used to obtain an abnormal pattern of network data and a confidence score of the abnormal pattern based on the pre-processed network data using a pre-trained neural network model, wherein the abnormal pattern includes an abnormal increase in data transmission volume, an abnormal frequency of access to specific sensitive data, an abnormal network connection behavior, and a network behavior matching a known attack pattern; A risk assessment module, which performs real-time assessment of potential data leakage risks based on the type and confidence score of the abnormal pattern to obtain a comprehensive risk assessment result; The alarm module is used to generate and send an alarm message when the comprehensive risk assessment result exceeds a preset threshold. The alarm message includes an abnormal pattern description, risk level and recommended response measures.

2. The network data leakage monitoring system according to claim 1, characterized in that: The neural network model used in the anomaly detection module includes an input layer, a feature extraction layer, a feature fusion layer, a graph convolutional network layer, an abnormal pattern recognition layer and an abnormal verification layer; wherein the input layer is used to receive the preprocessed network data; the feature extraction layer includes multiple parallel convolutional neural network sublayers, and the input of each convolutional neural network sublayer is the preprocessed data provided by the input layer; each convolutional neural network sublayer processes the input data to obtain a feature vector; the feature fusion layer is implemented by an attention mechanism, which is used to fuse the feature vectors provided by multiple convolutional neural network sublayers to generate a fused comprehensive feature vector; the graph convolutional network layer is implemented by a graph convolutional network, which is used to process and capture the complex dependencies and topological relationships between the fused comprehensive feature vectors in a non-Euclidean way to generate a high-dimensional feature vector; the abnormal pattern recognition layer is implemented by a recurrent neural network, which is used to perform time series analysis on the high-dimensional feature vector, identify potential abnormal patterns, and assign a preliminary confidence score to each potential abnormal pattern; the abnormal verification layer is implemented by a generative adversarial network, which obtains abnormal patterns and confidence scores according to the potential abnormal patterns and preliminary confidence scores provided by the abnormal pattern recognition layer.

3. The network data leakage monitoring system according to claim 2, characterized in that: The feature extraction layer includes the following multiple parallel convolutional neural network sublayers: The first convolutional neural network sublayer is used to extract short-term traffic features from the input preprocessed network data, including the first convolution layer, the first pooling layer, and the first activation layer; wherein the convolution kernel size used in the first convolution layer is 3×3, and the step size is 1; the pooling kernel size used in the first pooling layer is 2×2, and the step size is 2; the first activation layer uses the ReLU activation function; The second convolutional neural network sublayer is used to extract long-term behavioral features from the input preprocessed network data, including a second convolutional layer, a second pooling layer, and a second activation layer; wherein the convolution kernel size used in the second convolutional layer is 5×5, and the step size is 1; the pooling kernel size used in the second pooling layer is 2×2, and the step size is 2; the second activation layer uses a Leaky ReLU activation function; The third convolutional neural network sublayer is used to extract the frequency characteristics of specific sensitive data access from the input preprocessed network data, including a third convolution layer, a third pooling layer and a third activation layer; wherein the convolution kernel size used in the third convolution layer is 1×1 and the step size is 1; the third pooling layer uses global maximum pooling; and the third activation layer uses a Sigmoid activation function; The fourth convolutional neural network sublayer is used to extract abnormal network connection behavior features from the input preprocessed network data, including a fourth convolutional layer, a fourth pooling layer and a fourth activation layer; wherein the convolution kernel size used in the fourth convolutional layer is 3×3 and the step size is 1; the fourth pooling layer uses random pooling; and the fourth activation layer uses an ELU activation function.

4. The network data leakage monitoring system according to claim 2, characterized in that: The feature fusion layer includes a feature weighting module, a feature fusion module and a feature transformation module; wherein the feature weighting module uses a fully connected layer and a Softmax function to calculate the weight of each feature vector to obtain multiple weighted feature vectors; the feature fusion module combines multiple weighted feature vectors in a splicing manner to generate multiple fused preliminary comprehensive feature vectors; the feature transformation module performs a linear transformation on each preliminary comprehensive feature vector through a fully connected layer and a ReLU activation function to obtain a fused comprehensive feature vector.

5. The network data leakage monitoring system according to claim 2, characterized in that: The graph convolution network layer includes a graph construction module, a graph convolution layer and a feature transformation module; wherein the graph construction module is used to construct a graph structure representing the relationship between the comprehensive feature vectors and generate an adjacency matrix; the graph convolution layer is used to perform a convolution operation on the input comprehensive feature vector and the adjacency matrix to generate a preliminary high-dimensional feature vector; the feature transformation module is used to transform the preliminary high-dimensional feature vector output by the graph convolution layer through a fully connected layer and a nonlinear activation function to obtain a high-dimensional feature vector.

6. The network data leakage monitoring system according to claim 2, characterized in that: The abnormal pattern recognition layer includes a time series data preprocessing module, a recurrent neural network layer, an abnormal pattern detection module and a recognition output module; wherein the time series data preprocessing module is used to segment the high-dimensional feature vector in time sequence to form multiple time series segments; the recurrent neural network layer is used to process the time series segments to capture the dependencies and patterns in the time series segments; wherein the recurrent neural network layer includes a first layer of recurrent neural network and a second layer of recurrent neural network, the first layer of recurrent neural network is implemented using long short-term memory units, and the second layer of recurrent neural network is implemented using gated recurrent units; the abnormal pattern detection module detects potential abnormal patterns and assigns preliminary confidence scores based on the output of the recurrent neural network layer; the recognition output module is used to output the detected potential abnormal patterns and preliminary confidence scores of the potential abnormal patterns.

7. The network data leakage monitoring system according to claim 2, characterized in that: The anomaly verification layer includes a generator network, a discriminator network, an anomaly verification module and a verification output module; wherein the generator network is used to generate new feature samples according to potential anomaly patterns; the discriminator network is used to discriminate between the generated new feature samples and the real feature samples, and evaluate their authenticity; the anomaly verification module is used to integrate the results of the generator network and the discriminator network, verify the potential anomaly patterns and assign confidence scores; the verification output module is used to output the verified anomaly patterns and the confidence scores of the anomaly patterns.

8. The network data leakage monitoring system according to claim 2, characterized in that: The risk assessment module calculates the comprehensive risk assessment result according to the following formula 1: in, The results of the comprehensive risk assessment; is the total number of abnormal patterns detected; For the Risk weights for each type of abnormal pattern; For the confidence scores of the anomaly patterns; For the A severity score for each abnormal pattern, ranging from 1 to 10, set by the system based on historical data and expert judgment; For the The frequency of an abnormal pattern, which indicates the number of times the pattern is detected within a certain period of time; For the the duration of the abnormal pattern; is a specific threshold used to normalize the The duration of the abnormal pattern.

9. The network data leakage monitoring system according to claim 1, characterized in that: The data acquisition module comprises: Deep packet inspection engine, used to deeply analyze the content of network data packets and extract traffic information and data packet characteristics; Real-time traffic monitoring unit, used to monitor real-time traffic in the network, including HTTP requests, FTP transfers, email communications, and instant messages; Data mirroring module, used to mirror network data flow in real time without affecting the normal operation of the network for subsequent analysis; The data cache module is used to temporarily store the collected network data so as to quickly access the data before the data preprocessing module performs cleaning and standardization processing.

10. A network data leakage monitoring method, characterized in that: include: Collect network data from network data sources in real time; Cleaning and standardizing the network data collected in the data collection step to obtain pre-processed network data; According to the preprocessed network data, using a pre-trained neural network model, obtaining abnormal patterns of the network data and confidence scores of the abnormal patterns, wherein the abnormal patterns include abnormal increase in data transmission volume, abnormal frequency of access to specific sensitive data, abnormal network connection behavior, and network behavior matching a known attack pattern; Based on the type and confidence score of the abnormal pattern, a real-time assessment of the potential data leakage risk is performed to obtain a comprehensive risk assessment result; When the comprehensive risk assessment result exceeds a preset threshold, an alarm message is generated and sent, and the alarm message includes an abnormal pattern description, a risk level, and suggested countermeasures.

Images