Markov chain model-based network security risk detection method and system

Abstract

The invention provides a network security risk detection method and system based on a Markov chain model, and relates to the technical field of network security detection, and the method comprises the steps: obtaining network traffic data; extracting network flow characteristics and load characteristics of the network flow data; calculating an abnormal factor of the network flow data through a statistical method; judging whether the network flow data is abnormal or not according to the abnormal factors; if yes, entering the next step; otherwise, continuing to detect; segmenting the network flow data into a plurality of sliding windows; dividing the network traffic data in the sliding window into a plurality of state intervals; establishing a Markov chain model in the sliding window through a Pearson correlation analysis method; calculating a state transition probability between the state intervals and constructing a state transition probability matrix; calculating the support probability of the network flow data in the sliding window under the Markov chain model; and performing network security risk detection according to the support probability of the network traffic data under the Markov chain model.

Description

Technical Field

[0001] The present invention relates to the technical field of network security detection, and in particular to a network security risk detection method and system based on a Markov chain model. Background Art

[0002] With the rapid development of network technology and the increasing complexity of network environment, network security issues have become more and more prominent. The means and strategies of network attacks continue to evolve, from traditional virus and Trojan attacks to today's complex forms such as distributed denial of service (DDoS) attacks and advanced persistent threats (APT), which has brought unprecedented challenges to network security protection. In the face of this situation, modern network security systems must not only have excellent monitoring capabilities, but also be able to respond to and adapt to various complex security threats in real time.

[0003] Among existing technical solutions, traditional network security risk detection technologies are mainly based on signature matching and behavioral analysis to identify threats. Although these methods are effective in dealing with known threats, they have poor detection effects when facing zero-day attacks and customized malware.

[0004] In addition, with the widespread application of big data technology, the amount of network traffic data has increased dramatically, resulting in traditional detection technology being unable to quickly process such a large amount of data due to its high complexity and low efficiency, and unable to effectively respond to security threats in the first time. Summary of the invention

[0005] In order to solve the technical problem that traditional network security risk detection technology mainly identifies threats based on signature matching and behavior analysis, and has poor detection effect when facing zero-day attacks and customized malware, and with the widespread application of big data technology, the amount of network traffic data has increased dramatically, resulting in traditional detection technology being difficult to quickly process such a huge amount of data due to its high complexity and low efficiency, and unable to effectively respond to security threats in the first time, the present invention provides a network security risk detection method and system based on a Markov chain model.

[0006] The technical solution provided by the embodiment of the present invention is as follows:

[0007] First aspect:

[0008] An embodiment of the present invention provides a network security risk detection method based on a Markov chain model, comprising:

[0009] S1: Obtain network traffic data;

[0010] S2: extracting network traffic features of the network traffic data according to the statistical information and metadata of the network traffic data;

[0011] S3: extracting load characteristics of the network traffic data according to the load of the network traffic data;

[0012] S4: Calculating the abnormal factors of the network traffic data by statistical methods according to the network traffic characteristics and load characteristics of the network traffic data;

[0013] S5: judging whether the network traffic data is abnormal according to the abnormal factor of the network traffic data; if so, proceeding to the next step; otherwise, returning to S1 to continue detection;

[0014] S6: dividing the network traffic data into a plurality of sliding windows;

[0015] S7: dividing the network traffic data in each sliding window into a plurality of state intervals by an equal-width interval segmentation method;

[0016] S8: According to each of the state intervals, a Markov chain model is established in each of the sliding windows by using a Pearson correlation analysis method;

[0017] S9: According to the Markov chain model, the state transition probability between each state interval is calculated and a state transition probability matrix is ​​constructed;

[0018] S10: calculating the support probability of the network traffic data in each of the sliding windows under the Markov chain model through the state transition probability matrix;

[0019] S11: Perform network security risk detection according to the support probability of each network traffic data under the Markov chain model to determine whether the network traffic data is abnormal; if so, issue an alarm; otherwise, return to S1 to continue detection.

[0020] Second aspect:

[0021] An embodiment of the present invention provides a network security risk detection system based on a Markov chain model, comprising: a memory and one or more processors;

[0022] One or more application programs are stored in the memory, and the one or more application programs are suitable for being executed by the one or more processors to implement the above-mentioned network security risk detection method based on the Markov chain model.

[0023] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0024] In the present invention, by establishing a Markov chain model in each of the sliding windows, threats can be identified without signature matching and behavior analysis, and the detection effect is good when facing zero-day attacks and customized malware. By calculating the abnormal factors of the network traffic data, it is judged whether the network traffic data is abnormal according to the abnormal factors of the network traffic data, and network security risk detection is performed according to the support probability of each of the network traffic data under the Markov chain model. The invention has low complexity and high efficiency, can quickly process a large amount of network traffic data, and can effectively respond to security threats in the first time. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0026] Figure 1 A schematic diagram of a flow chart of a network security risk detection method based on a Markov chain model provided by an embodiment of the present invention;

[0027] Figure 2 A schematic diagram of the structure of a network security risk detection system based on a Markov chain model provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0029] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0030] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0031] Reference Manual Attached Figure 1 , shows a flow chart of a network security risk detection method based on a Markov chain model provided in an embodiment of the present invention.

[0032] The embodiment of the present invention provides a network security risk detection method based on a Markov chain model, which can be implemented by a network security risk detection device based on a Markov chain model, and the network security risk detection device based on a Markov chain model can be a terminal or a server. The processing flow of the network security risk detection method based on a Markov chain model can include the following steps:

[0033] S1: Obtain network traffic data.

[0034] Optionally, a network packet capture tool (such as Wireshark or tcpdump) is used to collect network traffic data transmitted in the network in real time.

[0035] Among them, Wireshark is a network protocol analysis tool that is usually used to capture and analyze data packets on a computer network in detail. It provides a graphical interface in which users can observe the details of network transmission, including data at each network layer and the time series of network communication. Wireshark can help network administrators diagnose network problems, analyze network communications of software applications, learn the specific implementation of network protocols, and check network security issues.

[0036] Among them, tcpdump is a command line interface network analysis tool that can capture data packets transmitted in the network. Tcpdump is mainly used in UNIX and UNIX-like operating systems. It runs through the terminal and allows users to filter and display data packets according to specified complex standards (such as port number, protocol type, IP address, etc.). This tool is an important tool for network administrators or security experts to monitor and diagnose problems in the network, especially when large amounts of data need to be analyzed quickly and efficiently or automated processing is required.

[0037] In the present invention, by real-time monitoring of network traffic, potential anomalies or attack behaviors can be discovered immediately, thereby allowing network administrators to respond quickly to prevent or mitigate the impact of attacks. Real-time data collection ensures the timeliness and effectiveness of the monitoring system.

[0038] S2: Extract network traffic features of the network traffic data based on the statistical information and metadata of the network traffic data.

[0039] Optionally, the network traffic characteristics include: traffic start time, traffic duration, source byte number, target byte number, source data packet number, and target data packet number.

[0040] The traffic start time refers to the timestamp when network traffic starts to be transmitted. It usually indicates the first time point when a data packet or connection starts to be transmitted. For network security monitoring, the traffic start time can be used to analyze the start-up mode of traffic, the time distribution of traffic activities, and potential abnormal behaviors, such as traffic surges in abnormal time periods.

[0041] Traffic duration refers to the time span from the start to the end of network traffic, that is, the length of time the traffic is active. It measures the duration of a traffic session or data transmission. Long-term traffic duration may indicate some persistent malicious activities, such as DDoS attacks or network scanning.

[0042] Source Bytes refers to the total number of bytes of data sent from the source to the destination. It reflects the amount of data sent by the source in a certain period of time and is usually used to assess the scale of traffic and whether the traffic is increasing abnormally. For example, an abnormally high number of source bytes may indicate that the source is performing large-scale data transmission or attacks.

[0043] The target bytes refers to the total number of bytes of data received from the source to the target. It reflects the amount of data received by the target and is used to analyze the reverse traffic of network communications. An abnormally large target bytes may indicate that the target is receiving a large amount of data, possibly due to abuse of the service or attack.

[0044] The number of source packets refers to the number of packets sent by the source. It reflects the frequency of data transmission at the source and can help identify packet sending patterns. An abnormally large number of source packets may be associated with malicious behavior, such as brute force cracking attempts, large-scale scanning or intrusion attempts, etc.

[0045] The target packet count refers to the number of packets received by the target. It is used to evaluate the frequency and pattern of data received by the target. Similar to the source packet count, an abnormally large target packet count may mean that the target is under attack, such as a DDoS attack or large-scale data theft.

[0046] In the present invention, extracting these specific features can help analyze network behavior more accurately. For example, through the flow start time and flow duration, the pattern and time distribution of network activity can be identified, which is very important for discovering possible abnormal activities (such as high-flow activities at night or during non-working hours). By monitoring the source byte count and the target byte count, the scale and direction of the flow can be evaluated, thereby detecting possible abnormal behaviors, such as data leakage, DDoS attacks or other forms of network infringement. Analysis of the source packet count and the target packet count can help identify attack attempts, such as scanning, brute force cracking or other network attack behaviors.

[0047] S3: Extracting load characteristics of the network traffic data according to the load of the network traffic data.

[0048] The payload refers to the actual data content contained in the data packet, usually application layer data, such as web page requests, file transfers, email content, etc. The payload carries the information that the user wants to transmit, not just the control information required by the network protocol (such as the IP header and TCP header).

[0049] Optionally, the payload feature is specifically: the first 32 bytes of the payload content. The first 32 bytes of the payload usually contain important information, such as the method, URL, user agent, cookie, etc. in the HTTP request. This information is crucial for identifying user behavior and request types, and helps detect common attack patterns such as SQL injection, cross-site scripting (XSS), etc.

[0050] It should be noted that directly analyzing the entire payload may incur high computational and storage costs, while selecting the first 32 bytes can effectively reduce the complexity of data processing while still retaining sufficient information for feature extraction and analysis.

[0051] In the present invention, directly analyzing the entire payload involves a large amount of data, resulting in a significant increase in computing and storage costs. Selecting to extract the first 32 bytes of the payload can significantly reduce the amount of data that needs to be processed, thereby reducing the demand for computing resources and processing time, and improving the overall efficiency of the system. By analyzing key payload content, potential malicious behavior or abnormal traffic patterns can be more effectively monitored and identified. This is of great significance for timely responding to security threats and preventing data leaks or system intrusions.

[0052] S4: Calculate the abnormal factors of the network traffic data by statistical methods according to the network traffic characteristics and load characteristics of the network traffic data.

[0053] In the present invention, the anomaly factor is calculated by combining network traffic characteristics (such as traffic start and end time, number of packets, number of bytes, etc.) and load characteristics (such as the specific content of HTTP requests), which can more accurately identify abnormal or potential malicious behaviors. This comprehensive analysis can reveal more detailed abnormal patterns and improve the accuracy of anomaly detection. By continuously monitoring the calculated anomaly factors, small changes in network behavior can be discovered in a timely manner, which may indicate the early stages of security threats. Early identification and handling of these threats can prevent them from evolving into larger security incidents, thereby protecting network resources from damage.

[0054] In a possible implementation, S4 specifically includes sub-steps S401 to S403:

[0055] S401: Concatenate the traffic characteristics and load characteristics of the network traffic data to form a feature vector.

[0056] It should be noted that combining traffic features and load features can effectively integrate information from different sources. This comprehensive feature vector can provide a more comprehensive perspective and help better identify complex attack patterns.

[0057] S402: Calculate the standard score of each feature in the feature vector.

[0058] Optionally, calculate the standard score for each feature in the feature vector according to the following formula:

[0059]

[0060] in, represents the standard score of the kth feature at time t0, represents the eigenvalue of the kth feature at time t0, μ k represents the mean of the kth feature, σ k represents the standard deviation of the kth feature.

[0061] S403: Calculate the abnormal factor of the network traffic data according to the standard score of each feature.

[0062] Optionally, the anomaly factor of the network traffic data is calculated according to the following formula:

[0063]

[0064] in, represents the abnormal factor of network traffic data at time t0, β k It represents the contribution of the kth feature to network attack detection, and K represents the total number of features.

[0065] It should be noted that the anomaly factor quantifies the degree of deviation between each data point and normal behavior, and judges the anomaly through the set threshold. This method can effectively identify potential network attacks and abnormal behaviors.

[0066] In the present invention, network traffic features and load features are spliced ​​to form a comprehensive feature vector. This method can integrate information from different levels (such as physical layer, network layer, application layer) to provide a more comprehensive view of network behavior. The feature values ​​are standardized by calculating the standard score of each feature, eliminating the dimension and scale differences between different features. This allows various types of data to be compared and analyzed under the same standard, enhancing the consistency and comparability of data processing. By calculating the anomaly factor to quantify the degree of deviation between each data point and normal behavior, anomaly detection is made more objective and quantifiable.

[0067] S5: According to the abnormal factors of the network traffic data, determine whether the network traffic data is abnormal. If yes, proceed to the next step. Otherwise, return to S1 to continue detection.

[0068] In a possible implementation, S5 is specifically:

[0069] The abnormal factor of the network traffic data is compared with the abnormal threshold to determine whether the abnormal factor of the network traffic data is greater than the abnormal threshold. If so, it is determined that the network traffic data is abnormal and the next step is entered. Otherwise, it is determined that the network traffic data is not abnormal and the test is returned to S1 to continue.

[0070] It should be noted that those skilled in the art can set the size of the abnormality threshold according to actual needs, and the present invention is not limited here.

[0071] In the present invention, by comparing abnormal factors with thresholds in real time, the system can instantly identify abnormal behavior, reducing the reliance on manual intervention. The automatic judgment process reduces the workload of network administrators and improves the efficiency of network monitoring and management.

[0072] S6: Divide the network traffic data into multiple sliding windows.

[0073] It should be noted that sliding window is a data processing technology that processes data by defining a fixed-length window on the data sequence and gradually sliding the window position. Each time the window slides, the data range contained in the window is updated, so that the local characteristics of the data can be continuously analyzed. Sliding windows are often used in time series analysis. By moving the window in the data stream, short-term dynamic changes can be captured, thereby realizing applications such as real-time monitoring and anomaly detection.

[0074] In the present invention, real-time and continuous monitoring of network traffic can be achieved through sliding window technology. This method allows the system to gradually update the data range contained in the window in the data stream, so as to capture any possible anomalies or changes in time, ensuring the timeliness and continuity of security monitoring. The sliding window can effectively capture the local features of the data, and can identify sudden security threats or short-term abnormal behaviors in the field of network security.

[0075] In a possible implementation manner, S6 specifically includes:

[0076] According to the following formula, the network traffic data is divided into multiple sliding windows:

[0077] W t (l) = {x t-l ,x t-l+1 ,x t-l+2 ,…,x t-1},t=l+1,l+2,…,T

[0078] Among them, W t () represents the sliding window at time t, l represents the total length of the sliding window, x represents the network traffic data, t represents the time, and T represents the total duration.

[0079] In the present invention, network traffic can be analyzed in a fine-grained manner by dividing it into multiple sliding windows. This method allows the data in each window to be evaluated independently, thereby more accurately capturing network behavior and potential abnormal patterns within a specific time period. Dividing the traffic data into multiple time windows enables the system to detect and analyze the data in each window in real time, and quickly identify and respond to sudden network security events.

[0080] S7: Divide the network traffic data in each sliding window into multiple state intervals through the equal-width interval segmentation method.

[0081] It should be noted that the equal-width interval segmentation method is a technique for dividing continuous data into multiple fixed-width intervals. Specifically, it divides the entire data range into several intervals of equal width according to the minimum and maximum values ​​of the data, and each interval represents a state or category. This method is commonly used in data processing and discretization, and is particularly suitable for converting continuous variables into discrete states when the data distribution is relatively uniform, which facilitates subsequent analysis and modeling, such as the state definition in the Markov chain model.

[0082] It should be noted that state intervals refer to dividing continuous data or value ranges into multiple discrete intervals, each of which represents a specific state. By mapping data to these predefined intervals, complex continuous data can be converted into finite discrete states for modeling and analysis. For example, in network traffic analysis, traffic data is divided into "low", "medium", and "high" state intervals according to the size of the data value. This can simplify data processing and facilitate the application of models such as Markov chains for state transition analysis and anomaly detection.

[0083] Among them, the width of each state interval is specifically:

[0084]

[0085] Among them, ω represents, max() represents the maximum value, W t () represents the sliding window at time t, l represents the length of the sliding window, min() represents the minimum value, and N represents the total number of state intervals.

[0086] In the present invention, continuous network traffic data is discretized into multiple fixed-width state intervals, simplifying the complexity of data processing. Equal-width interval segmentation provides a unified format for data, so that different data points can be processed and compared in the same way. Dividing network traffic into different state intervals such as "low", "medium", and "high" makes monitoring and reporting more intuitive. Network administrators can quickly identify which intervals have abnormal traffic and take corresponding security measures.

[0087] S8: According to each state interval, a Markov chain model is established in each sliding window through the Pearson correlation analysis method.

[0088] It should be noted that the Pearson correlation analysis method is a statistical method used to measure the degree of linear correlation between two variables. It expresses the relationship between variables by calculating the Pearson correlation coefficient (ranging from -1 to 1): when the coefficient is close to 1, it means that the two variables have a strong positive correlation. Close to -1 means a strong negative correlation. Close to 0 means almost no correlation. Pearson correlation analysis is widely used in data analysis to determine whether there is a significant linear relationship between variables, thereby helping to understand the inherent connections and patterns of the data.

[0089] It should be noted that the Markov chain model is a mathematical model used to describe the change of system states, in which the next state of the system depends only on the current state and has nothing to do with the previous state. This is called "Markov property" or "memorylessness". In the Markov chain, the transition between states is based on certain probabilities, which constitute the state transition probability matrix. The Markov chain model is widely used in time series analysis and prediction. For example, in network security, it can be used to simulate normal state transition patterns to identify abnormal behaviors.

[0090] In the present invention, by calculating the Pearson correlation coefficient to evaluate the correlation between different state intervals, it is possible to accurately determine which states have significant linear relationships. This helps to establish a more accurate Markov chain model, in which the state transition probability is derived based on actual data relationships, improving the accuracy and reliability of model predictions. The memoryless nature of the Markov chain means that the prediction of the next state depends only on the current state. By applying Pearson correlation analysis and establishing a Markov model in each sliding window, the state dependency and change pattern in the short term can be effectively captured.

[0091] In a possible implementation, S8 specifically includes sub-steps S801 and S802:

[0092] S801: Calculate the Pearson correlation coefficient between each sliding window by using the Pearson correlation analysis method:

[0093]

[0094] Among them, r() represents the Pearson correlation coefficient, n represents the order of the Markov chain model, l represents the total length of the sliding window, x represents the network traffic data, and t represents the time.

[0095] S802: According to each state interval, when the Pearson correlation coefficient is greater than or equal to a preset value, a Markov chain model is established in each sliding window:

[0096] λ(n)={S,Q,P n}

[0097] Among them, λ(n) represents the n-order Markov chain model, S represents the total number of state spaces, Q represents the initial state transition probability set of the state space, P n Represents the n-order state transition probability matrix.

[0098] It should be noted that those skilled in the art can set the size of the preset value according to actual needs, and the present invention is not limited here.

[0099] In the present invention, by calculating the Pearson correlation coefficient between sliding windows, the linear association between data can be accurately identified. This association indicates that the data is similar or related to some extent, which helps to select a suitable window as the basis of the Markov chain model, thereby building a more accurate and representative state model. Based on the accurately constructed Markov chain model, changes in network status can be more effectively monitored and potential security threats can be predicted. When an abnormal state transition probability is detected, the system can issue an early warning in time and take corresponding security measures.

[0100] S9: According to the Markov chain model, the state transition probability between each state interval is calculated and the state transition probability matrix is ​​constructed.

[0101] In the present invention, the state transition probability matrix provides the system with the transition probability of each state to other states, which enables the model to accurately predict future state changes. By updating the state transition probability matrix in real time, the system can quickly respond to changes in network status and provide immediate security decision support. The state transition probability matrix not only provides the prediction results of the model, but also clarifies the conversion relationship between different states, which enhances the transparency and interpretability of the model.

[0102] In a possible implementation, S9 specifically includes sub-steps S9010 and S902:

[0103] S901: According to the order of the Markov chain model, calculate the state transition probability between each state interval:

[0104]

[0105] in, represents the n-step state transition probability from the state interval at time t-1 to the state interval at time t, represents the number of n-step state transitions from the state interval at time t-1 to the state interval at time t, n represents the order of the Markov chain model, s t-1 represents the state interval at time t-1, s t represents the state interval at time t, and N represents the total number of state intervals.

[0106] S902: Construct a state transition probability matrix according to the state transition probabilities between each state interval:

[0107]

[0108] Among them, P n Represents the n-order state transition probability matrix.

[0109] In the present invention, by calculating the state transition probabilities of different orders (n), the deep-level patterns of state changes can be captured. In a high-order Markov chain, the determination of the current state depends not only on the previous state, but on multiple preceding states, which can more comprehensively reflect the historical dependency of the state and improve the prediction accuracy of the model. Constructing state transition probability matrices of different orders enables the model to be flexibly adapted to various complex situations. This multi-order model can better adapt to the actual dynamics of network behavior, especially in scenarios where network traffic is complex or has long-term dependencies.

[0110] S10: Calculate the support probability of the network traffic data in each sliding window under the Markov chain model through the state transition probability matrix.

[0111] It should be noted that the support probability is the conditional probability of a given output or result occurring in a probability model, usually based on the model's current state or input information. In Markov chains or other state-based models, the support probability specifically refers to the probability that a particular state or sequence of events is considered true or valid in the model. This probability helps determine the "support" of the model for a state or chain of events, and is used for decision making, predicting future states, or assessing the likelihood of a situation. For example, in network security monitoring, the support probability can be used to assess the likelihood that a certain network behavior sequence is normal or abnormal.

[0112] In the present invention, by using the support probability calculated in real time, the system can quickly identify and respond to potential security threats. The calculation of support probability enables the model to adapt to the ever-changing network environment and behavior patterns. By learning from historical data and analyzing real-time data, the model can continuously adjust its state transition probability to reflect the latest network behavior and threat trends.

[0113] In a possible implementation manner, S10 specifically includes:

[0114] According to the following formula, the support probability of network traffic data in the sliding window under the Markov chain model is calculated:

[0115]

[0116] Among them, P(x t |λ(n)) represents the support probability of the network traffic data at time t under the n-order Markov chain model, represents the initial state transition probability of the state interval at time tn, It represents the i-step state transition probability from the state interval at time ti to the state interval at time t, and ∏ represents the continuous multiplication operation.

[0117] In the present invention, by calculating the support probability of network traffic data at each time t under the n-order Markov chain model, the probability of the current network state can be more accurately determined. This method provides a reliable prediction of the future state based on the actual observed n states in the past, thereby greatly improving the accuracy of network behavior analysis. The method of combining the sliding window and the n-order Markov chain model can dynamically track the changes in the network state and capture the behavior dynamics in the short term.

[0118] S11: Perform network security risk detection based on the support probability of each network traffic data under the Markov chain model to determine whether the network traffic data is abnormal. If so, issue an alarm. Otherwise, return to S1 to continue detection.

[0119] Specifically, S11 includes:

[0120] When the support probability of network traffic data under the Markov chain model is equal to 0, it is determined that the network traffic data is abnormal and an alarm is issued.

[0121] When the support probability of the network traffic data under the Markov chain model is not equal to 0, it is determined that there is no anomaly in the network traffic data.

[0122] In the present invention, decision-making based on support probability makes the response measures more data-driven, reducing the false positive rate and the false negative rate. The support probability analysis is not only used to detect current anomalies, but also can be used to predict possible security events in the future.

[0123] In a possible implementation manner, after S11, the method further includes:

[0124] S12: Through the anomaly replacement strategy, the network traffic data with the maximum support probability in each sliding window is selected to replace the attack network traffic:

[0125]

[0126] Among them, x t ′ represents the network traffic data with the maximum support probability at time t, arg max represents the maximum value, x t represents the network traffic data at time t, W t () represents the sliding window at time t, l represents the length of the sliding window, P(x t |λ(n)) represents the support probability of the network traffic data at time t under the n-order Markov chain model.

[0127] In the present invention, replacing the traffic data identified as an attack can reduce or block the impact of malicious activities in real time. By replacing abnormal data with data with the highest support probability, the system can maintain the normal operation of the network while isolating or mitigating the damage caused by the attack. Selecting the data with the highest support probability as a replacement helps to quickly restore to a normal network state and ensure the continuity and stability of network services. After replacing the attack traffic, subsequent data processing and analysis can be performed in a cleaner data environment that is closer to the normal state. This helps to improve the accuracy and efficiency of data analysis and avoid misjudgments caused by the influence of attack data.

[0128] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0129] In the present invention, by establishing a Markov chain model in each of the sliding windows, threats can be identified without signature matching and behavior analysis, and the detection effect is good when facing zero-day attacks and customized malware. By calculating the abnormal factors of the network traffic data, it is judged whether the network traffic data is abnormal according to the abnormal factors of the network traffic data, and network security risk detection is performed according to the support probability of each of the network traffic data under the Markov chain model. The invention has low complexity and high efficiency, can quickly process a large amount of network traffic data, and can effectively respond to security threats in the first time.

[0130] Reference Manual Attached Figure 2 , showing a structural schematic diagram of a network security risk detection system based on a Markov chain model provided by the present invention.

[0131] The present invention further provides a network security risk detection system 30 based on a Markov chain model, comprising: a memory 303 and one or more processors 301 .

[0132] The memory 303 stores one or more application programs, and the one or more application programs are suitable for being executed by the one or more processors 301 to implement the network security risk detection method based on the Markov chain model described in the method embodiment.

[0133] The network security risk detection system 30 based on the Markov chain model includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, for example, through a bus 302.

[0134] The structure of the network security risk detection system 30 based on the Markov chain model does not constitute a limitation on the embodiment of the present invention.

[0135] Processor 301 may be a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of the present invention. Processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0136] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI bus or an EISA bus, etc. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0137] The memory 303 can be a ROM or other type of static storage device that can store static information and instructions, a RAM or other type of dynamic storage device that can store information and instructions, or an EEPROM, a CD-ROM or other optical disk storage, an optical disk storage (including a compressed optical disk, a laser disk, an optical disk, a digital versatile disk, a Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0138] It should be noted that the network security risk detection system 30 based on the Markov chain model can implement the above-mentioned network security risk detection method based on the Markov chain model, and can achieve the same or similar technical effects. To avoid repetition, the present invention will not go into details.

[0139] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0140] In the present invention, by establishing a Markov chain model in each of the sliding windows, threats can be identified without signature matching and behavior analysis, and the detection effect is good when facing zero-day attacks and customized malware. By calculating the abnormal factors of the network traffic data, it is judged whether the network traffic data is abnormal according to the abnormal factors of the network traffic data, and network security risk detection is performed according to the support probability of each of the network traffic data under the Markov chain model. The invention has low complexity and high efficiency, can quickly process a large amount of network traffic data, and can effectively respond to security threats in the first time.

[0141] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

[0142] There are a few points to note:

[0143] (1) The drawings of the embodiments of the present invention only relate to the structures related to the embodiments of the present invention, and other structures may refer to the general design.

[0144] (2) For the sake of clarity, in the drawings used to describe the embodiments of the present invention, the thickness of the layers or regions is exaggerated or reduced, that is, these drawings are not drawn according to the actual scale. It is understood that when an element such as a layer, film, region or substrate is referred to as being "on" or "under" another element, the element may be "directly" "on" or "under" the other element or there may be intermediate elements.

[0145] (3) In the absence of conflict, the embodiments of the present invention and the features therein may be combined with each other to obtain new embodiments.

[0146] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. The protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A network security risk detection method based on a Markov chain model, characterized in that: include: S1: Obtain network traffic data; S2: extracting network traffic features of the network traffic data according to the statistical information and metadata of the network traffic data; S3: extracting load characteristics of the network traffic data according to the load of the network traffic data; S4: Calculating the abnormal factors of the network traffic data by statistical methods according to the network traffic characteristics and load characteristics of the network traffic data; S5: judging whether the network traffic data is abnormal according to the abnormal factor of the network traffic data; If yes, go to the next step; otherwise, return to S1 to continue testing; S6: dividing the network traffic data into a plurality of sliding windows; S7: dividing the network traffic data in each sliding window into a plurality of state intervals by an equal-width interval segmentation method; S8: According to each of the state intervals, a Markov chain model is established in each of the sliding windows by using a Pearson correlation analysis method; S9: According to the Markov chain model, the state transition probability between each state interval is calculated and a state transition probability matrix is ​​constructed; S10: calculating the support probability of the network traffic data in each of the sliding windows under the Markov chain model through the state transition probability matrix; S11: Performing network security risk detection according to the support probability of each network traffic data under the Markov chain model to determine whether the network traffic data is abnormal; If so, sound the alarm; Otherwise, return to S1 to continue testing.

2. The network security risk detection method based on the Markov chain model according to claim 1 is characterized in that: The network traffic characteristics include: traffic start time, traffic duration, source byte number, target byte number, source data packet number and target data packet number.

3. The network security risk detection method based on the Markov chain model according to claim 1 is characterized in that: The S4 specifically includes: S401: concatenating the flow characteristics and load characteristics of the network flow data to form a feature vector; S402: Calculate the standard score of each feature in the feature vector; S403: Calculate the abnormal factor of the network traffic data according to the standard score of each feature.

4. The network security risk detection method based on the Markov chain model according to claim 1 is characterized in that: The S5 is specifically: Compare the abnormal factor of the network traffic data with the abnormal threshold to determine whether the abnormal factor of the network traffic data is greater than the abnormal threshold; if so, determine that the network traffic data is abnormal, and proceed to the next step; Otherwise, it is determined that there is no abnormality in the network traffic data, and the process returns to S1 to continue detection.

5. The network security risk detection method based on the Markov chain model according to claim 1 is characterized in that: The S8 specifically includes: S801: Calculate the Pearson correlation coefficient between each sliding window by using the Pearson correlation analysis method: Among them, r() represents the Pearson correlation coefficient, n represents the order of the Markov chain model, l represents the total length of the sliding window, x represents the network traffic data, and t represents the time; S802: According to each of the state intervals, when the Pearson correlation coefficient is greater than or equal to a preset value, a Markov chain model is established in each of the sliding windows: λ(n)={S,Q,P n } Among them, λ(n) represents the n-order Markov chain model, S represents the total number of state spaces, Q represents the initial state transition probability set of the state space, P n Represents the n-order state transition probability matrix.

6. The network security risk detection method based on the Markov chain model according to claim 1 is characterized in that: The S9 specifically includes: S901: Calculate the state transition probability between each state interval according to the order of the Markov chain model: in, represents the n-step state transition probability from the state interval at time t-1 to the state interval at time t, represents the number of n-step state transitions from the state interval at time t-1 to the state interval at time t, n represents the order of the Markov chain model, s t-1 represents the state interval at time t-1, s t represents the state interval at time t, and N represents the total number of state intervals; S902: Construct a state transition probability matrix according to the state transition probabilities between the state intervals: Among them, P n Represents the n-order state transition probability matrix.

7. The network security risk detection method based on the Markov chain model according to claim 1 is characterized in that: The S10 is specifically: The support probability of the network traffic data in the sliding window under the Markov chain model is calculated according to the following formula: Among them, P(x t |λ(n)) represents the support probability of the network traffic data at time t under the n-order Markov chain model, represents the initial state transition probability of the state interval at time tn, It represents the i-step state transition probability from the state interval at time ti to the state interval at time t, and ∏ represents the continuous multiplication operation.

8. The network security risk detection method based on the Markov chain model according to claim 1 is characterized in that: The S11 specifically includes: When the support probability of the network traffic data under the Markov chain model is equal to 0, it is determined that the network traffic data is abnormal and an alarm is issued; When the support probability of the network traffic data under the Markov chain model is not equal to 0, it is determined that there is no abnormality in the network traffic data.

9. The network security risk detection method based on the Markov chain model according to claim 1 is characterized in that: After S11, the method further includes: S12: Using an abnormal replacement strategy, select the network traffic data with the maximum support probability in each sliding window to replace the attack network traffic: Among them, x t ′ represents the network traffic data with the maximum support probability at time t, arg max represents the maximum value, x t represents the network traffic data at time t, W t () represents the sliding window at time t, l represents the length of the sliding window, P(x t |λ(n)) represents the support probability of the network traffic data at time t under the n-order Markov chain model.

10. A network security risk detection system based on a Markov chain model, characterized in that: include: memory and one or more processors; One or more applications are stored in the memory, and the one or more applications are suitable for being executed by the one or more processors to implement the network security risk detection method based on the Markov chain model as described in any one of claims 1 to 9.

Images