Real-time hidden illegal network connection detection method and system, electronic equipment and medium

Abstract

The invention discloses a real-time hidden illegal network connection detection method and system, electronic equipment and a medium, and provides a recursive transmission mechanism which inherits an LSTM (Long Short Term Memory) mechanism and designs an updating unit and a hidden state for the first time, so that each data packet can be independently processed when arriving, and the data packet can be detected while arriving; meanwhile, the time sequence characteristics of a preorder data packet can be inherited, so that packet-by-packet real-time detection is realized, the detection delay is remarkably reduced, hidden illegal connection can be quickly responded, and the real-time detection requirement of a high-dynamic network environment is well met; moreover, a self-adaptive attention mechanism is introduced, important features can be endowed with higher weights, the attention of the detection model on key features is enhanced, the method can adapt to the diversity of network traffic, and the extraction capability of complex traffic features is improved, so that the detection accuracy and robustness of the algorithm are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network illegal connection detection, and in particular, to a real-time hidden illegal network connection detection method and system, electronic equipment, and a computer-readable storage medium. Background Art

[0002] With the rapid development of network technology, the network has become the core infrastructure of various enterprises and organizations. However, the openness and complexity of the network environment make it face a variety of security threats. Among them, hidden illegal network connections are a new type of security problem, which is manifested in the attack mode that attackers evade traditional detection mechanisms by cleverly hiding traffic characteristics or adopting atypical traffic behaviors. Common hidden illegal network connection detection mainly relies on the following methods: 1) Rule-based detection method, by defining network behavior rules (such as traffic thresholds, protocol behavior rules, etc.), matching and anomaly detection of network traffic; 2) Signature-based detection method, using the characteristic signature of known attack behavior to perform network traffic matching detection; 3) Statistical feature-based detection method, by analyzing the statistical characteristics of network traffic (such as traffic size, packet arrival time distribution, etc.), constructing a normal behavior baseline and detecting abnormal behavior. However, these methods are less effective in the face of complex hidden illegal network connections and cannot cope with unknown threats. Moreover, as network behavior changes, rules, signatures, normal behavior baselines, etc. need to be adjusted frequently, and the maintenance cost is high.

[0003] In recent years, as deep learning has been introduced into the field of network traffic anomaly detection, it has shown certain advantages, such as improving the accuracy of intrusion detection. At present, the detection method based on LSTM neural network is the most widely used. It uses the characteristics of LSTM network that is good at capturing sequence data, analyzes the temporal characteristics in network traffic, and can capture long-term dependencies in a single data stream to detect abnormal traffic. However, the traditional LSTM neural network adopts a batch processing method. After the data packet arrives, it needs to wait for the complete batch processing to give the result. There is a detection delay. This delay may cause serious consequences in a rapidly evolving attack scenario, resulting in the inability to detect packet by packet in real time in a high-speed network environment (such as an industrial control system high-speed dynamic and easily invaded network environment), and it is impossible to identify hidden violations in time, and it is difficult to focus on key features, and the recognition effect of variable attack modes is limited. For example, patent CN113660195A discloses a network traffic anomaly detection method based on deep learning, which extracts spatial domain features through a multi-scale convolutional neural network MSCNN and extracts time domain features through an LTSM neural network. Based on the spatiotemporal feature analysis of data, the accuracy of intrusion detection can be effectively improved. Summary of the invention

[0004] The present invention provides a real-time hidden illegal network connection detection method and system, electronic equipment, and computer-readable storage medium, which can realize real-time detection of each packet, ensure rapid response to hidden illegal connections, well meet the real-time detection needs of highly dynamic network environments, and improve detection accuracy and robustness.

[0005] According to one aspect of the present invention, a real-time hidden illegal network connection detection method is provided, comprising the following contents:

[0006] Obtain historical data streams in the network, preprocess the historical data streams, and construct training data sets;

[0007] Construct a real-time hidden illegal network connection detection model based on inherited LSTM mechanism and adaptive attention mechanism;

[0008] The real-time hidden illegal network connection detection model is trained using the training data set until the model converges;

[0009] Real-time data packets in the network are collected and preprocessed, and the preprocessed real-time data packets are input into the trained real-time hidden illegal network connection detection model to output the real-time detection results of hidden illegal network connections.

[0010] Furthermore, the real-time hidden illegal network connection detection model includes an input layer, an inherited LSTM layer, an adaptive attention layer, a classification layer and an output layer. The input layer is used to input the data packet features and data packet characteristic features of the current data packet, and the inherited LSTM layer processes the update unit and hidden state obtained by processing the previous data packet features. The inherited LSTM layer is used to perform timing feature mining based on the data packet features of the current data packet, and the inherited LSTM layer processes the previous data packet features. The update unit and hidden state are obtained to output the timing features, update units and hidden states of the current data packet. The adaptive attention layer is used to perform adaptive attention mechanism processing based on the timing features and data packet characteristic features of the current data packet to obtain self-attention features. The classification layer is used to perform fully connected linear transformation and smoothing processing on the obtained self-attention features to obtain the probabilities of hidden illegal connections and normal connections. The output layer is used to output real-time detection results of hidden illegal network connections.

[0011] Furthermore, the adaptive attention layer performs adaptive attention mechanism processing according to the timing characteristics and data packet characteristic characteristics of the current data packet, and the process of obtaining the self-attention feature includes the following contents:

[0012] Inputting the data packet characteristic features of the current data packet into a lightweight adaptive weight matrix neural network, and outputting an adaptive weight matrix;

[0013] The query weight matrix, key weight matrix and value weight matrix of the self-attention mechanism are modified using the adaptive weight matrix;

[0014] Self-attention calculation is performed based on the modified query weight matrix, key weight matrix, value weight matrix and the timing characteristics of the current data packet, and the self-attention features are output.

[0015] Furthermore, for the starting data packet in the data stream, a Gaussian distribution function is used to initialize the update unit and hidden state thereof.

[0016] Furthermore, the query matrix, key matrix, and value matrix of the self-attention mechanism are modified based on the following formula:

[0017]

[0018] Among them, W Q , W K and W V Represent the original query weight matrix, key weight matrix and value weight matrix respectively, W Q ′、W K ′ and W V ′ respectively represent the modified query weight matrix, key weight matrix and value weight matrix, W ada Represents the adaptive weight matrix.

[0019] Furthermore, the process of preprocessing the historical data stream includes the following contents:

[0020] The historical data stream is divided into multiple data packets according to the IP and port information of the data packet, and the characteristic features of each data packet are extracted. The original message of the data packet is padded and encoded to convert it into a tensor form, and the data packet features of the data packet are extracted through the feature dimensionality reduction method to ensure that the data packet feature dimensions of each data packet are consistent.

[0021] Furthermore, the data packet characteristic features include source IP address, destination IP address, source port, destination port, protocol type, data packet length and data packet arrival interval.

[0022] In addition, the present invention also provides a real-time hidden illegal network connection detection system, comprising:

[0023] The data acquisition module is used to obtain the historical data stream in the network, pre-process the historical data stream, and build a training data set;

[0024] Model building module, used to build a real-time hidden illegal network connection detection model based on inherited LSTM mechanism and adaptive attention mechanism;

[0025] A model training module, used to train a real-time hidden illegal network connection detection model using a training data set until the model converges;

[0026] The real-time detection module is used to collect real-time data packets in the network and pre-process them, input the pre-processed real-time data packets into the trained real-time hidden illegal network connection detection model, and output the real-time detection results of hidden illegal network connections.

[0027] In addition, the present invention also provides an electronic device, including a processor and a memory, wherein the memory stores a computer program, and the processor executes the steps of the above method by calling the computer program stored in the memory.

[0028] In addition, the present invention also provides a computer-readable storage medium for storing a computer program for performing real-time hidden illegal network connection detection, wherein the computer program executes the steps of the above-mentioned method when running on a computer.

[0029] The present invention has the following beneficial effects:

[0030] The real-time hidden illegal network connection detection method of the present invention uses historical data streams to construct a training data set, and constructs a real-time hidden illegal network connection detection model based on the inherited LSTM mechanism and the adaptive attention mechanism, and then uses the training data set to train the model. After collecting real-time data packets in the network and preprocessing them, the preprocessed real-time data packets are input into the trained real-time hidden illegal network connection detection model, and the hidden illegal network connection real-time detection results can be output. The real-time hidden illegal network connection detection model of the present invention proposes an inherited LSTM mechanism for the first time, and by designing a recursive transmission mechanism of update units and hidden states, each data packet can be processed separately when it arrives, supporting "data packet detection as soon as it arrives", and can also inherit the timing characteristics of the previous data packet, thereby realizing real-time detection of each packet, significantly reducing the detection delay, ensuring a rapid response to hidden illegal connections, and well meeting the real-time detection requirements of a highly dynamic network environment; and, an adaptive attention mechanism is also introduced, which can give higher weights to important features, enhance the detection model's attention to key features, adapt to the diversity of network traffic, and improve the ability to extract complex traffic features, thereby improving the detection accuracy and robustness of the algorithm.

[0031] In addition, the real-time hidden illegal network connection detection system of the present invention also has the above advantages.

[0032] In addition to the above-described purposes, features and advantages, the present invention has other purposes, features and advantages. The present invention will be further described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The drawings constituting a part of this application are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0034] Figure 1 It is a flowchart of a real-time hidden illegal network connection detection method according to a preferred embodiment of the present application;

[0035] Figure 2 This is a schematic diagram of the network structure of a real-time hidden illegal network connection detection model of a preferred embodiment of the present application;

[0036] Figure 3 It is a flowchart of the adaptive attention mechanism of the preferred embodiment of the present application;

[0037] Figure 4 It is a schematic diagram of the module structure of a real-time hidden illegal network connection detection system according to another embodiment of the present application. DETAILED DESCRIPTION

[0038] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0039] Reference Figure 1 The preferred embodiment of the present application provides a real-time hidden illegal network connection detection method, including the following contents:

[0040] Step S1: Obtain historical data streams in the network, preprocess the historical data streams, and construct a training data set;

[0041] Step S2: construct a real-time hidden illegal network connection detection model based on the inherited LSTM mechanism and the adaptive attention mechanism;

[0042] Step S3: using the training data set to train the real-time hidden illegal network connection detection model until the model converges;

[0043] Step S4: collect real-time data packets in the network and pre-process them, input the pre-processed real-time data packets into the trained real-time hidden illegal network connection detection model, and output the real-time detection results of hidden illegal network connections.

[0044] It can be understood that the real-time hidden illegal network connection detection method of this embodiment uses historical data streams to construct a training data set, and constructs a real-time hidden illegal network connection detection model based on the inherited LSTM mechanism and the adaptive attention mechanism, and then uses the training data set to train the model. After collecting real-time data packets in the network and preprocessing them, the preprocessed real-time data packets are input into the trained real-time hidden illegal network connection detection model, and the hidden illegal network connection real-time detection results can be output. The real-time hidden illegal network connection detection model of the present invention proposes an inherited LSTM mechanism for the first time. By designing a recursive transmission mechanism of update units and hidden states, each data packet can be processed separately when it arrives, supporting "data packet detection as soon as it arrives", and can also inherit the timing characteristics of the previous data packet, thereby realizing real-time detection of each packet, significantly reducing the detection delay, ensuring a rapid response to hidden illegal connections, and well meeting the real-time detection requirements of highly dynamic network environments; and, an adaptive attention mechanism is also introduced, which can give higher weights to important features, enhance the detection model's attention to key features, adapt to the diversity of network traffic, and improve the ability to extract complex traffic features, thereby improving the detection accuracy and robustness of the algorithm.

[0045] It can be understood that in step S1, for a highly dynamic network environment, such as a high-speed dynamic and easily invaded network environment of an industrial control system, the historical data stream in the network is obtained and preprocessed, and then a training data set is constructed based on the preprocessed historical data stream to facilitate the training of the subsequently constructed real-time detection model. The process of preprocessing the historical data stream includes the following:

[0046] According to the IP and port information of the data packet, the historical data stream is divided into multiple data packets; then, the characteristic features of each data packet are extracted, wherein the data packet characteristic features include the source IP address, the destination IP address, the source port, the destination port, the protocol type, the data packet length and the data packet arrival interval, and these attributes are encoded to obtain the data packet characteristic feature tensor; then the original message of the data packet is filled and encoded to convert it into a tensor form, and the data packet features of the data packet are extracted by the feature dimension reduction method to ensure that the data packet feature dimensions of each data packet are consistent, forming a unified preprocessing feature. Among them, the specific feature dimension reduction method belongs to the prior art, for example, the principal component dimension reduction method can be used. In addition, the data packet arrival interval refers to the time interval between the arrival time of the current data packet and the arrival time of the previous data packet in the data stream, in seconds. If the current data packet is the starting data packet in the data stream, its arrival interval is set to 0 seconds. In addition, the protocol type preferably selects the application layer protocol. If the data packet does not contain the application layer protocol, the transport layer protocol is selected. If the transport layer protocol is not available, the network layer protocol is selected.

[0047] In addition, after preprocessing the historical data stream, each data packet needs to be labeled to distinguish hidden illegal connection data packets from normal data packets, so as to construct a training data set and divide the training data set into training set, verification set and test set to facilitate subsequent model training and evaluation.

[0048] It can be understood that in step S2, Figure 2 As shown in FIG. 1 , the real-time hidden illegal network connection detection model specifically includes an input layer, an inherited LSTM layer, an adaptive attention layer, a classification layer, and an output layer. The input layer is used to input the packet feature N of the current packet. t and packet characteristics S t , inherit the LSTM layer to process the previous data packet feature N t-1 The updated unit C t-1 and the hidden state h t-1 The inherited LSTM layer is used to identify the packet features N of the current packet. t , inherit the LSTM layer to process the previous data packet feature N t-1 The updated unit C t-1 and the hidden state h t-1 , perform timing feature mining and output the timing feature T of the current data packet t , Update unit C t and the hidden state h t The adaptive attention layer is used to adjust the temporal characteristics of the current data packet T t and packet characteristics S t , an adaptive attention mechanism is performed to obtain self-attention features. The classification layer is used to perform full-connection linear transformation and smoothing on the obtained self-attention features to obtain the probabilities of hidden illegal connections and normal connections. The output layer is used to output the real-time detection results of hidden illegal network connections.

[0049] It can be understood that the real-time hidden illegal network connection detection model of the present invention proposes an inherited LSTM mechanism. By designing a recursive transmission mechanism of update units and hidden states, the update units and hidden states of the previous data packet will be used for the hidden illegal connection detection of the next data packet in the data stream, and so on, so that each data packet can be processed separately when it arrives, supporting "data packet detection as soon as it arrives", and can also inherit the timing characteristics of the previous data packet, thereby realizing real-time detection of each packet, significantly reducing the detection delay. In addition, an adaptive attention mechanism is also introduced, which can give higher weights to important features, enhance the detection model's attention to key features, adapt to the diversity of network traffic, and improve the ability to extract complex traffic features, thereby improving the detection accuracy and robustness of the algorithm.

[0050] Among them, for the starting data packet in the data stream, the Gaussian distribution function is used to initialize its update unit C0 and hidden state h0.

[0051] It is understandable that the inventor of the present application also considers that the feature weighting in the existing self-attention mechanism is a static weight, but it does not pay enough attention to the differences in the characteristics of different data packets (such as source IP, protocol type, etc.), may miss key features, and does not dynamically adjust the diverse features in real-time traffic, making it difficult to adapt to complex network environments and attack modes. Therefore, the present invention also improves the self-attention mechanism and proposes an adaptive attention mechanism that adaptively adjusts the weights based on the characteristics of data packets. Among them, Figure 3 As shown, the adaptive attention layer performs adaptive attention mechanism processing according to the timing characteristics and characteristic characteristics of the current data packet, and the process of obtaining the self-attention feature includes the following contents:

[0052] Step S21: inputting the data packet characteristic features of the current data packet into a lightweight adaptive weight matrix neural network, and outputting an adaptive weight matrix;

[0053] Step S22: using the adaptive weight matrix to modify the query weight matrix, key weight matrix and value weight matrix of the self-attention mechanism;

[0054] Step S23: Perform self-attention calculation based on the modified query weight matrix, key weight matrix, value weight matrix and the timing characteristics of the current data packet, and output the self-attention features.

[0055] Specifically, firstly, the data packet characteristic feature S of the current data packet is t Input a lightweight adaptive weight matrix neural network, such as SqueezeNet, MobileNet, etc., and output an adaptive weight matrix W ada , where the lightweight adaptive weight matrix neural network is embedded in the adaptive attention layer. Then, using the adaptive weight matrix W ada The query weight matrix, key weight matrix, and value weight matrix of the self-attention mechanism are modified. Specifically, the query matrix, key matrix, and value matrix of the self-attention mechanism are modified based on the following formula:

[0056]

[0057] Among them, W Q , W K and W V Represent the original query weight matrix, key weight matrix and value weight matrix respectively, W′ Q , W′ K and W′ VThey represent the modified query weight matrix, key weight matrix and value weight matrix respectively, W ada Represents the adaptive weight matrix. Then, the modified query weight matrix, key weight matrix, value weight matrix and the timing characteristics of the current data packet are used to perform self-attention calculation and output the self-attention feature. The specific calculation formula is:

[0058] Q=T t ·W' Q ;

[0059] K=T t ·W' K ;

[0060] V=T t ·W' V ;

[0061]

[0062] Among them, Q, K, and V represent the query vector, key vector, and value vector respectively. k represents the dimension of the key vector, and the superscript T represents the transpose.

[0063] It can be understood that the characteristic feature C of the current data packet t Input the lightweight adaptive weight matrix neural network to obtain the weight matrix W ada , the original weight matrix (W q , W k , W v ) weights, this process does not change the original weight matrix (W q , W k , W v ) dimension, the weight matrix can be dynamically generated for self-attention calculation based on the real-time characteristic features of each data packet (such as traffic density, protocol type, etc.), and the query, key, and value matrices in the attention mechanism can be dynamically adjusted to enable the model to focus on key features more efficiently and further improve the ability to distinguish important features. In addition, by combining the inherited LSTM mechanism with the adaptive attention mechanism based on the characteristics of data packets, the model's ability to recognize latent attack patterns and atypical attack patterns with long spans is greatly enhanced. It not only continues the advantages of existing methods in long-term dependent feature extraction, but also overcomes the shortcomings of existing methods in real-time detection of each packet and differentiation of dynamic features. An efficient, accurate, real-time and robust hidden illegal network connection detection solution is proposed, which can well meet the real-time detection needs of highly dynamic network environments.

[0064] It can be understood that in step S3, the model is first trained using the training set, then verified using the validation set, and finally tested using the test set to obtain the optimal model.

[0065] It can be understood that in step S4, when real-time detection of hidden illegal network connections is required, real-time data packets in the network are collected, data packet features of the real-time data packets are extracted, and then the data packet features of the real-time data packets are input into the trained real-time hidden illegal network connection detection model, and the hidden illegal network connection detection results of the real-time data packets can be output, thereby realizing real-time detection of each packet.

[0066] In addition, if Figure 4 As shown, another embodiment of the present invention further provides a real-time hidden illegal network connection detection system, preferably using the real-time hidden illegal network connection detection method as described above, including:

[0067] The data acquisition module is used to obtain the historical data stream in the network, pre-process the historical data stream, and build a training data set;

[0068] Model building module, used to build a real-time hidden illegal network connection detection model based on inherited LSTM mechanism and adaptive attention mechanism;

[0069] A model training module, used to train a real-time hidden illegal network connection detection model using a training data set until the model converges;

[0070] The real-time detection module is used to collect real-time data packets in the network and pre-process them, input the pre-processed real-time data packets into the trained real-time hidden illegal network connection detection model, and output the real-time detection results of hidden illegal network connections.

[0071] It can be understood that the real-time hidden illegal network connection detection system of this embodiment uses historical data streams to construct a training data set, and constructs a real-time hidden illegal network connection detection model based on the inherited LSTM mechanism and the adaptive attention mechanism, and then uses the training data set to train the model. After collecting real-time data packets in the network and preprocessing them, the preprocessed real-time data packets are input into the trained real-time hidden illegal network connection detection model, and the hidden illegal network connection real-time detection results can be output. The real-time hidden illegal network connection detection model of the present invention proposes an inherited LSTM mechanism for the first time. By designing a recursive transmission mechanism of update units and hidden states, each data packet can be processed separately when it arrives, supporting "data packet detection as soon as it arrives", and can also inherit the timing characteristics of the previous data packet, thereby realizing real-time detection of each packet, significantly reducing the detection delay, ensuring a rapid response to hidden illegal connections, and well meeting the real-time detection requirements of highly dynamic network environments; and, an adaptive attention mechanism is also introduced, which can give higher weights to important features, enhance the detection model's attention to key features, adapt to the diversity of network traffic, and improve the ability to extract complex traffic features, thereby improving the detection accuracy and robustness of the algorithm.

[0072] In addition, another embodiment of the present invention further provides an electronic device, including a processor and a memory, wherein the memory stores a computer program, and the processor executes the steps of the above method by calling the computer program stored in the memory.

[0073] In addition, another embodiment of the present invention further provides a computer-readable storage medium for storing a computer program for performing real-time hidden illegal network connection detection, wherein the computer program executes the steps of the above-mentioned method when running on a computer.

[0074] The general form of computer readable storage media includes: floppy disk, flexible disk, hard disk, magnetic tape, any other magnetic medium, CD-ROM, any other optical medium, punch cards, paper tape, any other physical medium with a pattern of holes, random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), flash erasable programmable read-only memory (FLASH-EPROM), any other memory chip or cartridge, or any other medium that can be read by a computer. The instructions can further be transmitted or received by a transmission medium. The term transmission medium can include any tangible or intangible medium that can be used to store, encode or carry instructions for execution by a machine, and includes digital or analog communication signals or other intangible media that facilitate the communication of the above instructions. Transmission media include coaxial cables, copper wires and optical fibers, which include the wires of a bus used to transmit a computer data signal.

[0075] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0076] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0077] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0078] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0079] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0080] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

[0081] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A real-time hidden illegal network connection detection method, characterized in that: Includes the following: Obtain historical data streams in the network, preprocess the historical data streams, and construct training data sets; Construct a real-time hidden illegal network connection detection model based on inherited LSTM mechanism and adaptive attention mechanism; The real-time hidden illegal network connection detection model is trained using the training data set until the model converges; Real-time data packets in the network are collected and preprocessed, and the preprocessed real-time data packets are input into the trained real-time hidden illegal network connection detection model to output the real-time detection results of hidden illegal network connections.

2. The real-time hidden illegal network connection detection method according to claim 1, characterized in that: The real-time hidden illegal network connection detection model includes an input layer, an inherited LSTM layer, an adaptive attention layer, a classification layer and an output layer. The input layer is used to input the data packet features and data packet characteristic features of the current data packet, and the inherited LSTM layer processes the update unit and the hidden state obtained by processing the previous data packet features. The inherited LSTM layer is used to mine the time series features according to the data packet features of the current data packet, and the inherited LSTM layer processes the previous data packet features. The update unit and the hidden state are obtained to output the time series features, update units and hidden states of the current data packet. The adaptive attention layer is used to perform adaptive attention mechanism processing according to the time series features and data packet characteristic features of the current data packet to obtain self-attention features. The classification layer is used to perform full-connection linear transformation and smoothing processing on the obtained self-attention features to obtain the probabilities of hidden illegal connections and normal connections. The output layer is used to output the real-time detection results of hidden illegal network connections.

3. The real-time hidden illegal network connection detection method according to claim 2, characterized in that: The adaptive attention layer performs adaptive attention mechanism processing according to the timing characteristics and characteristic characteristics of the current data packet, and the process of obtaining the self-attention feature includes the following: Inputting the data packet characteristic features of the current data packet into a lightweight adaptive weight matrix neural network, and outputting an adaptive weight matrix; The query weight matrix, key weight matrix and value weight matrix of the self-attention mechanism are modified using the adaptive weight matrix; Self-attention calculation is performed based on the modified query weight matrix, key weight matrix, value weight matrix and the timing characteristics of the current data packet, and the self-attention features are output.

4. The real-time hidden illegal network connection detection method according to claim 2, characterized in that: For the starting data packet in the data stream, the Gaussian distribution function is used to initialize its update unit and hidden state.

5. The real-time hidden illegal network connection detection method according to claim 3, characterized in that: The query matrix, key matrix, and value matrix of the self-attention mechanism are modified based on the following formula: Among them, W Q , W K and W V Represent the original query weight matrix, key weight matrix and value weight matrix respectively, W Q ′、W K ′ and W V ′ respectively represent the modified query weight matrix, key weight matrix and value weight matrix, W ada Represents the adaptive weight matrix.

6. The real-time hidden illegal network connection detection method according to claim 1, characterized in that: The process of preprocessing the historical data stream includes the following contents: The historical data stream is divided into multiple data packets according to the IP and port information of the data packet, and the characteristic features of each data packet are extracted. The original message of the data packet is padded and encoded to convert it into a tensor form, and the data packet features of the data packet are extracted through the feature dimensionality reduction method to ensure that the data packet feature dimensions of each data packet are consistent.

7. The real-time hidden illegal network connection detection method according to claim 6, characterized in that: Packet characteristics include source IP address, destination IP address, source port, destination port, protocol type, packet length, and packet arrival interval.

8. A real-time hidden illegal network connection detection system, characterized in that: include: The data acquisition module is used to obtain the historical data stream in the network, pre-process the historical data stream, and build a training data set; Model building module, used to build a real-time hidden illegal network connection detection model based on inherited LSTM mechanism and adaptive attention mechanism; A model training module, used to train a real-time hidden illegal network connection detection model using a training data set until the model converges; The real-time detection module is used to collect real-time data packets in the network and pre-process them, input the pre-processed real-time data packets into the trained real-time hidden illegal network connection detection model, and output the real-time detection results of hidden illegal network connections.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the steps of the method according to any one of claims 1 to 7 by calling the computer program stored in the memory.

10. A computer-readable storage medium for storing a computer program for real-time covert illegal network connection detection, characterized in that: When the computer program is run on a computer, the steps of the method according to any one of claims 1 to 7 are executed.

Images