Intelligent network security detection system and method based on big data analysis

Abstract

The invention relates to the technical field of network security, in particular to an intelligent network security detection system and method based on big data analysis, and the method comprises the steps: generating adversarial data through a historical network data set, training a network security detection model through the adversarial data, and dynamically adjusting an adversarial training objective function in training. The network security detection model can balance normal loss and adversarial loss, and the robustness and accuracy of the network security detection model are balanced; the network flow data flow is analyzed through the machine learning model, the network state index is output, the network security detection model is optimized according to the output network state index, and the detection capability of the network security detection model to the antagonistic attack is improved; according to the method, traditional network attack data is extracted from a historical network data set, the traditional network attack data and adversarial disturbance generated through adversarial training are combined, and a network security detection model is trained, so that the network security detection model can detect traditional network attacks at the same time.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an intelligent network security detection system and method based on big data analysis. Background Art

[0002] So-called intelligent network security detection is usually an active defense measure that uses technologies such as artificial intelligence, machine learning, and big data analysis to automatically identify, analyze, and respond to network attacks. If an attacker uses adversarial samples (such as perturbed traffic) to deceive the model and bypass the model, the robustness of the model needs to be enhanced.

[0003] Adversarial training can enhance the robustness of the model to adversarial samples, that is, actively generating adversarial samples during the training process and adding them to the training set, forcing the model to learn the decision boundary under adversarial perturbations. However, adversarial training will reduce the accuracy of normal data detection.

[0004] In addition, in actual deployment, there is also the question of whether the model after adversarial training can normally cope with traditional network attacks and maintain the detection rate of traditional network attacks. Summary of the invention

[0005] The present invention balances the accuracy and robustness of the network security detection model by acquiring dynamic adjustment weights and updating the parameters of the model according to the adjusted dynamic adjustment weights.

[0006] The technical solution proposed by the present invention is: an intelligent network security detection system and method based on big data analysis, the method comprising:

[0007] Acquire historical network data to form a historical network data set; the historical network data includes historical network log data, traffic data, and network behavior data;

[0008] Generate adversarial data through historical network data sets, train a network security detection model through adversarial data, and dynamically adjust the adversarial training objective function during training so that the network security detection model can balance normal loss and adversarial loss, and balance the robustness and accuracy of the network security detection model; the network security detection model includes a feature extraction module, a dynamic task head and an adversarial training module;

[0009] Obtain real-time network traffic data streams, analyze network traffic data streams through machine learning models, output network status indicators, and optimize network security detection models based on the output network status indicators to improve the network security detection model's ability to detect adversarial attacks;

[0010] Traditional network attack data is extracted from historical network data sets, and the traditional network attack data is combined with adversarial perturbations generated by adversarial training to train the network security detection model, so that the network security detection model can also detect traditional network attacks.

[0011] Preferably, dynamically adjusting the adversarial training objective function during training so that the network security detection model can balance normal loss and adversarial loss, and balancing the robustness and accuracy of the network security detection model includes:

[0012] Define a dynamic weighted loss function, decompose the total loss into the weighted sum of normal sample loss and adversarial sample loss, and dynamically adjust the dynamic weight according to the model performance, including:

[0013] Assume the dynamic weighted loss function is: ,in, represents the cross entropy loss of normal samples, represents the cross entropy loss of adversarial samples; represents the dynamic weight, ;

[0014] Through monitoring and proportion, adjust , so that network security detection models are automatically balanced during training and , including:

[0015] Assume the adjusted dynamic weight is ;

[0016] ;in, is the smoothing coefficient, is the disturbance coefficient;

[0017] Perform model training. The training process includes the following steps:

[0018] Step 2.1: Set initial dynamic weights , generating adversarial samples through the PGD attack method ;

[0019] Step 2.2: Forward propagation calculation and :

[0020] and ;

[0021] Step 2.3, Substitute ,get ;

[0022] Step 2.4, calculate the total loss and back propagate:

[0023] , using the calculated Update model parameters ,Right now ;in, represents the learning rate;

[0024] Step 2.5: Repeat steps 2.1 to 2.4 until the model converges;

[0025] The model performance includes: during the training process, the normal accuracy of the network security detection model on the validation set increases or decreases or the adversarial accuracy increases or decreases;

[0026] The normal accuracy rate is the accuracy rate of the network security detection model for detecting normal network data, and the adversarial accuracy rate is the accuracy rate of the network security detection model for detecting adversarial data.

[0027] Preferably, the dynamically adjusting the adversarial training objective function during training so that the network security detection model can balance normal loss and adversarial loss, and balance the robustness and accuracy of the network security detection model, further includes:

[0028] Combining graph neural network GNN and causal reasoning algorithm to build a dynamic defense strategy, which includes the following steps:

[0029] Constructing an attack chain graph, wherein the attack chain graph includes nodes, edges, node features, and edge features;

[0030] GNN encodes the attack chain, specifically: using the graph attention network GAT to aggregate neighbor information and generate node embedding representations; capturing the propagation pattern of attack behaviors in multiple paths, including lateral movement and privilege escalation;

[0031] Identify causal dependencies in the attack chain based on causal discovery algorithms and locate key nodes using counterfactual analysis;

[0032] The adversarial sample generation and loss function are adjusted according to the causal importance weights, and the robustness and accuracy of the network security detection model are optimized by combining the GNN graph structure;

[0033] The nodes include users, devices, IPs and processes; the edges are interactive behaviors between nodes, including logins, API calls and data flows; the node features include login time and permission level, and the edge features include traffic size and protocol type.

[0034] Preferably, the method of aggregating neighbor information using a graph attention network (GAT) to generate a node embedding representation includes:

[0035] Calculate nodes using graph attention mechanism With its neighbors The attention coefficient: ;in, represents the activation function;

[0036] Node embedding updates:

[0037] ;

[0038] in, Representation Node The input feature vector of Represents a learnable weight matrix for feature transformation; represents the attention mechanism parameter vector, represents the activation function; Represents a collection of nodes.

[0039] Preferably, the identifying causal dependencies in the attack chain based on a causal discovery algorithm includes:

[0040] Calculate causal effects, i.e. measure the attack nodes Test results Impact:

[0041] ;

[0042] in, Indicates mandatory setting of nodes The status is ; Representation Node is the key causal node of the attack chain, where ; Multiple key causal nodes constitute a key attack node set .

[0043] Preferably, the graph structure combined with GNN optimizes the robustness and accuracy of the network security detection model, including:

[0044] Combining GNN embedding, causal effects and adversarial samples to construct a new dynamic weighted loss function: ,in, Representation Node The GNN embedding vector, represents the causal regularization weight, which is used to control the strength of the causal effect; represents causal regularization; Used to describe the accuracy of network security detection models, Used to describe the robustness of network security detection models;

[0045] Generate adversarial samples, and prioritize perturbing nodes with high causal effects:

[0046] ,in, Indicates that for the node The disturbance component of represents the causal perturbation weight, which is used to enhance adversarial attacks on key causal nodes.

[0047] Preferably, the method of acquiring real-time network traffic data stream, analyzing the network traffic data stream through a machine learning model, outputting a network status indicator, optimizing a network security detection model according to the output network status indicator, and improving the detection capability of the network security detection model against adversarial attacks comprises the following steps:

[0048] Obtain network traffic data flow information in real time, extract multiple network data features to form a network data flow information set , the network data characteristics include the size of the data packet, the protocol type, the IP of the data source and the data target;

[0049] The network status index is synthesized by calculating the attack density and traffic anomaly based on the network data characteristics in the network data flow information set;

[0050] The synthetic network status indicator and the current model performance, i.e., normal accuracy and adversarial accuracy, are used as input variables to input into the machine learning model, and the dynamic weight based on the synthetic network status indicator is output;

[0051] Substitute the output dynamic weight into the loss function to obtain ,use Update model parameters ; The model parameters are trainable parameters obtained through data learning in the network security detection model, specifically including the classification head, the weight and bias of the attention mechanism;

[0052] Deploy the updated network security detection model to the detection node.

[0053] Preferably, the combining of traditional network attack data and adversarial perturbations generated by adversarial training to train a network security detection model so that the network security detection model can simultaneously detect traditional network attacks includes:

[0054] Construct a mixed training data set, specifically:

[0055] Add adversarial perturbations to normal samples to generate simulated adversarial attack samples, and add adversarial perturbations to traditional attack datasets to generate adversarial samples;

[0056] Combine simulated adversarial attack samples and adversarial samples into a mixed training set;

[0057] Defining the mixed loss function ;in, Represents the traditional network attack detection loss, To combat losses, represents the prediction entropy regularization term, which is used to prevent overfitting of model perturbations; Represents the entropy regularization coefficient, which is used to constrain the model confidence;

[0058] Adaptively update dynamic weights, adjusted dynamic weights ,in, represents the sensitivity of accuracy difference, represents the network status influencing factor, represents the detection accuracy of traditional attack samples, Represents the accuracy of adversarial sample detection; Indicates network status indicators.

[0059] Substitute the adjusted dynamic weights into the hybrid loss function to obtain ,use Update model parameters ; Then the updated network security detection model is deployed to the detection nodes to deal with adversarial attacks and traditional attacks on the nodes.

[0060] An intelligent network security detection system based on big data analysis, comprising:

[0061] A big data analysis module, used to calculate network status indicators in real time, including attack density and traffic anomaly;

[0062] A dynamic parameter adjustment module is used to adjust the dynamic weight according to the network status indicators output by the big data analysis module;

[0063] Adaptive adversarial training module for optimizing network security detection models using dynamic weights.

[0064] A computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement an intelligent network security detection system and method based on big data analysis.

[0065] Beneficial effects of the present invention:

[0066] The present invention analyzes data in real time and dynamically adjusts dynamic weights (balances normal and adversarial samples) to enable network security detection models to better adapt to changes in the network environment. At the same time, the adversarial perturbations generated by adversarial training are combined with traditional attack feature enhancements to improve the network security detection model's ability to detect traditional attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 The present invention is a flow chart of an intelligent network security detection method based on big data analysis. DETAILED DESCRIPTION

[0068] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art can think of other obvious variations. The basic principles of the present invention defined in the following description can be applied to other embodiments, variations, improvements, equivalents, and other technical solutions that do not deviate from the spirit and scope of the present invention.

[0069] It is to be understood that the term "one" should be understood as "at least one" or "one or more", that is, in one embodiment, the number of an element may be one, while in another embodiment, the number of the element may be multiple, and the term "one" should not be understood as a limitation on the quantity.

[0070] Embodiment 1:

[0071] refer to Figure 1 The technical solution provided by the present invention is: an intelligent network security detection system and method based on big data analysis, comprising the following steps:

[0072] Step 1: Acquire historical network data to form a historical network data set, wherein the historical network data includes historical network log data, traffic data, and network behavior data;

[0073] Step 2: Generate adversarial data through historical network data sets, train the network security detection model through adversarial data, and dynamically adjust the adversarial training objective function during training so that the network security detection model can balance normal loss and adversarial loss, and balance the robustness and accuracy of the network security detection model; including the following steps:

[0074] Define a dynamic weighted loss function, decompose the total loss into the weighted sum of normal sample loss and adversarial sample loss, and dynamically adjust the dynamic weight according to the model performance, including:

[0075] Assume the dynamic weighted loss function is: ,in, represents the cross entropy loss of normal samples, represents the cross entropy loss of adversarial samples; represents the dynamic weight, ;

[0076] Through monitoring and proportion, adjust , so that network security detection models are automatically balanced during training and , including:

[0077] Assume the adjusted dynamic weight is , ;in, is the smoothing coefficient, is the disturbance coefficient;

[0078] Perform model training. The training process includes the following steps:

[0079] Step 2.1: Set initial dynamic weights , generating adversarial samples through the PGD attack method ;

[0080] Step 2.2: Forward propagation calculation and :

[0081] and ;

[0082] Step 2.3, Substitute ,get ;

[0083] Step 2.4, calculate the total loss and back propagate:

[0084] , using the calculated Update model parameters ,Right now ;in, represents the learning rate;

[0085] Step 2.5: Repeat steps 2.1 to 2.4 until the model converges;

[0086] The model parameters mentioned in this example , which can represent the convolution and weights for processing time series traffic data (such as packet sequences), the aggregation weights used to model network entity relationships in graph neural networks GNN, the self-attention weights used to analyze protocol fields or log text in Transformer encoders, and the parameters of adversarial attack detection heads.

[0087] During training The goal of updating through the back-propagation algorithm is to minimize the loss function, such as the one mentioned above. .

[0088] The model performance includes: during the training process, the normal accuracy of the network security detection model on the validation set increases or decreases or the adversarial accuracy increases or decreases;

[0089] The normal accuracy rate is the accuracy rate of the network security detection model for detecting normal network data, and the adversarial accuracy rate is the accuracy rate of the network security detection model for detecting adversarial data.

[0090] The network security detection model includes a feature extraction module, a dynamic task head and an adversarial training module;

[0091] Among them, the feature extraction module is used to extract network traffic features from network traffic data. For structured data (such as traffic statistical features), a multi-layer perceptron (MLP) or Transformer encoder can be used; for sequence data (such as packet payload byte stream), 1D convolution (CNN) or bidirectional LSTM or GRU can be used.

[0092] Among them, the dynamic task head includes the traditional attack classification head, the adversarial attack detection head and the shared attention module.

[0093] The traditional attack classification head includes a fully connected layer and a Softmax function, which outputs traditional attack types (such as DDos, SQL injection, etc.);

[0094] The adversarial attack detection head includes a fully connected layer and a Sigmoid function, which outputs the confidence of the adversarial sample (the confidence is 0 or 1, which is used to indicate whether it is adversarial perturbation traffic);

[0095] Attention modules (such as Transformer) dynamically weight the importance of different features.

[0096] Among them, the adversarial training module generates adversarial samples based on PGD and injects them into the training process.

[0097] Step 3: Obtain real-time network traffic data stream, analyze the network traffic data stream through a machine learning model, output network status indicators, and optimize the network security detection model based on the output network status indicators to improve the detection capability of the network security detection model against adversarial attacks; including the following steps:

[0098] Obtain network traffic data flow information in real time, extract multiple network data features to form a network data flow information set , the network data characteristics include the size of the data packet, the protocol type, the IP of the data source and the data target;

[0099] The network status index is synthesized by calculating the attack density and traffic anomaly based on the network data characteristics in the network data flow information set;

[0100] Attack density ;

[0101] Calculate traffic anomaly using the Isolation Forest (IForest) algorithm ;

[0102] Synthetic Network Status Indicator , ; Indicates the weight of attack density and traffic anomaly;

[0103] The synthetic network status indicator and the current model performance (i.e., normal accuracy and adversarial accuracy) are used as input variables to input into the machine learning model, and the dynamic weight based on the synthetic network status indicator is output; specifically:

[0104] Input Synthetic Network Status Indicator , Current normal accuracy And the current adversarial accuracy ;

[0105] Output dynamic weights based on synthetic network status indicators:

[0106] ;

[0107] That is, when the normal accuracy rate drops or the network risk is low ( When it is 0, increase , to focus on normal samples;

[0108] Substitute the output dynamic weight into the loss function to obtain ,use Update model parameters ; The model parameters are trainable parameters obtained through data learning in the network security detection model, specifically including the classification head, the weight and bias of the attention mechanism;

[0109] Deploy the updated network security detection model to the detection node.

[0110] Step 4: Extract traditional network attack data from historical network data sets, combine the traditional network attack data with the adversarial perturbations generated by adversarial training, and train the network security detection model so that the network security detection model can detect traditional network attacks at the same time, including the following steps:

[0111] Construct a mixed training data set, specifically:

[0112] Add adversarial perturbations to normal samples to generate simulated adversarial attack samples, and add adversarial perturbations to traditional attack datasets to generate adversarial samples;

[0113] Combine simulated adversarial attack samples and adversarial samples into a mixed training set;

[0114] Defining the mixed loss function ;in, Represents the traditional network attack detection loss, To combat losses, represents the prediction entropy regularization term, which is used to prevent overfitting of model perturbations; Represents the entropy regularization coefficient, which is used to constrain the model confidence;

[0115] Adaptively update dynamic weights, adjusted dynamic weights ,in, represents the sensitivity of accuracy difference, represents the network status influencing factor, represents the detection accuracy of traditional attack samples, Represents the accuracy of adversarial sample detection;

[0116] Substitute the adjusted dynamic weights into the hybrid loss function to obtain ,use Update model parameters ; Then the updated network security detection model is deployed to the detection nodes to deal with adversarial attacks and traditional attacks on the nodes.

[0117] For example, when detecting DDoS attack traffic, the characteristics of traditional attacks include high-frequency requests and abnormal source IP distribution;

[0118] The process of generating adversarial samples is as follows: adding small perturbations to the DDoS attack traffic to make it difficult for the model to identify;

[0119] The following training process can be adopted:

[0120] Initial stage sets initial dynamic weights , focuses on traditional network attack detection;

[0121] Accuracy in detecting adversarial attacks (e.g., adversarial evasion attacks) When decreasing, the dynamic weight is reduced to 0.6 to enhance robustness and ensure the detection of adversarial attacks;

[0122] During the network calm period, that is, when there is no attack density and traffic anomaly, the dynamic weight is restored to 0.7 to balance accuracy and robustness.

[0123] The present invention also provides an intelligent network security detection system based on big data analysis, comprising:

[0124] A big data analysis module, used to calculate network status indicators in real time, including attack density and traffic anomaly;

[0125] A dynamic parameter adjustment module is used to adjust the dynamic weight according to the network status indicators output by the big data analysis module;

[0126] Adaptive adversarial training module for optimizing network security detection models using dynamic weights.

[0127] Embodiment 2:

[0128] The difference between this embodiment and the first embodiment is that the complex dependency relationship of the attack chain is modeled by combining graph neural network and causal reasoning, and the key causal path is identified, so as to dynamically optimize the detection and defense capabilities of the network security detection model against attacks. The specific steps are as follows:

[0129] Combine graph neural network GNN and causal reasoning algorithm to build a dynamic defense strategy. The specific steps are as follows:

[0130] Construct an attack chain graph, which includes nodes, edges, node features, and edge features; specifically: input network logs at the node, network behavior data at the node, and threat intelligence; output a dynamic graph ,in, Represent node features and edge features respectively, Represent the node information set and edge information set respectively;

[0131] GNN encodes the attack chain, specifically: using the graph attention network GAT to aggregate neighbor information and generate node embedding representations; capturing the propagation pattern of attack behaviors in multiple paths, including lateral movement and privilege escalation; this step includes the following sub-steps:

[0132] Calculate nodes using graph attention mechanism With its neighbors The attention coefficient: ;in, represents the activation function;

[0133] Node embedding updates: ;in, Representation Node The input feature vector of Represents a learnable weight matrix for feature transformation; represents the attention mechanism parameter vector, represents the activation function; Represents a collection of nodes.

[0134] Identify causal dependencies in the attack chain based on the causal discovery algorithm and use counterfactual analysis to locate key nodes; this step includes the following sub-steps:

[0135] Calculate causal effects, i.e. measure the attack nodes Test results Impact:

[0136] ;

[0137] Causal Effects in This Example The calculation process is based on the randomized controlled trial RCT algorithm, namely:

[0138] ;

[0139] ;

[0140] The intervention group: mandatory (Under attack), Control group: Keep (Normal state);

[0141] Indicates mandatory setting of nodes The status is ; Representation Node is the key causal node of the attack chain, where ; Multiple key causal nodes constitute a key attack node set .

[0142] Combining GNN embedding, causal effects and adversarial samples to construct a new dynamic weighted loss function ,in, Representation Node The GNN embedding vector, represents the causal regularization weight, which is used to control the strength of the causal effect; represents causal regularization; Used to describe the accuracy of network security detection models, Used to describe the robustness of network security detection models;

[0143] Generate adversarial samples, and prioritize perturbing nodes with high causal effects:

[0144] ,in, Indicates that for the node The disturbance component of represents the causal perturbation weight, which is used to enhance adversarial attacks on key causal nodes.

[0145] The adversarial sample generation and loss function are adjusted according to the causal importance weights, and the robustness and accuracy of the network security detection model are optimized by combining the GNN graph structure.

[0146] The nodes include users, devices, IPs and processes; the edges are interactive behaviors between nodes, including logins, API calls and data flows; the node features include login time and permission level, and the edge features include traffic size and protocol type.

[0147] For example, an attacker infiltrates user A through a phishing email, uses A's permissions to move laterally to server B, and steals data;

[0148] At this time, the nodes are user A, server B, mail client and database; the edges are A logging into the mail client, A accessing B, and B accessing the database;

[0149] The abnormal path of "user A-server B-database" is found through the GAT layer of GNN, and the calculation (User A) and (User B), user A is determined to be the attack entry point. In adversarial training, the node feature (user A) is enhanced to perturb and improve the sensitivity to abnormal behavior;

[0150] Add the causal regularization weight of user A to the loss function ,By adjusting the weight, the robustness of high-risk nodes can be improved in a targeted manner.

[0151] The present invention also provides an intelligent network security detection system based on big data analysis, comprising:

[0152] A big data analysis module, used to calculate network status indicators in real time, including attack density and traffic anomaly;

[0153] A dynamic parameter adjustment module is used to adjust the dynamic weight according to the network status indicators output by the big data analysis module;

[0154] Adaptive adversarial training module for optimizing network security detection models using dynamic weights.

[0155] In addition, in some preferred embodiments, nonlinear interactions and matrix constraints are introduced into the loss function to effectively capture the complex relationship between different loss terms.

[0156] For example, let the loss function ;in, represents the loss correlation coefficient, . Denotes the dynamic weight matrix, the diagonal elements are used to control the normal and adversarial losses respectively, and the off-diagonal elements are used to capture the cross-effect. The loss function is expanded to a two-dimensional collaborative optimization problem to reflect the correlation between the normal and adversarial losses.

[0157] By setting a dynamic weight matrix, it can be used for multi-task security detection, such as identifying malware and abnormal logins at the same time.

[0158] The present invention also provides a computer-readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the intelligent network security detection method based on big data analysis.

[0159] In the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. The embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part, and / or installed from a removable medium. When the computer program is executed by the central processing unit (CPU), the above functions defined in the method of the present application are executed. It should be noted that the computer-readable medium mentioned above in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more wire segments, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, electrical wire, optical cable, RF, etc., or any suitable combination of the foregoing.

[0160] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in a different order than the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0161] Those skilled in the art should understand that the embodiments of the present invention described above and shown in the accompanying drawings are only examples and do not limit the present invention. The objectives of the present invention have been fully and effectively achieved. The functions and structural principles of the present invention have been demonstrated and explained in the embodiments. Without departing from the principles, the implementation methods of the present invention may be subject to any changes or modifications.

Claims

1. An intelligent network security detection method based on big data analysis, characterized in that: The method comprises: Acquire historical network data to form a historical network data set; the historical network data includes historical network log data, traffic data, and network behavior data; Generate adversarial data through historical network data sets, train a network security detection model through adversarial data, and dynamically adjust the adversarial training objective function during training so that the network security detection model can balance normal loss and adversarial loss, and balance the robustness and accuracy of the network security detection model; the network security detection model includes a feature extraction module, a dynamic task head and an adversarial training module; Obtain real-time network traffic data streams, analyze network traffic data streams through machine learning models, output network status indicators, and optimize network security detection models based on the output network status indicators to improve the network security detection model's ability to detect adversarial attacks; Traditional network attack data is extracted from historical network data sets, and the traditional network attack data is combined with adversarial perturbations generated by adversarial training to train the network security detection model, so that the network security detection model can also detect traditional network attacks.

2. According to claim 1, an intelligent network security detection method based on big data analysis is characterized in that: The adversarial training objective function is dynamically adjusted during training so that the network security detection model can balance normal loss and adversarial loss, and balance the robustness and accuracy of the network security detection model, including: Define a dynamic weighted loss function, decompose the total loss into the weighted sum of normal sample loss and adversarial sample loss, and dynamically adjust the dynamic weight according to the model performance, including: Assume the dynamic weighted loss function is: ,in, represents the cross entropy loss of normal samples, represents the cross entropy loss of adversarial samples; represents the dynamic weight, ; Through monitoring and proportion, adjust , so that network security detection models are automatically balanced during training and , specifically including: Assume the adjusted dynamic weight is , ;in, is the smoothing coefficient, is the disturbance coefficient; Perform model training. The training process includes the following steps: Step 2.1: Set initial dynamic weights , generate adversarial samples through PGD attack method ; Step 2.2: Forward propagation calculation and : and ; Step 2.3, Substitute ,get ; Step 2.4, calculate the total loss and back propagate: , using the calculated Update model parameters: ;in, represents the learning rate; Step 2.5: Repeat steps 2.1 to 2.4 until the model converges; The model performance includes: during the training process, the normal accuracy of the network security detection model on the validation set increases or decreases or the adversarial accuracy increases or decreases; The normal accuracy rate is the accuracy rate of the network security detection model for detecting normal network data, and the adversarial accuracy rate is the accuracy rate of the network security detection model for detecting adversarial data.

3. According to claim 2, an intelligent network security detection method based on big data analysis is characterized in that: The method of dynamically adjusting the adversarial training objective function during training so that the network security detection model can balance the normal loss and the adversarial loss, and balance the robustness and accuracy of the network security detection model, further includes: Combining graph neural network GNN and causal reasoning algorithm to build a dynamic defense strategy, which includes the following steps: Constructing an attack chain graph, wherein the attack chain graph includes nodes, edges, node features, and edge features; GNN encodes the attack chain, specifically: using the graph attention network GAT to aggregate neighbor information and generate node embedding representations; capturing the propagation pattern of attack behaviors in multiple paths, including lateral movement and privilege escalation; Identify causal dependencies in the attack chain based on causal discovery algorithms and locate key nodes using counterfactual analysis; The adversarial sample generation and loss function are adjusted according to the causal importance weights, and the robustness and accuracy of the network security detection model are optimized by combining the GNN graph structure; The nodes include users, devices, IPs and processes; the edges are interactive behaviors between nodes, including logins, API calls and data flows; the node features include login time and permission level, and the edge features include traffic size and protocol type.

4. According to claim 3, an intelligent network security detection method based on big data analysis is characterized in that: The use of the graph attention network GAT to aggregate neighbor information and generate node embedding representations includes: Calculate nodes using graph attention mechanism With its neighbors The attention coefficient: ;in, represents the activation function; Node embedding updates: ； in, Representation Node The input feature vector of Represents a learnable weight matrix for feature transformation; represents the attention mechanism parameter vector, represents the activation function; Represents a collection of nodes.

5. The intelligent network security detection method based on big data analysis according to claim 4 is characterized in that: The causal dependency relationship in the attack chain is identified based on the causal discovery algorithm, including: Calculate causal effects, i.e. measure the attack nodes Test results Impact: ； in, Indicates mandatory setting of nodes The status is ; Representation Node is the key causal node of the attack chain, where ; Multiple key causal nodes constitute a key attack node set .

6. The intelligent network security detection method based on big data analysis according to claim 5 is characterized in that: The graph structure combined with GNN optimizes the robustness and accuracy of the network security detection model, including: Combining GNN embedding, causal effects and adversarial samples to construct a new dynamic weighted loss function: ,in, Representation Node The GNN embedding vector, represents the causal regularization weight, which is used to control the strength of the causal effect; represents causal regularization; Used to describe the accuracy of network security detection models, Used to describe the robustness of network security detection models; Generate adversarial samples, and prioritize perturbing nodes with high causal effects: ,in, Indicates that for the node The disturbance component of represents the causal perturbation weight, which is used to enhance adversarial attacks on key causal nodes.

7. The intelligent network security detection method based on big data analysis according to claim 6 is characterized in that: The method of obtaining a real-time network traffic data stream, analyzing the network traffic data stream through a machine learning model, outputting a network status indicator, and optimizing a network security detection model according to the output network status indicator to improve the detection capability of the network security detection model against adversarial attacks includes the following steps: Obtain network traffic data flow information in real time, extract multiple network data features to form a network data flow information set , the network data characteristics include the size of the data packet, the protocol type, the IP of the data source and the data target; The network status index is synthesized by calculating the attack density and traffic anomaly based on the network data characteristics in the network data flow information set; The synthetic network state indicator and the current model performance, i.e., normal accuracy and adversarial accuracy, are used as input variables to input into the machine learning model, and the dynamic weight based on the synthetic network state indicator is output; Substitute the output dynamic weight into the loss function to obtain ,use Update model parameters ; The model parameters are trainable parameters obtained through data learning in the network security detection model, specifically including the classification head, the weight and bias of the attention mechanism; Deploy the updated network security detection model to the detection node.

8. The intelligent network security detection method based on big data analysis according to claim 7 is characterized in that: The method combines traditional network attack data with adversarial perturbations generated by adversarial training to train a network security detection model, so that the network security detection model can simultaneously detect traditional network attacks, including: Construct a mixed training data set, specifically: Add adversarial perturbations to normal samples to generate simulated adversarial attack samples, and add adversarial perturbations to traditional attack datasets to generate adversarial samples; Combine simulated adversarial attack samples and adversarial samples into a mixed training set; Defining the mixed loss function ;in, Represents the traditional network attack detection loss, To combat losses, represents the prediction entropy regularization term, which is used to prevent overfitting of model perturbations; represents the entropy regularization coefficient, which is used to constrain the model confidence; Adaptively update dynamic weights, adjusted dynamic weights ,in, represents the sensitivity of accuracy difference, represents the network status influencing factor, represents the detection accuracy of traditional attack samples, represents the detection accuracy of adversarial samples, Indicates network status indicators; Substitute the adjusted dynamic weights into the loss function to obtain ,use Update model parameters ; Then the updated network security detection model is deployed to the detection nodes to deal with adversarial attacks and traditional attacks on the nodes.

9. An intelligent network security detection system based on big data analysis, characterized in that: include: A big data analysis module, used to calculate network status indicators in real time, including attack density and traffic anomaly; A dynamic parameter adjustment module is used to adjust the dynamic weight according to the network status indicators output by the big data analysis module; Adaptive adversarial training module for optimizing network security detection models using dynamic weights.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement an intelligent network security detection method based on big data analysis as described in any one of claims 1 to 8.

Images